@blamejs/pki 0.5.4 → 0.5.6

package/CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.6 — 2026-08-16
+
+A CMS SignedData is verified over the bytes it was parsed from, an omitted PKCS#12 password is refused rather than encoded as the empty one, and a verb documented as returning a Promise rejects instead of throwing past your .catch.
+
+### Changed
+
+- A verb documented as returning a Promise now rejects; it never throws synchronously. An operator reads -> Promise<...> in the reference and writes the documented shape, pki.cms.sign(content, signers).catch(handleIt) -- and a validation that ran before the promise was created threw straight past that .catch, so a misspelled option or a malformed input became an uncaught exception in code that already handles errors. Nothing in the shape of the call said which verbs did it. Eleven did: pki.cms.verify, pki.cms.sign, pki.cms.countersign, pki.ocsp.sign, pki.tsp.sign, and six pki.acme verbs. Nine more on the client pki.acme.client(...) returns did the same, including getAuthorization, which an ordinary ACME loop reaches with a URL that came from the CA rather than from the caller. The checks still run synchronously, so a caller's mutable options are read before any turn passes; only the way a fault leaves has changed. If you wrapped one of these verbs in a synchronous try/catch without awaiting it -- which the documented signature never supported, but which worked by accident on exactly these verbs -- that catch no longer fires and the rejection surfaces as an unhandled one instead. Await the call, or attach .catch to it.
+- pki.tsp.verify reports whether revocation was established, not only whether the timestamp authority chained. Revocation runs only when a revocationChecker is supplied, so a token whose TSA was never checked against a CRL or an OCSP responder read identically to one established un-revoked -- and that is the default. The verdict now carries revocationChecked and anchorConstraints from the path validation, in pki.path.validate's own vocabulary, so a timestamp archived to be re-read years later can still answer what was actually checked. The trustAnchor documentation no longer lists revocation unconditionally.
+
+### Fixed
+
+- pki.cms.verify computes its verdict over the bytes the parser read. A SignedData's meaning is a signature over a byte range, but a parsed one presents that range, the signature, the algorithms and the certificates as separate properties, and the verb read them as though the parser had produced them together. The forgery that follows is concrete: take a message a trusted signer really signed, keep its SignerInfo and signature untouched, set signedAttrsBytes to null, and present the signature's own preimage -- the signed attributes re-tagged as the SET OF the signature covers -- as the encapsulated content under any content type you like. With no signed attributes the signature is checked against the content directly, which is exactly those bytes, and neither the content-type nor the message-digest check runs, so the message verifies as valid content the signer never signed. pki.schema.cms.parse now records what it read, pki.cms.verify re-derives from that record, and a SignedData a caller assembled rather than parsed is refused with a typed error instead of dereferenced into a raw TypeError. Passing DER, PEM, or the parser's own unmodified result is unaffected.
+- pki.pkcs12.build refuses a store with no password instead of building one under the empty password. An omitted password and the empty password are different credentials, and the difference was invisible at the call site: pki.pkcs12.build(spec) with no options at all, or with the option name misspelled, returned a well-formed store whose shrouded private key opened under "" -- a key protected by nothing, with no error anywhere. The empty password is still available; it has to be asked for, as "".
+- pki.pkcs12.build validates opts.integrity.mode against the value it accepts. Compared against a single literal, any other spelling read as "not public-key" and silently selected password integrity, dropping the signer with it: a caller who wrote mode: 'publicKey' asked for a CMS signature over the AuthenticatedSafe and got a password MAC. Combined with the previous item, a caller who misspelled both options got a store MACed under the empty password while believing it was signature-protected. An unrecognized key on opts.integrity is refused too.
+- pki.pkcs12.open bounds the key-derivation work of a modern store, not only a legacy one. The aggregate budget existed because a per-bag iteration cap resets on every bag, so a store that repeats a costly bag up to the parser's element limit multiplies the cap by that limit -- but it was charged only on the RFC 7292 Appendix C path, leaving the RFC 8018 PBES2 path -- the one OpenSSL and NSS emit, and the one this toolkit itself builds -- free to do exactly that. Measured before the fix: ten bags at a million iterations each ran ten million aggregate rounds of blocking PBKDF2 with no refusal. Both schemes now charge one budget, and it is charged before the derivation runs rather than after.
+- A PKCS#12 password this toolkit encoded is cleared once the derivation has consumed it, on the PBES2 and PBMAC1 paths as well as the classic ones. The Appendix B.1 copy taken from a password argument was wiped while the UTF-8 copy taken from the same argument in the same call was not, leaving a plaintext password in the heap after every modern bag encryption, bag decryption and MAC. A Buffer you supply is never written to: it is yours, and clearing it would destroy your credential rather than protect it.
