@blamejs/pki 0.5.31 → 0.5.33

package/lib/cms-decrypt.js

@@ -129,7 +129,7 @@ function _parse(input) {
   return schemaCms.parse(_toDer(input));
 }
 function _toDer(input) {
-  if (Buffer.isBuffer(input) || input instanceof Uint8Array) return guard.bytes.snapshot(input, CmsError, "cms/bad-input", "input");
+  if (guard.bytes.isByteSource(input)) return guard.bytes.snapshotSource(input, CmsError, "cms/bad-input", "input");
   if (typeof input === "string") { try { return schemaCms.pemDecode(input); } catch (e) { throw _err("cms/bad-input", "the CMS PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
 }
@@ -166,7 +166,7 @@ function _riKindForKey(km) {
   throw _err("cms/bad-input", "key material needs { key, cert }, { password }, { kek }, or { cek }");
 }
 function _assertSupported(ri, km) {
-  if (ri.type === "kari" && ri.keyEncryptionAlgorithm && /mqv/i.test(ri.keyEncryptionAlgorithm.name || "")) throw _err("cms/unsupported-algorithm", "ECMQV kari is not supported");
+  if (ri.type === "kari" && ri.keyEncryptionAlgorithm && intrinsic.stringIndexOf(intrinsic.toLowerCase(ri.keyEncryptionAlgorithm.name || ""), "mqv") !== -1) throw _err("cms/unsupported-algorithm", "ECMQV kari is not supported");   // /mqv/i (ASCII name)
   if (ri.type === "ori") {
     if (ri.oriType !== O("kem")) throw _err("cms/unsupported-recipient-type", "unsupported OtherRecipientInfo type " + ri.oriType);
     if (ri.kemri && ri.kemri.kem && ri.kemri.kem.oid === O("id-kem-rsa")) throw _err("cms/unsupported-algorithm", "RSA-KEM is not supported");
@@ -801,7 +801,7 @@ function _releaseKeyDer(k) {
   if (k && k.owned) guard.secret.zeroize(k.der, CmsError, "cms/bad-input", "the recipient private-key copy");
 }
 function _normCertDer(cert) {
-  if (Buffer.isBuffer(cert) || cert instanceof Uint8Array) return guard.bytes.snapshot(cert, CmsError, "cms/bad-input", "the recipient certificate");
+  if (guard.bytes.isByteSource(cert)) return guard.bytes.snapshotSource(cert, CmsError, "cms/bad-input", "the recipient certificate");
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("cms/bad-input", "the recipient certificate PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "the recipient certificate must be a DER Buffer or PEM string");
 }

package/lib/cms-encrypt.js

@@ -41,7 +41,7 @@ function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(nam
 // A certificate descriptor -> raw DER (the recipient cert is parsed for dispatch + rid; the caller
 // supplies bytes, not a re-encoded parse).
 function _normCertDer(cert, what) {
-  if (Buffer.isBuffer(cert) || cert instanceof Uint8Array) return guard.bytes.snapshot(cert, CmsError, "cms/bad-input", what || "a certificate");
+  if (guard.bytes.isByteSource(cert)) return guard.bytes.snapshotSource(cert, CmsError, "cms/bad-input", what || "a certificate");
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("cms/bad-input", (what || "a certificate") + " PEM could not be decoded", e); } }
   throw _err("cms/bad-input", (what || "a certificate") + " must be a DER Buffer, Uint8Array, or PEM string");
 }

package/lib/cms-sign.js

@@ -117,13 +117,13 @@ function _buildSid(cert, useSki) {
 // signature octets + signing-time, content-type omitted per sec. 11.4).
 function _buildSignedAttrs(pairs) {
   var seenTypes = {};
-  var attrs = pairs.map(function (p) {
+  var attrs = intrinsic.map(pairs, function (p) {
     if (intrinsic.hasOwn(seenTypes, p.type)) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
     seenTypes[p.type] = 1;
     return b.sequence([b.oid(p.type), b.set(p.values)]);
   });
   var setOf = b.set(attrs);   // SET OF (tag 0x31) -- the exact bytes the signature covers (sec. 5.4)
-  var wire = Buffer.from(setOf); wire[0] = 0xA0;   // the on-wire [0] IMPLICIT tag
+  var wire = intrinsic.bufferFrom(setOf); wire[0] = 0xA0;   // the on-wire [0] IMPLICIT tag
   return { setOf: setOf, wire: wire };
 }
 
