@blamejs/pki 0.5.31 → 0.5.32

package/lib/asn1-der.js

@@ -38,6 +38,7 @@ var intrinsic = require("./guard-intrinsic");
 // The list test at each builder door decides whether a caller's argument is refused. Read at the
 // moment it runs, a replacement answering true admits a non-list and the door it guards is gone.
 var _isArray = intrinsic.isArray;
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 
 var Asn1Error = frameworkError.Asn1Error;
 var OidError = frameworkError.OidError;
@@ -626,7 +627,7 @@ function _decodeVisible(buf) {
 // PrintableString is restricted to A-Z a-z 0-9 space and ' ( ) + , - . / : = ?
 function _decodePrintable(buf) {
   var s = buf.toString("latin1");
-  if (!PRINTABLE_RE.test(s)) throw new Asn1Error("asn1/bad-printable-string", "PrintableString has characters outside the restricted set");
+  if (!isPrintableString(s)) throw new Asn1Error("asn1/bad-printable-string", "PrintableString has characters outside the restricted set");
   return s;
 }
 
@@ -644,7 +645,7 @@ function readNumericString(node) {
   _expectUniversal(node, TAGS.NUMERIC_STRING, "readNumericString");
   _expectPrimitive(node, "readNumericString");
   var s = node.content.toString("latin1");
-  if (!NUMERIC_RE.test(s)) throw new Asn1Error("asn1/bad-numeric-string", "NumericString has characters outside the digits-and-space set");
+  if (!_isNumericString(s)) throw new Asn1Error("asn1/bad-numeric-string", "NumericString has characters outside the digits-and-space set");
   return s;
 }
 
@@ -702,12 +703,54 @@ function _decodeUtf32be(buf) {
   return out;
 }
 
-var UTC_RE = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/;
-var GEN_RE = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/;
-// The X.690 sec. 11.7 DER fractional-seconds GeneralizedTime profile: seconds present,
-// a `.` decimal separator (never `,`), a non-empty fraction, Z-terminated. The
-// trailing-zeros rule (sec. 11.7.3) is enforced separately. Used by RFC 3161 genTime.
-var GEN_FRAC_RE = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})\.(\d+)Z$/;
+// Exactly `count` ASCII digits at `start`, as an integer, or null on any non-digit or short read.
+// Character-scanned so no regex match protocol -- a live, replaceable `exec` -- stands between the
+// codec and the time field it slices out.
+function _digitsToInt(s, start, count) {
+  if (start + count > s.length) return null;
+  var v = 0;
+  for (var i = 0; i < count; i++) {
+    var c = _charCodeAt(s, start + i);
+    if (c < 48 || c > 57) return null;
+    v = v * 10 + (c - 48);
+  }
+  return v;
+}
+
+// The fixed DER time layout, scanned into its components, or null on any format violation:
+// yearLen digits (2 for UTCTime YY, 4 for GeneralizedTime YYYY), then MM DD HH MM SS, then --
+// when allowFrac -- the X.690 sec. 11.7 fractional-seconds profile (a "." decimal separator, never
+// ",", and a non-empty fraction), then a terminating "Z" as the final character with nothing after.
+// `ms` is the first three fraction digits right-zero-padded (matching (frac + "000").slice(0,3));
+// `fracLastIsZero` carries the sec. 11.7.3 trailing-zero check the caller enforces.
+function _scanTimeFields(s, yearLen, allowFrac) {
+  var pos = 0;
+  var year = _digitsToInt(s, pos, yearLen); if (year === null) return null; pos += yearLen;
+  var month = _digitsToInt(s, pos, 2); if (month === null) return null; pos += 2;
+  var day = _digitsToInt(s, pos, 2); if (day === null) return null; pos += 2;
+  var hour = _digitsToInt(s, pos, 2); if (hour === null) return null; pos += 2;
+  var min = _digitsToInt(s, pos, 2); if (min === null) return null; pos += 2;
+  var sec = _digitsToInt(s, pos, 2); if (sec === null) return null; pos += 2;
+  var hasFrac = false, ms = 0, fracLastIsZero = false;
+  if (allowFrac) {
+    if (_charCodeAt(s, pos) !== 46) return null; // "."
+    pos += 1;
+    var f = [0, 0, 0], fi = 0;
+    while (pos < s.length) {
+      var c = _charCodeAt(s, pos);
+      if (c < 48 || c > 57) break;
+      if (fi < 3) f[fi] = c - 48;
+      fi += 1; pos += 1;
+    }
+    if (fi === 0) return null; // a non-empty fraction is required
+    hasFrac = true;
+    fracLastIsZero = _charCodeAt(s, pos - 1) === 48;
+    ms = f[0] * 100 + f[1] * 10 + f[2];
+  }
+  if (pos !== s.length - 1 || _charCodeAt(s, pos) !== 90) return null; // trailing "Z", nothing after
+  return { year: year, month: month, day: day, hour: hour, min: min, sec: sec,
+           hasFrac: hasFrac, ms: ms, fracLastIsZero: fracLastIsZero };
+}
 
