@blamejs/pki 0.5.30 → 0.5.32

package/lib/pki-build.js

@@ -25,16 +25,279 @@ var _bufferFrom = intrinsic.bufferFrom;
 var _bufferEquals = intrinsic.bufferEquals;
 var oid = require("./oid");
 var ipUtils = require("./ip-utils");
+// packIpLiteral decides a GeneralName form (a bare string -> iPAddress or not), so its binding is taken at
+// load: calling it through the exports object would be a live property read, and code that reassigned that
+// property could steer the form decision without touching a regex.
+var _packIpLiteral = ipUtils.packIpLiteral;
 var nodeCrypto = require("crypto");
 // The key-material comparison, taken at load like every other operation a decision here rests on.
 var _keyEquals = intrinsic.uncurry(nodeCrypto.KeyObject.prototype.equals);
+// The bare-string GeneralName classifier (_classifyBareGeneralName) decides which name FORM a SAN string
+// becomes. It uses no regular expression: a regex is matched through a live, replaceable protocol
+// (RegExp.prototype.exec / test, String.prototype.match / split consult the regex's own `exec` and the
+// `[Symbol.match]` / `[Symbol.split]` hooks, and RegExp.prototype.compile can mutate a pattern in place),
+// so co-resident code could steer a form decision without our seeing it -- and the structural URI/email
+// rules a regex cannot state cleanly are what kept drawing edge-case escapes. Instead every form is
+// decided by scanning the string one character code at a time through these captured string primitives,
+// which read the value directly and have no per-character dispatch to replace.
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _stringIndexOf = intrinsic.stringIndexOf;
+var _stringLastIndexOf = intrinsic.uncurry(String.prototype.lastIndexOf);
+var _sliceStr = intrinsic.uncurry(String.prototype.slice);
+var _String = intrinsic.String;
+var _objectKeys = intrinsic.keys;
+var _isBufferChk = intrinsic.isBuffer;
+var _stringify = intrinsic.stringify;
 