@@ -131,10 +131,10 @@ function _buildSignedAttrs(pairs) {
 // into the pair shape _buildSignedAttrs consumes; each MUST carry >= 1 value (Attribute values is
 // SET SIZE (1..MAX)).
 function _resolveAttrPairs(list, what) {
-  return (list || []).map(function (a) {
-    var vals = (a.values || []).map(function (v) { return _toBuf(v, what); });
+  return intrinsic.map(list || [], function (a) {
+    var vals = intrinsic.map(a.values || [], function (v) { return _toBuf(v, what); });
     if (!vals.length) throw _err("cms/bad-input", "a signed attribute must carry at least one value (RFC 5652 -- Attribute values is SET SIZE (1..MAX))");
-    return { type: /^\d+(\.\d+)+$/.test(a.type) ? a.type : O(a.type), values: vals };
+    return { type: oid.isDottedDecimal(a.type) ? a.type : O(a.type), values: vals };
   });
 }
 
@@ -151,24 +151,26 @@ UNSIGNED_FORBIDDEN[O("signingTime")] = "signing-time";
 // duplicate type (RFC 5652 sec. 11 / sec. 5.3) is a config-time cms/bad-input.
 function _buildUnsignedAttrs(list) {
   if (list == null) return null;
-  if (!Array.isArray(list)) throw _err("cms/bad-input", "opts.unsignedAttributes must be an array of { type, values }");
+  if (!intrinsic.isArray(list)) throw _err("cms/bad-input", "opts.unsignedAttributes must be an array of { type, values }");
   if (!list.length) return null;
   var pairs = _resolveAttrPairs(list, "an unsigned attribute value");
   var seen = {};
-  pairs.forEach(function (p) {
+  intrinsic.forEach(pairs, function (p) {
     if (intrinsic.hasOwn(UNSIGNED_FORBIDDEN, p.type)) throw _err("cms/bad-input", "the " + UNSIGNED_FORBIDDEN[p.type] + " attribute must not appear as an unsigned attribute (RFC 5652 sec. 11)");
     if (intrinsic.hasOwn(seen, p.type)) throw _err("cms/bad-input", "unsignedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
     seen[p.type] = 1;
   });
-  var setOf = b.set(pairs.map(function (p) { return b.sequence([b.oid(p.type), b.set(p.values)]); }));
-  var wire = Buffer.from(setOf); wire[0] = 0xA1;   // SET OF -> [1] IMPLICIT UnsignedAttributes
+  var setOf = b.set(intrinsic.map(pairs, function (p) { return b.sequence([b.oid(p.type), b.set(p.values)]); }));
+  var wire = intrinsic.bufferFrom(setOf); wire[0] = 0xA1;   // SET OF -> [1] IMPLICIT UnsignedAttributes
   return wire;
 }
 
-// Build one SignerInfo (RFC 5652 sec. 5.3) and sign it. Resolves the SignerInfo (as a build
-// node) plus its digestAlgorithm AlgorithmIdentifier and the signer certificate DER (for the
-// SignedData digestAlgorithms + certificates sets).
-function _buildSignerInfo(signer, content, eContentType, opts) {
+// Resolve, at entry and once, every field an emitted SignerInfo depends on (RFC 5652 sec. 5.3):
+// the SignerIdentifier + version, the signature scheme, the private key reference, the declared
+// public bytes, and the signer certificate DER. Nothing here defers, so the values are captured
+// before any promise turn; the digest, the signature, and the self-check happen a turn later in
+// _finishSignerInfo, off exactly these captured values. Buffered and streamed signing share this.
+function _resolveSignerContext(signer, opts) {
   var so = signer || {};
   // A key-only signer: `{ key, spki, keyIdentifier }` with no certificate. RFC
   // 5272 sec. 3.2 requires exactly this when a Full PKI Request is signed with the
@@ -199,36 +201,54 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
   var sidv = keyOnly
     ? { sid: b.contextPrimitive(0, _keyOnlyKeyId(so)), version: 3 }   // [0] IMPLICIT SubjectKeyIdentifier
     : _buildSid(cert, opts.sid === "ski");
-  var sid = sidv.sid, version = sidv.version;
+  return { keyOnly: keyOnly, soKey: soKey, soSpki: soSpki, certDer: certDer, cert: cert,
+    scheme: scheme, sid: sidv.sid, version: sidv.version };
+}
 