 // readTime(node, opts?) -- opts.allowFractional enables the RFC 3161 / X.690 sec. 11.7
 // fractional-seconds GeneralizedTime profile. Fractional is OFF by default because
@@ -718,39 +761,37 @@ function readTime(node, opts) {
   if (node.tagClass !== "universal") throw new Asn1Error("asn1/expected-time", "readTime: not a universal time type");
   _expectPrimitive(node, "readTime");
   var s = node.content.toString("latin1");
-  var m, year;
+  var t, year;
   if (node.tagNumber === TAGS.UTC_TIME) {
-    m = UTC_RE.exec(s);
-    if (!m) throw new Asn1Error("asn1/bad-utctime", "UTCTime must be YYMMDDHHMMSSZ, got " + JSON.stringify(s));
-    year = parseInt(m[1], 10);
+    t = _scanTimeFields(s, 2, false);
+    if (!t) throw new Asn1Error("asn1/bad-utctime", "UTCTime must be YYMMDDHHMMSSZ, got " + JSON.stringify(s));
+    year = t.year;
     // RFC 5280 sec. 4.1.2.5.1 -- YY < 50 => 20YY, else 19YY.
     year += (year < 50) ? 2000 : 1900;
   } else if (node.tagNumber === TAGS.GENERALIZED_TIME) {
-    m = GEN_RE.exec(s);
-    if (!m) {
+    t = _scanTimeFields(s, 4, false);
+    if (!t) {
       if (!(opts && opts.allowFractional)) throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime must be YYYYMMDDHHMMSSZ, got " + JSON.stringify(s));
-      m = GEN_FRAC_RE.exec(s);
-      if (!m) throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime must be YYYYMMDDHHMMSS[.fraction]Z, got " + JSON.stringify(s));
+      t = _scanTimeFields(s, 4, true);
+      if (!t) throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime must be YYYYMMDDHHMMSS[.fraction]Z, got " + JSON.stringify(s));
       // X.690 sec. 11.7.3 -- the fractional part MUST NOT end in a zero (and is non-empty
-      // by the regex). ".5Z" is valid; ".50Z" and ".500Z" are non-canonical. X.690
+      // by the scan). ".5Z" is valid; ".50Z" and ".500Z" are non-canonical. X.690
       // sec. 11.7 places NO cap on the fraction length (RFC 3161 sec. 2.4.2 gives the 5-digit
       // example 19990609001326.34352Z), so a fraction of any length is accepted; the
       // returned Date is millisecond-precision, and a caller needing the exact fraction
       // reads it from node.content (the raw bytes, surfaced losslessly like the OID /
       // serial paths).
-      if (m[7].charAt(m[7].length - 1) === "0") throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime fraction must not have trailing zeros, got " + JSON.stringify(s));
+      if (t.fracLastIsZero) throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime fraction must not have trailing zeros, got " + JSON.stringify(s));
     }
-    year = parseInt(m[1], 10);
+    year = t.year;
   } else {
     throw new Asn1Error("asn1/expected-time", "readTime: tag " + node.tagNumber + " is not a time type");
   }
-  // The month is capture group 2 in UTC_RE, GEN_RE, and GEN_FRAC_RE alike
-  // (the groups diverge only at 1, the year, and 7, the fraction).
-  var month = parseInt(m[2], 10);
-  var day   = parseInt(m[3], 10);
-  var hour  = parseInt(m[4], 10);
-  var min   = parseInt(m[5], 10);
-  var sec   = parseInt(m[6], 10);
+  var month = t.month;
+  var day   = t.day;
+  var hour  = t.hour;
+  var min   = t.min;
+  var sec   = t.sec;
   // Build from the LITERAL year via setUTCFullYear: the Date.UTC() / new Date()
   // constructors remap a year in 0..99 to 1900..1999, which would corrupt a
   // GeneralizedTime year below 100 (0099 -> 1999). setUTCFullYear(year, ...)
@@ -758,11 +799,11 @@ function readTime(node, opts) {
   // below 100 and proleptic leap years are handled correctly.
   // A fractional GeneralizedTime carries sub-second precision; surface it on the
   // Date at millisecond resolution (the first three fraction digits, zero-padded).
-  var ms = (node.tagNumber === TAGS.GENERALIZED_TIME && m[7]) ? parseInt((m[7] + "000").slice(0, 3), 10) : 0;
+  var ms = (node.tagNumber === TAGS.GENERALIZED_TIME && t.hasFrac) ? t.ms : 0;
   var d = new Date(0);
   d.setUTCFullYear(year, month - 1, day);
   d.setUTCHours(hour, min, sec, ms);
-  // Coverage residual -- regex-validated fields are finite integers and Date rolls over (never NaN); out-of-range is caught by the component round-trip check below.
+  // Coverage residual -- scan-validated fields are finite integers and Date rolls over (never NaN); out-of-range is caught by the component round-trip check below.
   if (isNaN(guard.time.instantOf(d))) throw new Asn1Error("asn1/bad-time", "unparseable time " + JSON.stringify(s));
   // Date/setUTC* silently roll over out-of-range fields (Feb 30 -> Mar 2,
   // month 13 -> next Jan, hour 25 -> +1 day). Reject unless every component
@@ -895,8 +936,26 @@ function encodeOidContent(dotted) {
   return Buffer.from(out);
 }
 
