@blamejs/pki 0.5.31 → 0.5.33

package/lib/crl-sign.js

@@ -180,7 +180,7 @@ function _resolveReason(reason, isDelta) {
 // The AKI keyIdentifier from the issuer: an explicit Buffer, or true -> the issuer cert's subjectKeyIdentifier,
 // else the SHA-1 of the issuer SPKI (RFC 5280 sec. 5.2.1 key-identifier method).
 function _akiKeyId(val, ctx) {
-  if (Buffer.isBuffer(val)) return guard.bytes.snapshot(val, CrlError, "crl/bad-input", "the authorityKeyIdentifier keyIdentifier");
+  if (guard.bytes.isByteSource(val)) return guard.bytes.snapshotSource(val, CrlError, "crl/bad-input", "the authorityKeyIdentifier keyIdentifier");
   if (val === true) {
     if (ctx.issuerCert) {
       var ski = (ctx.issuerCert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
@@ -597,7 +597,7 @@ function _coerceCrl(crl) {
 // names, are separate questions that only a certificate can answer.
 function _resolveIssuer(issuer) {
   if (issuer == null) throw _err("crl/bad-input", "an issuer is required to verify a CRL");
-  if (Buffer.isBuffer(issuer)) { _assertValidSpki(issuer, "issuer SPKI"); return { spki: issuer, cert: null }; }
+  if (guard.bytes.isByteSource(issuer)) { var _isp = guard.bytes.source(issuer, CrlError, "crl/bad-input", "issuer SPKI"); _assertValidSpki(_isp, "issuer SPKI"); return { spki: _isp, cert: null }; }
   if (issuer.cert != null) { var ic = _parseIssuerCert(issuer.cert); return { spki: ic.subjectPublicKeyInfo.bytes, cert: ic }; }
   if (issuer.publicKey != null) { var spki = _reqDer(issuer.publicKey, "issuer.publicKey"); _assertValidSpki(spki, "issuer.publicKey"); return { spki: spki, cert: null }; }
   // A parsed certificate passed directly. It reaches the same identity and cRLSign checks the
@@ -685,8 +685,8 @@ function _serialHexOf(serial) {
   if (typeof serial === "bigint") v = serial;
   else if (typeof serial === "number") { if (!Number.isSafeInteger(serial)) throw _err("crl/bad-input", "serialNumber number must be a safe integer (pass a BigInt, hex string, or Buffer)"); v = BigInt(serial); }
   else if (typeof serial === "string") { try { v = BigInt(serial); } catch (e) { throw _err("crl/bad-input", "serialNumber string must be a decimal or 0x-hex integer", e); } }
-  else if (Buffer.isBuffer(serial)) { v = serial.length ? BigInt("0x" + serial.toString("hex")) : 0n; }
-  else throw _err("crl/bad-input", "serialNumber must be a BigInt, integer, hex string, or Buffer");
+  else if (guard.bytes.isByteSource(serial)) { var _sb = guard.bytes.source(serial, CrlError, "crl/bad-input", "serialNumber"); v = _sb.length ? BigInt("0x" + _sb.toString("hex")) : 0n; }
+  else throw _err("crl/bad-input", "serialNumber must be a BigInt, integer, hex string, or BufferSource");
   if (v <= 0n) throw _err("crl/bad-input", "serialNumber must be a positive integer");
   // Match schema-crl's serialNumberHex: the DER INTEGER content octets (preserving sign padding).
   return asn1.decode(b.integer(v)).content.toString("hex");

package/lib/crmf-sign.js

@@ -328,7 +328,8 @@ function _buildEncryptedKeyPop(pop, outerTag, template) {
   // reject. CBC is the default here for that reason, not as a preference between the two.
   var cea = pop.contentEncryptionAlgorithm || "aes-256-cbc";
   if (typeof cea !== "string") throw _err("crmf/bad-input", "pop.contentEncryptionAlgorithm must be an algorithm name");
-  if (/gcm|ccm|chacha/i.test(cea)) {
+  var _ceaLc = intrinsic.toLowerCase(cea);   // /gcm|ccm|chacha/i (ASCII algorithm name)
+  if (intrinsic.stringIndexOf(_ceaLc, "gcm") !== -1 || intrinsic.stringIndexOf(_ceaLc, "ccm") !== -1 || intrinsic.stringIndexOf(_ceaLc, "chacha") !== -1) {
     throw _err("crmf/bad-popo", "encryptedKey is typed EnvelopedData, and the AEAD algorithm " + cea +
       " produces an AuthEnvelopedData instead (RFC 5083) -- choose a CBC content-encryption algorithm");
   }

package/lib/csr-sign.js

@@ -47,9 +47,6 @@ var _b = pkiBuild.makeBuilder({
   NAME_SCHEMA: pkix.name(NS), SPKI_SCHEMA: pkix.spki(NS), EXT_DECODERS: EXT_DECODERS,
 });
 
