@blamejs/pki 0.5.30 → 0.5.32

package/lib/est.js

@@ -73,6 +73,10 @@ var crmfFmt = require("./schema-crmf");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _toLowerCase = intrinsic.uncurry(String.prototype.toLowerCase);
+var pkix = require("./schema-pkix");   // shared base64-whitespace strip + JS-\s predicate
 // Own-key membership through an operation taken at load: written out it reads two replaceable
 // properties to answer one question, and here it decides which fields of a response are copied.
 var _hasOwn = intrinsic.hasOwn;
@@ -85,6 +89,14 @@ function E(code, message, cause) { return new EstError(code, message, cause); }
 var ID_SIGNED_DATA = oid.byName("signedData");
 var OID_CHALLENGE_PASSWORD = oid.byName("challengePassword");
 var OID_DECRYPT_KEY_ID = oid.byName("decryptKeyID");
+
+// Charset tables built once from the shared pkix.charTable / pkix.allCharsIn char-scan home.
+var _DIGITS_TABLE = pkix.charTable("0123456789");                                                          // /^[0-9]+$/
+var _LABEL_TABLE = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._~-");   // /^[A-Za-z0-9._~-]+$/
+
+// Trailing-slash strip (/\/+$/ -> ""): the length after dropping a run of trailing "/" (0x2f); the
+// caller slices to it, so the removed regex read is traded for the slice that replaces it.
+function _stripTrailingSlashEnd(s) { var end = s.length; while (end > 0 && _charCodeAt(s, end - 1) === 0x2f) end -= 1; return end; }
 var OID_ASYMM_DECRYPT_KEY_ID = oid.byName("asymmDecryptKeyID");
 var OID_SMIME_CAPABILITIES = oid.byName("smimeCapabilities");
 var OID_TEMPLATE = oid.byName("certificationRequestInfoTemplate");
@@ -175,7 +187,7 @@ function transferDecode(body) {
   var s = guard.text.decode(body, cap, EstError, {
     charset: "latin1", tooLarge: "est/too-large", badInput: "est/bad-input", label: "the EST payload",
   });
-  var stripped = s.replace(/[\r\n \t]/g, "");
+  var stripped = pkix.stripBase64Whitespace(s);
   // Strict canonical RFC 4648 base64 (RFC 8951 sec. 3.1) via the shared encoding
   // guard: the alphabet + whole-4-group + canonical round-trip fail a malformed
   // body closed instead of silently truncating to a shorter, different DER.
@@ -208,11 +220,31 @@ function transferEncode(der) {
 
 // ---- the multipart/mixed splitter (/serverkeygen) -----------------------
 
+// Case-insensitive ASCII prefix test: does `s` begin with the uppercase literal `litUpper`?
+function _ciStartsWith(s, litUpper) {
+  if (s.length < litUpper.length) return false;
+  for (var k = 0; k < litUpper.length; k++) {
+    var c = _charCodeAt(s, k);
+    if (c >= 97 && c <= 122) c -= 32;   // fold lowercase -> uppercase
+    if (c !== _charCodeAt(litUpper, k)) return false;
+  }
+  return true;
+}
+// /^multipart\/mixed\s*(;|$)/i by character scan: the media type "multipart/mixed" (case-insensitive),
+// then JS \s* whitespace, then a `;` parameter separator or end of the header value.
+var _MULTIPART_MIXED = "MULTIPART/MIXED";
+function _isMultipartMixedPrefix(ct) {
+  if (!_ciStartsWith(ct, _MULTIPART_MIXED)) return false;
+  var p = _MULTIPART_MIXED.length;
+  while (p < ct.length && pkix.isJsWhitespace(_charCodeAt(ct, p))) p++;
+  return p === ct.length || _charCodeAt(ct, p) === 0x3b;
+}
+
 // Extract the boundary from a `multipart/mixed; boundary=...` content-type,
 // tolerating whitespace before the semicolon (erratum 5779 REJECTED the ban).
 function _multipartBoundary(contentType) {
   var ct = String(contentType || "");
-  if (!/^multipart\/mixed\s*(;|$)/i.test(ct)) return null;
+  if (!_isMultipartMixedPrefix(ct)) return null;
   // Two boundaries name two different splits of the same body; there is no reading
   // of that header, so it is refused rather than resolved by taking the first.
   var bp = _ctParam(ct, "boundary");
@@ -223,6 +255,94 @@ function _multipartBoundary(contentType) {
   return bp.value;
 }
 