-var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
-var NUMERIC_RE = /^[0-9 ]*$/;
+// PrintableString (X.680): A-Z a-z 0-9 space and ' ( ) + , - . / : = ? -- checked by character scan (no
+// regex). NumericString: digits and space only.
+function _isPrintableChar(c) {
+  if ((c >= 65 && c <= 90) || (c >= 97 && c <= 122) || (c >= 48 && c <= 57)) return true;   // A-Z a-z 0-9
+  switch (c) {
+    case 32: case 39: case 40: case 41: case 43: case 44: case 45: case 46: case 47:        // space ' ( ) + , - . /
+    case 58: case 61: case 63:                                                              // : = ?
+      return true;
+    default: return false;
+  }
+}
+function isPrintableString(s) {
+  if (typeof s !== "string") return false;
+  for (var i = 0; i < s.length; i += 1) if (!_isPrintableChar(_charCodeAt(s, i))) return false;
+  return true;
+}
+function _isNumericString(s) {
+  for (var i = 0, c; i < s.length; i += 1) { c = _charCodeAt(s, i); if (!((c >= 48 && c <= 57) || c === 32)) return false; }
+  return true;
+}
 
 function _fmtTwo(n) { return (n < 10 ? "0" : "") + n; }
 
@@ -989,13 +1048,13 @@ var build = {
     // would silently pass a non-IA5 character through as a different one.
     s = String(s);
     for (var i = 0; i < s.length; i++) {
-      if (s.charCodeAt(i) > 0x7F) throw new Asn1Error("asn1/bad-ia5-string", "IA5String requires 7-bit ASCII");
+      if (_charCodeAt(s, i) > 0x7F) throw new Asn1Error("asn1/bad-ia5-string", "IA5String requires 7-bit ASCII");
     }
     return _universal(TAGS.IA5_STRING, false, Buffer.from(s, "latin1"));
   },
   printable: function (s) {
     s = String(s);
-    if (!PRINTABLE_RE.test(s)) throw new Asn1Error("asn1/bad-printable-string", "value has characters outside the PrintableString set");
+    if (!isPrintableString(s)) throw new Asn1Error("asn1/bad-printable-string", "value has characters outside the PrintableString set");
     return _universal(TAGS.PRINTABLE_STRING, false, Buffer.from(s, "latin1"));
   },
   bmpString: function (s) {
@@ -1005,7 +1064,7 @@ var build = {
     s = String(s);
     var out = Buffer.alloc(s.length * 2);
     for (var i = 0; i < s.length; i++) {
-      var u = s.charCodeAt(i);
+      var u = _charCodeAt(s, i);
       if (u >= 0xD800 && u <= 0xDFFF) throw new Asn1Error("asn1/bad-bmp-string", "BMPString cannot encode a surrogate code point (non-BMP characters are unsupported)");
       out[i * 2] = (u >> 8) & 0xFF;
       out[i * 2 + 1] = u & 0xFF;
@@ -1074,6 +1133,7 @@ function _asBufferArray(arr, who) {
 module.exports = {
   TAGS:          TAGS,
   decode:        decode,
+  isPrintableString: isPrintableString,
   // `encode` is the documented public name for the low-level TLV encoder;
   // `encodeTLV` remains as the descriptive alias.
   encode:        encodeTLV,

package/lib/cmc-build.js

@@ -369,12 +369,12 @@ function _assertNoDuplicateBinding(callerControls, spec) {
 function _asBigInt(v, what) { return guard.range.authoredInteger(v, E, "cmc/bad-input", what); }
 
 function _der(v, what) {
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmcError, "cmc/bad-input", what);
+  if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, CmcError, "cmc/bad-input", what);
   throw E("cmc/bad-input", what + " must be DER bytes");
 }
 function _oidOf(v) {
   if (typeof v !== "string") throw E("cmc/bad-input", "an OID must be a name or a dotted string");
-  return /^\d+(\.\d+)+$/.test(v) ? v : O(v);
+  return oid.isDottedDecimal(v) ? v : O(v);
 }
 
 // ---- controls --------------------------------------------------------
@@ -725,13 +725,24 @@ function _copySigners(signer, owned) {
   // replace or zeroize while cms.sign reads them in a later turn. A CryptoKey is
   // an opaque handle and is passed through as-is.
   function copyValue(v, isSecret) {
-    if (Buffer.isBuffer(v) || v instanceof Uint8Array) return _own(Buffer.from(v), isSecret);
+    if (!isSecret) {
+      // A public signer field (cert / spki / keyIdentifier DER): any BufferSource is
+      // snapshotted to a private Buffer so a caller cannot mutate it in a later turn;
+      // an ArrayBuffer or DataView is accepted, not silently turned into an empty object.
+      // A non-byte descriptor or scalar (a parsed certificate, a CryptoKey handle) passes
+      // through untouched.
+      if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, CmcError, "cmc/bad-input", "a signer field");
+      return v;
+    }
+    // The private key stays on the ownership contract: a Buffer is copied, a Uint8Array is
+    // copied, and every copy is collected so it can be zeroized once signing settles.
+    if (Buffer.isBuffer(v) || v instanceof Uint8Array) return _own(Buffer.from(v), true);   // allow:byte-source-narrow -- private key bytes (Buffer borrowed / Uint8Array copied+wiped)
     if (!v || typeof v !== "object" || typeof v.type === "string") return v;   // CryptoKey / scalar
     var c = {}, ck;
     for (ck in v) {
       if (!_hasOwn(v, ck)) continue;
       var cv = v[ck];
-      c[ck] = (Buffer.isBuffer(cv) || cv instanceof Uint8Array) ? _own(Buffer.from(cv), isSecret) : cv;
+      c[ck] = (Buffer.isBuffer(cv) || cv instanceof Uint8Array) ? _own(Buffer.from(cv), true) : cv;   // allow:byte-source-narrow -- composite key component
     }
     return c;
   }
@@ -787,15 +798,15 @@ function _assertKeyOnlySigner(signer, requests) {
 // The sec. 3.2a/3.2c binding for a single key-only signer.
 function _assertKeyOnlySignerBinding(so, requests) {
   var id = so.keyIdentifier;
-  var idBytes = (Buffer.isBuffer(id) || id instanceof Uint8Array) ? Buffer.from(id) : null;
-  if (!idBytes) {
+  if (!guard.bytes.isByteSource(id)) {
     throw E("cmc/bad-signer",
       "a key-only signer must name the Subject Key Identifier its certification request declares (RFC 5272 sec. 3.2)");
   }
-  var signerSpki = (Buffer.isBuffer(so.spki) || so.spki instanceof Uint8Array) ? Buffer.from(so.spki) : null;
-  if (!signerSpki) {
+  var idBytes = guard.bytes.snapshotSource(id, CmcError, "cmc/bad-input", "the signer's keyIdentifier");
+  if (!guard.bytes.isByteSource(so.spki)) {
     throw E("cmc/bad-signer", "a key-only signer must carry its spki as DER bytes (RFC 5272 sec. 3.2)");
   }
+  var signerSpki = guard.bytes.snapshotSource(so.spki, CmcError, "cmc/bad-input", "the signer's spki");
   var declaredSki = false, sawRequest = false;
   for (var i = 0; i < requests.length; i++) {
     var req = requests[i];