-// challengePassword DirectoryString charset (PrintableString set); anything else uses UTF8String.
-var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
-
 // attributes ::= [0] IMPLICIT SET OF Attribute (RFC 2986). The IMPLICIT tag replaces the universal SET,
 // so it is a context-constructed [0] whose DER-sorted members ARE the SET-OF; empty -> A0 00.
 function _implicitSetOf0(members) {
@@ -64,7 +61,7 @@ function _buildRequestedExtensions(extSpec, subjectSpki) { return _b.requestedEx
 // value is in that charset, else UTF8String; never a Teletex/BMP/Universal string for a new value.
 function _challengePassword(pw) {
   if (typeof pw !== "string" || pw.length < 1 || pw.length > 255) throw _err("csr/bad-input", "challengePassword must be a 1..255 character string (RFC 2985 sec. 5.4.1)");
-  return PRINTABLE_RE.test(pw) ? b.printable(pw) : b.utf8(pw);
+  return asn1.isPrintableString(pw) ? b.printable(pw) : b.utf8(pw);
 }
 
 /**

package/lib/ct.js

@@ -49,6 +49,10 @@ var intrinsic = require("./guard-intrinsic.js");
 // replaceable properties to answer one thing, and here it decides whether a log state is one this
 // toolkit trusts -- answering true for a name the table never carried trusts an untrusted log.
 var _hasOwn = intrinsic.hasOwn;
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _JSON_SUFFIX = ".json";
+// A pathname ending with the literal ".json" suffix (matching /\.json$/), by suffix compare (no regex).
+function _endsWithJson(s) { return s.length >= _JSON_SUFFIX.length && _strSlice(s, s.length - _JSON_SUFFIX.length) === _JSON_SUFFIX; }
 var ByteReader = require("./byte-reader.js");
 var ByteWriter = require("./byte-writer.js");
 var oid = require("./oid.js");
@@ -973,9 +977,9 @@ function _parseHttpsUrl(u, label) {
 // yield an unambiguous sig URL, so the caller must pass opts.sigUrl explicitly (guards never guess a value).
 // The derived URL inherits the json URL's https origin.
 function _sigUrlFor(parsed) {
-  if (!/\.json$/.test(parsed.pathname)) throw _ctErr("ct/bad-input", "cannot derive the detached-signature URL from a non-.json path (" + JSON.stringify(parsed.pathname) + "); pass opts.sigUrl explicitly");
+  if (!_endsWithJson(parsed.pathname)) throw _ctErr("ct/bad-input", "cannot derive the detached-signature URL from a non-.json path (" + JSON.stringify(parsed.pathname) + "); pass opts.sigUrl explicitly");
   var sig = new URL(parsed.href);
-  sig.pathname = parsed.pathname.replace(/\.json$/, ".sig");
+  sig.pathname = _strSlice(parsed.pathname, 0, parsed.pathname.length - _JSON_SUFFIX.length) + ".sig";
   return sig.href;
 }
 
@@ -994,8 +998,8 @@ function _fetchBody(transport, url, req, label) {
     res = res || {};
     var h = {};
     Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
-    var body = (Buffer.isBuffer(res.body) || res.body instanceof Uint8Array)
-      ? guard.bytes.view(res.body, CtError, "ct/bad-input", label)
+    var body = guard.bytes.isByteSource(res.body)
+      ? guard.bytes.source(res.body, CtError, "ct/bad-input", label)
       : Buffer.from(String(res.body == null ? "" : res.body), "utf8");
     if (body.length > req.maxResponseBytes) throw _ctErr("ct/response-too-large", "the " + label + " (" + body.length + " bytes) exceeds the " + req.maxResponseBytes + "-byte cap");
     if (res.status !== 200) throw _ctErr("ct/http-error", "the CT server returned HTTP " + JSON.stringify(res.status) + " for the " + label);

package/lib/est.js

@@ -73,6 +73,10 @@ var crmfFmt = require("./schema-crmf");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _toLowerCase = intrinsic.uncurry(String.prototype.toLowerCase);
+var pkix = require("./schema-pkix");   // shared base64-whitespace strip + JS-\s predicate
 // Own-key membership through an operation taken at load: written out it reads two replaceable
 // properties to answer one question, and here it decides which fields of a response are copied.
 var _hasOwn = intrinsic.hasOwn;
@@ -85,6 +89,14 @@ function E(code, message, cause) { return new EstError(code, message, cause); }
 var ID_SIGNED_DATA = oid.byName("signedData");
 var OID_CHALLENGE_PASSWORD = oid.byName("challengePassword");
 var OID_DECRYPT_KEY_ID = oid.byName("decryptKeyID");
+
+// Charset tables built once from the shared pkix.charTable / pkix.allCharsIn char-scan home.
+var _DIGITS_TABLE = pkix.charTable("0123456789");                                                          // /^[0-9]+$/
+var _LABEL_TABLE = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._~-");   // /^[A-Za-z0-9._~-]+$/
+
+// Trailing-slash strip (/\/+$/ -> ""): the length after dropping a run of trailing "/" (0x2f); the
+// caller slices to it, so the removed regex read is traded for the slice that replaces it.
+function _stripTrailingSlashEnd(s) { var end = s.length; while (end > 0 && _charCodeAt(s, end - 1) === 0x2f) end -= 1; return end; }
 var OID_ASYMM_DECRYPT_KEY_ID = oid.byName("asymmDecryptKeyID");
 var OID_SMIME_CAPABILITIES = oid.byName("smimeCapabilities");
 var OID_TEMPLATE = oid.byName("certificationRequestInfoTemplate");
@@ -175,7 +187,7 @@ function transferDecode(body) {
   var s = guard.text.decode(body, cap, EstError, {
     charset: "latin1", tooLarge: "est/too-large", badInput: "est/bad-input", label: "the EST payload",
   });
-  var stripped = s.replace(/[\r\n \t]/g, "");
+  var stripped = pkix.stripBase64Whitespace(s);
   // Strict canonical RFC 4648 base64 (RFC 8951 sec. 3.1) via the shared encoding
   // guard: the alphabet + whole-4-group + canonical round-trip fail a malformed
   // body closed instead of silently truncating to a shorter, different DER.
@@ -208,11 +220,31 @@ function transferEncode(der) {
 