+// A boundary delimiter at a candidate line start `ls`: `--boundary`, an optional `--` close marker, optional
+// SP/HTAB transport-padding, then a CRLF/LF or end-of-text. Returns { end, close } (end = the index past the
+// trailing line terminator) or null. `(--)?` is taken greedily without backtracking loss: a `-` can be neither
+// padding nor a terminator, so if the close marker is present it is the only possible parse.
+function _matchDelimAt(text, ls, boundary) {
+  var n = text.length, q = ls, blen = boundary.length, k;
+  if (q + 2 > n || _charCodeAt(text, q) !== 0x2d || _charCodeAt(text, q + 1) !== 0x2d) return null;
+  q += 2;
+  if (q + blen > n) return null;
+  for (k = 0; k < blen; k++) { if (_charCodeAt(text, q + k) !== _charCodeAt(boundary, k)) return null; }
+  q += blen;
+  var close = false;
+  if (q + 2 <= n && _charCodeAt(text, q) === 0x2d && _charCodeAt(text, q + 1) === 0x2d) { close = true; q += 2; }
+  while (q < n && (_charCodeAt(text, q) === 0x20 || _charCodeAt(text, q) === 0x09)) q += 1;
+  if (q === n) return { end: q, close: close };
+  if (_charCodeAt(text, q) === 0x0a) return { end: q + 1, close: close };
+  if (_charCodeAt(text, q) === 0x0d && q + 1 < n && _charCodeAt(text, q + 1) === 0x0a) return { end: q + 2, close: close };
+  return null;
+}
+// Every delimiter in `text`, replacing the global /(?:^|\r?\n)--boundary(--)?[ \t]*(?:\r?\n|$)/g scan: a
+// delimiter begins the text or follows a CRLF/LF (which the match CONSUMES), so `at` is the index of that
+// leading terminator (0 at the start) and `bodyStart` is the index past the trailing one. The leftmost match
+// at or after the previous `bodyStart` is taken, so two adjacent delimiters share one terminator and only the
+// first is found -- the same non-overlapping behavior the regex has.
+function _findMultipartMarks(text, boundary) {
+  var marks = [], n = text.length, searchStart = 0, p;
+  while (searchStart <= n) {
+    var found = null, foundAt = -1;
+    for (p = searchStart; p <= n; p++) {
+      if (p === 0) { var r0 = _matchDelimAt(text, 0, boundary); if (r0) { found = r0; foundAt = 0; break; } }
+      var lsN = -1;
+      if (_charCodeAt(text, p) === 0x0a) lsN = p + 1;
+      else if (_charCodeAt(text, p) === 0x0d && p + 1 < n && _charCodeAt(text, p + 1) === 0x0a) lsN = p + 2;
+      if (lsN !== -1) { var r1 = _matchDelimAt(text, lsN, boundary); if (r1) { found = r1; foundAt = p; break; } }
+    }
+    if (!found) break;
+    marks[marks.length] = { at: foundAt, bodyStart: found.end, close: found.close };
+    searchStart = found.end === foundAt ? found.end + 1 : found.end;
+  }
+  return marks;
+}
+// Strip the part-body framing the regexes /^(\r?\n){2}/ and /\r?\n$/ removed: the two leading line terminators
+// (all-or-nothing) that follow the header/body separator, and one trailing terminator.
+function _stripTwoLeadingEol(seg, from) {
+  var q = from;
+  for (var t = 0; t < 2; t++) {
+    if (_charCodeAt(seg, q) === 0x0d && _charCodeAt(seg, q + 1) === 0x0a) q += 2;
+    else if (_charCodeAt(seg, q) === 0x0a) q += 1;
+    else return from;
+  }
+  return q;
+}
+function _stripOneTrailingEol(seg, end) {
+  if (end >= 1 && _charCodeAt(seg, end - 1) === 0x0a) {
+    if (end >= 2 && _charCodeAt(seg, end - 2) === 0x0d) return end - 2;
+    return end - 1;
+  }
+  return end;
+}
+// Unfold folded MIME header lines (/\r?\n(?=[ \t])/g -> ""): a CRLF/LF immediately followed by SP/HTAB is a
+// FOLD, not a header break, so the terminator is dropped while the whitespace stays.
+function _unfoldHeaders(raw) {
+  var out = "", last = 0, i = 0, n = raw.length;
+  while (i < n) {
+    var nlLen = 0;
+    if (_charCodeAt(raw, i) === 0x0d && i + 1 < n && _charCodeAt(raw, i + 1) === 0x0a) nlLen = 2;
+    else if (_charCodeAt(raw, i) === 0x0a) nlLen = 1;
+    if (nlLen > 0) {
+      var after = i + nlLen;
+      if (after < n && (_charCodeAt(raw, after) === 0x20 || _charCodeAt(raw, after) === 0x09)) { out += _strSlice(raw, last, i); last = after; i = after; continue; }
+    }
+    i += 1;
+  }
+  return out + _strSlice(raw, last, n);
+}
+// Split on CRLF/LF (.split(/\r?\n/)) by character scan, preserving JS split semantics (leading/trailing "").
+function _splitCrlf(s) {
+  var out = [], last = 0, i = 0, n = s.length;
+  while (i < n) {
+    var nlLen = 0;