-  return Promise.resolve().then(function () {
-    if (opts.signedAttributes === false) return content;   // sign the content directly (no signed attributes)
+// Finish a SignerInfo (RFC 5652 sec. 5.3) from a resolved context: build the SignedAttributes (or
+// sign the content directly), sign them, self-check the signature against the declared key, and
+// assemble the SignerInfo. `md` is the message digest of the content under `rc.scheme.digest`,
+// already computed -- over a buffered content by _digest, or over a streamed content's chunks by the
+// engine's single-pass digest. `content` is read ONLY on the signedAttributes:false path, where the
+// signature covers the content directly and there is no digest attribute.
+async function _finishSignerInfo(rc, md, content, eContentType, opts) {
+  // await throughout, never a live Promise.resolve()/.then lookup: on the streamed path this runs after
+  // the content's iterator has driven the digest, so a replaced global Promise.resolve or a replaced
+  // Promise.prototype.then would otherwise let it disrupt the signing that completes here. await hooks
+  // onto a native promise through the internal job, not the caller-replaceable prototype method.
+  var toSign;
+  if (opts.signedAttributes === false) {
+    toSign = content;   // sign the content directly (no signed attributes)
+  } else {
     // Signed attributes (RFC 5652 sec. 5.3): content-type == eContentType, message-digest ==
     // digest(content), and (by default) signing-time, plus any caller-supplied attribute.
-    return _digest(scheme.digest, content).then(function (md) {
-      var pairs = [
-        { type: O("contentType"), values: [b.oid(eContentType)] },
-        { type: O("messageDigest"), values: [b.octetString(md)] },
-      ];
-      if (opts.signingTime !== false) pairs.push({ type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
-      pairs = pairs.concat(_resolveAttrPairs(opts.additionalSignedAttributes, "a signed attribute value"));
-      return _buildSignedAttrs(pairs);
-    });
-  }).then(function (toSign) {
-    var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
-    return signScheme.signOverTbs(scheme, soKey, signedBytes, _signE).then(function (sig) {
-      return _assertKeyMatchesSpki(keyOnly, soKey, soSpki, scheme, sig, signedBytes, cert).then(function () { return sig; });
-    }).then(function (sig) {
-      var fields = [b.integer(BigInt(version)), sid, scheme.digestAlgId];
-      if (toSign.wire) fields.push(toSign.wire);              // [0] IMPLICIT signedAttrs
-      fields.push(scheme.sigAlgId, b.octetString(sig));
-      var ua = _buildUnsignedAttrs(opts.unsignedAttributes);
-      if (ua) fields.push(ua);                                 // [1] IMPLICIT unsignedAttrs
-      return { si: b.sequence(fields), digestAlgId: scheme.digestAlgId, version: version, certDer: certDer };
-      // certDer is null for a key-only signer, and the certificates [0] embedding
-      // below filters it out -- there is nothing to embed, which is the point.
-    });
-  });
+    var pairs = [
+      { type: O("contentType"), values: [b.oid(eContentType)] },
+      { type: O("messageDigest"), values: [b.octetString(md)] },
+    ];
+    if (opts.signingTime !== false) intrinsic.push(pairs, { type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
+    pairs = intrinsic.concat(pairs, _resolveAttrPairs(opts.additionalSignedAttributes, "a signed attribute value"));
+    toSign = _buildSignedAttrs(pairs);
+  }
+  var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
+  var sig = await signScheme.signOverTbs(rc.scheme, rc.soKey, signedBytes, _signE);
+  await _assertKeyMatchesSpki(rc.keyOnly, rc.soKey, rc.soSpki, rc.scheme, sig, signedBytes, rc.cert);
+  var fields = [b.integer(BigInt(rc.version)), rc.sid, rc.scheme.digestAlgId];
+  if (toSign.wire) intrinsic.push(fields, toSign.wire);              // [0] IMPLICIT signedAttrs
+  intrinsic.push(fields, rc.scheme.sigAlgId, b.octetString(sig));
+  var ua = _buildUnsignedAttrs(opts.unsignedAttributes);
+  if (ua) intrinsic.push(fields, ua);                                 // [1] IMPLICIT unsignedAttrs
+  // certDer is null for a key-only signer, and the certificates [0] embedding below filters it out --
+  // there is nothing to embed, which is the point.
+  return { si: b.sequence(fields), digestAlgId: rc.scheme.digestAlgId, version: rc.version, certDer: rc.certDer };
+}
+
+// Build one SignerInfo (RFC 5652 sec. 5.3) over a buffered content and sign it: resolve the context,
+// digest the content (unless it is signed directly), then finish.
+function _buildSignerInfo(signer, content, eContentType, opts) {
+  var rc = _resolveSignerContext(signer, opts);
+  var mdP = opts.signedAttributes === false ? Promise.resolve(null) : _digest(rc.scheme.digest, content);
+  return mdP.then(function (md) { return _finishSignerInfo(rc, md, content, eContentType, opts); });
 }
 