+- pki.tsp.request validates a pre-encoded extension instead of splicing it in. Elements of opts.extensions were checked only for being byte-like and then concatenated straight into the request, so a caller relaying an extension blob it did not author put fully chosen bytes into the structure -- and the encoder emitted requests its own pki.tsp.parseRequest refuses: an undecodable value, a repeated extension identifier, an explicit critical=FALSE that DER requires be omitted. Each element now goes through the same pre-encoded-Extension gate every other request builder in the toolkit applies, including the duplicate-identifier check.
+- pki.tsp.sign, pki.tsp.request and pki.tsp.verify report a bad serial number or nonce as a typed tsp/bad-input. A value that is not an integer reached BigInt() directly and raised a raw SyntaxError or RangeError out of a public verb -- an untyped fault a caller handling tsp/* codes cannot catch.
+- pki.sigstore.verifyBundle refuses an option it does not recognize. The identity policy one level down already did, for the reason that applies just as much at the top: the signer pin goes by other names in other Sigstore tooling, and a spelling this verb swallowed checked nothing under a name the operator believed pinned the signer. At the top level the same slip also loses the SLSA predicate pin, and unlike the identity fields there is no report field to reveal it -- the verdict said verified: true with the signer and the predicate entirely unpinned.
+
+## v0.5.5 — 2026-08-15
+
+A verdict is computed over the bytes the parser read, an identity is derived from the bytes that carry it, and the guards match no patterns.
+
+### Changed
+
+- The package resolves one entry point. require("@blamejs/pki") is unchanged; a path INTO the package, such as require("@blamejs/pki/lib/schema-x509"), no longer resolves. Every module under lib/ carries @internal in its own header and none has ever appeared in the API snapshot that freezes the public surface -- they were reachable because the package declared no exports map, not because they were offered, and one of them mints the provenance record the integrity verbs above rely on. Everything the internals do is on pki.*: the decoders are pki.schema.<format>.parse, the codec is pki.asn1, the OID registry is pki.oid, the error classes are pki.errors. MIGRATING.md carries the recipe.
+- pki.merkle, pki.jose, pki.hpke, pki.smime and pki.est refuse an option they do not recognize, which completes the toolkit -- every module that takes options now does. A misspelled option is the one input that reads as an omission rather than as a value, so the caller who asked for something stricter gets the looser default and is told nothing: a misspelled psk leaves an HPKE psk-mode setup with no pre-shared key, a misspelled key leaves pki.jose.verify accepting whichever key the message names, a misspelled leafIndex leaves a Merkle inclusion proof about a leaf the caller never chose, a misspelled strictMicalg accepts the S/MIME digest mismatch it was set to reject, and a misspelled expectedRecipientKeyId drops the recipient pin on an EST server-generated private key. The accepted set is per verb rather than per module, because the surfaces differ -- form means something to pki.smime.sign and nothing to pki.smime.encrypt, strict cannot run on pki.est.cacerts at all, and HPKE's two ends read the same object from opposite sides, so senderPublicKey does nothing at the sender and senderKey nothing at the recipient. A merged set would accept each verb's options everywhere and reproduce the silence in a wider form, which is why an option passed to the wrong end of an HPKE exchange is refused with a message saying where it belongs rather than ignored -- the caller who passed it usually believes they authenticated something. Four options pki.smime.sign has always forwarded (hcp, sid, signedAttributes, additionalSignedAttributes) and EST's auth object are now documented; they worked before and were absent from the reference.
+- The guards match no patterns. A guard runs on the most hostile input the toolkit sees, and a pattern engine's cost on a rejecting string is a property of the pattern rather than of the length -- the one thing a caller's size cap cannot bound. Nine patterns across five guards are now explicit character walks, each one pass. Three carried a second defect settled by the rewrite: the whitespace fold above, a JSON number grammar written twice (once as the scan and once as a pattern re-matching what the scan had just read), and an RFC 4514 escape that ran a pattern replace and then a second loop over the same attacker-supplied value.
+
+### Fixed
+
+- A claimed-parsed structure must carry every field the matching pki.schema parser produces. The rule already existed at one door -- pki.path.build refused a partial claimed-parsed certificate -- while pki.path.validate, which build hands its result to, tested only for a truthy tbsBytes and passed the object into the RFC 5280 sec. 6.1 walk. Eleven doors now share it: pki.path.validate and build, pki.path.crlChecker, pki.crl.verify / isRevoked and the issuer of pki.crl.sign, the issuer of pki.x509.sign, pki.attrcert.sign, pki.ocsp's certificate argument, pki.lint, and the caller root certificates pki.webauthn takes for attestation and for android-safetynet. Completeness is measured against the parser rather than against what any one verb reads, because a field absent from an object is not a field with a safe default: an extension entry with no critical property read as non-critical, so a certificate rejected for an unknown critical extension when passed as bytes validated when passed as an object; a missing serialNumber surfaced as an error from the ASN.1 layer; and a missing issuer.bytes produced an OCSP request whose issuerNameHash covered nothing. Passing bytes, PEM, or the parser's own unmodified output is unaffected.