-var b = asn1.build;
+// --- bare-string GeneralName form detection, by character-code scan (no regex) ---
+// Each predicate answers "is this string syntactically THIS name form", reading the string one code unit
+// at a time; a caller cannot steer the answer by replacing a prototype method. The classifier below tries
+// the forms in a fixed precedence and refuses anything none of them accepts (the object form is the escape).
+function _isAlphaCode(c) { return (c >= 65 && c <= 90) || (c >= 97 && c <= 122); }          // A-Z a-z
+function _isDigitCode(c) { return c >= 48 && c <= 57; }                                      // 0-9
+function _isHexCode(c) { return (c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70); }
+
+// RFC 3986 sec. 2.3 unreserved: ALPHA / DIGIT / "-" / "." / "_" / "~".
+function _isUnreserved(c) { return _isAlphaCode(c) || _isDigitCode(c) || c === 45 || c === 46 || c === 95 || c === 126; }
+// RFC 3986 sec. 2.2 sub-delims: ! $ & ' ( ) * + , ; =
+function _isSubDelim(c) {
+  switch (c) {
+    case 33: case 36: case 38: case 39: case 40: case 41: case 42: case 43: case 44: case 59: case 61: return true;
+    default: return false;
+  }
+}
+// A userinfo byte: unreserved / sub-delim / ":" (percent-encoding handled separately). No "@".
+function _isUserinfoByte(c) { return _isUnreserved(c) || _isSubDelim(c) || c === 58; }
+// A path/query/fragment byte: unreserved / sub-delim / a non-bracket gen-delim (":" "/" "?" "#" "@").
+// "%" is handled separately (it must open a "%HEXHEX" triplet); the IP-literal brackets "[" "]" are
+// excluded, so an IPv6-literal host is refused by the shorthand and uses the object form.
+function _isUriByte(c) {
+  return _isUnreserved(c) || _isSubDelim(c) || c === 58 || c === 47 || c === 63 || c === 35 || c === 64;
+}
+
+// An RFC 5322 sec. 3.2.3 "atext" byte: ALPHA / DIGIT and a fixed set of specials, used for an unquoted
+// email local part. "." is deliberately excluded so the dot-atom structure is enforced by the scan.
+function _isAtextByte(c) {
+  if (_isAlphaCode(c) || _isDigitCode(c)) return true;
+  switch (c) {
+    case 33: case 35: case 36: case 37: case 38: case 39:         // ! # $ % & '
+    case 42: case 43: case 45: case 47: case 61: case 63:         // * + - / = ?
+    case 94: case 95: case 96: case 123: case 124: case 125: case 126:   // ^ _ ` { | } ~
+      return true;
+    default: return false;
+  }
+}
+
+// IPv4 SHAPE: one or more digit groups joined by single dots (only digits and dots, no leading/trailing/
+// doubled dot, at least one dot). This is the "looks like an address" test, not a valid-address test --
+// packIpLiteral decides validity; a shape match that is not a valid address is refused as ambiguous.
+function _looksLikeIPv4Shape(s) {
+  var n = s.length, i, c, sawDot = false, atomEmpty = true;
+  if (n === 0) return false;
+  for (i = 0; i < n; i += 1) {
+    c = _charCodeAt(s, i);
+    if (c === 46) { if (atomEmpty) return false; sawDot = true; atomEmpty = true; }   // "."
+    else if (_isDigitCode(c)) { atomEmpty = false; }
+    else return false;
+  }
+  return sawDot && !atomEmpty;
+}
+
+// Every byte in [from,to) is an allowed component byte (per `byteOk`) or opens a "%HEXHEX" triplet.
+function _componentBytesOk(s, from, to, byteOk) {
+  var i = from, c;
+  while (i < to) {
+    c = _charCodeAt(s, i);
+    if (c === 37) {                                                                    // "%" -> %HEXHEX
+      if (i + 2 >= to || !_isHexCode(_charCodeAt(s, i + 1)) || !_isHexCode(_charCodeAt(s, i + 2))) return false;
+      i += 3;
+    } else if (byteOk(c)) { i += 1; }
+    else return false;
+  }
+  return true;
+}
+
+// The URI host in [from,to): RFC 5280 sec. 4.2.1.6 requires a URI SAN authority to carry a fully-qualified
+// domain name or IP host, stricter than an RFC 3986 reg-name. So the host is either a valid IPv4 literal,
+// or an FQDN of strict-LDH labels (the email-domain grammar: no underscore, no hyphen at a label edge) with
+// at least one dot -- a single-label host such as "localhost" is not fully qualified and uses the object
+// form, matching the email domain. An IPv4-SHAPED host that is not a valid address is refused as ambiguous
+// (the same rule the top-level classifier uses), and an IPv6-literal host -- needing the excluded "[" "]"
+// -- uses the object form.
+function _validUriHost(s, from, to) {
+  if (to <= from) return false;                                                        // empty host
+  var host = _sliceStr(s, from, to), len = host.length;
+  if (_looksLikeIPv4Shape(host)) return _packIpLiteral(host) !== null;                  // IPv4 (first-match-wins)
+  var end = _charCodeAt(host, len - 1) === 46 ? len - 1 : len;                          // ignore an absolute-root "."
+  if (end > 253) return false;                                                         // RFC 1035 name length (root dot excluded)
+  var firstDot = _stringIndexOf(host, ".", 0);
+  if (firstDot === -1 || firstDot >= end) return false;                                // multi-label FQDN ("localhost" is not)
+  return _labelsValid(host, 0, len, _isHostLabelRange, true);                           // strict-LDH FQDN, root "." allowed
+}
+
+// The authority in [from,to) is "[ userinfo "@" ] host [ ":" port ]" (RFC 3986 sec. 3.2): at most one "@"
+// (userinfo and reg-name each exclude it), a host validated by _validUriHost (RFC 5280 FQDN or IPv4), and