 // ---- the multipart/mixed splitter (/serverkeygen) -----------------------
 
+// Case-insensitive ASCII prefix test: does `s` begin with the uppercase literal `litUpper`?
+function _ciStartsWith(s, litUpper) {
+  if (s.length < litUpper.length) return false;
+  for (var k = 0; k < litUpper.length; k++) {
+    var c = _charCodeAt(s, k);
+    if (c >= 97 && c <= 122) c -= 32;   // fold lowercase -> uppercase
+    if (c !== _charCodeAt(litUpper, k)) return false;
+  }
+  return true;
+}
+// /^multipart\/mixed\s*(;|$)/i by character scan: the media type "multipart/mixed" (case-insensitive),
+// then JS \s* whitespace, then a `;` parameter separator or end of the header value.
+var _MULTIPART_MIXED = "MULTIPART/MIXED";
+function _isMultipartMixedPrefix(ct) {
+  if (!_ciStartsWith(ct, _MULTIPART_MIXED)) return false;
+  var p = _MULTIPART_MIXED.length;
+  while (p < ct.length && pkix.isJsWhitespace(_charCodeAt(ct, p))) p++;
+  return p === ct.length || _charCodeAt(ct, p) === 0x3b;
+}
+
 // Extract the boundary from a `multipart/mixed; boundary=...` content-type,
 // tolerating whitespace before the semicolon (erratum 5779 REJECTED the ban).
 function _multipartBoundary(contentType) {
   var ct = String(contentType || "");
-  if (!/^multipart\/mixed\s*(;|$)/i.test(ct)) return null;
+  if (!_isMultipartMixedPrefix(ct)) return null;
   // Two boundaries name two different splits of the same body; there is no reading
   // of that header, so it is refused rather than resolved by taking the first.
   var bp = _ctParam(ct, "boundary");
@@ -223,6 +255,94 @@ function _multipartBoundary(contentType) {
   return bp.value;
 }
 