+- A certificate or CRL a verdict is taken from is re-derived from the bytes its parser read. pki.path.validate and build, pki.path.crlChecker, pki.crl.verify and pki.crl.isRevoked all reach a decision, and completeness alone cannot carry one: a certificate is one signature over one byte range, but a parsed certificate presents that range, the signature, and every field the range encodes as separate properties. Keep a real CA certificate's signed bytes and signature and replace only its subjectPublicKeyInfo, and every field is well-formed, the signature verifies over the original range, and the substituted key is then what verifies the next certificate in the chain -- a forged chain built out of a genuine certificate. Emptying extensions is the same move against basicConstraints, keyUsage, name constraints and the unknown-critical rule; emptying a CRL's revokedCertificates leaves a correctly signed CRL reporting a revoked certificate as good. pki.schema.x509.parse and pki.schema.crl.parse now record what they read, these verbs parse it again from that record, and a certificate or CRL a caller assembled rather than parsed is refused. Passing bytes, PEM, or the parser's own unmodified output is unaffected.
+- pki.ocsp.verify, pki.path.verifyOcspResponse, pki.pkcs12.verifyMac and pki.pkcs12.open compute their verdict over the bytes the parser read. A signature check has three parts -- the signature, the algorithm that verifies it, and the byte range it covers -- and on a parsed response all three are separate properties: pair a real CA's signature over a certificate that CA issued with that certificate's own signed bytes and algorithm, relabel the three, and every part of the check passes for a response the responder never produced. A PKCS#12 store has the same shape with two parts, the range the MAC covers and the bags handed back as verified, so one object could say verify this and return that. The parsers now record what they parsed and these verbs re-derive from that record, so an object edited or rebuilt after parsing is not what the verdict describes. Passing the parser's own result still works and is unchanged.
+- pki.attrcert.sign derives both halves of a Holder's identity from the signed bytes. Issuer and serial together ARE the identity being bound; the issuer was decoded from tbsBytes while the serial was read off the object, so a parsed certificate with one field replaced produced a Holder naming a real issuer with a serial nobody issued.
+- pki.trust.anchor answers from what the store read. A root program's metadata -- these purposes, until this date -- is a statement about a KEY, so an entry rebuilt with a substituted publicKey carried the program's word onto a key it never saw; the (name, key) pair is now re-derived from the certificate the store parsed, and an entry carrying store metadata without that provenance is refused. The purposes and distrust dates come from the same place and are copied on the way out, so neither editing a store entry nor writing through a returned anchor changes what that anchor authorizes -- pki.trust.anchor(entry).purposes.serverAuth = true no longer opens a gate the store never opened, and an anchor reports the store's bits and dates however the caller has since handled the entry. A caller asserting their own bare (name, key) anchor carries no metadata and is unaffected.
+- A private key decoded for the crypto engine is wiped once the engine has imported it. A signer or recipient key may be given as a Buffer, a Uint8Array, or a PEM string; the first is the caller's own memory and is used in place, while the other two are decoded into a new buffer inside the toolkit -- a second copy of a private key, which until now stayed readable in the heap until the garbage collector happened to reuse the page. It is cleared on the failure path too, so a malformed key or a tampered message is not a way to leave one behind. A Buffer you supply is never written to: it is yours, you still hold it, and clearing it would destroy the key rather than protect it.
+- pki.webauthn.verifyAssertion holds both accepted forms of a stored credential key to the same rules. The COSE bytes went through the curve and length rules, the 2048-bit RSA modulus floor and the exponent checks; the object form went through none, so one key was refused in one form and imported for signature verification in the other. Which form a relying party stores is a question about what their datastore round-trips, not about how carefully their credential is checked.
+- A certificate's keyUsage is read the same way at every boundary that asks what the certificate may do. keyUsage is a NamedBitList, so DER drops its trailing zero bits (X.690 sec. 11.2.2) and RFC 5280 sec. 4.2.1.3 requires at least one bit set. Four boundaries read the bits themselves and applied neither rule, so one certificate could be authorized in one place and called malformed everywhere else: pki.crl.verify accepting a CRL signer, pki.tsp.verify accepting a timestamp authority, pki.cms.encrypt accepting a recipient, and the FIDO metadata reader accepting the leaf that signs a catalogue.
+- The distinguished-name comparison that decides name chaining, revocation-issuer matching and name constraints folds the four ASCII whitespace characters X.520's caseIgnoreMatch names, and no others. It had been collapsing whitespace with a pattern, which also folds vertical tab, form feed, no-break space and every Unicode space separator -- equating names X.520 keeps distinct.
+
 ## v0.5.4 — 2026-08-15
 
