@blamejs/pki 0.5.31 → 0.5.32

package/lib/ocsp.js

@@ -84,7 +84,7 @@ function _responseFromBytes(response) {
 }
 
 function _toDer(input, what) {
-  if (Buffer.isBuffer(input) || input instanceof Uint8Array) return guard.bytes.snapshot(input, OcspError, "ocsp/bad-input", what || "input");
+  if (guard.bytes.isByteSource(input)) return guard.bytes.snapshotSource(input, OcspError, "ocsp/bad-input", what || "input");
   if (typeof input === "string") { try { return ocspSchema.pemDecode(input); } catch (e) { throw _err("ocsp/bad-input", (what || "input") + " PEM could not be decoded", e); } }
   throw _err("ocsp/bad-input", (what || "input") + " must be a DER Buffer, Uint8Array, or PEM string");
 }
@@ -221,16 +221,16 @@ function _buildRequest(query, opts) {
 }
 function _emitReq(der, opts) { return opts.pem ? ocspSchema.pemEncode(der, "OCSP REQUEST") : der; }
 function _nameDer(name) {
-  if (Buffer.isBuffer(name)) return guard.bytes.snapshot(name, OcspError, "ocsp/bad-input", "requestorName");
+  if (guard.bytes.isByteSource(name)) return guard.bytes.snapshotSource(name, OcspError, "ocsp/bad-input", "requestorName");
   if (name && name.bytes) return name.bytes;   // a parsed Name
-  throw _err("ocsp/bad-input", "requestorName must be a DER Name Buffer or a parsed Name");
+  throw _err("ocsp/bad-input", "requestorName must be a DER Name BufferSource or a parsed Name");
 }
 // The RAW DER of a certificate that will be embedded verbatim (the responder cert in a
 // BasicOCSPResponse, the signer cert in a signed OCSPRequest). It must be supplied as bytes:
 // a parsed certificate does not retain its full DER encoding, and re-encoding it would risk
 // byte drift from the signed original, so a parsed cert is rejected rather than reconstructed.
 function _normCertDer(cert, what) {
-  if (Buffer.isBuffer(cert) || cert instanceof Uint8Array) return guard.bytes.snapshot(cert, OcspError, "ocsp/bad-input", what || "a certificate");
+  if (guard.bytes.isByteSource(cert)) return guard.bytes.snapshotSource(cert, OcspError, "ocsp/bad-input", what || "a certificate");
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("ocsp/bad-input", (what || "a certificate") + " PEM could not be decoded", e); } }
   if (cert && cert.tbsBytes && cert.subjectPublicKeyInfo) {
     throw _err("ocsp/bad-input", (what || "a certificate") + " to embed must be supplied as DER bytes or a PEM string, not a parsed certificate (the parser does not retain the full DER encoding needed to embed it verbatim)");
@@ -378,7 +378,7 @@ function _asDate(d) {
 // the aliasing window is wiped rather than left to the garbage collector. Only our own
 // allocations are listed: the caller's key is never written to.
 function _snapshotSignerKey(key, owned) {
-  if (Buffer.isBuffer(key) || key instanceof Uint8Array) {
+  if (Buffer.isBuffer(key) || key instanceof Uint8Array) {   // allow:byte-source-narrow -- responder private key on the key-ownership contract (Buffer / Uint8Array / PEM / CryptoKey); widening keys is a separate root decision
     var copy = guard.bytes.snapshot(key, OcspError, "ocsp/bad-input", "the responder key");
     owned.push(copy);
     return copy;
@@ -550,8 +550,8 @@ function verify(response, opts) {
     // A client that sent a nonce binds it (RFC 9654 / RFC 5019 sec. 4): a missing or mismatched
     // response nonce fails the verdict closed, even if the status/signature were otherwise good.
     var respNonce = _responseNonce(parsed);
-    var reqNonce = (Buffer.isBuffer(opts.requestNonce) || opts.requestNonce instanceof Uint8Array)
-      ? guard.bytes.snapshot(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
+    var reqNonce = guard.bytes.isByteSource(opts.requestNonce)
+      ? guard.bytes.snapshotSource(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
     var matched = respNonce != null && reqNonce != null && guard.crypto.constantTimeEqual(respNonce, reqNonce);
     var out = Object.assign({}, verdict, { nonceMatched: matched });
     // The downgrade applies to `good` ONLY. `unknown` is the closed direction for a

package/lib/oid.js

@@ -652,6 +652,21 @@ function byName(n) {
   return _byName.get(n);
 }
 
+// Does `s` look like a dotted-decimal OID -- one or more digit groups joined by single dots (at least two
+// groups, no leading/trailing/doubled dot)? Distinguishes a numeric OID from a symbolic name so a caller may
+// pass either. Decided by character scan (no regex); the arc-value bounds are the encoder's authority.
+function isDottedDecimal(s) {
+  if (typeof s !== "string" || s.length === 0) return false;
+  var i, c, sawDot = false, atomEmpty = true;
+  for (i = 0; i < s.length; i += 1) {
+    c = s.charCodeAt(i);
+    if (c === 46) { if (atomEmpty) return false; sawDot = true; atomEmpty = true; }   // "."
+    else if (c >= 48 && c <= 57) { atomEmpty = false; }                               // 0-9
+    else return false;
+  }
+  return sawDot && !atomEmpty;
+}
+
 function has(dotted) {
   _assertDotted(dotted, "has");
   return _byOid.has(dotted);
@@ -876,6 +891,7 @@ function kemParams(oidOrName) { return KEM_PARAMS[oidOrName]; }
 module.exports = {
   name:           name,
   byName:         byName,
+  isDottedDecimal: isDottedDecimal,
   has:            has,
   paramsMustBeAbsent: paramsMustBeAbsent,
   kemParams:      kemParams,