 
@@ -250,7 +270,7 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
 // This is the same post-sign self-check every other signer in the toolkit runs,
 // through the same shared helper. It costs one verification per SignerInfo, which
 // is what a certificate, a CRL, a CSR and a CMP message have always paid here.
-function _assertKeyMatchesSpki(keyOnly, soKey, soSpki, scheme, sig, signedBytes, cert) {
+async function _assertKeyMatchesSpki(keyOnly, soKey, soSpki, scheme, sig, signedBytes, cert) {
   var declared = keyOnly ? soSpki : (cert && cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.bytes);
   // A parsed certificate that does not retain its SPKI bytes cannot be checked this
   // way. That is not a shape x509.parse produces, and if it ever were, refusing is
@@ -260,20 +280,26 @@ function _assertKeyMatchesSpki(keyOnly, soKey, soSpki, scheme, sig, signedBytes,
       "a signer certificate did not surface its subjectPublicKeyInfo, so the signature it produced could " +
       "not be checked against the key the SignerInfo declares");
   }
-  return Promise.resolve()
-    .then(function () { return _b.assertSignatureVerifies(signedBytes, sig, declared, scheme); })
-    .then(null, function (e) {
-      if (e && typeof e.code === "string" && e.code.indexOf("cms/") === 0) throw e;
-      throw _signE("bad-input",
-        "a signer's `key` does not match the public key its SignerInfo declares (" +
-        (keyOnly ? "`spki`" : "its certificate") + "): the signature it produced does not verify under that key", e);
-    });
+  // await, never Promise.resolve()/.then: reached from _finishSignerInfo after a streamed content's
+  // iterator ran, so a replaced global Promise.resolve would otherwise disrupt this self-check.
+  try {
+    await _b.assertSignatureVerifies(signedBytes, sig, declared, scheme);
+  } catch (e) {
+    if (e && typeof e.code === "string" && e.code.indexOf("cms/") === 0) throw e;
+    throw _signE("bad-input",
+      "a signer's `key` does not match the public key its SignerInfo declares (" +
+      (keyOnly ? "`spki`" : "its certificate") + "): the signature it produced does not verify under that key", e);
+  }
 }
 