+// an all-digit -- possibly empty -- port after the host's single ":" (a reg-name has no ":"). The userinfo
+// bytes are validated against the RFC 3986 userinfo class.
+function _validUriAuthority(s, from, to) {
+  var i, c, at = -1;
+  for (i = from; i < to; i += 1) {
+    c = _charCodeAt(s, i);
+    if (c === 64) { if (at !== -1) return false; at = i; }                             // "@" -- at most one
+  }
+  var hostStart = at === -1 ? from : at + 1;
+  if (at !== -1 && !_componentBytesOk(s, from, at, _isUserinfoByte)) return false;      // userinfo
+  var colon = -1;
+  for (i = hostStart; i < to; i += 1) { if (_charCodeAt(s, i) === 58) { colon = i; break; } }   // ":" -> port
+  var hostEnd = colon === -1 ? to : colon;
+  if (!_validUriHost(s, hostStart, hostEnd)) return false;                              // FQDN or IPv4 host
+  if (colon !== -1) {
+    for (i = colon + 1; i < to; i += 1) { if (!_isDigitCode(_charCodeAt(s, i))) return false; }   // port = *DIGIT
+  }
+  return true;
+}
+
+// scheme "://" authority [ path ] [ "?" query ] [ "#" fragment ], parsed by RFC 3986 component. The
+// authority is validated by _validUriAuthority; the remainder is path/query/fragment bytes with at most
+// one "#" (its single fragment delimiter). A structurally malformed URL is refused; the object form is
+// the escape for one the shorthand does not accept.
+function _looksLikeUri(s) {
+  var n = s.length, i, c;
+  if (n === 0 || !_isAlphaCode(_charCodeAt(s, 0))) return false;                       // scheme starts ALPHA
+  i = 1;
+  while (i < n) {
+    c = _charCodeAt(s, i);
+    if (_isAlphaCode(c) || _isDigitCode(c) || c === 43 || c === 45 || c === 46) i += 1;   // + - . in scheme
+    else break;
+  }
+  if (i + 3 > n || _charCodeAt(s, i) !== 58 || _charCodeAt(s, i + 1) !== 47 || _charCodeAt(s, i + 2) !== 47) return false;
+  i += 3;
+  var authStart = i, authEnd = n;
+  for (; i < n; i += 1) { c = _charCodeAt(s, i); if (c === 47 || c === 63 || c === 35) { authEnd = i; break; } }
+  if (authEnd === authStart) return false;                                             // empty authority
+  if (!_validUriAuthority(s, authStart, authEnd)) return false;
+  var sawHash = false;                                                                 // path / query / fragment
+  i = authEnd;
+  while (i < n) {
+    c = _charCodeAt(s, i);
+    if (c === 37) {                                                                    // "%" -> %HEXHEX
+      if (i + 2 >= n || !_isHexCode(_charCodeAt(s, i + 1)) || !_isHexCode(_charCodeAt(s, i + 2))) return false;
+      i += 3;
+      continue;
+    }
+    if (c === 35) { if (sawHash) return false; sawHash = true; }                        // one "#" fragment delimiter
+    if (!_isUriByte(c)) return false;
+    i += 1;
+  }
+  return true;
+}
+
+// A single dNSName label over [from,to): 1-63 bytes, LDH plus a LEADING or EMBEDDED underscore, no hyphen
+// at either edge, and no underscore at the trailing edge. The underscore tolerance is deliberate and
+// leading/embedded only: the real forms are _acme-challenge, _dmarc, _25._tcp (a label-initial "_"); a
+// label ending in "_" has no such use. An email DOMAIN is stricter still -- see _isHostLabelRange.
+function _isDnsLabelRange(s, from, to) {
+  var len = to - from, i, c;
+  if (len < 1 || len > 63) return false;
+  for (i = from; i < to; i += 1) {
+    c = _charCodeAt(s, i);
+    if (_isAlphaCode(c) || _isDigitCode(c)) continue;                                  // A-Z a-z 0-9 anywhere
+    if (i === to - 1) return false;                                                    // last byte must be alnum
+    if (c === 95) continue;                                                            // "_" leading or embedded
+    if (c === 45 && i !== from) continue;                                              // "-" embedded (not leading)
+    return false;
+  }
+  return true;
+}
+
+// A single RFC 5321 sec. 2.3.5 hostname label over [from,to): the strict letter-digit-hyphen grammar with
+// no hyphen at either edge and NO underscore. This is the email-domain label rule (a mail domain is a real
+// hostname), stricter than the underscore-tolerant dNSName label above.
+function _isHostLabelRange(s, from, to) {
+  var len = to - from, i, c, edge;
+  if (len < 1 || len > 63) return false;
+  for (i = from; i < to; i += 1) {
+    c = _charCodeAt(s, i);
+    edge = (i === from || i === to - 1);
+    if (_isAlphaCode(c) || _isDigitCode(c)) continue;                                  // A-Z a-z 0-9
+    if (c === 45 && !edge) continue;                                                   // "-" not at an edge
+    return false;
+  }
+  return true;
+}
+
+// Every dot-separated label in [from,to) satisfies `labelFn`. Scans with indexOf; no split allocation. When
+// `allowRootDot` is set, a single trailing "." (the absolute-FQDN root) is stripped before validating, so
+// "example.com." checks as "example.com"; an interior empty label (a doubled or leading dot) still fails.
+function _labelsValid(s, from, to, labelFn, allowRootDot) {
+  if (allowRootDot && to - from >= 1 && _charCodeAt(s, to - 1) === 46) to -= 1;         // an absolute-root "."
+  if (to <= from) return false;                                                        // nothing (a lone ".")
+  var start = from, dot;
+  for (;;) {
+    dot = _stringIndexOf(s, ".", start);
+    var end = (dot === -1 || dot >= to) ? to : dot;
+    if (!labelFn(s, start, end)) return false;
+    if (end === to) return true;
+    start = end + 1;
+  }
+}
 