package/lib/path-validate.js

@@ -49,6 +49,7 @@ var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
@@ -568,11 +569,54 @@ function hostConstraintMatch(constraint, host) {
 // or a value carrying non-hostname characters (a scheme "://", a path "/", a
 // port ":") is not a FQDN and cannot be matched against a domain-suffix
 // constraint. Only [A-Za-z0-9.-] with at least one dot qualifies.
+// A code-point membership table built from a string of the allowed characters, and the shared scan that
+// checks every character of a non-empty string against one -- replacing the hostname-charset regexes
+// through one loop (no per-predicate character-class chain).
+function _charTable(chars) { var t = []; for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true; return t; }
+var _FQDN_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-");   // /^[a-z0-9.-]+$/i
+var _DIGDOT_TABLE = _charTable("0123456789.");                                                     // /^[0-9.]+$/
+function _allCharsIn(s, table) {
+  if (s.length === 0) return false;
+  for (var i = 0; i < s.length; i++) if (!table[_charCodeAt(s, i)]) return false;
+  return true;
+}
+// /^[0-9]/ : begins with an ASCII digit (a dotted-OID attempt, vs an EKU / purpose name).
+function _startsWithDigit(s) { if (s.length === 0) return false; var c = _charCodeAt(s, 0); return c >= 48 && c <= 57; }
+
+var _SCHEME_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+.-");   // [a-z0-9+.-]
+// /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i : the [start, end) range of the authority (up to the first / ? #
+// or end), or null when the input is not a scheme "//" URI. Returns a range so the caller slices once
+// (the slice that replaces the removed .exec), not a fresh substring here.
+function _uriAuthorityRange(uri) {
+  var n = uri.length;
+  if (n === 0) return null;
+  var c0 = _charCodeAt(uri, 0);
+  if (!((c0 >= 65 && c0 <= 90) || (c0 >= 97 && c0 <= 122))) return null;                 // scheme starts with a letter
+  var p = 1;
+  while (p < n && _SCHEME_TABLE[_charCodeAt(uri, p)]) p += 1;
+  if (_charCodeAt(uri, p) !== 58 || _charCodeAt(uri, p + 1) !== 47 || _charCodeAt(uri, p + 2) !== 47) return null;   // "://"
+  p += 3;
+  var authStart = p;
+  while (p < n) { var d = _charCodeAt(uri, p); if (d === 47 || d === 63 || d === 35) break; p += 1; }   // [^/?#]*
+  return [authStart, p];
+}
+// /:\d+$/ : the index at which a trailing ":" + digits port starts (to slice off), or s.length when absent.
+function _portStripIndex(s) {
+  var i = s.length;
+  while (i > 0) { var c = _charCodeAt(s, i - 1); if (c >= 48 && c <= 57) i -= 1; else break; }
+  return (i < s.length && i > 0 && _charCodeAt(s, i - 1) === 58) ? i - 1 : s.length;
+}
+// /^\[(.*)\]$/ -> "$1" : an IPv6 literal's surrounding "[" "]" removed, else the string unchanged.
+function _stripBrackets(s) {
+  var n = s.length;
+  return (n >= 2 && _charCodeAt(s, 0) === 91 && _charCodeAt(s, n - 1) === 93) ? s.slice(1, n - 1) : s;
+}
+
 function isFqdnHost(host) {
   var h = stripTrailingDot(host);
   if (h === "" || h.indexOf(".") === -1) return false;       // empty or single-label (localhost)
-  if (!/^[a-z0-9.-]+$/i.test(h)) return false;               // scheme/path/port/IPv6 chars, "@", etc.
-  if (/^[0-9.]+$/.test(h)) return false;                     // IPv4 dotted-quad literal
+  if (!_allCharsIn(h, _FQDN_TABLE)) return false;            // scheme/path/port/IPv6 chars, "@", etc.
+  if (_allCharsIn(h, _DIGDOT_TABLE)) return false;           // IPv4 dotted-quad literal
   return true;
 }
 
@@ -595,9 +639,9 @@ function uriMatch(constraint, uri) {
 }
 
 function uriHost(uri) {
-  var m = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i.exec(uri);
-  if (!m) return null;
-  var authority = m[1];
+  var r = _uriAuthorityRange(uri);
+  if (r === null) return null;
+  var authority = uri.slice(r[0], r[1]);
   // authority = [ userinfo "@" ] host [ ":" port ]. RFC 3986 userinfo does not
   // contain a raw "@", so a conformant authority has at most one "@". With more
   // than one the host cannot be determined reliably, so this fails closed
@@ -606,7 +650,7 @@ function uriHost(uri) {
   var firstAt = authority.indexOf("@");
   if (firstAt !== authority.lastIndexOf("@")) return null;
   if (firstAt !== -1) authority = authority.slice(firstAt + 1);
-  var host = authority.replace(/:\d+$/, "");
+  var host = authority.slice(0, _portStripIndex(authority));
   return host === "" ? null : host;   // an empty authority cannot be evaluated -> unsupported
 }
 