+// A boundary delimiter at a candidate line start `ls`: `--boundary`, an optional `--` close marker, optional
+// SP/HTAB transport-padding, then a CRLF/LF or end-of-text. Returns { end, close } (end = the index past the
+// trailing line terminator) or null. `(--)?` is taken greedily without backtracking loss: a `-` can be neither
+// padding nor a terminator, so if the close marker is present it is the only possible parse.
+function _matchDelimAt(text, ls, boundary) {
+  var n = text.length, q = ls, blen = boundary.length, k;
+  if (q + 2 > n || _charCodeAt(text, q) !== 0x2d || _charCodeAt(text, q + 1) !== 0x2d) return null;
+  q += 2;
+  if (q + blen > n) return null;
+  for (k = 0; k < blen; k++) { if (_charCodeAt(text, q + k) !== _charCodeAt(boundary, k)) return null; }
+  q += blen;
+  var close = false;
+  if (q + 2 <= n && _charCodeAt(text, q) === 0x2d && _charCodeAt(text, q + 1) === 0x2d) { close = true; q += 2; }
+  while (q < n && (_charCodeAt(text, q) === 0x20 || _charCodeAt(text, q) === 0x09)) q += 1;
+  if (q === n) return { end: q, close: close };
+  if (_charCodeAt(text, q) === 0x0a) return { end: q + 1, close: close };
+  if (_charCodeAt(text, q) === 0x0d && q + 1 < n && _charCodeAt(text, q + 1) === 0x0a) return { end: q + 2, close: close };
+  return null;
+}
+// Every delimiter in `text`, replacing the global /(?:^|\r?\n)--boundary(--)?[ \t]*(?:\r?\n|$)/g scan: a
+// delimiter begins the text or follows a CRLF/LF (which the match CONSUMES), so `at` is the index of that
+// leading terminator (0 at the start) and `bodyStart` is the index past the trailing one. The leftmost match
+// at or after the previous `bodyStart` is taken, so two adjacent delimiters share one terminator and only the
+// first is found -- the same non-overlapping behavior the regex has.
+function _findMultipartMarks(text, boundary) {
+  var marks = [], n = text.length, searchStart = 0, p;
+  while (searchStart <= n) {
+    var found = null, foundAt = -1;
+    for (p = searchStart; p <= n; p++) {
+      if (p === 0) { var r0 = _matchDelimAt(text, 0, boundary); if (r0) { found = r0; foundAt = 0; break; } }
+      var lsN = -1;
+      if (_charCodeAt(text, p) === 0x0a) lsN = p + 1;
+      else if (_charCodeAt(text, p) === 0x0d && p + 1 < n && _charCodeAt(text, p + 1) === 0x0a) lsN = p + 2;
+      if (lsN !== -1) { var r1 = _matchDelimAt(text, lsN, boundary); if (r1) { found = r1; foundAt = p; break; } }
+    }
+    if (!found) break;
+    marks[marks.length] = { at: foundAt, bodyStart: found.end, close: found.close };
+    searchStart = found.end === foundAt ? found.end + 1 : found.end;
+  }
+  return marks;
+}
+// Strip the part-body framing the regexes /^(\r?\n){2}/ and /\r?\n$/ removed: the two leading line terminators
+// (all-or-nothing) that follow the header/body separator, and one trailing terminator.
+function _stripTwoLeadingEol(seg, from) {
+  var q = from;
+  for (var t = 0; t < 2; t++) {
+    if (_charCodeAt(seg, q) === 0x0d && _charCodeAt(seg, q + 1) === 0x0a) q += 2;
+    else if (_charCodeAt(seg, q) === 0x0a) q += 1;
+    else return from;
+  }
+  return q;
+}
+function _stripOneTrailingEol(seg, end) {
+  if (end >= 1 && _charCodeAt(seg, end - 1) === 0x0a) {
+    if (end >= 2 && _charCodeAt(seg, end - 2) === 0x0d) return end - 2;
+    return end - 1;
+  }
+  return end;
+}
+// Unfold folded MIME header lines (/\r?\n(?=[ \t])/g -> ""): a CRLF/LF immediately followed by SP/HTAB is a
+// FOLD, not a header break, so the terminator is dropped while the whitespace stays.
+function _unfoldHeaders(raw) {
+  var out = "", last = 0, i = 0, n = raw.length;
+  while (i < n) {
+    var nlLen = 0;
+    if (_charCodeAt(raw, i) === 0x0d && i + 1 < n && _charCodeAt(raw, i + 1) === 0x0a) nlLen = 2;
+    else if (_charCodeAt(raw, i) === 0x0a) nlLen = 1;
+    if (nlLen > 0) {
+      var after = i + nlLen;
+      if (after < n && (_charCodeAt(raw, after) === 0x20 || _charCodeAt(raw, after) === 0x09)) { out += _strSlice(raw, last, i); last = after; i = after; continue; }
+    }
+    i += 1;
+  }
+  return out + _strSlice(raw, last, n);
+}
+// Split on CRLF/LF (.split(/\r?\n/)) by character scan, preserving JS split semantics (leading/trailing "").
+function _splitCrlf(s) {
+  var out = [], last = 0, i = 0, n = s.length;
+  while (i < n) {
+    var nlLen = 0;
+    if (_charCodeAt(s, i) === 0x0d && i + 1 < n && _charCodeAt(s, i + 1) === 0x0a) nlLen = 2;
+    else if (_charCodeAt(s, i) === 0x0a) nlLen = 1;
+    if (nlLen > 0) { out[out.length] = _strSlice(s, last, i); i += nlLen; last = i; } else i += 1;
+  }
+  out[out.length] = _strSlice(s, last, n);
+  return out;
+}
+
 // Split a multipart/mixed body into its parts, each { headers, contentType,
 // body }. A boundary delimiter is `--boundary` only at the START OF A LINE (body
 // start or after CRLF), optional transport-padding, then CRLF (a part) or `--`
@@ -234,34 +354,30 @@ function splitMultipartMixed(body, contentType) {
   var text = guard.text.decode(body, constants.LIMITS.DER_MAX_BYTES * 2, EstError, {
     charset: "latin1", tooLarge: "est/too-large", badInput: "est/bad-input", label: "the multipart body",
   });
-  var esc = boundary.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  var delimRe = new RegExp("(?:^|\\r?\\n)--" + esc + "(--)?[ \\t]*(?:\\r?\\n|$)", "g");
-  var marks = [], m;
-  while ((m = delimRe.exec(text)) !== null) {
-    marks.push({ at: m.index, bodyStart: delimRe.lastIndex, close: m[1] === "--" });
-    if (delimRe.lastIndex === m.index) delimRe.lastIndex += 1;   // guard a zero-length match
-  }
+  var marks = _findMultipartMarks(text, boundary);
   var closeAt = -1;
   for (var c = 0; c < marks.length; c++) { if (marks[c].close) { closeAt = c; break; } }
   if (closeAt === -1) throw E("est/bad-multipart", "the multipart body is missing its terminal boundary (RFC 2046)");
   var parts = [];
   for (var i = 0; i < closeAt; i++) {
-    var seg = text.slice(marks[i].bodyStart, marks[i + 1].at);   // between this delimiter and the next
+    var seg = _strSlice(text, marks[i].bodyStart, marks[i + 1].at);   // between this delimiter and the next
     var sep = seg.indexOf("\r\n\r\n");
     if (sep === -1) sep = seg.indexOf("\n\n");
     if (sep === -1) throw E("est/bad-multipart", "a multipart part is missing its header/body separator");
-    var rawHeaders = seg.slice(0, sep);
-    var partBody = seg.slice(sep).replace(/^(\r?\n){2}/, "").replace(/\r?\n$/, "");
+    var rawHeaders = _strSlice(seg, 0, sep);
+    var partBody = _strSlice(seg, _stripTwoLeadingEol(seg, sep), _stripOneTrailingEol(seg, seg.length));
     var headers = {};
     // Unfold MIME part headers (RFC 5322 sec. 2.2.3 / RFC 2046): a CRLF immediately followed by whitespace is a
     // FOLD, not a header break, so it is removed before the split -- a Content-Type whose smime-type parameter
     // continues on the next line must be read whole, not truncated.
-    rawHeaders.replace(/\r?\n(?=[ \t])/g, "").split(/\r?\n/).forEach(function (line) {
+    var lines = _splitCrlf(_unfoldHeaders(rawHeaders));
+    for (var li = 0; li < lines.length; li++) {
+      var line = lines[li];
       var col = line.indexOf(":");
       if (col > 0) headers[line.slice(0, col).trim().toLowerCase()] = line.slice(col + 1).trim();
-    });
+    }
     var partCt = headers["content-type"] || "";
-    if (/^multipart\//i.test(partCt)) throw E("est/bad-multipart", "a nested multipart part is not permitted");
+    if (_ciStartsWith(partCt, "MULTIPART/")) throw E("est/bad-multipart", "a nested multipart part is not permitted");
     parts.push({ headers: headers, contentType: partCt, body: partBody });
   }
   return parts;
@@ -376,7 +492,7 @@ function _recipientMatches(recipientInfos, opts) {
     var sn = ias.serialNumber, want;
     if (typeof sn === "bigint" && sn >= 0n) want = sn;
     else if (typeof sn === "number" && Number.isSafeInteger(sn) && sn >= 0) want = BigInt(sn);
-    else if (typeof sn === "string" && /^[0-9]+$/.test(sn)) want = BigInt(sn);
+    else if (typeof sn === "string" && pkix.allCharsIn(sn, _DIGITS_TABLE)) want = BigInt(sn);
     else throw E("est/bad-input", "expectedRecipientIssuerSerial.serialNumber must be a NON-NEGATIVE bigint, a safe non-negative integer, or a decimal digit string (a certificate serial is non-negative, RFC 5280 sec. 4.1.2.2)");
     // An issuerAndSerialNumber names an ASYMMETRIC recipient -- a certificate identity the server derived from
     // an AsymmetricDecryptKeyIdentifier (RFC 7030 sec. 4.4.2); a symmetric KEK recipient has none. So a SYMMETRIC
@@ -442,12 +558,31 @@ function _ctParam(contentType, name) {
   return { value: value, duplicated: count > 1 };
 }
 