 A path verdict says whether revocation was ever established, a trust anchor's own distrust metadata can no longer sit inert, and a CRL is asked what only a certificate can answer.

package/MIGRATING.md

@@ -7,3 +7,75 @@ Some breaking changes cannot warn at runtime: an on-disk format break or a wire-
 ## No active deprecations
 
 The toolkit has no `deprecate()`-marked surface awaiting removal.
+
+---
+
+## Out-of-band breaking changes
+
+Listed newest-first.
+
+### v0.5.6 — `try { pki.<verb>(...) } catch`
+
+A verb documented `-> Promise` rejects on a bad input instead of throwing before the promise exists.
+
+If you awaited the call, or attached `.catch`, nothing changes and there is nothing to do.
+
+What changes is the undocumented shape: a synchronous `try`/`catch` that never consumed the
+returned promise.
+
+```js
+try {
+  pki.cms.verify(bytes);            // no await, no .catch
+} catch (e) { /* used to fire on a malformed input */ }
+```
+
+That `catch` no longer runs, and the rejection surfaces as an unhandled one. It worked by
+accident on exactly the verbs where a check happened to run before the promise existed --
+`pki.cms.verify`, `pki.cms.sign`, `pki.cms.countersign`, `pki.ocsp.sign`, `pki.tsp.sign`, six
+`pki.acme` verbs, and nine verbs on the client `pki.acme.client(...)` returns. Which verbs
+those were was not visible from the call, which is why they are now uniform.
+
+```js
+await pki.cms.verify(bytes);        // or pki.cms.verify(bytes).catch(handleIt)
+```
+
+### v0.5.6 — `pki.pkcs12.build(spec)`
+
+An omitted password is refused rather than encoded as the empty one.
+
+A store whose password option was missing or misspelled no longer builds silently under `""`.
+
+```js
+await pki.pkcs12.build(spec);                    // now pkcs12/bad-input
+await pki.pkcs12.build(spec, { password: "" });  // the empty password, asked for
+```
+
+If you were relying on the default, the second form restores the previous output byte for
+byte. `opts.integrity.mode` is validated the same way: a spelling other than `"public-key"`
+is now `pkcs12/bad-integrity-mode` instead of silently selecting password integrity and
+dropping the signer.
+
+### v0.5.5 — `require("@blamejs/pki/lib/...")`
+
+The package resolves one entry point; a path into the package no longer resolves.
+
+`require("@blamejs/pki")` and `import ... from "@blamejs/pki"` are unchanged. What no
+longer resolves is a path INTO the package:
+
+```
+require("@blamejs/pki/lib/schema-x509")   // ERR_PACKAGE_PATH_NOT_EXPORTED
+```
+
+Every module under `lib/` carries `@internal` in its own header and none has ever appeared
+in the API snapshot that freezes the public surface. They were reachable because the package
+declared no `exports` map, not because they were offered -- and one of them mints the
+provenance record the OCSP and PKCS#12 integrity verbs rely on, which reachable from outside
+could be minted for any object.
+
+Everything the internals do is on `pki.*`: the decoders are `pki.schema.<format>.parse`, the
+codec is `pki.asn1`, the OID registry is `pki.oid`, the error classes are `pki.errors`. If you
+are reaching for something with no `pki.*` route, that is a gap worth reporting rather than a
+module worth importing -- the internals change shape between patch releases and carry no
+compatibility promise.
+
+`require("@blamejs/pki/package.json")` still resolves, for tooling that reads the version.