@@ -788,8 +832,7 @@ function treeIsEmpty(tree) { return tree.children.length === 0; }
 function isSubtreeBaseValid(tag, base) {
   switch (tag) {
     case 1: case 2: case 6: return typeof base === "string";                       // rfc822Name / dNSName / URI
-    case 7: return (Buffer.isBuffer(base) || base instanceof Uint8Array) &&
-                   (base.length === 8 || base.length === 32);                      // iPAddress: address + mask
+    case 7: return Buffer.isBuffer(base) && (base.length === 8 || base.length === 32);   // iPAddress: address + mask (any BufferSource is normalized to a Buffer in checkedSubtreeSeeds)
     case 4: return base !== null && typeof base === "object" && !!base.rdns && intrinsic.isArray(base.rdns);   // directoryName
     default: return base !== undefined;
   }
@@ -803,10 +846,19 @@ function checkedSubtreeSeeds(list, optName) {
   if (list === undefined || list === null) return [];
   if (!intrinsic.isArray(list)) throw E("path/bad-input", "validate: opts." + optName + " must be an array of { tag, base } subtree entries");
   return list.map(function (st) {
-    if (!st || typeof st !== "object" || !Number.isInteger(st.tag) || st.tag < 0 || st.tag > 8 || !isSubtreeBaseValid(st.tag, st.base)) {
+    if (!st || typeof st !== "object" || !Number.isInteger(st.tag) || st.tag < 0 || st.tag > 8) {
+      throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
+    }
+    // An iPAddress base (address+mask) may arrive as any BufferSource; normalize it to a
+    // private Buffer so the matcher can index it by byte and a caller cannot mutate it once a
+    // microtask has passed. The name forms (string / directoryName) are validated as they stand.
+    var base = (st.tag === 7 && guard.bytes.isByteSource(st.base))
+      ? guard.bytes.snapshotSource(st.base, PathError, "path/bad-input", "an iPAddress subtree base")
+      : st.base;
+    if (!isSubtreeBaseValid(st.tag, base)) {
       throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
     }
-    return { tag: st.tag, base: st.base };
+    return { tag: st.tag, base: base };
   });
 }
 