package/lib/cmc-verify.js

@@ -126,7 +126,7 @@ function _assertBound(body, sent) {
   function _carries(v) {
     if (v == null) return false;
     if (typeof v === "string") return v.length > 0;
-    if (Buffer.isBuffer(v) || v instanceof Uint8Array) return v.length > 0;
+    if (Buffer.isBuffer(v) || v instanceof Uint8Array) return v.length > 0;   // allow:byte-source-narrow -- sent.senderNonce / dataReturn are already normalized to a Buffer by _snapshotSent; this is a length test on a settled value, not an input door
     return true;   // an integer or other scalar identifier is its own value
   }
   var bound = {
@@ -405,7 +405,7 @@ function _snapshotIfBytes(input) {
   // BufferSource, so an ArrayBuffer or a DataView reaches the decoder too -- and
   // leaving those aliased would reopen the window for exactly the inputs that came
   // in by the wider door.
-  if (ArrayBuffer.isView(input) || input instanceof ArrayBuffer) {
+  if (guard.bytes.isByteSource(input)) {
     return guard.bytes.snapshotSource(input, CmcError, "cmc/bad-input", "pki.cmc.verify");
   }
   return input;
@@ -516,8 +516,8 @@ function _assertAuthentic(body, sent, responseBytes) {
     // the signers and the certificate bag in the gap would get one message's
     // verdict reported beside another message's verified signature. There are no
     // bytes to pin, so the honest answer is that nothing was authenticated.
-    var haveBytes = Buffer.isBuffer(responseBytes) || responseBytes instanceof Uint8Array ||
-      typeof responseBytes === "string";
+    var haveBytes = typeof responseBytes === "string" ||
+      Buffer.isBuffer(responseBytes) || responseBytes instanceof Uint8Array;   // allow:byte-source-narrow -- responseBytes is _snapshotIfBytes's return: any BufferSource is already a Buffer here, so this is Buffer-or-string by construction
     // The two accepted carriers are authenticated DIFFERENTLY, so the rule has to
     // be written for both: a SignedData by its SignerInfo signatures, an
     // AuthenticatedData by a MAC over a key this layer never holds. Checking only

package/lib/cmp-build.js

@@ -44,6 +44,10 @@ var _hasOwn = intrinsic.hasOwn;
 // message: each decides what reaches the wire, so a replaced built-in must not get a say.
 var _isArray = intrinsic.isArray;
 var _isBuffer = intrinsic.isBuffer;
+var _charAt = intrinsic.uncurry(String.prototype.charAt);
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _strIndexOf = intrinsic.uncurry(String.prototype.indexOf);
 var _bufferConcat = intrinsic.bufferConcat;
 var _map = intrinsic.map;
 var _keys = intrinsic.keys;
@@ -892,7 +896,7 @@ var KNOWN_TRANSFER_OPTS = { transport: 1, tls: 1, headers: 1, timeout: 1, maxRes
 // view reads as zero-length) as cmp/bad-input rather than silently POSTing an empty body in its place.
 function _cmpMessageDer(input) {
   var der;
-  if (Buffer.isBuffer(input) || input instanceof Uint8Array) der = guard.bytes.view(input, CmpError, "cmp/bad-input", "the CMP message DER");
+  if (guard.bytes.isByteSource(input)) der = guard.bytes.source(input, CmpError, "cmp/bad-input", "the CMP message DER");
   else if (typeof input === "string") {
     // Normalize a PEM decode failure (no block, wrong armor label, malformed base64) to the stable
     // cmp/bad-input at this input boundary, rather than leaking the PEM layer's PemError to the caller.
@@ -991,8 +995,8 @@ function _transfer(url, message, opts) {
     // from an injected transport) is re-viewed through the byte guard, as the request path does; only a
     // genuine string body falls back to a UTF-8 encode (the width a real socket already counts) so the size
     // cap and the parser see the same bytes -- a typed array is not stringified to "48,130,..." garbage.
-    var body = (Buffer.isBuffer(res.body) || res.body instanceof Uint8Array)
-      ? guard.bytes.view(res.body, CmpError, "cmp/bad-response", "the CMP response body")
+    var body = guard.bytes.isByteSource(res.body)
+      ? guard.bytes.source(res.body, CmpError, "cmp/bad-response", "the CMP response body")
       : Buffer.from(String(res.body == null ? "" : res.body), "utf8");
     if (body.length > maxResponseBytes) throw _err("cmp/response-too-large", "the response body (" + body.length + " bytes) exceeds the " + maxResponseBytes + "-byte cap");
     return _classifyCmpResponse(res.status, h, body, res.tls || null);
@@ -1001,9 +1005,17 @@ function _transfer(url, message, opts) {
 