package/lib/acme.js

@@ -684,6 +684,12 @@ function _payloadBuf(obj) {
   if (obj === undefined) return Buffer.alloc(0);                 // POST-as-GET
   return Buffer.from(JSON.stringify(obj), "utf8");
 }
+// A verb documented `-> Promise` refuses by REJECTING, never by throwing (guard-async).
+//
+// The validation stays SYNCHRONOUS: these verbs read a caller's options object -- the key, the
+// nonce, the identifiers -- and resolving those before any turn passes is what stops a value being
+// swapped between the check and the use. Only the exit changes.
+var _promised = guard.async.deferred;
 function _signOuter(o, payloadObj) {
   if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
   if (!o.key) throw E("acme/bad-input", "a signing key (opts.key) is required");
@@ -707,10 +713,12 @@ function _signOuter(o, payloadObj) {
  *   await pki.acme.postAsGet({ key, alg: "ES256", nonce, url: orderUrl, kid });
  */
 function postAsGet(o) {
-  if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
-  // An authenticated read is ALWAYS kid-signed; copy only the kid-mode fields so a
-  // leftover jwk (e.g. reused from a newAccount options object) cannot embed a key.
-  return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, undefined);
+  return _promised(function () {
+    if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
+    // An authenticated read is ALWAYS kid-signed; copy only the kid-mode fields so a
+    // leftover jwk (e.g. reused from a newAccount options object) cannot embed a key.
+    return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, undefined);
+  });
 }
 
 // A contact URL (RFC 8555 sec. 7.3): a `mailto:` addr-spec carries no header
@@ -750,6 +758,7 @@ function _assertContacts(contacts) {
  *   await pki.acme.newAccount({ key, alg: "ES256", nonce, url, jwk, termsOfServiceAgreed: true });
  */
 function newAccount(o) {
+  return _promised(function () {
   if (!_isObject(o) || !_isObject(o.jwk)) throw E("acme/bad-input", "newAccount must embed the account public jwk (RFC 8555 sec. 7.3)");
   var payload = {};
   if (o.contact !== undefined) { _assertContacts(o.contact); payload.contact = o.contact; }
@@ -769,6 +778,7 @@ function newAccount(o) {
     payload.externalAccountBinding = o.externalAccountBinding;
   }
   return jose.sign({ protected: { alg: o.alg, nonce: o.nonce, url: o.url, jwk: o.jwk }, payload: _payloadBuf(payload), key: o.key, jwk: o.jwk, profile: "acme-outer" });
+  });
 }
 
 var _HMAC_HASH = { HS256: "SHA-256", HS384: "SHA-384", HS512: "SHA-512" };
@@ -855,6 +865,7 @@ function _validateOrderIdentifier(id) {
  *   await pki.acme.newOrder({ key, alg: "ES256", nonce, url, kid, identifiers: [{ type: "dns", value: "example.org" }] });
  */
 function newOrder(o) {
+  return _promised(function () {
   if (!_isObject(o) || !Array.isArray(o.identifiers) || o.identifiers.length === 0) throw E("acme/bad-order", "newOrder requires a non-empty identifiers array (RFC 8555 sec. 7.4)");
   // Serialize the CANONICAL { type, value } each validator returns, never the caller's objects (which may carry
   // getter-backed / inherited fields JSON.stringify would drop, or extra enumerable fields it would send).
@@ -863,6 +874,7 @@ function newOrder(o) {
   if (o.notAfter !== undefined) { if (!_isRfc3339(o.notAfter)) throw E("acme/bad-order", "notAfter must be an RFC 3339 date-time"); payload.notAfter = o.notAfter; }
   if (o.replaces !== undefined) { if (!_isString(o.replaces)) throw E("acme/bad-order", "replaces must be an ARI certID string (RFC 9773 sec. 5)"); payload.replaces = o.replaces; }
   return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload);
+  });
 }
 