@@ -2522,8 +2574,8 @@ function verifyOcspResponse(response, cert, issuerCert, time, opts) {
 var _OCSP_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
 function _ocspFromBytes(response) {
   return guard.parsed.fromTrustedSource(response, "ocspResponse", _OCSP_CLAIM, function (bytes) {
-    if (!Buffer.isBuffer(bytes) && !(bytes instanceof Uint8Array) && typeof bytes !== "string") {
-      throw E("path/bad-input", "verifyOcspResponse: the response must be an OCSP response DER Buffer, a PEM string, or a pki.schema.ocsp.parseResponse result");
+    if (!guard.bytes.isByteSource(bytes) && typeof bytes !== "string") {
+      throw E("path/bad-input", "verifyOcspResponse: the response must be an OCSP response DER BufferSource, a PEM string, or a pki.schema.ocsp.parseResponse result");
     }
     return ocsp.parseResponse(bytes);
   }, E, "path/bad-input",
@@ -2674,7 +2726,7 @@ function resolvePurposeOpts(opts) {
       // A dotted-form attempt (leads with a digit) must be a canonical OID -- a
       // loose regex accepted a leading-zero / out-of-bounds key that would never
       // match the canonical EKU the target advertises; anything else is a name.
-      if (/^[0-9]/.test(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
+      if (_startsWithDigit(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
       var dotted = oid.byName(p);
       if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
       return dotted;
@@ -2685,7 +2737,7 @@ function resolvePurposeOpts(opts) {
     if (typeof opts.checkPurpose !== "string" || opts.checkPurpose.length === 0) {
       throw E("path/bad-input", "validate: opts.checkPurpose must be a key-purpose OID name or dotted OID string");
     }
-    if (/^[0-9]/.test(opts.checkPurpose)) {
+    if (_startsWithDigit(opts.checkPurpose)) {
       var cpDotted = guard.identifier.assertCanonicalOid(opts.checkPurpose, E, "path/bad-input", "validate: opts.checkPurpose");
       checkPurpose = oid.name(cpDotted) || cpDotted;   // normalize a dotted purpose OID to its name for the anchor map
     } else {
@@ -2840,7 +2892,7 @@ function toAnchor(entry, verb) {
   // entry refusal, not a raw exception leaked past the typed guards. `alg` and the raw publicKey are PINNED
   // to ONE read here and used throughout, so a stateful accessor that returns a value now and throws (or
   // returns a different value) on a later read cannot slip past this guard at the shape check or the snapshot.
-  var isTuple = false, alg = null, pubRaw = null, nameRaw = null, pk = null, purposesSnap, distrustSnap;
+  var isTuple = false, alg = null, pubRaw, nameRaw = null, pk = null, purposesSnap, distrustSnap;
   var subjectDerRaw, labelRaw, mozRaw;
   // A Proxy anchor is refused outright. Every field read below -- whether by property access or from an own
   // data descriptor -- is answered by the anchor's own reflection, and a Proxy's traps let the same read
@@ -2915,7 +2967,10 @@ function toAnchor(entry, verb) {
       // it is captured. A non-tuple leaves pk null / isTuple false and falls through to coerceCert below.
       pubRaw = entry.publicKey;
       if (guard.bytes.isByteSource(pubRaw)) {
-        pk = guard.bytes.snapshot(pubRaw, PathError, "path/bad-input", who + ": trustAnchor publicKey");
+        // snapshotSource, not snapshot: isByteSource accepts all four BufferSource forms (Buffer, any view,
+        // DataView, ArrayBuffer), so the normalizer must too -- snapshot accepts only Buffer/Uint8Array and
+        // would accept-then-throw on an ArrayBuffer / DataView anchor publicKey.
+        pk = guard.bytes.snapshotSource(pubRaw, PathError, "path/bad-input", who + ": trustAnchor publicKey");
       }
       nameRaw = entry.name;
       alg = entry.algorithm;
@@ -3005,7 +3060,10 @@ function toAnchor(entry, verb) {
     // resolve a polluted Object.prototype.rdns on a name that supplied none (and could invoke an inherited
     // throwing getter) -- means a name with no own rdns is refused, never accepted on an inherited array.
     var nameHasRdns = intrinsic.hasOwn(nameOut, "rdns") && intrinsic.isArray(nameOut.rdns);
-    if (!nameHasRdns || !Buffer.isBuffer(pubRaw) || algStr === null) {
+    // Gate on the NORMALIZED key `pk` (a private Buffer from snapshotSource iff publicKey was any of the four
+    // BufferSource forms), not the raw `pubRaw` -- Buffer.isBuffer(pubRaw) would reject a Uint8Array / view /
+    // ArrayBuffer publicKey that isByteSource + snapshotSource just accepted.
+    if (!nameHasRdns || !Buffer.isBuffer(pk) || algStr === null) {
       throw E("path/bad-input", who + ": a trustAnchor tuple must be { name: { rdns: [...] }, publicKey: Buffer, algorithm: an OID string or a SubjectPublicKeyInfo algorithm carrying an oid }");
     }
     // Hold the stated algorithm to a canonical dotted-decimal OID: a shape-valid but non-canonical value
@@ -3256,7 +3314,7 @@ async function _fetchAiaIssuers(current, aia) {
     // A DNS-NAME host's private RESOLUTION can only be blocked by a transport that filters the resolved address;
     // with an UNGUARDED transport (an injected fn that does not vouch blocksPrivateAddresses) fail closed -- fetch
     // IP literals only (already validated above), never a hostname whose resolved address we cannot verify.
-    if (net.isIP(u.hostname.replace(/^\[(.*)\]$/, "$1")) === 0 && !aia.transportGuardsAddresses) continue;
+    if (net.isIP(_stripBrackets(u.hostname)) === 0 && !aia.transportGuardsAddresses) continue;
     u.hash = "";                                          // the fragment is never sent on the wire -> not part of the request/dedupe identity
     if (intrinsic.setHas(aia.fetchedUrls, u.href) || intrinsic.setHas(seenThisCert, u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
     if (seenThisCert.size >= aia.maxPerCert) break;       // per-cert DISTINCT-url cap, checked BEFORE appending so maxAiaPerCert:0 collects nothing (no fetch at all)

package/lib/pbes2.js

@@ -157,7 +157,7 @@ function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
   opts = opts || {};
   var cipherName = opts.cipher || "aes256-CBC";
   var keyBits = CONTENT_KEYBITS[O(cipherName)];
-  if (!keyBits || !/CBC/.test(cipherName)) throw E(prefix + "/bad-input", "unsupported PBES2 cipher " + cipherName + " (AES-CBC only)");
+  if (!keyBits || cipherName.indexOf("CBC") === -1) throw E(prefix + "/bad-input", "unsupported PBES2 cipher " + cipherName + " (AES-CBC only)");
   var prf = opts.prf || "hmacWithSHA256";
   var prfNode = prfNodeByName(prf, E, prefix);
   var iterations = assertIterations(opts.iterations == null ? 2048 : opts.iterations, E, prefix);
@@ -200,7 +200,7 @@ function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix, budget) {
     pb = parsePbkdf2Params(kdf[1].bytes, opts, E, prefix, true);   // strictPrf: reject a non-canonical explicit default prf
     var encOid = asn1.read.oid(encScheme[0]);
     keyBits = CONTENT_KEYBITS[encOid];
-    if (!keyBits || !/CBC/.test(oid.name(encOid) || "")) throw E(prefix + "/unsupported-algorithm", "unsupported PBES2 encryptionScheme " + (oid.name(encOid) || encOid) + " (AES-CBC only)");
+    if (!keyBits || (oid.name(encOid) || "").indexOf("CBC") === -1) throw E(prefix + "/unsupported-algorithm", "unsupported PBES2 encryptionScheme " + (oid.name(encOid) || encOid) + " (AES-CBC only)");
     iv = asn1.read.octetString(encScheme[1]);
     if (iv.length !== 16) throw E(prefix + "/bad-algorithm-parameters", "the AES-CBC IV must be 16 octets");
   } catch (e) {