 // A single safe path segment for a well-known URI: no separator, dot-segment, or reserved/space char that
 // would retarget the resource; percent-encoded on the way out. Fails closed (guards never guess a value).
+// /[/?#\s\\]/ : does `s` contain a path separator, query/fragment marker, whitespace, or a backslash?
+function _hasUnsafeSegChar(s) {
+  for (var i = 0; i < s.length; i++) {
+    var c = _charCodeAt(s, i);
+    if (c === 0x2f || c === 0x3f || c === 0x23 || c === 0x5c || pkix.isJsWhitespace(c)) return true;
+  }
+  return false;
+}
 function _wellKnownSeg(v, name) {
   var s = String(v);
-  if (s === "" || s === "." || s === ".." || /[/?#\s\\]/.test(s)) throw _err("cmp/bad-url", "the CMP " + name + " must be a single safe path segment (no '/', dot-segment, or reserved char): " + JSON.stringify(s));
+  if (s === "" || s === "." || s === ".." || _hasUnsafeSegChar(s)) throw _err("cmp/bad-url", "the CMP " + name + " must be a single safe path segment (no '/', dot-segment, or reserved char): " + JSON.stringify(s));
   // encodeURIComponent throws a raw URIError (no .code) on an unpaired UTF-16 surrogate; normalize it to the
   // helper's cmp/bad-url contract so a malformed-config segment never escapes as an untyped error.
   try { return encodeURIComponent(s); }
@@ -1012,6 +1024,24 @@ function _wellKnownSeg(v, name) {
 
 var KNOWN_WELLKNOWN_OPTS = { label: 1, operation: 1 };
 
+// ---- URL raw-path helpers by character scan (no regex) --------------------------------------------
+function _isAsciiLetter(ch) { return (ch >= "A" && ch <= "Z") || (ch >= "a" && ch <= "z"); }
+// The "scheme://authority" prefix removed (matching /^[a-z]+:\/\/[^/?#]*/i: a leading letter run,
+// "://", then a run of characters other than "/", "?" or "#"), else the string unchanged.
+function _stripSchemeAuthority(s) {
+  var p = 0, n = s.length;
+  while (p < n && _isAsciiLetter(_charAt(s, p))) p += 1;
+  if (p === 0 || _strSlice(s, p, p + 3) !== "://") return s;
+  p += 3;
+  while (p < n) { var ch = _charAt(s, p); if (ch === "/" || ch === "?" || ch === "#") break; p += 1; }
+  return _strSlice(s, p);
+}
+// Everything before the first "?" or "#" (matching split(/[?#]/)[0]).
+function _beforeQueryOrFragment(s) {
+  for (var i = 0; i < s.length; i++) { var ch = _charAt(s, i); if (ch === "?" || ch === "#") return _strSlice(s, 0, i); }
+  return s;
+}
+
 function wellKnownUrl(base, opts) {
   opts = opts || {};
   // Reject an unknown option key (a typo like { lable } / { operaton }), as build/transfer do -- a silently
@@ -1030,13 +1060,13 @@ function wellKnownUrl(base, opts) {
   // A backslash has no place in an http(s) authority: WHATWG rewrites it to a path separator (so
   // `https://ca.example\tenant` is really the path `/tenant`), but the raw-path regex below excludes only
   // `/?#` and would swallow it as authority, slipping a supplied path past the check. Reject it outright.
-  if (/\\/.test(String(base))) throw _err("cmp/bad-url", "the CMP base URL must not contain a backslash (WHATWG rewrites it to a path separator): " + JSON.stringify(String(base)));
+  if (_strIndexOf(String(base), "\\") !== -1) throw _err("cmp/bad-url", "the CMP base URL must not contain a backslash (WHATWG rewrites it to a path separator): " + JSON.stringify(String(base)));
   // An RFC 8615 well-known URI is AUTHORITY-ROOTED (/.well-known/...), so a base carrying ANY path is
   // rejected fail-closed -- an operator whose CMP endpoint sits under a path passes that full operation URL
   // to transfer() directly. Inspect the RAW path in the source string, NOT url.pathname: WHATWG normalizes
   // dot-segments (`/tenant/..`, `/%2e`) to "/" before the parse, which would slip a supplied path past a
   // pathname check and silently target the authority-root profile instead of reporting the misconfiguration.
-  var rawBasePath = String(base).replace(/^[a-z]+:\/\/[^/?#]*/i, "").split(/[?#]/)[0];
+  var rawBasePath = _beforeQueryOrFragment(_stripSchemeAuthority(String(base)));
   if (rawBasePath !== "" && rawBasePath !== "/") throw _err("cmp/bad-url", "an RFC 8615 well-known URI is authority-rooted; the CMP base URL must have no path component (pass a full operation URL to transfer instead): " + JSON.stringify(String(base)));
   var segs = [".well-known", "cmp"];
   if (opts.label != null) { segs.push("p"); segs.push(_wellKnownSeg(opts.label, "label")); }