+    if (_charCodeAt(s, i) === 0x0d && i + 1 < n && _charCodeAt(s, i + 1) === 0x0a) nlLen = 2;
+    else if (_charCodeAt(s, i) === 0x0a) nlLen = 1;
+    if (nlLen > 0) { out[out.length] = _strSlice(s, last, i); i += nlLen; last = i; } else i += 1;
+  }
+  out[out.length] = _strSlice(s, last, n);
+  return out;
+}
+
 // Split a multipart/mixed body into its parts, each { headers, contentType,
 // body }. A boundary delimiter is `--boundary` only at the START OF A LINE (body
 // start or after CRLF), optional transport-padding, then CRLF (a part) or `--`
@@ -234,34 +354,30 @@ function splitMultipartMixed(body, contentType) {
   var text = guard.text.decode(body, constants.LIMITS.DER_MAX_BYTES * 2, EstError, {
     charset: "latin1", tooLarge: "est/too-large", badInput: "est/bad-input", label: "the multipart body",
   });
-  var esc = boundary.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  var delimRe = new RegExp("(?:^|\\r?\\n)--" + esc + "(--)?[ \\t]*(?:\\r?\\n|$)", "g");
-  var marks = [], m;
-  while ((m = delimRe.exec(text)) !== null) {
-    marks.push({ at: m.index, bodyStart: delimRe.lastIndex, close: m[1] === "--" });
-    if (delimRe.lastIndex === m.index) delimRe.lastIndex += 1;   // guard a zero-length match
-  }
+  var marks = _findMultipartMarks(text, boundary);
   var closeAt = -1;
   for (var c = 0; c < marks.length; c++) { if (marks[c].close) { closeAt = c; break; } }
   if (closeAt === -1) throw E("est/bad-multipart", "the multipart body is missing its terminal boundary (RFC 2046)");
   var parts = [];
   for (var i = 0; i < closeAt; i++) {
-    var seg = text.slice(marks[i].bodyStart, marks[i + 1].at);   // between this delimiter and the next
+    var seg = _strSlice(text, marks[i].bodyStart, marks[i + 1].at);   // between this delimiter and the next
     var sep = seg.indexOf("\r\n\r\n");
     if (sep === -1) sep = seg.indexOf("\n\n");
     if (sep === -1) throw E("est/bad-multipart", "a multipart part is missing its header/body separator");
-    var rawHeaders = seg.slice(0, sep);
-    var partBody = seg.slice(sep).replace(/^(\r?\n){2}/, "").replace(/\r?\n$/, "");
+    var rawHeaders = _strSlice(seg, 0, sep);
+    var partBody = _strSlice(seg, _stripTwoLeadingEol(seg, sep), _stripOneTrailingEol(seg, seg.length));
     var headers = {};
     // Unfold MIME part headers (RFC 5322 sec. 2.2.3 / RFC 2046): a CRLF immediately followed by whitespace is a
     // FOLD, not a header break, so it is removed before the split -- a Content-Type whose smime-type parameter
     // continues on the next line must be read whole, not truncated.
-    rawHeaders.replace(/\r?\n(?=[ \t])/g, "").split(/\r?\n/).forEach(function (line) {
+    var lines = _splitCrlf(_unfoldHeaders(rawHeaders));
+    for (var li = 0; li < lines.length; li++) {
+      var line = lines[li];
       var col = line.indexOf(":");
       if (col > 0) headers[line.slice(0, col).trim().toLowerCase()] = line.slice(col + 1).trim();
-    });
+    }
     var partCt = headers["content-type"] || "";
-    if (/^multipart\//i.test(partCt)) throw E("est/bad-multipart", "a nested multipart part is not permitted");
+    if (_ciStartsWith(partCt, "MULTIPART/")) throw E("est/bad-multipart", "a nested multipart part is not permitted");
     parts.push({ headers: headers, contentType: partCt, body: partBody });
   }
   return parts;
@@ -376,7 +492,7 @@ function _recipientMatches(recipientInfos, opts) {
     var sn = ias.serialNumber, want;
     if (typeof sn === "bigint" && sn >= 0n) want = sn;
     else if (typeof sn === "number" && Number.isSafeInteger(sn) && sn >= 0) want = BigInt(sn);
-    else if (typeof sn === "string" && /^[0-9]+$/.test(sn)) want = BigInt(sn);
+    else if (typeof sn === "string" && pkix.allCharsIn(sn, _DIGITS_TABLE)) want = BigInt(sn);
     else throw E("est/bad-input", "expectedRecipientIssuerSerial.serialNumber must be a NON-NEGATIVE bigint, a safe non-negative integer, or a decimal digit string (a certificate serial is non-negative, RFC 5280 sec. 4.1.2.2)");
     // An issuerAndSerialNumber names an ASYMMETRIC recipient -- a certificate identity the server derived from
     // an AsymmetricDecryptKeyIdentifier (RFC 7030 sec. 4.4.2); a symmetric KEK recipient has none. So a SYMMETRIC
@@ -442,12 +558,31 @@ function _ctParam(contentType, name) {
   return { value: value, duplicated: count > 1 };
 }
 