package/lib/pkcs12-build.js

@@ -216,7 +216,7 @@ function _p12Encode(pw) {
   // A view first, so a detached backing store is a reject and never an empty password; then a copy,
   // because everything this function returns is reported owned and gets zeroized after derivation,
   // and handing back a view of a caller's Uint8Array would wipe the caller's own credential.
-  if (Buffer.isBuffer(pw) || pw instanceof Uint8Array) return guard.bytes.snapshot(pw, Pkcs12Error, "pkcs12/bad-input", "the password");
+  if (Buffer.isBuffer(pw) || pw instanceof Uint8Array) return guard.bytes.snapshot(pw, Pkcs12Error, "pkcs12/bad-input", "the password");   // allow:byte-source-narrow -- password on the ownership contract (string / Buffer / Uint8Array); widening passwords is a separate root decision
   if (typeof pw !== "string") throw _err("pkcs12/bad-input", _MISSING_PASSWORD);
   var out = Buffer.alloc(pw.length * 2 + 2);   // + the 2-byte NULL terminator
   for (var i = 0; i < pw.length; i++) {
@@ -507,7 +507,7 @@ async function _buildAuthSafeElement(sc, opts) {
     var alg = sc.contentEncryptionAlgorithm || "aes-256-cbc";
     // RFC 7292 sec. 4.1 lists only id-envelopedData for a public-key privacy safe (never id-ct-authEnvelopedData);
     // cms.encrypt DEFAULTS to aes-256-gcm (AEAD -> AuthEnvelopedData), so force a CBC content cipher and reject GCM.
-    if (!/^aes-(128|192|256)-cbc$/.test(alg)) throw _err("pkcs12/bad-input", "a public-key privacy safe requires an AES-CBC content cipher (aes-128|192|256-cbc), not " + JSON.stringify(alg) + " -- RFC 7292 sec. 4.1 admits only id-envelopedData, not GCM/AuthEnvelopedData");
+    if (alg !== "aes-128-cbc" && alg !== "aes-192-cbc" && alg !== "aes-256-cbc") throw _err("pkcs12/bad-input", "a public-key privacy safe requires an AES-CBC content cipher (aes-128|192|256-cbc), not " + JSON.stringify(alg) + " -- RFC 7292 sec. 4.1 admits only id-envelopedData, not GCM/AuthEnvelopedData");
     var envCi = await cms.encrypt(safeContentsDer, sc.recipients, { contentEncryptionAlgorithm: alg, contentType: "data" });
     return b.raw(envCi);   // cms.encrypt returns the whole id-envelopedData ContentInfo DER -- splice it verbatim
   }

package/lib/pki-build.js

@@ -355,7 +355,7 @@ function makeBuilder(ctx) {
   // A DN spec -> RDNSequence DER. A string is shorthand for a single commonName RDN; a Buffer is raw
   // pre-encoded Name DER (validated through the parser). An empty array yields an empty RDNSequence.
   function encodeName(spec) {
-    if (Buffer.isBuffer(spec)) { assertValidNameDer(spec); return spec; }
+    if (guard.bytes.isByteSource(spec)) { var _nd = guard.bytes.snapshotSource(spec, ErrorClass, ctx.prefix + "/bad-name", "raw Name DER"); assertValidNameDer(_nd); return _nd; }
     if (typeof spec === "string") spec = [{ commonName: spec }];
     if (!_isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
     return b.sequence(spec.map(encodeRdn));
@@ -560,14 +560,14 @@ function makeBuilder(ctx) {
     return nodeCrypto.createHash("sha1").update(keyBytes).digest();
   }
   function skiKeyId(val, spkiDer) {
-    if (Buffer.isBuffer(val)) return guard.bytes.snapshot(val, ErrorClass, ctx.prefix + "/bad-input", "subjectKeyIdentifier");
+    if (guard.bytes.isByteSource(val)) return guard.bytes.snapshotSource(val, ErrorClass, ctx.prefix + "/bad-input", "subjectKeyIdentifier");
     if (val === true) return spkiKeyId(spkiDer);
-    throw E("bad-input", "subjectKeyIdentifier must be true (auto-derive) or a Buffer key id");
+    throw E("bad-input", "subjectKeyIdentifier must be true (auto-derive) or a BufferSource key id");
   }
 