 // A signing-time Time value: UTCTime before 2050, GeneralizedTime from 2050 (RFC 5652 sec. 11.3 /
-// RFC 5280 sec. 4.1.2.5). A caller Date overrides; false omits the attribute (handled above).
+// RFC 5280 sec. 4.1.2.5). A caller Date overrides; false omits the attribute (handled above). The
+// DEFAULT instant is read from the captured Date intrinsic, never the live global: a streamed content's
+// iterator runs during the digest, one turn before this attribute is built, and a replaced global Date
+// would otherwise let it stamp the signature with an attacker-chosen instant (byte-identical, under a
+// deterministic scheme, to signing with that instant explicitly).
 function _timeValue(when) {
-  var d = guard.time.isDate(when) ? when : new Date();
+  var d = guard.time.isDate(when) ? when : new intrinsic.Date();
   return d.getUTCFullYear() < 2050 ? b.utcTime(d) : b.generalizedTime(d);
 }
 
@@ -351,29 +377,114 @@ function _keyOnlyKeyId(so) {
 
 function _normCertDer(c) {
   if (c == null) throw _err("cms/bad-input", "each signer requires a certificate (cert)");
-  if (c instanceof Uint8Array || Buffer.isBuffer(c)) {
-    c = guard.bytes.snapshot(c, CmsError, "cms/bad-input", "a signer certificate");
+  if (guard.bytes.isByteSource(c)) {
+    c = guard.bytes.snapshotSource(c, CmsError, "cms/bad-input", "a signer certificate");
     return c[0] === 0x30 ? c : _pemToDer(c.toString("latin1"));   // DER as-is, else PEM
   }
   if (typeof c === "string") return _pemToDer(c);
   throw _err("cms/bad-input", "a signer certificate must be a DER Buffer or a PEM string");
 }
 function _pemToDer(text) {
-  var m = text.match(/-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/);
-  if (!m) throw _err("cms/bad-input", "a signer certificate PEM is not a CERTIFICATE block");
-  return Buffer.from(m[1].replace(/[^A-Za-z0-9+/=]/g, ""), "base64");
+  var der = pkix.pemDecodeLenient(text, "CERTIFICATE");
+  if (der === null) throw _err("cms/bad-input", "a signer certificate PEM is not a CERTIFICATE block");
+  return der;
 }
 