+// A media type `type/subtype` by character scan (RFC 2045 sec. 5.1 restricted token): the first character
+// of each part is alphanumeric, the rest add !#$&^_.+- (case-insensitive), exactly one `/` separates them.
+var _MT_FIRST = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
+var _MT_REST = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$&^_.+-");
+function _isMediaToken(s, from, to) {
+  if (to <= from || !_MT_FIRST[_charCodeAt(s, from)]) return false;
+  for (var i = from + 1; i < to; i++) { if (!_MT_REST[_charCodeAt(s, i)]) return false; }
+  return true;
+}
+// /^\s*([a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*)\s*$/i -> the lowercased media type, or null:
+// trim JS whitespace, require a single `/` splitting two restricted tokens.
+function _mediaType(seg) {
+  var a = 0, b = seg.length, slash = -1, i;
+  while (a < b && pkix.isJsWhitespace(_charCodeAt(seg, a))) a += 1;
+  while (b > a && pkix.isJsWhitespace(_charCodeAt(seg, b - 1))) b -= 1;
+  for (i = a; i < b; i++) { if (_charCodeAt(seg, i) === 0x2f) { if (slash !== -1) return null; slash = i; } }
+  if (slash === -1 || !_isMediaToken(seg, a, slash) || !_isMediaToken(seg, slash + 1, b)) return null;
+  return _toLowerCase(_strSlice(seg, a, b));
+}
+
 function _partMediaType(contentType) {
   var segs = _splitContentTypeParams(String(contentType || ""));
-  var mediaMatch = /^\s*([a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*)\s*$/i.exec(segs[0]);
   var st = _ctParam(contentType, "smime-type");
   return {
-    media: mediaMatch ? mediaMatch[1].toLowerCase() : null,
+    media: _mediaType(segs[0]),
     smimeType: st.value === null ? null : st.value.toLowerCase(),
     ambiguous: st.duplicated,
   };
@@ -679,14 +814,15 @@ function classifyResponse(status, headers, body, opts) {
 function paths(baseUrl, opts) {
   opts = opts || {};
   _knownOpts(opts, PATHS_OPTS, "paths");
-  var prefix = String(baseUrl).replace(/\/+$/, "") + "/.well-known/est";
+  var base = String(baseUrl);
+  var prefix = base.slice(0, _stripTrailingSlashEnd(base)) + "/.well-known/est";
   if (opts.label != null) {
     var label = String(opts.label);
     // A label is ONE URL path segment: unreserved characters only (RFC 3986),
     // never a dot-segment or an operation name. Rejecting rather than
     // percent-encoding keeps a reserved char (`/` `?` `#` `%`) or `..` from
     // silently retargeting the request to a different resource.
-    if (label === "" || label === "." || label === ".." || !/^[A-Za-z0-9._~-]+$/.test(label) || OPERATIONS.indexOf(label) !== -1) {
+    if (label === "" || label === "." || label === ".." || !pkix.allCharsIn(label, _LABEL_TABLE) || OPERATIONS.indexOf(label) !== -1) {
       throw E("est/bad-label", "an EST CA label must be a single path segment of unreserved characters, not '.' / '..' or an operation name (RFC 7030 sec. 3.2.2)");
     }
     prefix += "/" + label;
@@ -707,8 +843,10 @@ function challengePasswordFromTlsUnique(channelBinding) {
   // The count comes from the guard, so an own `length` on the caller's Buffer cannot report a
   // full one as empty. `length` is shadowable on any instance, and `Object.defineProperty(buf,
   // "length", { get: function () { return 0; } })` had this refuse bytes that were there.
-  if (!Buffer.isBuffer(channelBinding) || guard.bytes.lengthOf(channelBinding) === 0) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
-  var b64 = guard.bytes.view(channelBinding, EstError, "est/bad-input", "the channel-binding bytes").toString("base64");
+  if (!guard.bytes.isByteSource(channelBinding)) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
+  var _cb = guard.bytes.source(channelBinding, EstError, "est/bad-input", "the channel-binding bytes");
+  if (_cb.length === 0) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
+  var b64 = _cb.toString("base64");
   if (b64.length > 255) throw E("est/tls-unique-too-long", "the base64 tls-unique value exceeds 255 octets (RFC 7030 sec. 3.5)");
   return _attr(OID_CHALLENGE_PASSWORD, [asn1.build.printable(b64)]);
 }
@@ -834,9 +972,9 @@ var MAX_TIMEOUT = constants.TIME.seconds(600);
 // The DER of a caller-supplied CSR: a DER Buffer as-is, or a PEM "CERTIFICATE REQUEST"
 // decoded. Any other input is a config-time est/bad-input.
 function _csrDer(input) {
-  if (Buffer.isBuffer(input)) return guard.bytes.snapshot(input, EstError, "est/bad-input", "a CSR");
+  if (guard.bytes.isByteSource(input)) return guard.bytes.snapshotSource(input, EstError, "est/bad-input", "a CSR");
   if (typeof input === "string") return csr.pemDecode(input);
-  throw E("est/bad-input", "a CSR must be a DER Buffer or a PEM CERTIFICATE REQUEST string");
+  throw E("est/bad-input", "a CSR must be a DER BufferSource or a PEM CERTIFICATE REQUEST string");
 }
 