   // ---- embedded-input validators ----
   function reqDer(v, what) {
-    if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, ErrorClass, ctx.prefix + "/bad-input", what);
+    if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, ErrorClass, ctx.prefix + "/bad-input", what);
     throw E("bad-input", what + " must be a DER Buffer");
   }
   // Full validation of an embedded SubjectPublicKeyInfo, walked through the parser the decoder uses.
@@ -663,8 +663,8 @@ function makeBuilder(ctx) {
     } else if (typeof serial === "bigint") { v = serial; }
     else if (typeof serial === "number") { if (!Number.isSafeInteger(serial)) throw E("bad-serial", "serialNumber number must be a safe integer (pass a BigInt, hex string, or Buffer for a value above 2^53-1)"); v = BigInt(serial); }
     else if (typeof serial === "string") { try { v = BigInt(serial); } catch (e) { throw E("bad-serial", "serialNumber string must be a decimal or 0x-hex integer", e); } }
-    else if (Buffer.isBuffer(serial)) { v = serial.length ? BigInt("0x" + serial.toString("hex")) : 0n; }
-    else { throw E("bad-serial", "serialNumber must be a BigInt, integer, hex string, or Buffer"); }
+    else if (guard.bytes.isByteSource(serial)) { var _sb = guard.bytes.source(serial, ErrorClass, ctx.prefix + "/bad-serial", "serialNumber"); v = _sb.length ? BigInt("0x" + _sb.toString("hex")) : 0n; }
+    else { throw E("bad-serial", "serialNumber must be a BigInt, integer, hex string, or BufferSource"); }
     if (v <= 0n) throw E("bad-serial", "serialNumber must be a positive integer (RFC 5280 sec. 4.1.2.2)");
     var tlv = b.integer(v);
     if (asn1.decode(tlv).content.length > 20) throw E("bad-serial", "serialNumber must not exceed 20 octets (RFC 5280 sec. 4.1.2.2)");

package/lib/rfc3339.js

@@ -13,23 +13,72 @@
  * domain fault code.
  */
 
-// date "T" time with a zone (Z or a numeric offset); an optional fractional second.
-var RFC3339_RE = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:[Zz]|([+-])(\d{2}):(\d{2}))$/;
+// Exactly `count` ASCII digits at `start`, as an integer, or null on any non-digit or short read.
+// The grammar is decided character by character (no regex, whose match protocol re-dispatches through
+// a replaceable `exec`); `\d` in the original is ASCII [0-9] only, matched here as 48..57.
+function _digitsAt(v, start, count) {
+  if (start + count > v.length) return null;
+  var val = 0;
+  for (var i = 0; i < count; i++) {
+    var c = v.charCodeAt(start + i);
+    if (c < 48 || c > 57) return null;
+    val = val * 10 + (c - 48);
+  }
+  return val;
+}
+
+// RFC 3339 date-time scanned into its components, or null on any grammar violation:
+// YYYY "-" MM "-" DD [Tt] HH ":" MM ":" SS, an optional "." + one-or-more fraction digits, then a
+// zone -- [Zz] or ([+-]) OFFHH ":" OFFMM -- with nothing after. Calendar validity is checked by the
+// caller. `offset` carries the numeric-offset hours/minutes when present, else null.
+function _scanDateTime(v) {
+  var n = v.length, p = 0;
+  var year = _digitsAt(v, p, 4); if (year === null) return null; p += 4;
+  if (v.charAt(p) !== "-") return null; p += 1;
+  var month = _digitsAt(v, p, 2); if (month === null) return null; p += 2;
+  if (v.charAt(p) !== "-") return null; p += 1;
+  var day = _digitsAt(v, p, 2); if (day === null) return null; p += 2;
+  var t = v.charAt(p); if (t !== "T" && t !== "t") return null; p += 1;
+  var hour = _digitsAt(v, p, 2); if (hour === null) return null; p += 2;
+  if (v.charAt(p) !== ":") return null; p += 1;
+  var min = _digitsAt(v, p, 2); if (min === null) return null; p += 2;
+  if (v.charAt(p) !== ":") return null; p += 1;
+  var sec = _digitsAt(v, p, 2); if (sec === null) return null; p += 2;
+  if (v.charAt(p) === ".") {   // optional fractional second: "." + one or more digits
+    p += 1;
+    var fracStart = p;
+    while (p < n) { var fc = v.charCodeAt(p); if (fc < 48 || fc > 57) break; p += 1; }
+    if (p === fracStart) return null;
+  }
+  var z = v.charAt(p), offset = null;
+  if (z === "Z" || z === "z") {
+    p += 1;
+  } else if (z === "+" || z === "-") {
+    p += 1;
+    var offHour = _digitsAt(v, p, 2); if (offHour === null) return null; p += 2;
+    if (v.charAt(p) !== ":") return null; p += 1;
+    var offMin = _digitsAt(v, p, 2); if (offMin === null) return null; p += 2;
+    offset = { hour: offHour, min: offMin };
+  } else {
+    return null;   // a zone is required
+  }
+  if (p !== n) return null;   // no trailing characters
+  return { year: year, month: month, day: day, hour: hour, min: min, sec: sec, offset: offset };
+}
 
 // isValid(v) -> boolean: v is a syntactically well-formed AND calendar-valid RFC 3339 date-time string.
 function isValid(v) {
   if (typeof v !== "string") return false;
-  var m = RFC3339_RE.exec(v);
-  if (!m) return false;
-  var year = +m[1], month = +m[2], day = +m[3], hour = +m[4], min = +m[5], sec = +m[6];
-  if (month < 1 || month > 12) return false;
+  var t = _scanDateTime(v);
+  if (!t) return false;
+  if (t.month < 1 || t.month > 12) return false;
   // Reject a :60 leap second (Node's Date.parse returns NaN for it, so a comparison on such a value
   // would silently pass) and any hour/minute/second out of range.
-  if (hour > 23 || min > 59 || sec > 59) return false;
-  var leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+  if (t.hour > 23 || t.min > 59 || t.sec > 59) return false;
+  var leap = (t.year % 4 === 0 && t.year % 100 !== 0) || t.year % 400 === 0;
   var daysInMonth = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  if (day < 1 || day > daysInMonth[month - 1]) return false;
-  if (m[7]) { if (+m[8] > 23 || +m[9] > 59) return false; }   // a numeric zone offset must itself be valid
+  if (t.day < 1 || t.day > daysInMonth[t.month - 1]) return false;
+  if (t.offset) { if (t.offset.hour > 23 || t.offset.min > 59) return false; }   // a numeric zone offset must itself be valid
   return true;
 }
 