+// A media type `type/subtype` by character scan (RFC 2045 sec. 5.1 restricted token): the first character
+// of each part is alphanumeric, the rest add !#$&^_.+- (case-insensitive), exactly one `/` separates them.
+var _MT_FIRST = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
+var _MT_REST = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$&^_.+-");
+function _isMediaToken(s, from, to) {
+  if (to <= from || !_MT_FIRST[_charCodeAt(s, from)]) return false;
+  for (var i = from + 1; i < to; i++) { if (!_MT_REST[_charCodeAt(s, i)]) return false; }
+  return true;
+}
+// /^\s*([a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*)\s*$/i -> the lowercased media type, or null:
+// trim JS whitespace, require a single `/` splitting two restricted tokens.
+function _mediaType(seg) {
+  var a = 0, b = seg.length, slash = -1, i;
+  while (a < b && pkix.isJsWhitespace(_charCodeAt(seg, a))) a += 1;
+  while (b > a && pkix.isJsWhitespace(_charCodeAt(seg, b - 1))) b -= 1;
+  for (i = a; i < b; i++) { if (_charCodeAt(seg, i) === 0x2f) { if (slash !== -1) return null; slash = i; } }
+  if (slash === -1 || !_isMediaToken(seg, a, slash) || !_isMediaToken(seg, slash + 1, b)) return null;
+  return _toLowerCase(_strSlice(seg, a, b));
+}
+
 function _partMediaType(contentType) {
   var segs = _splitContentTypeParams(String(contentType || ""));
-  var mediaMatch = /^\s*([a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*)\s*$/i.exec(segs[0]);
   var st = _ctParam(contentType, "smime-type");
   return {
-    media: mediaMatch ? mediaMatch[1].toLowerCase() : null,
+    media: _mediaType(segs[0]),
     smimeType: st.value === null ? null : st.value.toLowerCase(),
     ambiguous: st.duplicated,
   };
@@ -679,14 +814,15 @@ function classifyResponse(status, headers, body, opts) {
 function paths(baseUrl, opts) {
   opts = opts || {};
   _knownOpts(opts, PATHS_OPTS, "paths");
-  var prefix = String(baseUrl).replace(/\/+$/, "") + "/.well-known/est";
+  var base = String(baseUrl);
+  var prefix = base.slice(0, _stripTrailingSlashEnd(base)) + "/.well-known/est";
   if (opts.label != null) {
     var label = String(opts.label);
     // A label is ONE URL path segment: unreserved characters only (RFC 3986),
     // never a dot-segment or an operation name. Rejecting rather than
     // percent-encoding keeps a reserved char (`/` `?` `#` `%`) or `..` from
     // silently retargeting the request to a different resource.
-    if (label === "" || label === "." || label === ".." || !/^[A-Za-z0-9._~-]+$/.test(label) || OPERATIONS.indexOf(label) !== -1) {
+    if (label === "" || label === "." || label === ".." || !pkix.allCharsIn(label, _LABEL_TABLE) || OPERATIONS.indexOf(label) !== -1) {
       throw E("est/bad-label", "an EST CA label must be a single path segment of unreserved characters, not '.' / '..' or an operation name (RFC 7030 sec. 3.2.2)");
     }
     prefix += "/" + label;
@@ -707,8 +843,10 @@ function challengePasswordFromTlsUnique(channelBinding) {
   // The count comes from the guard, so an own `length` on the caller's Buffer cannot report a
   // full one as empty. `length` is shadowable on any instance, and `Object.defineProperty(buf,
   // "length", { get: function () { return 0; } })` had this refuse bytes that were there.
-  if (!Buffer.isBuffer(channelBinding) || guard.bytes.lengthOf(channelBinding) === 0) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
-  var b64 = guard.bytes.view(channelBinding, EstError, "est/bad-input", "the channel-binding bytes").toString("base64");
+  if (!guard.bytes.isByteSource(channelBinding)) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
+  var _cb = guard.bytes.source(channelBinding, EstError, "est/bad-input", "the channel-binding bytes");
+  if (_cb.length === 0) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
+  var b64 = _cb.toString("base64");
   if (b64.length > 255) throw E("est/tls-unique-too-long", "the base64 tls-unique value exceeds 255 octets (RFC 7030 sec. 3.5)");
   return _attr(OID_CHALLENGE_PASSWORD, [asn1.build.printable(b64)]);
 }
@@ -834,9 +972,9 @@ var MAX_TIMEOUT = constants.TIME.seconds(600);
 // The DER of a caller-supplied CSR: a DER Buffer as-is, or a PEM "CERTIFICATE REQUEST"
 // decoded. Any other input is a config-time est/bad-input.
 function _csrDer(input) {
-  if (Buffer.isBuffer(input)) return guard.bytes.snapshot(input, EstError, "est/bad-input", "a CSR");
+  if (guard.bytes.isByteSource(input)) return guard.bytes.snapshotSource(input, EstError, "est/bad-input", "a CSR");
   if (typeof input === "string") return csr.pemDecode(input);
-  throw E("est/bad-input", "a CSR must be a DER Buffer or a PEM CERTIFICATE REQUEST string");
+  throw E("est/bad-input", "a CSR must be a DER BufferSource or a PEM CERTIFICATE REQUEST string");
 }
 