 // Parse + validate the request URL BEFORE any transport is called: a URL that will not
@@ -880,9 +1018,47 @@ function _redirectTarget(current, location, method, opts) {
 // which must NOT be read as a Basic challenge), then the scheme is matched at the start or after a
 // comma-separated challenge, followed by whitespace / a comma / end -- never a substring, so `Digest
 // realm="basic"` is not taken as Basic. `scheme` is always our own literal ("Basic" / "Digest").
+// Blank the CONTENTS of every complete quoted-string (/"(?:[^"\\]|\\.)*"/g -> `""`) by character scan: a
+// `\` escapes the next character, so `\"` does not close; an unterminated final quote is left as written
+// (the regex only matches a closed quoted-string).
+function _blankQuotedStrings(s) {
+  var out = "", last = 0, i = 0, n = s.length;
+  while (i < n) {
+    if (_charCodeAt(s, i) === 0x22) {
+      var j = i + 1, closed = -1;
+      while (j < n) { var c = _charCodeAt(s, j); if (c === 0x5c) { j += 2; continue; } if (c === 0x22) { closed = j; break; } j += 1; }
+      if (closed === -1) break;
+      out += _strSlice(s, last, i) + "\"\"";
+      last = closed + 1; i = closed + 1;
+    } else i += 1;
+  }
+  return out + _strSlice(s, last, n);
+}
+// Is `scheme` (our own literal, case-insensitive) offered as a challenge TOKEN in the blanked header?
+// (?:^|,)\s*SCHEME(?=[\s,]|$): at the start or after a comma, optional whitespace, the scheme, then a
+// whitespace / comma / end boundary -- never a substring, so `Digest realm="basic"` is not read as Basic.
+function _schemeOffered(s, scheme) {
+  var n = s.length, slen = scheme.length, p, k;
+  for (p = 0; p <= n; p++) {
+    if (p !== 0 && _charCodeAt(s, p - 1) !== 0x2c) continue;
+    var q = p;
+    while (q < n && pkix.isJsWhitespace(_charCodeAt(s, q))) q += 1;
+    if (q + slen > n) continue;
+    var ok = true;
+    for (k = 0; k < slen; k++) {
+      var x = _charCodeAt(s, q + k), y = _charCodeAt(scheme, k);
+      if (x >= 65 && x <= 90) x += 32;
+      if (y >= 65 && y <= 90) y += 32;
+      if (x !== y) { ok = false; break; }
+    }
+    if (!ok) continue;
+    var after = q + slen;
+    if (after === n || pkix.isJsWhitespace(_charCodeAt(s, after)) || _charCodeAt(s, after) === 0x2c) return true;
+  }
+  return false;
+}
 function _offersScheme(www, scheme) {
-  var s = String(www || "").replace(/"(?:[^"\\]|\\.)*"/g, "\"\"");
-  return new RegExp("(?:^|,)\\s*" + scheme + "(?=[\\s,]|$)", "i").test(s);
+  return _schemeOffered(_blankQuotedStrings(String(www || "")), scheme);
 }
 // The chosen HTTP auth scheme: an explicit opts.auth.scheme wins; a legacy opts.username / opts.password
 // WITHOUT opts.auth means Basic (backwards compatible); otherwise none. There is NO scheme:"auto" -- a
@@ -1573,8 +1749,8 @@ function _collectNestedPaths(list, prefix, out, depth) {
 function _assertAgrees(name, supplied, carried) {
   if (supplied == null) return;
   var same;
-  if (Buffer.isBuffer(supplied) || supplied instanceof Uint8Array) {
-    same = Buffer.isBuffer(carried) && Buffer.from(supplied).equals(carried);
+  if (guard.bytes.isByteSource(supplied)) {
+    same = Buffer.isBuffer(carried) && guard.bytes.source(supplied, EstError, "est/bad-input", "opts.senderNonce").equals(carried);
   } else {
     // Through the shared authoring guard, not a bare BigInt(): a `number` above
     // Number.MAX_SAFE_INTEGER has already lost the digits that distinguish it from
@@ -1624,8 +1800,8 @@ function _shallowCopy(o) {
 function _cmcRequestDer(request) {
   // COPIED, not aliased: these bytes are parsed now (for the requested keys) and
   // transmitted later, so sharing the caller's buffer would let the two disagree.