@@ -44,20 +93,29 @@ function parse(v, E, code, label) {
 // RFC 3339 sec. 5.6 `full-date`: a calendar date with no time component. A distinct production from
 // the date-time above, and deliberately a separate pair of functions instead of a flag: a consumer
 // that expects one and is handed the other has a malformed value, not a permissible variant.
-var FULL_DATE_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+// RFC 3339 full-date scanned into its components (YYYY "-" MM "-" DD, nothing after), or null.
+function _scanFullDate(v) {
+  var p = 0;
+  var year = _digitsAt(v, p, 4); if (year === null) return null; p += 4;
+  if (v.charAt(p) !== "-") return null; p += 1;
+  var month = _digitsAt(v, p, 2); if (month === null) return null; p += 2;
+  if (v.charAt(p) !== "-") return null; p += 1;
+  var day = _digitsAt(v, p, 2); if (day === null) return null; p += 2;
+  if (p !== v.length) return null;
+  return { year: year, month: month, day: day };
+}
 
 // isValidDate(v) -> boolean: v is a syntactically well-formed AND calendar-valid RFC 3339 full-date.
 // Calendar validity matters as much as shape: "2021-02-30" parses as a Date in JS by rolling over
 // into March, so a shape-only check would silently accept a day that does not exist.
 function isValidDate(v) {
   if (typeof v !== "string") return false;
-  var m = FULL_DATE_RE.exec(v);
-  if (!m) return false;
-  var year = +m[1], month = +m[2], day = +m[3];
-  if (month < 1 || month > 12) return false;
-  var leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+  var t = _scanFullDate(v);
+  if (!t) return false;
+  if (t.month < 1 || t.month > 12) return false;
+  var leap = (t.year % 4 === 0 && t.year % 100 !== 0) || t.year % 400 === 0;
   var daysInMonth = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  return day >= 1 && day <= daysInMonth[month - 1];
+  return t.day >= 1 && t.day <= daysInMonth[t.month - 1];
 }
 
 // parseDate(v, E, code, label) -> Date at UTC midnight. Anchored explicitly at UTC ("T00:00:00Z")