 /**
@@ -1035,10 +1047,12 @@ async function finalize(o) {
  *   await pki.acme.challengeResponse({ key, alg: "ES256", nonce, url: challUrl, kid });
  */
 function challengeResponse(o) {
-  if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
-  var payload = o.payload !== undefined ? o.payload : {};
-  if (!_isObject(payload)) throw E("acme/bad-input", "a challenge response payload must be a JSON object (RFC 8555 sec. 7.5.1)");
-  return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload);
+  return _promised(function () {
+    if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
+    var payload = o.payload !== undefined ? o.payload : {};
+    if (!_isObject(payload)) throw E("acme/bad-input", "a challenge response payload must be a JSON object (RFC 8555 sec. 7.5.1)");
+    return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload);
+  });
 }
 
 /**
@@ -1061,8 +1075,10 @@ function challengeResponse(o) {
  *   await pki.acme.deactivate({ key, alg: "ES256", nonce, url: authzUrl, kid });
  */
 function deactivate(o) {
-  if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
-  return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, { status: "deactivated" });
+  return _promised(function () {
+    if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
+    return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, { status: "deactivated" });
+  });
 }
 
 /**
@@ -1091,6 +1107,7 @@ function deactivate(o) {
  *   await pki.acme.revokeCert({ key, alg: "ES256", nonce, url, kid, certificate: certDer, reason: 1 });
  */
 function revokeCert(o) {
+  return _promised(function () {
   if (!_isObject(o) || !Buffer.isBuffer(o.certificate)) throw E("acme/bad-input", "revokeCert requires a DER certificate Buffer (opts.certificate)");
   x509.parse(o.certificate);                              // structural validation of the target
   var hasKid = Object.prototype.hasOwnProperty.call(o, "kid");
@@ -1106,6 +1123,7 @@ function revokeCert(o) {
   var header = { alg: o.alg, nonce: o.nonce, url: o.url };
   if (hasKid) header.kid = o.kid; else header.jwk = o.jwk;
   return jose.sign({ protected: header, payload: _payloadBuf(payload), key: o.key, jwk: o.jwk, profile: "acme-outer" });
+  });
 }
 
 /**
@@ -2015,12 +2033,18 @@ function client(directoryUrl, opts) {
     });
     });
   }
-  function _getOrder(url) { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("order", _json(res)); }); }
-  function _getAuthorization(url) { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("authorization", _json(res)); }); }
-  function _getChallenge(url) { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("challenge", _json(res)); }); }
-  function _respondToChallenge(url) { return _post(_clientUrl(url), challengeResponse, null, "kid").then(function (res) { return validate("challenge", _json(res)); }); }
-
-  function _finalize(order, o) {
+  // A bad URL leaves as a REJECTION, like every other verb on this client. It is not only a caller
+  // typo that reaches here: the message layer deliberately accepts http as well as https, so an
+  // order whose `authorizations` array carries an http URL validates, and the very next step --
+  // getAuthorization(order.authorizations[0]) -- threw out of the middle of an async ACME loop
+  // rather than rejecting into the handler already wrapped around it.
+  function _getOrder(url) { return _promised(function () { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("order", _json(res)); }); }); }
+  function _getAuthorization(url) { return _promised(function () { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("authorization", _json(res)); }); }); }
+  function _getChallenge(url) { return _promised(function () { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("challenge", _json(res)); }); }); }
+  function _respondToChallenge(url) { return _promised(function () { return _post(_clientUrl(url), challengeResponse, null, "kid").then(function (res) { return validate("challenge", _json(res)); }); }); }
+
+  function _finalize(order, o) { return _promised(function () { return _finalizeBody(order, o); }); }
+  function _finalizeBody(order, o) {
     o = o || {};
     if (!_isObject(order) || !_isString(order.finalize)) throw E("acme/bad-input", "finalize requires the order object with its finalize URL");
     if (!Array.isArray(order.identifiers)) throw E("acme/bad-input", "finalize requires the order's identifiers to enforce the RFC 8555 sec. 7.4 CSR-set match");
@@ -2155,10 +2179,11 @@ function client(directoryUrl, opts) {
     });
   }
 
-  function _deactivateAccount() { return _post(_requireKid(), deactivate, null, "kid").then(function (res) { return validate("account", _json(res)); }); }
-  function _deactivateAuthorization(url) { return _post(_clientUrl(url), deactivate, null, "kid").then(function (res) { return validate("authorization", _json(res)); }); }
+  function _deactivateAccount() { return _promised(function () { return _post(_requireKid(), deactivate, null, "kid").then(function (res) { return validate("account", _json(res)); }); }); }
+  function _deactivateAuthorization(url) { return _promised(function () { return _post(_clientUrl(url), deactivate, null, "kid").then(function (res) { return validate("authorization", _json(res)); }); }); }
 