-  if (Buffer.isBuffer(request) || request instanceof Uint8Array) {
-    return guard.bytes.snapshot(request, EstError, "est/bad-input", "the Full PKI Request");
+  if (guard.bytes.isByteSource(request)) {
+    return guard.bytes.snapshotSource(request, EstError, "est/bad-input", "the Full PKI Request");
   }
   if (typeof request === "string") return cms.pemDecode(request);
   throw E("est/bad-input", "pki.est.fullcmc requires the Full PKI Request as DER bytes or a PEM CMS block");
@@ -1991,13 +2167,37 @@ function _serverkeygenEncryptionFromCsr(csrDer) {
 // The delivered private key rides TLS confidentiality alone: a NULL / anonymous / EXPORT suite MUST NOT be
 // used to carry it (RFC 7030 sec. 4.4, sec. 6). Assert (never reconfigure) the negotiated cipher when the
 // transport surfaces it; an injected transport that reports no cipher is trusted (the test/loopback channel).
+// The weak-cipher token scan (RFC 3986/2119-free ASCII, by character code): a "word" character is
+// [A-Za-z0-9_] (regex \w), and a boundary (\b) sits where a word character meets a non-word one or a
+// string edge. `_subAt`/`_containsSub` test a literal token at / anywhere in an already-uppercased name.
+function _isWordChar(c) { return (c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 95; }
+function _subAt(s, sub, i) { var m = sub.length; if (i + m > s.length) return false; for (var k = 0; k < m; k++) { if (_charCodeAt(s, i + k) !== _charCodeAt(sub, k)) return false; } return true; }
+function _containsSub(s, sub) { for (var i = 0; i + sub.length <= s.length; i++) { if (_subAt(s, sub, i)) return true; } return false; }
+function _wbBefore(s, i) { return i === 0 || !_isWordChar(_charCodeAt(s, i - 1)); }
+function _wbAfter(s, j) { return j === s.length || !_isWordChar(_charCodeAt(s, j)); }
+// /NULL|ANON|EXPORT|\bEXP[-_0-9]|\bA(EC)?DH\b/ over the uppercased name: the three plain substrings, then
+// EXP at a word boundary followed by a separator OR a digit run (EXP-RC4-MD5, EXP1024-RC4-SHA -- a bare
+// \bEXP\b misses EXP1024), then ADH / AECDH each bounded on both sides.
+function _hasWeakCipherToken(name) {
+  if (_containsSub(name, "NULL") || _containsSub(name, "ANON") || _containsSub(name, "EXPORT")) return true;
+  var i, n = name.length;
+  for (i = 0; i + 3 <= n; i++) {
+    if (_subAt(name, "EXP", i) && _wbBefore(name, i)) {
+      var c = _charCodeAt(name, i + 3);
+      if (c === 45 || c === 95 || (c >= 48 && c <= 57)) return true;
+    }
+  }
+  for (i = 0; i < n; i++) {
+    if (_subAt(name, "ADH", i) && _wbBefore(name, i) && _wbAfter(name, i + 3)) return true;
+    if (_subAt(name, "AECDH", i) && _wbBefore(name, i) && _wbAfter(name, i + 5)) return true;
+  }
+  return false;
+}
 function _assertConfidentialCipher(res) {
   if (!res || !res.tls || !res.tls.cipher) return;
   var c = res.tls.cipher;
   var name = (String(c.name || "") + " " + String(c.standardName || "")).toUpperCase();
-  // EXPORT covers the RFC/IANA name; the OpenSSL short names use an EXP prefix followed by a separator OR a
-  // digit run (EXP-RC4-MD5, EXP1024-RC4-SHA), so match EXP before either -- a bare `\bEXP\b` misses EXP1024.
-  if (/NULL|ANON|EXPORT|\bEXP[-_0-9]|\bA(EC)?DH\b/.test(name)) throw E("est/weak-cipher", "the serverkeygen channel negotiated a NULL / anonymous / EXPORT cipher (" + (c.standardName || c.name) + "), which cannot protect the delivered private key (RFC 7030 sec. 4.4)");
+  if (_hasWeakCipherToken(name)) throw E("est/weak-cipher", "the serverkeygen channel negotiated a NULL / anonymous / EXPORT cipher (" + (c.standardName || c.name) + "), which cannot protect the delivered private key (RFC 7030 sec. 4.4)");
 }
 