package/lib/schema-c509.js

@@ -263,16 +263,37 @@ function _specialText(node) {
 // name one certificate. A natively signed certificate is exempt: sec. 3.1.4 says bytes and tag 48
 // there "do not correspond to any predefined text string encoding and may also be used for other attribute
 // types", so no canonical text spelling exists to hold one to.
-var _HEX_OPTIMIZED = /^(?:[0-9a-f]{2})+$/;
-var _EUI64_TEXT = /^(?:[0-9A-F]{2}-){7}[0-9A-F]{2}$/;
+// Even-length lowercase hex ("HHHH..."), decided by character so no regex match protocol -- a live,
+// replaceable exec -- stands between the canonicalization gate and the value it inspects.
+function _isEvenHexLower(s) {
+  var n = s.length;
+  if (n < 2 || (n & 1) !== 0) return false;
+  for (var i = 0; i < n; i++) {
+    var c = s.charCodeAt(i);
+    if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 102))) return false; // 0-9 a-f
+  }
+  return true;
+}
+// EUI-64 text form: eight uppercase hex pairs joined by single hyphens ("HH-HH-...-HH", 23 chars).
+function _isEui64Text(s) {
+  if (s.length !== 23) return false;
+  for (var i = 0; i < 23; i++) {
+    if ((i % 3) === 2) { if (s.charCodeAt(i) !== 45) return false; } // "-" at 2,5,...,20
+    else {
+      var c = s.charCodeAt(i);
+      if (!((c >= 48 && c <= 57) || (c >= 65 && c <= 70))) return false; // 0-9 A-F
+    }
+  }
+  return true;
+}
 function _assertCanonicalSpecialText(node, isNative, E) {
   if (isNative) return;
   if (node.majorType === 3) {
     var t = cbor.read.textString(node);
-    if (t.length >= 2 && _HEX_OPTIMIZED.test(t)) {
+    if (t.length >= 2 && _isEvenHexLower(t)) {
       throw _err(E, "a text attribute value of even-length hex characters must be encoded as a CBOR byte string (draft sec. 3.1.4)");
     }
-    if (_EUI64_TEXT.test(t)) {
+    if (_isEui64Text(t)) {
       throw _err(E, "a text attribute value in EUI-64 form must be encoded as a CBOR tag-48 MAC address (draft sec. 3.1.4)");
     }
     return;
@@ -1973,7 +1994,7 @@ function _reconstructDer(r, sigNode) {
   // The signature is re-wrapped as a DER ECDSA-Sig-Value from the fixed-width r||s, so only an ECDSA
   // signature algorithm is in the type-3 reconstruction covered set (an RSA/EdDSA signature is raw bytes,
   // not r||s, so it is rejected). A wrong-length r||s surfaces the caller's typed code.
-  if (!/^ecdsa/i.test(r.signatureAlgorithm.name || "")) {
+  if (String(r.signatureAlgorithm.name || "").toLowerCase().indexOf("ecdsa") !== 0) {
     throw _err("c509/non-invertible", "type-3 signature reconstruction covers only ECDSA; got " + r.signatureAlgorithm.name);
   }
   // The fixed-width r||s must split at a real curve field width: P-256/384/521 = 64/96/132 bytes
@@ -2143,7 +2164,7 @@ function _encAlgorithm(alg, toInt, key) {
 function _encSpecialText(rdn) {
   if (rdn.eui64) return cbor.build.tag(48, cbor.build.byteString(rdn.eui64));
   var v = String(rdn.value);
-  if (v.length >= 2 && _HEX_OPTIMIZED.test(v)) return cbor.build.byteString(Buffer.from(v, "hex"));
+  if (v.length >= 2 && _isEvenHexLower(v)) return cbor.build.byteString(Buffer.from(v, "hex"));
   return cbor.build.textString(v);
 }
 // A Name -> CBOR: null (issuer only) | a bare SpecialText single utf8 commonName | an array of RDN pairs.
@@ -2293,9 +2314,15 @@ function _encodeC509Array(r) {
 // value (draft-20 sec. 3.2.3): an FF-FE-in-the-middle EUI-64 collapses to its 6-byte EUI-48, else the
 // 8-byte EUI-64 verbatim. A non-MAC commonName returns null (encoded as text). The exact inverse of
 // _macToEui64String, so the reconstruction rebuilds the identical DER commonName string.
+// The "-" characters removed from a string, by character scan (no regex replace protocol).
+function _stripHyphens(s) {
+  var out = "";
+  for (var i = 0; i < s.length; i++) { var ch = s.charAt(i); if (ch !== "-") out += ch; }
+  return out;
+}
 function _euiFromCn(value) {
-  if (!/^[0-9A-F]{2}(-[0-9A-F]{2}){7}$/.test(value)) return null;
-  var bytes = Buffer.from(value.replace(/-/g, ""), "hex");
+  if (!_isEui64Text(value)) return null;
+  var bytes = Buffer.from(_stripHyphens(value), "hex");
   if (bytes[3] === 0xff && bytes[4] === 0xfe) return Buffer.concat([bytes.subarray(0, 3), bytes.subarray(5)]);
   return bytes;
 }
@@ -2415,7 +2442,7 @@ _derToType3 = function (input, opts) {
   // (A v3 certificate with the extensions field OMITTED is fully supported: sec. 3.1.10 encodes
   // an omitted 'extensions' field as an empty CBOR array.)
   if (c.version !== 3) throw _err("c509/non-invertible", "C509 covers X.509 v3 certificates; got v" + c.version);
-  if (!/^ecdsa/i.test(c.signatureAlgorithm.name || "")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
+  if (String(c.signatureAlgorithm.name || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
   if (c.subjectPublicKeyInfo.algorithm.name !== "ecPublicKey") throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
   var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
   var curve = oid.name(curveOid);

package/lib/schema-cmc.js

@@ -685,7 +685,7 @@ function _finishBody(body, where) {
  *   d.controls.length;   // 0 -- present and empty, which is legal
  */
 function parsePkiData(input) {
-  var root = asn1.decode(Buffer.isBuffer(input) ? input : Buffer.from(input));
+  var root = asn1.decode(guard.bytes.isByteSource(input) ? guard.bytes.source(input, E, "cmc/bad-input", "the CMC DER") : Buffer.from(input));
   var body = schema.walk(PKI_DATA, root, NS).result;
   body.bytes = root.bytes;
   return _finishBody(body, "pkiData");
@@ -711,7 +711,7 @@ function parsePkiData(input) {
  *   r.statuses.length;   // 0 -- no status control means success is assumed
  */
 function parsePkiResponse(input) {
-  var root = asn1.decode(Buffer.isBuffer(input) ? input : Buffer.from(input));
+  var root = asn1.decode(guard.bytes.isByteSource(input) ? guard.bytes.source(input, E, "cmc/bad-input", "the CMC DER") : Buffer.from(input));
   var body = schema.walk(PKI_RESPONSE, root, NS).result;
   body.bytes = root.bytes;
   return _finishBody(body, "pkiResponse");
@@ -752,7 +752,7 @@ function parse(input) {
   // encapContentInfo is the field this function goes on to read, so requiring it
   // is the same question the code below already asks.
   var parsedCms = (input && typeof input === "object" && !ArrayBuffer.isView(input) &&
-    !(input instanceof ArrayBuffer) && input.encapContentInfo != null)
+    !guard.bytes.isByteSource(input) && input.encapContentInfo != null)
     ? input : cms.parse(input);
   // The CARRIER is part of the identity, not just the encapsulated content type.
   // RFC 5272 sec. 3.2 / 4.2 admit a SignedData or an AuthenticatedData; other CMS