 // Parse + validate the request URL BEFORE any transport is called: a URL that will not
@@ -880,9 +1018,47 @@ function _redirectTarget(current, location, method, opts) {
 // which must NOT be read as a Basic challenge), then the scheme is matched at the start or after a
 // comma-separated challenge, followed by whitespace / a comma / end -- never a substring, so `Digest
 // realm="basic"` is not taken as Basic. `scheme` is always our own literal ("Basic" / "Digest").
+// Blank the CONTENTS of every complete quoted-string (/"(?:[^"\\]|\\.)*"/g -> `""`) by character scan: a
+// `\` escapes the next character, so `\"` does not close; an unterminated final quote is left as written
+// (the regex only matches a closed quoted-string).
+function _blankQuotedStrings(s) {
+  var out = "", last = 0, i = 0, n = s.length;
+  while (i < n) {
+    if (_charCodeAt(s, i) === 0x22) {
+      var j = i + 1, closed = -1;
+      while (j < n) { var c = _charCodeAt(s, j); if (c === 0x5c) { j += 2; continue; } if (c === 0x22) { closed = j; break; } j += 1; }
+      if (closed === -1) break;
+      out += _strSlice(s, last, i) + "\"\"";
+      last = closed + 1; i = closed + 1;
+    } else i += 1;
+  }
+  return out + _strSlice(s, last, n);
+}
+// Is `scheme` (our own literal, case-insensitive) offered as a challenge TOKEN in the blanked header?
+// (?:^|,)\s*SCHEME(?=[\s,]|$): at the start or after a comma, optional whitespace, the scheme, then a
+// whitespace / comma / end boundary -- never a substring, so `Digest realm="basic"` is not read as Basic.
+function _schemeOffered(s, scheme) {
+  var n = s.length, slen = scheme.length, p, k;
+  for (p = 0; p <= n; p++) {
+    if (p !== 0 && _charCodeAt(s, p - 1) !== 0x2c) continue;
+    var q = p;
+    while (q < n && pkix.isJsWhitespace(_charCodeAt(s, q))) q += 1;
+    if (q + slen > n) continue;
+    var ok = true;
+    for (k = 0; k < slen; k++) {
+      var x = _charCodeAt(s, q + k), y = _charCodeAt(scheme, k);
+      if (x >= 65 && x <= 90) x += 32;
+      if (y >= 65 && y <= 90) y += 32;
+      if (x !== y) { ok = false; break; }
+    }
+    if (!ok) continue;
+    var after = q + slen;
+    if (after === n || pkix.isJsWhitespace(_charCodeAt(s, after)) || _charCodeAt(s, after) === 0x2c) return true;
+  }
+  return false;
+}
 function _offersScheme(www, scheme) {
-  var s = String(www || "").replace(/"(?:[^"\\]|\\.)*"/g, "\"\"");
-  return new RegExp("(?:^|,)\\s*" + scheme + "(?=[\\s,]|$)", "i").test(s);
+  return _schemeOffered(_blankQuotedStrings(String(www || "")), scheme);
 }
 // The chosen HTTP auth scheme: an explicit opts.auth.scheme wins; a legacy opts.username / opts.password
 // WITHOUT opts.auth means Basic (backwards compatible); otherwise none. There is NO scheme:"auto" -- a
@@ -1573,8 +1749,8 @@ function _collectNestedPaths(list, prefix, out, depth) {
 function _assertAgrees(name, supplied, carried) {
   if (supplied == null) return;
   var same;
-  if (Buffer.isBuffer(supplied) || supplied instanceof Uint8Array) {
-    same = Buffer.isBuffer(carried) && Buffer.from(supplied).equals(carried);
+  if (guard.bytes.isByteSource(supplied)) {
+    same = Buffer.isBuffer(carried) && guard.bytes.source(supplied, EstError, "est/bad-input", "opts.senderNonce").equals(carried);
   } else {
     // Through the shared authoring guard, not a bare BigInt(): a `number` above
     // Number.MAX_SAFE_INTEGER has already lost the digits that distinguish it from
@@ -1624,8 +1800,8 @@ function _shallowCopy(o) {
 function _cmcRequestDer(request) {
   // COPIED, not aliased: these bytes are parsed now (for the requested keys) and
   // transmitted later, so sharing the caller's buffer would let the two disagree.
-  if (Buffer.isBuffer(request) || request instanceof Uint8Array) {
-    return guard.bytes.snapshot(request, EstError, "est/bad-input", "the Full PKI Request");
+  if (guard.bytes.isByteSource(request)) {
+    return guard.bytes.snapshotSource(request, EstError, "est/bad-input", "the Full PKI Request");
   }
   if (typeof request === "string") return cms.pemDecode(request);
   throw E("est/bad-input", "pki.est.fullcmc requires the Full PKI Request as DER bytes or a PEM CMS block");
@@ -1991,13 +2167,37 @@ function _serverkeygenEncryptionFromCsr(csrDer) {
 // The delivered private key rides TLS confidentiality alone: a NULL / anonymous / EXPORT suite MUST NOT be
 // used to carry it (RFC 7030 sec. 4.4, sec. 6). Assert (never reconfigure) the negotiated cipher when the
 // transport surfaces it; an injected transport that reports no cipher is trusted (the test/loopback channel).
+// The weak-cipher token scan (RFC 3986/2119-free ASCII, by character code): a "word" character is
+// [A-Za-z0-9_] (regex \w), and a boundary (\b) sits where a word character meets a non-word one or a
+// string edge. `_subAt`/`_containsSub` test a literal token at / anywhere in an already-uppercased name.
+function _isWordChar(c) { return (c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 95; }
+function _subAt(s, sub, i) { var m = sub.length; if (i + m > s.length) return false; for (var k = 0; k < m; k++) { if (_charCodeAt(s, i + k) !== _charCodeAt(sub, k)) return false; } return true; }
+function _containsSub(s, sub) { for (var i = 0; i + sub.length <= s.length; i++) { if (_subAt(s, sub, i)) return true; } return false; }
+function _wbBefore(s, i) { return i === 0 || !_isWordChar(_charCodeAt(s, i - 1)); }
+function _wbAfter(s, j) { return j === s.length || !_isWordChar(_charCodeAt(s, j)); }
+// /NULL|ANON|EXPORT|\bEXP[-_0-9]|\bA(EC)?DH\b/ over the uppercased name: the three plain substrings, then
+// EXP at a word boundary followed by a separator OR a digit run (EXP-RC4-MD5, EXP1024-RC4-SHA -- a bare
+// \bEXP\b misses EXP1024), then ADH / AECDH each bounded on both sides.
+function _hasWeakCipherToken(name) {
+  if (_containsSub(name, "NULL") || _containsSub(name, "ANON") || _containsSub(name, "EXPORT")) return true;
+  var i, n = name.length;
+  for (i = 0; i + 3 <= n; i++) {
+    if (_subAt(name, "EXP", i) && _wbBefore(name, i)) {
+      var c = _charCodeAt(name, i + 3);
+      if (c === 45 || c === 95 || (c >= 48 && c <= 57)) return true;
+    }
+  }
+  for (i = 0; i < n; i++) {
+    if (_subAt(name, "ADH", i) && _wbBefore(name, i) && _wbAfter(name, i + 3)) return true;
+    if (_subAt(name, "AECDH", i) && _wbBefore(name, i) && _wbAfter(name, i + 5)) return true;
+  }
+  return false;
+}
 function _assertConfidentialCipher(res) {
   if (!res || !res.tls || !res.tls.cipher) return;
   var c = res.tls.cipher;
   var name = (String(c.name || "") + " " + String(c.standardName || "")).toUpperCase();
-  // EXPORT covers the RFC/IANA name; the OpenSSL short names use an EXP prefix followed by a separator OR a
-  // digit run (EXP-RC4-MD5, EXP1024-RC4-SHA), so match EXP before either -- a bare `\bEXP\b` misses EXP1024.
-  if (/NULL|ANON|EXPORT|\bEXP[-_0-9]|\bA(EC)?DH\b/.test(name)) throw E("est/weak-cipher", "the serverkeygen channel negotiated a NULL / anonymous / EXPORT cipher (" + (c.standardName || c.name) + "), which cannot protect the delivered private key (RFC 7030 sec. 4.4)");
+  if (_hasWeakCipherToken(name)) throw E("est/weak-cipher", "the serverkeygen channel negotiated a NULL / anonymous / EXPORT cipher (" + (c.standardName || c.name) + "), which cannot protect the delivered private key (RFC 7030 sec. 4.4)");
 }
 