-// A well-formed dotted-decimal OID: a first arc 0-2 followed by one or more non-leading-zero arcs. Used to
-// accept a raw OID string (an unregistered KeyPurposeId / policy OID) where a registered name would go; the
-// encoder (encodeOidContent) remains the authoritative validator of the arc-value bounds.
-var DOTTED_OID_RE = /^[0-2](?:\.(?:0|[1-9]\d*))+$/;
+// A dNSName: at most 253 bytes, an optional single leading "*." wildcard, then dot-separated dNSName labels
+// (underscore-tolerant), with an optional trailing absolute-root ".".
+function _looksLikeDnsName(s) {
+  var n = s.length, start = 0;
+  if (n < 1) return false;
+  var end = _charCodeAt(s, n - 1) === 46 ? n - 1 : n;                                   // exclude an absolute-root "."
+  if (end < 1 || end > 253) return false;                                              // RFC 1035 name length (root dot excluded)
+  if (end >= 2 && _charCodeAt(s, 0) === 42 && _charCodeAt(s, 1) === 46) start = 2;      // "*."
+  if (start >= end) return false;
+  return _labelsValid(s, start, n, _isDnsLabelRange, true);
+}
+
+// An rfc822Name: an unquoted RFC 5321 dot-atom local part (atext runs joined by single dots), one "@",
+// and a dotted hostname domain (at least one dot -- an FQDN, no wildcard, strict LDH labels, no underscore).
+function _looksLikeEmail(s) {
+  if (s.length > 254) return false;                                                    // the whole mailbox <= 254 octets (RFC 5321 sec. 4.5.3.1.3)
+  var at = _stringIndexOf(s, "@", 0);
+  if (at < 1 || at > 64 || _stringLastIndexOf(s, "@") !== at) return false;            // one "@", a 1-64 octet local part (RFC 5321 sec. 4.5.3.1.1)
+  var i, c, atomEmpty = true;
+  for (i = 0; i < at; i += 1) {                                                        // local part = dot-atom
+    c = _charCodeAt(s, i);
+    if (c === 46) { if (atomEmpty) return false; atomEmpty = true; }                   // no leading/doubled dot
+    else if (_isAtextByte(c)) { atomEmpty = false; }
+    else return false;
+  }
+  if (atomEmpty) return false;                                                         // no trailing dot / empty
+  var dStart = at + 1, dLen = s.length - dStart;
+  if (dLen < 1 || dLen > 253 || _stringIndexOf(s, ".", dStart) === -1) return false;   // domain must be dotted
+  return _labelsValid(s, dStart, s.length, _isHostLabelRange, false);                   // strict LDH, no underscore or root dot
+}
+
+// A well-formed dotted-decimal OID SHAPE (no regex, by the same character scan the name forms use): a first
+// arc 0-2, then one or more arcs each introduced by "." and written without a leading zero ("0" alone, or a
+// non-zero digit followed by more digits). Used to accept a raw OID string (an unregistered KeyPurposeId /
+// policy OID) where a registered name would go; the encoder (encodeOidContent) remains the authoritative
+// validator of the arc-value bounds.
+function _isDottedOid(s) {
+  var n = s.length, i, c, d0, arcs = 0;
+  if (n < 3) return false;                              // shortest is "X.Y"
+  c = _charCodeAt(s, 0);
+  if (c < 48 || c > 50) return false;                  // first arc is a single digit 0-2
+  i = 1;
+  while (i < n) {
+    if (_charCodeAt(s, i) !== 46) return false;         // every following arc is introduced by "."
+    i += 1;
+    if (i >= n) return false;                           // a trailing "." has no arc
+    d0 = _charCodeAt(s, i);
+    if (d0 === 48) { i += 1; }                           // "0" is a complete arc; a leading zero is refused
+    else if (d0 >= 49 && d0 <= 57) { i += 1; while (i < n && _isDigitCode(_charCodeAt(s, i))) i += 1; }
+    else { return false; }                              // an arc must start with a digit
+    arcs += 1;
+  }
+  return arcs >= 1;
+}
+
+var b = asn1.build;
 