 // A case-insensitive header lookup: the injectable transport seam only promises { status, headers, body }, so a
@@ -2130,7 +2330,7 @@ function serverkeygen(baseUrl, csrInput, opts) {
       var eis = opts.expectedRecipientIssuerSerial;
       if (typeof eis !== "object" || Buffer.isBuffer(eis) || !Buffer.isBuffer(eis.issuer)) throw E("est/bad-input", "opts.expectedRecipientIssuerSerial must be { issuer: Buffer, serialNumber }");
       var s = eis.serialNumber;
-      if (!((typeof s === "bigint" && s >= 0n) || (typeof s === "number" && Number.isSafeInteger(s) && s >= 0) || (typeof s === "string" && /^[0-9]+$/.test(s)))) throw E("est/bad-input", "opts.expectedRecipientIssuerSerial.serialNumber must be a NON-NEGATIVE bigint, a safe non-negative integer, or a decimal digit string (a certificate serial is non-negative, RFC 5280 sec. 4.1.2.2)");
+      if (!((typeof s === "bigint" && s >= 0n) || (typeof s === "number" && Number.isSafeInteger(s) && s >= 0) || (typeof s === "string" && pkix.allCharsIn(s, _DIGITS_TABLE)))) throw E("est/bad-input", "opts.expectedRecipientIssuerSerial.serialNumber must be a NON-NEGATIVE bigint, a safe non-negative integer, or a decimal digit string (a certificate serial is non-negative, RFC 5280 sec. 4.1.2.2)");
     }
     // A recipient expectation implies the key part MUST be encrypted to that recipient; if the CSR advertised no
     // key-encryption attribute the coherence check below never runs, so a compromised CA could deliver the key