 // pki.cms.sign -- documented by the @primitive block in cms-verify.js (the @module pki.cms home).
-// Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async); the checks stay
-// synchronous because they read the caller's mutable content and signer list.
+// Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async). The stream/buffer routing
+// classifies `content` at the door, which reads `content[Symbol.asyncIterator]` -- a caller accessor
+// that can throw -- so the whole dispatch runs inside the rejection boundary rather than fixedCall's
+// alone, which the classification precedes. The checks the impls run stay synchronous because they
+// read the caller's mutable content and signer list.
 function sign(content, signers, opts) {
-  // Every caller-owned argument copied at entry and released when the call settles; see the note
-  // on the same call in x509-sign. Here it is what makes the attribute-shaped-content refusal below
-  // hold: the value that decides it and the value that gets signed are now the same read.
+  return guard.async.deferred(function () { return _signDispatch(content, signers, opts); });
+}
+
+function _signDispatch(content, signers, opts) {
+  // The signer list and options are copied FIRST, before the content is classified. Classifying reads
+  // content[Symbol.asyncIterator] -- a caller accessor that runs in-realm -- and a probe run before the
+  // copy could mutate the still-uncopied signers/opts, or replace the Array.prototype method the copy
+  // uses, and steer the emitted signature. With the copies taken first, the probe cannot reach them.
   return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
-    [content, "content"], [signers, "the signer list"], [opts, "pki.cms.sign options"],
-  ], _sign);
+    [signers, "the signer list"], [opts, "pki.cms.sign options"],
+  ], function (copiedSigners, copiedOpts) {
+    // A streaming content is classified by guard.bytes.asyncStreamOf, which reads Symbol.asyncIterator a
+    // single time and returns a LAZY stream (its underlying iterator is acquired only when the digest
+    // engine drives it, so a pre-hash rejection never opens a resource to leak). The stream, consumed
+    // exactly once, is passed through; it CANNOT be deep-copied itself. A byte source (or any
+    // non-iterable) yields null here and takes the buffered path.
+    var stream = guard.bytes.asyncStreamOf(content);
+    if (stream) return _signStream(stream, copiedSigners, copiedOpts);
+    // Buffered: the content byte source is copied too, so the value that decides the attribute-shaped-
+    // content refusal and the value that gets signed are the same read.
+    return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+      [content, "content"],
+    ], function (copiedContent) { return _sign(copiedContent, copiedSigners, copiedOpts); });
+  });
+}
+
+// Sign a streamed content (an async iterable of byte chunks) as a DETACHED SignedData. The payload
+// is hashed once, incrementally, under every distinct SignerInfo digest algorithm (RFC 5652
+// sec. 5.4), so an arbitrarily large content is never held whole and a single-use stream serves
+// every signer in one pass. Detached is the only conformant streamed form: an attached SignedData
+// embeds the content as a definite-length OCTET STRING, which needs the whole content buffered to
+// state its length, and signed attributes are required (a stream cannot be signed directly, and the
+// message-digest attribute is exactly what the streamed hash produces).
+async function _signStream(stream, signers, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.sign options");
+  guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "cms/bad-input", "unknown opts field ");
+  if (opts.detached !== true) {