 // KeyUsage named-bit positions (RFC 5280 sec. 4.2.1.3); contentCommitment is the RFC 5280 rename of the
 // X.509 nonRepudiation bit (1).
@@ -92,7 +355,7 @@ function makeBuilder(ctx) {
   // A DN spec -> RDNSequence DER. A string is shorthand for a single commonName RDN; a Buffer is raw
   // pre-encoded Name DER (validated through the parser). An empty array yields an empty RDNSequence.
   function encodeName(spec) {
-    if (Buffer.isBuffer(spec)) { assertValidNameDer(spec); return spec; }
+    if (guard.bytes.isByteSource(spec)) { var _nd = guard.bytes.snapshotSource(spec, ErrorClass, ctx.prefix + "/bad-name", "raw Name DER"); assertValidNameDer(_nd); return _nd; }
     if (typeof spec === "string") spec = [{ commonName: spec }];
     if (!_isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
     return b.sequence(spec.map(encodeRdn));
@@ -112,15 +375,51 @@ function makeBuilder(ctx) {
 
   // ---- GeneralName encoding (RFC 5280 sec. 4.2.1.6) ----
   function ia5Content(s) {
-    s = String(s);
+    // Captured String / charCodeAt / bufferFrom: this converts a GeneralName value (a classified bare
+    // string or an object-form value) to the emitted IA5String bytes, so co-resident code replacing any of
+    // them after load could otherwise change which host the certificate names from the one that was checked.
+    s = _String(s);
     for (var i = 0; i < s.length; i++) {
-      if (s.charCodeAt(i) > 0x7F) throw E("bad-input", "value requires 7-bit ASCII (IA5String): " + JSON.stringify(s));
+      if (_charCodeAt(s, i) > 0x7F) throw E("bad-input", "value requires 7-bit ASCII (IA5String): " + _stringify(s));
     }
-    return Buffer.from(s, "latin1");
+    return _bufferFrom(s, "latin1");
+  }
+  // A bare-string GeneralName shorthand: classify a string into exactly one form, FAIL-CLOSED. RFC 5280
+  // sec. 4.2.1.6 GeneralName is a CHOICE, so an input that does not UNAMBIGUOUSLY match one form throws
+  // rather than being guessed -- the explicit object form ({ dNSName: s } etc.) is always the escape. The
+  // per-form syntax is decided by the character-scan predicates above (no regex). Precedence resolves the
+  // overlaps of the later tests: an IP literal is also LDH-with-dots (so it is tested first), and a
+  // scheme://authority URL can carry userinfo that reads like an email (so URI is tested before rfc822Name).
+  // Form detection only -- IA5String (7-bit) enforcement stays at ia5Content, so a non-ASCII value still
+  // throws at encode.
+  function _classifyBareGeneralName(s) {
+    if (_packIpLiteral(s) !== null) return { iPAddress: s };
+    // A string of only digit groups separated by dots is an IPv4 ATTEMPT; if packIpLiteral rejected it,
+    // it is a MALFORMED address, not a dNSName. It reads two ways (an invalid IP and a syntactically
+    // valid all-numeric name), so it is ambiguous and refused rather than silently encoded as a name the
+    // caller did not intend -- a genuine all-numeric name uses the explicit { dNSName: ... } form.
+    if (_looksLikeIPv4Shape(s)) {
+      throw E("bad-input", "the bare GeneralName string " + _stringify(s) + " looks like an IPv4 address but is not a valid one; pass { iPAddress: ... } for an address or { dNSName: ... } for a name");
+    }
+    if (_looksLikeUri(s)) return { uniformResourceIdentifier: s };
+    if (_looksLikeEmail(s)) return { rfc822Name: s };
+    if (_looksLikeDnsName(s)) return { dNSName: s };
+    var _qs = _stringify(s);
+    throw E("bad-input", "cannot classify the bare GeneralName string " + _qs +
+      " as a dNSName, rfc822Name, iPAddress, or URI; pass an explicit form object, e.g. { dNSName: " + _qs + " }");
   }
   function encodeGeneralName(entry) {
-    if (!entry || typeof entry !== "object" || Buffer.isBuffer(entry)) throw E("bad-input", "a GeneralName must be an object with exactly one name form");
-    var keys = Object.keys(entry);
+    // A bare non-empty string is shorthand -- normalized to its single-key object form, fail-closed,
+    // before the object checks below; an empty string is refused here (never classified).
+    if (typeof entry === "string") {
+      if (entry === "") throw E("bad-input", "an empty GeneralName value is not permitted (RFC 5280 sec. 4.2.1.6)");
+      entry = _classifyBareGeneralName(entry);
+    }
+    if (!entry || typeof entry !== "object" || _isBufferChk(entry)) throw E("bad-input", "a GeneralName must be an object with exactly one name form");
+    // Captured Object.keys / property read: this reads which form and value the certificate will emit for a
+    // GeneralName (a freshly classified bare string, or a caller object), so a replaced Object.keys must not
+    // be able to relabel the classified result into a different, attacker-chosen form after validation.
+    var keys = _objectKeys(entry);
     if (keys.length !== 1) throw E("bad-input", "a GeneralName entry must have exactly one form, got " + keys.length);
     var k = keys[0], v = entry[k];
     if (v == null || v === "") throw E("bad-input", "an empty GeneralName value is not permitted (RFC 5280 sec. 4.2.1.6)");
@@ -134,10 +433,10 @@ function makeBuilder(ctx) {
         // octets by hand (a GeneralName iPAddress is a bare host address, RFC 5280 sec. 4.2.1.6).
         var ipBuf = v;
         if (typeof v === "string") {
-          ipBuf = ipUtils.packIpLiteral(v);
-          if (ipBuf === null) throw E("bad-input", "iPAddress string is not a valid IPv4 or IPv6 literal: " + JSON.stringify(v));
+          ipBuf = _packIpLiteral(v);
+          if (ipBuf === null) throw E("bad-input", "iPAddress string is not a valid IPv4 or IPv6 literal: " + _stringify(v));
         }
-        if (!Buffer.isBuffer(ipBuf) || (ipBuf.length !== 4 && ipBuf.length !== 16)) throw E("bad-input", "iPAddress must be a 4- or 16-octet Buffer or an IPv4/IPv6 string");
+        if (!_isBufferChk(ipBuf) || (ipBuf.length !== 4 && ipBuf.length !== 16)) throw E("bad-input", "iPAddress must be a 4- or 16-octet Buffer or an IPv4/IPv6 string");
         return b.contextPrimitive(7, ipBuf);
       case "directoryName": return b.explicit(4, encodeName(v));   // Name is a CHOICE -> the context tag is EXPLICIT
       case "otherName":
@@ -187,8 +486,8 @@ function makeBuilder(ctx) {
   function _resolveOid(n, label) {
     var dotted = O(n);
     if (dotted != null) return dotted;
-    if (typeof n === "string" && DOTTED_OID_RE.test(n)) {
-      // The regex fixes the general shape; b.oid's encoder is the authoritative X.660 arc-bounds check
+    if (typeof n === "string" && _isDottedOid(n)) {
+      // The shape scan fixes the general form; b.oid's encoder is the authoritative X.660 arc-bounds check
       // (a first arc 0/1 caps the second at 39; an arc must DER-encode). A failure there is this producer's
       // bad-input, not a leaked oid/* code, so every shared-builder consumer keeps its own error contract.
       try { b.oid(n); }
@@ -261,14 +560,14 @@ function makeBuilder(ctx) {
     return nodeCrypto.createHash("sha1").update(keyBytes).digest();
   }
   function skiKeyId(val, spkiDer) {
-    if (Buffer.isBuffer(val)) return guard.bytes.snapshot(val, ErrorClass, ctx.prefix + "/bad-input", "subjectKeyIdentifier");
+    if (guard.bytes.isByteSource(val)) return guard.bytes.snapshotSource(val, ErrorClass, ctx.prefix + "/bad-input", "subjectKeyIdentifier");
     if (val === true) return spkiKeyId(spkiDer);
-    throw E("bad-input", "subjectKeyIdentifier must be true (auto-derive) or a Buffer key id");
+    throw E("bad-input", "subjectKeyIdentifier must be true (auto-derive) or a BufferSource key id");
   }
 