-  function _keyChange(o) {
+  function _keyChange(o) { return _promised(function () { return _keyChangeBody(o); }); }
+  function _keyChangeBody(o) {
     o = o || {};
     if (!o.newKey || !_isObject(o.newJwk) || !_isString(o.newAlg)) throw E("acme/bad-input", "keyChange requires newKey, newJwk, and newAlg");
     var account = _requireKid();
@@ -2181,6 +2206,9 @@ function client(directoryUrl, opts) {
 
   // ARI RenewalInfo (RFC 9773 sec. 4.1) -- the SOLE UNAUTHENTICATED GET (no JWS, no nonce).
   function _renewalInfo(certDer, clockFn, retryAfterCapSeconds) {
+    return _promised(function () { return _renewalInfoBody(certDer, clockFn, retryAfterCapSeconds); });
+  }
+  function _renewalInfoBody(certDer, clockFn, retryAfterCapSeconds) {
     if (!Buffer.isBuffer(certDer)) throw E("acme/bad-input", "renewalInfo requires a DER certificate Buffer");
     var _rawClk = typeof clockFn === "function" ? clockFn : clock;   // renewalWindow may pass a per-call clock
     // The clock MUST return finite epoch ms: a NaN / Infinity would make the expiry comparison below silently

package/lib/attrcert-sign.js

@@ -83,12 +83,13 @@ var _tbsNameBytes = pkiBuild.tbsNameField;   // the AA issuerName / holder baseC
 // Parse a certificate DER/PEM (or accept a parsed certificate), re-typing a raw x509/* parse fault to the
 // attrcert domain so a malformed AA cert / holder cert surfaces attrcert/*, not a foreign CertificateError.
 function _parseCert(cert, what) {
-  if (!Buffer.isBuffer(cert) && typeof cert !== "string") {
-    if (!cert || !cert.tbsBytes) throw _err("attrcert/bad-input", what + " must be a certificate DER/PEM or a parsed certificate");
-    return cert;
-  }
-  try { return x509.parse(cert); }
-  catch (e) { if (e instanceof AttrCertError) throw e; throw _err("attrcert/bad-input", what + " is not a well-formed certificate", e); }
+  // Re-derived from the bytes its parser read. Issuer and serial together ARE the Holder's identity,
+  // so a certificate assembled from parts could bind an attribute certificate to a holder that no
+  // issuer ever named.
+  return guard.parsed.acceptDerived(cert, "certificate", function (bytes) {
+    try { return x509.parse(bytes); }
+    catch (e) { if (e instanceof AttrCertError) throw e; throw _err("attrcert/bad-input", what + " is not a well-formed certificate", e); }
+  }, _err, "attrcert/bad-input", what);
 }
 // The raw content octets of an OBJECT IDENTIFIER (past its own tag+len) -- the body of a [0] IMPLICIT OID.
 function _oidContent(name) {
@@ -149,8 +150,11 @@ function _encodeHolder(holder) {
   if (holder.fromCertificate != null) {
     // Bind to a public-key certificate's identity: baseCertificateID = { issuer = the PKC's issuer DN as a
     // directoryName, serial = the PKC serialNumber } (RFC 5755 sec. 4.1 / 7.3).
+    // BOTH halves from the signed bytes. issuer and serial together ARE the identity, so deriving
+    // the issuer from tbsBytes while reading the serial off the object let the two name different
+    // certificates: a Holder with a genuine issuer DN and whatever serial the caller wrote.
     var pkc = _parseCert(holder.fromCertificate, "holder.fromCertificate");
-    var content = _issuerSerialContent({ issuer: [{ directoryName: _tbsNameBytes(pkc, "issuer") }], serial: pkc.serialNumber });
+    var content = _issuerSerialContent({ issuer: [{ directoryName: _tbsNameBytes(pkc, "issuer") }], serial: pkiBuild.tbsSerialNumber(pkc) });
     return b.sequence([b.contextConstructed(0, content)]);
   }
   // objectDigestInfo [2] IMPLICIT ObjectDigestInfo.