 // A case-insensitive header lookup: the injectable transport seam only promises { status, headers, body }, so a
@@ -2130,7 +2330,7 @@ function serverkeygen(baseUrl, csrInput, opts) {
       var eis = opts.expectedRecipientIssuerSerial;
       if (typeof eis !== "object" || Buffer.isBuffer(eis) || !Buffer.isBuffer(eis.issuer)) throw E("est/bad-input", "opts.expectedRecipientIssuerSerial must be { issuer: Buffer, serialNumber }");
       var s = eis.serialNumber;
-      if (!((typeof s === "bigint" && s >= 0n) || (typeof s === "number" && Number.isSafeInteger(s) && s >= 0) || (typeof s === "string" && /^[0-9]+$/.test(s)))) throw E("est/bad-input", "opts.expectedRecipientIssuerSerial.serialNumber must be a NON-NEGATIVE bigint, a safe non-negative integer, or a decimal digit string (a certificate serial is non-negative, RFC 5280 sec. 4.1.2.2)");
+      if (!((typeof s === "bigint" && s >= 0n) || (typeof s === "number" && Number.isSafeInteger(s) && s >= 0) || (typeof s === "string" && pkix.allCharsIn(s, _DIGITS_TABLE)))) throw E("est/bad-input", "opts.expectedRecipientIssuerSerial.serialNumber must be a NON-NEGATIVE bigint, a safe non-negative integer, or a decimal digit string (a certificate serial is non-negative, RFC 5280 sec. 4.1.2.2)");
     }
     // A recipient expectation implies the key part MUST be encrypted to that recipient; if the CSR advertised no
     // key-encryption attribute the coherence check below never runs, so a compromised CA could deliver the key