package/lib/cmp-session.js

@@ -538,12 +538,12 @@ function session(opts) {
         // return value as its contract -- using it as a predicate throws that contract away.
         _expectedSenderCert = (_engine && _engine.coerceCert) ? _engine.coerceCert(_es) : _es;
       }
-      else if (Buffer.isBuffer(_es) || _es instanceof Uint8Array) { _expectedSenderDer = Buffer.from(_es); _expectedSenderCert = x509.parse(_expectedSenderDer); }
+      else if (guard.bytes.isByteSource(_es)) { _expectedSenderDer = guard.bytes.snapshotSource(_es, CmpError, "cmp/bad-input", "opts.expectedSender"); _expectedSenderCert = x509.parse(_expectedSenderDer); }
       else if (typeof _es === "string") { _expectedSenderDer = x509.pemDecode(_es); _expectedSenderCert = x509.parse(_expectedSenderDer); }
-      else { throw _err("cmp/bad-input", "opts.expectedSender must be a certificate DER Buffer / PEM string / parsed certificate"); }
+      else { throw _err("cmp/bad-input", "opts.expectedSender must be a certificate DER BufferSource / PEM string / parsed certificate"); }
     } catch (e) {
       if (e.isCmpError) throw e;
-      throw _err("cmp/bad-input", "opts.expectedSender must be the CA signer certificate (DER Buffer / PEM / parsed) so every signed response can be bound to it -- " + ((e && e.message) || e), e);
+      throw _err("cmp/bad-input", "opts.expectedSender must be the CA signer certificate (DER BufferSource / PEM / parsed) so every signed response can be bound to it -- " + ((e && e.message) || e), e);
     }
   }
   // Reject a DISTINCT intermediate pool exceeding the per-flavor cap (the candidate ceiling MINUS the room reserved
@@ -1095,7 +1095,7 @@ function session(opts) {
   // build path validates the key separately) or the CSR is unparseable (which fails at the build boundary).
   function _extractRequestedSpki(arm, armSpec) {
     if (arm === "p10cr") {
-      if (!Buffer.isBuffer(armSpec) && !(armSpec instanceof Uint8Array)) return null;
+      if (!guard.bytes.isByteSource(armSpec)) return null;
       try { return csr.parse(armSpec).subjectPublicKeyInfo.bytes; }
       catch (_e) { /* allow:swallow-unverified an unparseable p10cr CSR fails closed at the cmp.build boundary; the key-match is simply not applied to a request that never sends */ return null; }
     }
@@ -1103,7 +1103,7 @@ function session(opts) {
     // SNAPSHOT: this is held in session state across the transport round trip and then compared
     // against the issued certificate's key, so an alias would let the caller rewrite the key the
     // response is checked against after the request went out.
-    if (Buffer.isBuffer(pk) || pk instanceof Uint8Array) return guard.bytes.snapshot(pk, CmpError, "cmp/bad-input", "the certTemplate publicKey");
+    if (guard.bytes.isByteSource(pk)) return guard.bytes.snapshotSource(pk, CmpError, "cmp/bad-input", "the certTemplate publicKey");
     return null;
   }
 

package/lib/cmp-verify.js

@@ -63,9 +63,6 @@ var _isFinite = intrinsic.isFinite;
 // comparing is no longer the one the certificate carries.
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _strLastIndexOf = intrinsic.uncurry(String.prototype.lastIndexOf);
-var _strSearch = intrinsic.uncurry(String.prototype.search);
-var _reTest = intrinsic.uncurry(RegExp.prototype.test);
-var _reExec = intrinsic.uncurry(RegExp.prototype.exec);
 var _isArray = Array.isArray;
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
@@ -181,8 +178,8 @@ function _coerce(message) {
   // buffer. (A PEM string is immutable and base64-decodes into fresh bytes, so it needs no copy.)
   // The slot, not the prototype: this decides whether the message is privately copied before it is
   // parsed, and `instanceof` consults `Uint8Array[Symbol.hasInstance]` at call time.
-  if (_isBuffer(message) || util.types.isUint8Array(message)) return cmp.parse(_bufferFrom(message));
-  return cmp.parse(message);   // a PEM CMP string (throws cmp/* on malformed input)
+  if (guard.bytes.isByteSource(message)) return cmp.parse(guard.bytes.snapshotSource(message, CmpError, "cmp/bad-input", "the CMP message"));
+  return cmp.parse(message);   // a PEM CMP string (immutable; base64-decodes into fresh bytes, so it needs no copy; throws cmp/* on malformed input)
 }
 
 // Rebuild the PKIMessage DER from a parsed object's raw slices: SEQUENCE { header, body, protection [0]
@@ -200,11 +197,12 @@ function _reassemble(m) {
   return b.sequence(kids);
 }
 