+    throw _err("cms/bad-input", "a streaming (async-iterable) content requires opts.detached: true; an attached " +
+      "SignedData embeds the content as a definite-length OCTET STRING, which cannot be produced without buffering it");
+  }
+  if (opts.signedAttributes === false) {
+    throw _err("cms/bad-input", "a streaming content cannot be signed without signed attributes: the message-digest " +
+      "attribute is the streamed hash, and there is no content to sign directly (RFC 5652 sec. 5.4)");
+  }
+  var list = intrinsic.isArray(signers) ? signers : [signers];
+  if (!list.length) throw _err("cms/bad-input", "pki.cms.sign requires at least one signer");
+  var eContentType = opts.eContentType ? O(opts.eContentType) : OID_DATA;
+  if (eContentType === OID_PKI_DATA && list.length > 1 &&
+      intrinsic.some(list, function (s) { return s && s.cert == null && s.spki != null; })) {
+    throw _err("cms/bad-input",
+      "a key-only signer must be the ONLY SignerInfo in a Full PKI Request (RFC 5272 sec. 3.2)");
+  }
+  if (opts.signingTime != null && opts.signingTime !== false) guard.time.assertValid(opts.signingTime, _err, "cms/bad-input", "signingTime");
+  // Resolve every signer's context first (no stream consumed yet): this yields each SignerInfo's
+  // digest algorithm, so the stream can be hashed once under the distinct set.
+  var rcs = intrinsic.map(list, function (s) { return _resolveSignerContext(s, opts); });
+  var digestNames = [], seenDigest = {};
+  intrinsic.forEach(rcs, function (r) { if (!seenDigest[r.scheme.digest]) { seenDigest[r.scheme.digest] = 1; intrinsic.push(digestNames, r.scheme.digest); } });
+  var wcNames = intrinsic.map(digestNames, function (n) { return DIGEST_HASH[n]; });
+  // `await`, not `.then`: the streamed content's iterator runs during digestStream and could replace
+  // Promise.prototype.then (or Promise.all, whose spec-internal element handling dispatches through it)
+  // to drop SignerInfos from the emitted DER or bypass the non-empty-signer check. await and a captured
+  // await-each aggregation dispatch through no such caller-replaceable method.
+  var digests;
+  try {
+    digests = await subtle.digestStream(wcNames, stream);
+  } catch (e) {
+    // The engine reports malformed streamed content in its own domain; report it in this verb's domain
+    // instead, exactly as a buffered content's bad bytes are, rather than leaking the engine code. A
+    // non-byte chunk is webcrypto/data; a source whose async-iterator protocol is malformed (a
+    // non-callable next, or a factory returning a non-iterator) is webcrypto/syntax. The digest
+    // algorithm names are this module's own, so webcrypto/syntax here is never an algorithm fault.
+    if (e && e.code === "webcrypto/data") throw _err("cms/bad-input", "a streamed content chunk is not a byte source", e);
+    if (e && e.code === "webcrypto/syntax") throw _err("cms/bad-input", "the streamed content is not a valid async iterable of byte chunks", e);
+    throw e;
+  }
+  var byName = {};
+  intrinsic.forEach(digestNames, function (n, i) { byName[n] = intrinsic.bufferFrom(digests[i]); });
+  // Build each SignerInfo sequentially -- START it only as it is awaited -- rather than starting them
+  // all and awaiting each: awaiting is the capture-safe combinator (no Promise.all/.then the streamed
+  // content could replace), but starting all first would leave a later signer's rejection unobserved
+  // if an earlier one rejects, which Node can escalate to an unhandled-rejection crash. Per-signer work
+  // is small, so the sequential cost is negligible.
+  var built = [];
+  for (var _ip = 0; _ip < rcs.length; _ip++) {
+    intrinsic.push(built, await _finishSignerInfo(rcs[_ip], byName[rcs[_ip].scheme.digest], null, eContentType, opts));
+  }
+  return _assembleSignedData(built, eContentType, opts, null);
 }
 