package/lib/framework-error.js

@@ -28,9 +28,23 @@
  *   classes the toolkit throws.
  */
 
-// The frozen shape of every error code: a `domain/reason` string of
-// lowercase alphanumerics and dashes.
-var CODE_SHAPE = /^[a-z0-9-]+\/[a-z0-9-]+$/;
+var intrinsic = require("./guard-intrinsic");
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _String = intrinsic.String;
+var _defineProperty = intrinsic.defineProperty;
+
+// The frozen shape of every error code: a `domain/reason` string -- one or more lowercase alphanumerics or
+// dashes, a single "/", then one or more of the same. Decided by character scan (no regex).
+function _isCodeShape(c) {
+  var n = c.length, i, ch, slash = -1;
+  if (n < 3) return false;                                             // shortest is "a/b"
+  for (i = 0; i < n; i += 1) {
+    ch = _charCodeAt(c, i);
+    if (ch === 47) { if (slash !== -1) return false; slash = i; }       // "/" -- at most one
+    else if (!((ch >= 97 && ch <= 122) || (ch >= 48 && ch <= 57) || ch === 45)) return false;   // a-z 0-9 "-"
+  }
+  return slash > 0 && slash < n - 1;                                   // one slash, both sides non-empty
+}
 
 /**
  * @primitive  pki.errors.PkiError
@@ -59,9 +73,9 @@ class PkiError extends Error {
     super(message);
     this.name = "PkiError";
     var c = code || "pki/invalid";
-    if (typeof c !== "string" || !CODE_SHAPE.test(c)) {
+    if (typeof c !== "string" || !_isCodeShape(c)) {
       throw new TypeError(
-        "PkiError code must be a domain/reason string, got " + String(c) +
+        "PkiError code must be a domain/reason string, got " + _String(c) +
         " (PkiError takes (message, code); defineClass subclasses take (code, message))"
       );
     }
@@ -114,7 +128,7 @@ function defineClass(name, opts) {
       }
     }
   };
-  Object.defineProperty(GeneratedError, "name", { value: name, configurable: true });
+  _defineProperty(GeneratedError, "name", { value: name, configurable: true });
   GeneratedError.factory = function (code, message, arg3) {
     return new GeneratedError(code, message, arg3);
   };