package/lib/framework-error.js

@@ -28,9 +28,23 @@
  *   classes the toolkit throws.
  */
 
-// The frozen shape of every error code: a `domain/reason` string of
-// lowercase alphanumerics and dashes.
-var CODE_SHAPE = /^[a-z0-9-]+\/[a-z0-9-]+$/;
+var intrinsic = require("./guard-intrinsic");
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _String = intrinsic.String;
+var _defineProperty = intrinsic.defineProperty;
+
+// The frozen shape of every error code: a `domain/reason` string -- one or more lowercase alphanumerics or
+// dashes, a single "/", then one or more of the same. Decided by character scan (no regex).
+function _isCodeShape(c) {
+  var n = c.length, i, ch, slash = -1;
+  if (n < 3) return false;                                             // shortest is "a/b"
+  for (i = 0; i < n; i += 1) {
+    ch = _charCodeAt(c, i);
+    if (ch === 47) { if (slash !== -1) return false; slash = i; }       // "/" -- at most one
+    else if (!((ch >= 97 && ch <= 122) || (ch >= 48 && ch <= 57) || ch === 45)) return false;   // a-z 0-9 "-"
+  }
+  return slash > 0 && slash < n - 1;                                   // one slash, both sides non-empty
+}
 
 /**
  * @primitive  pki.errors.PkiError
@@ -59,9 +73,9 @@ class PkiError extends Error {
     super(message);
     this.name = "PkiError";
     var c = code || "pki/invalid";
-    if (typeof c !== "string" || !CODE_SHAPE.test(c)) {
+    if (typeof c !== "string" || !_isCodeShape(c)) {
       throw new TypeError(
-        "PkiError code must be a domain/reason string, got " + String(c) +
+        "PkiError code must be a domain/reason string, got " + _String(c) +
         " (PkiError takes (message, code); defineClass subclasses take (code, message))"
       );
     }
@@ -114,7 +128,7 @@ function defineClass(name, opts) {
       }
     }
   };
-  Object.defineProperty(GeneratedError, "name", { value: name, configurable: true });
+  _defineProperty(GeneratedError, "name", { value: name, configurable: true });
   GeneratedError.factory = function (code, message, arg3) {
     return new GeneratedError(code, message, arg3);
   };

package/lib/guard-bytes.js

@@ -41,7 +41,7 @@ var _stringify = intrinsic.stringify;
 var _forEach = intrinsic.forEach;
 var _map = intrinsic.map;
 var _filter = intrinsic.filter;
-var _reTest = intrinsic.uncurry(RegExp.prototype.test);
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _setForEach = intrinsic.uncurry(Set.prototype.forEach);
 var _mapForEach = intrinsic.uncurry(Map.prototype.forEach);
 var _String = intrinsic.String;
@@ -151,10 +151,26 @@ function _reView(v) {
 // The two string operations in this table run AT LOAD, in the same statement that reads
 // `util.types` once and for the same reason. Nothing a caller can replace has run yet, so there is
 // no live read to remove; capturing them would only move the question one line earlier.
+// A util.types predicate that names a concrete typed-array kind: "is" + one-or-more alphanumerics +
+// "Array" (e.g. "isUint8Array"), decided character by character so no regex match protocol -- which
+// re-dispatches through a replaceable `exec` -- stands between this table and the runtime it reads.
+function _isTypedArrayPredName(name) {
+  var n = name.length;
+  if (n < 8) return false; // "is" + >=1 middle char + "Array"
+  if (_charCodeAt(name, 0) !== 105 || _charCodeAt(name, 1) !== 115) return false; // "is"
+  var tail = "Array";
+  for (var k = 0; k < 5; k++) { if (_charCodeAt(name, n - 5 + k) !== _charCodeAt(tail, k)) return false; }
+  for (var i = 2; i < n - 5; i++) {
+    var c = _charCodeAt(name, i);
+    if (!((c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122))) return false;
+  }
+  return true;
+}
+
 var _CONCRETE_KINDS = _filter(
   _map(
     // allow:guard-reads-runtime-live -- module-init, see above
-    _filter(_objectKeys(util.types), function (name) { return _reTest(/^is[A-Za-z0-9]+Array$/, name); }),
+    _filter(_objectKeys(util.types), function (name) { return _isTypedArrayPredName(name); }),
     // allow:guard-reads-runtime-live -- module-init, see above
     function (name) { return [util.types[name], globalThis[name.slice(2)]]; }
   ),
@@ -188,7 +204,12 @@ function _kindName(v) {
   return typeof v === "function" ? "function" : "value";
 }
 
-function _article(name) { return _reTest(/^[AEIOU]/i, name) ? "an" : "a"; }
+function _article(name) {
+  var c = name.length > 0 ? _charCodeAt(name, 0) : 0;
+  var vowel = c === 65 || c === 69 || c === 73 || c === 79 || c === 85 ||
+              c === 97 || c === 101 || c === 105 || c === 111 || c === 117; // A E I O U, either case
+  return vowel ? "an" : "a";
+}
 
 // outputView(input, ErrorClass, code, label) -> a Buffer aliasing a caller's view, for WRITING.
 //