-// A certificate DER from a Buffer/Uint8Array (detached-view-safe) or a PEM string.
+// A certificate DER from any BufferSource (Buffer / typed array / DataView / ArrayBuffer,
+// detached-view-safe) or a PEM string.
 function _certDer(cert, what) {
-  if (_isBuffer(cert) || util.types.isUint8Array(cert)) return guard.bytes.view(cert, CmpError, "cmp/bad-input", what);
+  if (guard.bytes.isByteSource(cert)) return guard.bytes.source(cert, CmpError, "cmp/bad-input", what);
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("cmp/bad-input", what + " PEM could not be decoded", e); } }
-  throw _err("cmp/bad-input", what + " must be a certificate DER Buffer/Uint8Array or PEM string");
+  throw _err("cmp/bad-input", what + " must be a certificate DER BufferSource or PEM string");
 }
 
 // The subjectKeyIdentifier extension value of a parsed certificate, or null when absent/undecodable.
@@ -320,7 +318,7 @@ function _mailboxSplit(s) {
   // An unquoted (Dot-string) Local-part is atext atoms joined by single dots (RFC 5321 sec. 4.1.2): every
   // character must be an atext octet or a "." with no empty atom / leading-trailing dot. A malformed atom
   // character (e.g. a space in "user name") makes the whole address malformed -> byte-exact comparison.
-  if (_charAt(s, 0) !== "\"" && (local.length === 0 || _charAt(local, 0) === "." || _charAt(local, local.length - 1) === "." || _strIndexOf(local, "..") !== -1 || !_reTest(/^[A-Za-z0-9!#$%&'*+/=?^_`{|}~.-]+$/, local))) return -1;
+  if (_charAt(s, 0) !== "\"" && (local.length === 0 || _charAt(local, 0) === "." || _charAt(local, local.length - 1) === "." || _strIndexOf(local, "..") !== -1 || !_isEmailLocalPart(local))) return -1;
   return sep;
 }
 
@@ -343,6 +341,78 @@ function _rfc822Equal(a, b) {
 // about which characters case-fold.
 var _lowerAsciiDomain = guard.name.lowerAscii;
 