   // ---- embedded-input validators ----
   function reqDer(v, what) {
-    if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, ErrorClass, ctx.prefix + "/bad-input", what);
+    if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, ErrorClass, ctx.prefix + "/bad-input", what);
     throw E("bad-input", what + " must be a DER Buffer");
   }
   // Full validation of an embedded SubjectPublicKeyInfo, walked through the parser the decoder uses.
@@ -364,8 +663,8 @@ function makeBuilder(ctx) {
     } else if (typeof serial === "bigint") { v = serial; }
     else if (typeof serial === "number") { if (!Number.isSafeInteger(serial)) throw E("bad-serial", "serialNumber number must be a safe integer (pass a BigInt, hex string, or Buffer for a value above 2^53-1)"); v = BigInt(serial); }
     else if (typeof serial === "string") { try { v = BigInt(serial); } catch (e) { throw E("bad-serial", "serialNumber string must be a decimal or 0x-hex integer", e); } }
-    else if (Buffer.isBuffer(serial)) { v = serial.length ? BigInt("0x" + serial.toString("hex")) : 0n; }
-    else { throw E("bad-serial", "serialNumber must be a BigInt, integer, hex string, or Buffer"); }
+    else if (guard.bytes.isByteSource(serial)) { var _sb = guard.bytes.source(serial, ErrorClass, ctx.prefix + "/bad-serial", "serialNumber"); v = _sb.length ? BigInt("0x" + _sb.toString("hex")) : 0n; }
+    else { throw E("bad-serial", "serialNumber must be a BigInt, integer, hex string, or BufferSource"); }
     if (v <= 0n) throw E("bad-serial", "serialNumber must be a positive integer (RFC 5280 sec. 4.1.2.2)");
     var tlv = b.integer(v);
     if (asn1.decode(tlv).content.length > 20) throw E("bad-serial", "serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");

package/lib/rfc3339.js

@@ -13,23 +13,72 @@
  * domain fault code.
  */
 
-// date "T" time with a zone (Z or a numeric offset); an optional fractional second.
-var RFC3339_RE = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:[Zz]|([+-])(\d{2}):(\d{2}))$/;
+// Exactly `count` ASCII digits at `start`, as an integer, or null on any non-digit or short read.
+// The grammar is decided character by character (no regex, whose match protocol re-dispatches through
+// a replaceable `exec`); `\d` in the original is ASCII [0-9] only, matched here as 48..57.
+function _digitsAt(v, start, count) {
+  if (start + count > v.length) return null;
+  var val = 0;
+  for (var i = 0; i < count; i++) {
+    var c = v.charCodeAt(start + i);
+    if (c < 48 || c > 57) return null;
+    val = val * 10 + (c - 48);
+  }
+  return val;
+}
+
+// RFC 3339 date-time scanned into its components, or null on any grammar violation:
+// YYYY "-" MM "-" DD [Tt] HH ":" MM ":" SS, an optional "." + one-or-more fraction digits, then a
+// zone -- [Zz] or ([+-]) OFFHH ":" OFFMM -- with nothing after. Calendar validity is checked by the
+// caller. `offset` carries the numeric-offset hours/minutes when present, else null.
+function _scanDateTime(v) {
+  var n = v.length, p = 0;
+  var year = _digitsAt(v, p, 4); if (year === null) return null; p += 4;
+  if (v.charAt(p) !== "-") return null; p += 1;
+  var month = _digitsAt(v, p, 2); if (month === null) return null; p += 2;
+  if (v.charAt(p) !== "-") return null; p += 1;
+  var day = _digitsAt(v, p, 2); if (day === null) return null; p += 2;
+  var t = v.charAt(p); if (t !== "T" && t !== "t") return null; p += 1;
+  var hour = _digitsAt(v, p, 2); if (hour === null) return null; p += 2;
+  if (v.charAt(p) !== ":") return null; p += 1;
+  var min = _digitsAt(v, p, 2); if (min === null) return null; p += 2;
+  if (v.charAt(p) !== ":") return null; p += 1;
+  var sec = _digitsAt(v, p, 2); if (sec === null) return null; p += 2;
+  if (v.charAt(p) === ".") {   // optional fractional second: "." + one or more digits
+    p += 1;
+    var fracStart = p;
+    while (p < n) { var fc = v.charCodeAt(p); if (fc < 48 || fc > 57) break; p += 1; }
+    if (p === fracStart) return null;
+  }
+  var z = v.charAt(p), offset = null;
+  if (z === "Z" || z === "z") {
+    p += 1;
+  } else if (z === "+" || z === "-") {
+    p += 1;
+    var offHour = _digitsAt(v, p, 2); if (offHour === null) return null; p += 2;
+    if (v.charAt(p) !== ":") return null; p += 1;
+    var offMin = _digitsAt(v, p, 2); if (offMin === null) return null; p += 2;
+    offset = { hour: offHour, min: offMin };
+  } else {
+    return null;   // a zone is required
+  }
+  if (p !== n) return null;   // no trailing characters
+  return { year: year, month: month, day: day, hour: hour, min: min, sec: sec, offset: offset };
+}
 