 function _sign(content, signers, opts) {
@@ -422,45 +533,55 @@ function _sign(content, signers, opts) {
   // silently-ignored non-Date or an Invalid Date that would encode a garbage Time.
   if (opts.signingTime != null && opts.signingTime !== false) guard.time.assertValid(opts.signingTime, _err, "cms/bad-input", "signingTime");
 
-  return Promise.all(list.map(function (s) { return _buildSignerInfo(s, contentBuf, eContentType, opts); })).then(function (built) {
-    // digestAlgorithms: the distinct SignerInfo digestAlgorithm AlgorithmIdentifiers, deduped.
-    var seen = {}, digestAlgs = [];
-    built.forEach(function (x) { var k = x.digestAlgId.toString("hex"); if (!seen[k]) { seen[k] = 1; digestAlgs.push(x.digestAlgId); } });
-    // CMSVersion (RFC 5652 sec. 5.1): 3 if any SignerInfo is v3 (ski) or eContentType != id-data;
-    // otherwise 1 (v1 emits only X.509 certificates, so the v4/v5 attribute-certificate cases
-    // do not arise).
-    var v3 = built.some(function (x) { return x.version === 3; }) || eContentType !== OID_DATA;
-    var version = v3 ? 3 : 1;
-    // EncapsulatedContentInfo: eContentType + [0] EXPLICIT eContent (omitted when detached).
-    var encapFields = [b.oid(eContentType)];
-    if (!opts.detached) encapFields.push(b.explicit(0, b.octetString(contentBuf)));
-    var encap = b.sequence(encapFields);
-    // certificates [0] IMPLICIT SET OF (the signer certs), deduped + SET-OF-ordered, when embedded.
-    var sdFields = [b.integer(BigInt(version)), b.set(digestAlgs), encap];
-    if (opts.certificates !== false) {
-      // A key-only signer contributes no certificate (certDer is null), so the
-      // set can end up EMPTY -- and an empty certificates [0] is not the same as
-      // an absent one, so the field is omitted entirely in that case.
-      var certDers = _dedupe(built.map(function (x) { return x.certDer; })
-        .filter(function (d) { return d != null; })).sort(Buffer.compare);        // X.690 sec. 11.6
-      if (certDers.length) sdFields.push(b.contextConstructed(0, Buffer.concat(certDers)));   // [0] IMPLICIT SET OF
-    }
-    sdFields.push(b.set(built.map(function (x) { return x.si; })));                 // signerInfos SET OF
-    var signedData = b.sequence(sdFields);
-    var contentInfo = b.sequence([b.oid(OID_SIGNED_DATA), b.explicit(0, signedData)]);   // ContentInfo
-    return opts.pem ? pkix.pemEncode(contentInfo, "CMS", frameworkError.PemError) : contentInfo;
-  });
+  return Promise.all(list.map(function (s) { return _buildSignerInfo(s, contentBuf, eContentType, opts); }))
+    .then(function (built) { return _assembleSignedData(built, eContentType, opts, contentBuf); });
+}
+
+// Assemble the SignedData ContentInfo (RFC 5652 sec. 5.1) from the built SignerInfos: the deduped
+// digestAlgorithms set, the coupled CMSVersion, the EncapsulatedContentInfo (eContent omitted when
+// detached, the only form a streamed content takes), the deduped certificates [0], and the
+// signerInfos SET OF. `contentBuf` is the content bytes for the attached form, or null when detached.
+function _assembleSignedData(built, eContentType, opts, contentBuf) {
+  // digestAlgorithms: the distinct SignerInfo digestAlgorithm AlgorithmIdentifiers, deduped. Captured
+  // enumeration throughout: this assembly runs after a streamed content's iterator may have replaced
+  // Array.prototype.map / forEach / Buffer.prototype.toString, and a live one could drop SignerInfos
+  // from the emitted CMS or mis-dedup the algorithm / certificate sets.
+  var seen = {}, digestAlgs = [];
+  intrinsic.forEach(built, function (x) { var k = intrinsic.bufToString(x.digestAlgId, "hex"); if (!seen[k]) { seen[k] = 1; intrinsic.push(digestAlgs, x.digestAlgId); } });
+  // CMSVersion (RFC 5652 sec. 5.1): 3 if any SignerInfo is v3 (ski) or eContentType != id-data;
+  // otherwise 1 (v1 emits only X.509 certificates, so the v4/v5 attribute-certificate cases
+  // do not arise).
+  var v3 = intrinsic.some(built, function (x) { return x.version === 3; }) || eContentType !== OID_DATA;
+  var version = v3 ? 3 : 1;
+  // EncapsulatedContentInfo: eContentType + [0] EXPLICIT eContent (omitted when detached).
+  var encapFields = [b.oid(eContentType)];
+  if (!opts.detached) intrinsic.push(encapFields, b.explicit(0, b.octetString(contentBuf)));
+  var encap = b.sequence(encapFields);
+  // certificates [0] IMPLICIT SET OF (the signer certs), deduped + SET-OF-ordered, when embedded.
+  var sdFields = [b.integer(BigInt(version)), b.set(digestAlgs), encap];
+  if (opts.certificates !== false) {
+    // A key-only signer contributes no certificate (certDer is null), so the
+    // set can end up EMPTY -- and an empty certificates [0] is not the same as
+    // an absent one, so the field is omitted entirely in that case.
+    var certDers = intrinsic.sort(_dedupe(intrinsic.filter(intrinsic.map(built, function (x) { return x.certDer; }),
+      function (d) { return d != null; })), intrinsic.compare);        // X.690 sec. 11.6
+    if (certDers.length) intrinsic.push(sdFields, b.contextConstructed(0, intrinsic.bufferConcat(certDers)));   // [0] IMPLICIT SET OF
+  }
+  intrinsic.push(sdFields, b.set(intrinsic.map(built, function (x) { return x.si; })));                 // signerInfos SET OF
+  var signedData = b.sequence(sdFields);
+  var contentInfo = b.sequence([b.oid(OID_SIGNED_DATA), b.explicit(0, signedData)]);   // ContentInfo
+  return opts.pem ? pkix.pemEncode(contentInfo, "CMS", frameworkError.PemError) : contentInfo;
 }
 
 // Dedupe certificate DERs (two signers may share a cert, so embed it once).
 function _dedupe(ders) {
   var seen = {}, out = [];
-  ders.forEach(function (d) { var k = d.toString("hex"); if (!seen[k]) { seen[k] = 1; out.push(d); } });
+  intrinsic.forEach(ders, function (d) { var k = intrinsic.bufToString(d, "hex"); if (!seen[k]) { seen[k] = 1; intrinsic.push(out, d); } });
   return out;
 }
 
 function _toBuf(v, what) {
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmsError, "cms/bad-input", what);
+  if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, CmsError, "cms/bad-input", what);
   throw _err("cms/bad-input", what + " must be a Buffer");
 }