+// ---- URI / email grammar predicates by character scan (no regex) ----------------------------------
+// The non-alphanumeric members of the RFC 5321 atext set and the RFC 3986 URI character set (the
+// A-Za-z0-9 range is checked directly), so charset membership is an indexOf rather than a live regex
+// match protocol.
+var _EMAIL_LOCAL_SPECIALS = "!#$%&'*+/=?^_`{|}~.-";
+var _URI_SPECIALS = "._~:/?#@!$&'()*+,;=%[]-";
+function _isAsciiAlnum(ch) { return (ch >= "A" && ch <= "Z") || (ch >= "a" && ch <= "z") || (ch >= "0" && ch <= "9"); }
+function _isHexDigit(ch) { return (ch >= "0" && ch <= "9") || (ch >= "A" && ch <= "F") || (ch >= "a" && ch <= "f"); }
+
+// A non-empty RFC 5321 Dot-string atext run (matching /^[A-Za-z0-9!#$%&'*+/=?^_`{|}~.-]+$/).
+function _isEmailLocalPart(s) {
+  if (s.length === 0) return false;
+  for (var i = 0; i < s.length; i++) {
+    var ch = _charAt(s, i);
+    if (!(_isAsciiAlnum(ch) || _strIndexOf(_EMAIL_LOCAL_SPECIALS, ch) !== -1)) return false;
+  }
+  return true;
+}
+
+// Every character an RFC 3986 URI character (matching /^[A-Za-z0-9._~:/?#@!$&'()*+,;=%[\]-]*$/; empty is valid).
+function _isAllUriChars(s) {
+  for (var i = 0; i < s.length; i++) {
+    var ch = _charAt(s, i);
+    if (!(_isAsciiAlnum(ch) || _strIndexOf(_URI_SPECIALS, ch) !== -1)) return false;
+  }
+  return true;
+}
+
+// A "%" not introducing a valid %HH pct-encoding (matching /%(?![0-9A-Fa-f]{2})/): true when malformed.
+function _hasInvalidPercent(u) {
+  for (var i = 0; i < u.length; i++) {
+    if (_charAt(u, i) === "%" && !(_isHexDigit(_charAt(u, i + 1)) && _isHexDigit(_charAt(u, i + 2)))) return true;
+  }
+  return false;
+}
+
+// A scheme + rest split (matching /^([a-zA-Z][a-zA-Z0-9+.-]*):(.*)$/): a leading letter, then
+// [a-zA-Z0-9+.-]*, then ":"; returns { scheme, rest } or null. The URI charset gate runs first, so `u`
+// carries no CR/LF here and the [^\n] semantics of "." never apply.
+function _splitScheme(u) {
+  if (u.length === 0) return null;
+  var first = _charAt(u, 0);
+  if (!((first >= "A" && first <= "Z") || (first >= "a" && first <= "z"))) return null;
+  var p = 1;
+  while (p < u.length) {
+    var ch = _charAt(u, p);
+    if (!(_isAsciiAlnum(ch) || ch === "+" || ch === "." || ch === "-")) break;
+    p += 1;
+  }
+  if (_charAt(u, p) !== ":") return null;
+  return { scheme: _strSlice(u, 0, p), rest: _strSlice(u, p + 1) };
+}
+
+// The index of the first "/", "?" or "#" (the authority terminator), or -1 (matching search(/[/?#]/)).
+function _firstAuthorityDelim(s) {
+  for (var i = 0; i < s.length; i++) {
+    var ch = _charAt(s, i);
+    if (ch === "/" || ch === "?" || ch === "#") return i;
+  }
+  return -1;
+}
+
+// A ":" followed by zero-or-more digits, whole string (matching /^:[0-9]*$/).
+function _isColonPort(s) {
+  if (s.length === 0 || _charAt(s, 0) !== ":") return false;
+  for (var i = 1; i < s.length; i++) {
+    var ch = _charAt(s, i);
+    if (!(ch >= "0" && ch <= "9")) return false;
+  }
+  return true;
+}
+
 // RFC 5280 sec. 4.2.1.6 / RFC 3986 sec. 6.2.2.1 URI comparison: the scheme and the authority host are
 // case-insensitive; every other component (userinfo, port, path, query, fragment) is byte-exact. Return
 // null for anything that is not a well-formed absolute URI so the caller falls back to exact-DER (fail-closed
@@ -351,17 +421,17 @@ function _normalizeUri(u) {
   // RFC 3986 syntax: every character must be a URI character and every "%" must introduce a valid pct-encoding
   // (%HH). A URI with an out-of-charset byte or a malformed percent-escape ("%zz") in any component (path,
   // query, fragment, userinfo) is not normalized; return null so it is compared byte-exact.
-  if (!_reTest(/^[A-Za-z0-9._~:/?#@!$&'()*+,;=%[\]-]*$/, u) || _reTest(/%(?![0-9A-Fa-f]{2})/, u)) return null;
-  var m = _reExec(/^([a-zA-Z][a-zA-Z0-9+.-]*):(.*)$/, u);   // scheme ":" rest (RFC 3986 sec. 3.1)
+  if (!_isAllUriChars(u) || _hasInvalidPercent(u)) return null;
+  var m = _splitScheme(u);   // scheme ":" rest (RFC 3986 sec. 3.1)
   if (!m) return null;
-  var scheme = _toLowerCase(m[1]);
-  var rest = m[2];
+  var scheme = _toLowerCase(m.scheme);
+  var rest = m.rest;
   // A URI SAN identity is host-based (RFC 5280 sec. 4.2.1.6): an authority-free URI (no "//", e.g. a URN) has
   // no host to anchor the comparison, so compare it byte-exact and never case-fold its scheme; the shared
   // GeneralName parser only enforces printable IA5, not a present authority.
   if (_strSlice(rest, 0, 2) !== "//") return null;
   var body = _strSlice(rest, 2);
-  var cut = _strSearch(body, /[/?#]/);   // authority ends at the first "/", "?" or "#" (RFC 3986 sec. 3.2)
+  var cut = _firstAuthorityDelim(body);   // authority ends at the first "/", "?" or "#" (RFC 3986 sec. 3.2)
   var split = cut < 0 ? body.length : cut;
   var authority = _strSlice(body, 0, split), tail = _strSlice(body, split);   // tail: path/query/fragment -- exact
   // A raw "@" is not permitted inside userinfo (RFC 3986 sec. 3.2.1); more than one "@" is a MALFORMED
@@ -385,7 +455,7 @@ function _normalizeUri(u) {
   // The port must be numeric (RFC 3986 sec. 3.2.3 port = *DIGIT). A non-numeric port is a malformed authority:
   // return null so the caller compares the raw values exactly and never case-folds the host of an input the
   // normalizer cannot confidently parse (which would bind two byte-distinct malformed authorities).
-  if (port !== "" && !_reTest(/^:[0-9]*$/, port)) return null;
+  if (port !== "" && !_isColonPort(port)) return null;
   // The authority host must be a well-formed FQDN or IP literal (RFC 5280 sec. 4.2.1.6 requires a URI SAN
   // authority to carry an FQDN/IP host): an empty, malformed ("Victim..COM"), or bad IPv6-literal host is
   // compared byte-exact and never case-folded, since the GeneralName parser only enforces printable IA5.
@@ -742,7 +812,7 @@ function _certList(v) {
   var out = [];
   for (var i = 0, n = arr.length; i < n; i++) {
     var c = arr[i];
-    _append(out, (_isBuffer(c) || util.types.isUint8Array(c) || typeof c === "string")
+    _append(out, (guard.bytes.isByteSource(c) || typeof c === "string")
       ? _certDer(c, "a trust anchor / intermediate") : c);
   }
   return out;

package/lib/cms-compress.js

@@ -37,7 +37,7 @@ var NULL_PARAMS_DER = Buffer.from([0x05, 0x00]);
 // (default id-data), eContent = the RFC 1950 ZLIB stream }.
 async function compress(content, opts) {
   opts = opts || {};
-  var raw = guard.bytes.view(content, CmsError, "cms/bad-input", "content");
+  var raw = guard.bytes.source(content, CmsError, "cms/bad-input", "content");
   var level = opts.level;
   if (level !== undefined && (typeof level !== "number" || !isFinite(level) || Math.floor(level) !== level)) throw _err("cms/bad-input", "opts.level must be an integer");
   var ctName = opts.contentType || "data";
@@ -86,7 +86,7 @@ async function decompress(input, opts) {
 }
 
 function _toDer(input) {
-  if (Buffer.isBuffer(input) || input instanceof Uint8Array) return guard.bytes.snapshot(input, CmsError, "cms/bad-input", "input");
+  if (guard.bytes.isByteSource(input)) return guard.bytes.snapshotSource(input, CmsError, "cms/bad-input", "input");
   if (typeof input === "string") { try { return schemaCms.pemDecode(input); } catch (e) { throw _err("cms/bad-input", "the CMS PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
 }