 // isValid(v) -> boolean: v is a syntactically well-formed AND calendar-valid RFC 3339 date-time string.
 function isValid(v) {
   if (typeof v !== "string") return false;
-  var m = RFC3339_RE.exec(v);
-  if (!m) return false;
-  var year = +m[1], month = +m[2], day = +m[3], hour = +m[4], min = +m[5], sec = +m[6];
-  if (month < 1 || month > 12) return false;
+  var t = _scanDateTime(v);
+  if (!t) return false;
+  if (t.month < 1 || t.month > 12) return false;
   // Reject a :60 leap second (Node's Date.parse returns NaN for it, so a comparison on such a value
   // would silently pass) and any hour/minute/second out of range.
-  if (hour > 23 || min > 59 || sec > 59) return false;
-  var leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+  if (t.hour > 23 || t.min > 59 || t.sec > 59) return false;
+  var leap = (t.year % 4 === 0 && t.year % 100 !== 0) || t.year % 400 === 0;
   var daysInMonth = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  if (day < 1 || day > daysInMonth[month - 1]) return false;
-  if (m[7]) { if (+m[8] > 23 || +m[9] > 59) return false; }   // a numeric zone offset must itself be valid
+  if (t.day < 1 || t.day > daysInMonth[t.month - 1]) return false;
+  if (t.offset) { if (t.offset.hour > 23 || t.offset.min > 59) return false; }   // a numeric zone offset must itself be valid
   return true;
 }
 
@@ -44,20 +93,29 @@ function parse(v, E, code, label) {
 // RFC 3339 sec. 5.6 `full-date`: a calendar date with no time component. A distinct production from
 // the date-time above, and deliberately a separate pair of functions instead of a flag: a consumer
 // that expects one and is handed the other has a malformed value, not a permissible variant.
-var FULL_DATE_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+// RFC 3339 full-date scanned into its components (YYYY "-" MM "-" DD, nothing after), or null.
+function _scanFullDate(v) {
+  var p = 0;
+  var year = _digitsAt(v, p, 4); if (year === null) return null; p += 4;
+  if (v.charAt(p) !== "-") return null; p += 1;
+  var month = _digitsAt(v, p, 2); if (month === null) return null; p += 2;
+  if (v.charAt(p) !== "-") return null; p += 1;
+  var day = _digitsAt(v, p, 2); if (day === null) return null; p += 2;
+  if (p !== v.length) return null;
+  return { year: year, month: month, day: day };
+}
 
 // isValidDate(v) -> boolean: v is a syntactically well-formed AND calendar-valid RFC 3339 full-date.
 // Calendar validity matters as much as shape: "2021-02-30" parses as a Date in JS by rolling over
 // into March, so a shape-only check would silently accept a day that does not exist.
 function isValidDate(v) {
   if (typeof v !== "string") return false;
-  var m = FULL_DATE_RE.exec(v);
-  if (!m) return false;
-  var year = +m[1], month = +m[2], day = +m[3];
-  if (month < 1 || month > 12) return false;
-  var leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+  var t = _scanFullDate(v);
+  if (!t) return false;
+  if (t.month < 1 || t.month > 12) return false;
+  var leap = (t.year % 4 === 0 && t.year % 100 !== 0) || t.year % 400 === 0;
   var daysInMonth = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  return day >= 1 && day <= daysInMonth[month - 1];
+  return t.day >= 1 && t.day <= daysInMonth[t.month - 1];
 }
 
 // parseDate(v, E, code, label) -> Date at UTC midnight. Anchored explicitly at UTC ("T00:00:00Z")

package/lib/schema-c509.js

@@ -263,16 +263,37 @@ function _specialText(node) {
 // name one certificate. A natively signed certificate is exempt: sec. 3.1.4 says bytes and tag 48
 // there "do not correspond to any predefined text string encoding and may also be used for other attribute
 // types", so no canonical text spelling exists to hold one to.
-var _HEX_OPTIMIZED = /^(?:[0-9a-f]{2})+$/;
-var _EUI64_TEXT = /^(?:[0-9A-F]{2}-){7}[0-9A-F]{2}$/;
+// Even-length lowercase hex ("HHHH..."), decided by character so no regex match protocol -- a live,
+// replaceable exec -- stands between the canonicalization gate and the value it inspects.
+function _isEvenHexLower(s) {
+  var n = s.length;
+  if (n < 2 || (n & 1) !== 0) return false;
+  for (var i = 0; i < n; i++) {
+    var c = s.charCodeAt(i);
+    if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 102))) return false; // 0-9 a-f
+  }
+  return true;
+}
+// EUI-64 text form: eight uppercase hex pairs joined by single hyphens ("HH-HH-...-HH", 23 chars).
+function _isEui64Text(s) {
+  if (s.length !== 23) return false;
+  for (var i = 0; i < 23; i++) {
+    if ((i % 3) === 2) { if (s.charCodeAt(i) !== 45) return false; } // "-" at 2,5,...,20
+    else {
+      var c = s.charCodeAt(i);
+      if (!((c >= 48 && c <= 57) || (c >= 65 && c <= 70))) return false; // 0-9 A-F
+    }
+  }
+  return true;
+}
 function _assertCanonicalSpecialText(node, isNative, E) {
   if (isNative) return;
   if (node.majorType === 3) {
     var t = cbor.read.textString(node);
-    if (t.length >= 2 && _HEX_OPTIMIZED.test(t)) {
+    if (t.length >= 2 && _isEvenHexLower(t)) {
       throw _err(E, "a text attribute value of even-length hex characters must be encoded as a CBOR byte string (draft sec. 3.1.4)");
     }
-    if (_EUI64_TEXT.test(t)) {
+    if (_isEui64Text(t)) {
       throw _err(E, "a text attribute value in EUI-64 form must be encoded as a CBOR tag-48 MAC address (draft sec. 3.1.4)");
     }
     return;
@@ -1973,7 +1994,7 @@ function _reconstructDer(r, sigNode) {
   // The signature is re-wrapped as a DER ECDSA-Sig-Value from the fixed-width r||s, so only an ECDSA
   // signature algorithm is in the type-3 reconstruction covered set (an RSA/EdDSA signature is raw bytes,
   // not r||s, so it is rejected). A wrong-length r||s surfaces the caller's typed code.
-  if (!/^ecdsa/i.test(r.signatureAlgorithm.name || "")) {
+  if (String(r.signatureAlgorithm.name || "").toLowerCase().indexOf("ecdsa") !== 0) {
     throw _err("c509/non-invertible", "type-3 signature reconstruction covers only ECDSA; got " + r.signatureAlgorithm.name);
   }
   // The fixed-width r||s must split at a real curve field width: P-256/384/521 = 64/96/132 bytes
@@ -2143,7 +2164,7 @@ function _encAlgorithm(alg, toInt, key) {
 function _encSpecialText(rdn) {
   if (rdn.eui64) return cbor.build.tag(48, cbor.build.byteString(rdn.eui64));
   var v = String(rdn.value);
-  if (v.length >= 2 && _HEX_OPTIMIZED.test(v)) return cbor.build.byteString(Buffer.from(v, "hex"));
+  if (v.length >= 2 && _isEvenHexLower(v)) return cbor.build.byteString(Buffer.from(v, "hex"));
   return cbor.build.textString(v);
 }
 // A Name -> CBOR: null (issuer only) | a bare SpecialText single utf8 commonName | an array of RDN pairs.
@@ -2293,9 +2314,15 @@ function _encodeC509Array(r) {
 // value (draft-20 sec. 3.2.3): an FF-FE-in-the-middle EUI-64 collapses to its 6-byte EUI-48, else the
 // 8-byte EUI-64 verbatim. A non-MAC commonName returns null (encoded as text). The exact inverse of
 // _macToEui64String, so the reconstruction rebuilds the identical DER commonName string.
+// The "-" characters removed from a string, by character scan (no regex replace protocol).
+function _stripHyphens(s) {
+  var out = "";
+  for (var i = 0; i < s.length; i++) { var ch = s.charAt(i); if (ch !== "-") out += ch; }
+  return out;
+}
 function _euiFromCn(value) {
-  if (!/^[0-9A-F]{2}(-[0-9A-F]{2}){7}$/.test(value)) return null;
-  var bytes = Buffer.from(value.replace(/-/g, ""), "hex");
+  if (!_isEui64Text(value)) return null;
+  var bytes = Buffer.from(_stripHyphens(value), "hex");
   if (bytes[3] === 0xff && bytes[4] === 0xfe) return Buffer.concat([bytes.subarray(0, 3), bytes.subarray(5)]);
   return bytes;
 }
@@ -2415,7 +2442,7 @@ _derToType3 = function (input, opts) {
   // (A v3 certificate with the extensions field OMITTED is fully supported: sec. 3.1.10 encodes
   // an omitted 'extensions' field as an empty CBOR array.)
   if (c.version !== 3) throw _err("c509/non-invertible", "C509 covers X.509 v3 certificates; got v" + c.version);
-  if (!/^ecdsa/i.test(c.signatureAlgorithm.name || "")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
+  if (String(c.signatureAlgorithm.name || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
   if (c.subjectPublicKeyInfo.algorithm.name !== "ecPublicKey") throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
   var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
   var curve = oid.name(curveOid);

package/lib/schema-cmc.js

@@ -685,7 +685,7 @@ function _finishBody(body, where) {
  *   d.controls.length;   // 0 -- present and empty, which is legal
  */
 function parsePkiData(input) {
-  var root = asn1.decode(Buffer.isBuffer(input) ? input : Buffer.from(input));
+  var root = asn1.decode(guard.bytes.isByteSource(input) ? guard.bytes.source(input, E, "cmc/bad-input", "the CMC DER") : Buffer.from(input));
   var body = schema.walk(PKI_DATA, root, NS).result;
   body.bytes = root.bytes;
   return _finishBody(body, "pkiData");
@@ -711,7 +711,7 @@ function parsePkiData(input) {
  *   r.statuses.length;   // 0 -- no status control means success is assumed
  */
 function parsePkiResponse(input) {
-  var root = asn1.decode(Buffer.isBuffer(input) ? input : Buffer.from(input));
+  var root = asn1.decode(guard.bytes.isByteSource(input) ? guard.bytes.source(input, E, "cmc/bad-input", "the CMC DER") : Buffer.from(input));
   var body = schema.walk(PKI_RESPONSE, root, NS).result;
   body.bytes = root.bytes;
   return _finishBody(body, "pkiResponse");
@@ -752,7 +752,7 @@ function parse(input) {
   // encapContentInfo is the field this function goes on to read, so requiring it
   // is the same question the code below already asks.
   var parsedCms = (input && typeof input === "object" && !ArrayBuffer.isView(input) &&
-    !(input instanceof ArrayBuffer) && input.encapContentInfo != null)
+    !guard.bytes.isByteSource(input) && input.encapContentInfo != null)
     ? input : cms.parse(input);
   // The CARRIER is part of the identity, not just the encapsulated content type.
   // RFC 5272 sec. 3.2 / 4.2 admit a SignedData or an AuthenticatedData; other CMS