package/lib/cmp-session.js

@@ -129,12 +129,24 @@ function _boundedPool(base, added) {
 // the unsigned extraCerts ordering, so a corrupted-signature copy sharing a valid issuer's TBS must NOT collapse
 // onto it and evict the valid one. Returns null when the identity cannot be derived; a NON-deduped entry is safe
 // (a redundant slot), a wrong merge (dropping a distinct or the only valid certificate) is not.
+// The identity comes from the SAME derivation every other certificate door uses: the bytes the
+// parser recorded, never the fields of the object handed in. This is a dedupe rather than a verdict,
+// and no collision attack on it is apparent -- carrying another certificate's exact tbsBytes AND
+// signature means being that certificate. But "no attack is apparent" is the reasoning that put a
+// completeness-only door on nine deciding boundaries, so it is not the reasoning this uses: one
+// derivation for certificates, everywhere, and the exceptions have to argue for themselves.
+//
+// Failure returns null rather than throwing, which is this function's own contract and is why the
+// door is wrapped: an underivable identity is a redundant pool slot, while a wrong merge (dropping
+// a distinct or the only valid certificate) is not. So a rebuilt entry simply does not dedupe.
 function _certIdentity(cert) {
   try {
-    var p = (cert && Buffer.isBuffer(cert.tbsBytes)) ? cert : x509.parse(cert);   // x509.parse accepts a DER Buffer OR a PEM string
-    if (!p || !Buffer.isBuffer(p.tbsBytes)) return null;
-    return p.tbsBytes.toString("base64") + "|" + (p.signatureValue && p.signatureValue.bytes ? p.signatureValue.bytes.toString("base64") : "");
-  } catch (_e) { return null; }
+    var p = guard.parsed.acceptDerived(cert, "certificate", x509.parse, _err, "cmp/bad-input", "a pool certificate");
+    if (!guard.parsed.isCert(p)) return null;
+    return p.tbsBytes.toString("base64") + "|" + p.signatureValue.bytes.toString("base64");
+  } catch (_e) {
+    return null;   // underivable: kept as its own slot, never merged onto another certificate's
+  }
 }
 
 // A canonical identity for a SubjectPublicKeyInfo: the algorithm OID + the AlgorithmIdentifier parameters +
@@ -383,12 +395,13 @@ function session(opts) {
     var _es = opts.expectedSender;
     try {
       if (_es && Buffer.isBuffer(_es.tbsBytes)) {   // the documented already-parsed form (pki.schema.x509.parse output), detected like _certIdentity
-        // A Buffer tbsBytes alone is NOT a complete parsed certificate: senderBoundToCert dereferences subject /
-        // subjectAltName, so a partial object (e.g. { tbsBytes }) would pass here and then throw a raw TypeError
-        // mid-transaction, consuming the one-shot session for a local config error. Validate the FULL shape now
-        // with the same coerceCert check the path engine applies to every parsed-cert input.
-        if (_engine && _engine.coerceCert) _engine.coerceCert(_es);
-        _expectedSenderCert = _es;
+        // The door's RETURN is what gets pinned, not the object handed in. coerceCert re-derives the
+        // certificate from the bytes its parser read, so calling it only as a check and then storing
+        // the caller's object keeps every edit the re-derivation exists to discard: this pin is
+        // compared against each response signer's subject and SAN, so an edited one would accept a
+        // different CMP signer than the caller meant to pin. A validator that normalizes has its
+        // return value as its contract -- using it as a predicate throws that contract away.
+        _expectedSenderCert = (_engine && _engine.coerceCert) ? _engine.coerceCert(_es) : _es;
       }
       else if (Buffer.isBuffer(_es) || _es instanceof Uint8Array) { _expectedSenderDer = Buffer.from(_es); _expectedSenderCert = x509.parse(_expectedSenderDer); }
       else if (typeof _es === "string") { _expectedSenderDer = x509.pemDecode(_es); _expectedSenderCert = x509.parse(_expectedSenderDer); }

package/lib/cmp-verify.js

@@ -506,11 +506,19 @@ async function _verifySignature(m, protectedPart, protectionAlg, protection, opt
 // A canonical certificate identity (tbs + signature) for the extraCerts pool dedup: it keys a Buffer /
 // Uint8Array (parse) and an already-parsed candidate object identically (path.build accepts both forms), so
 // an extraCert duplicating a caller intermediate is dropped regardless of which representation the caller used.
+// The key is derived from the bytes the parser recorded, through the same door every other
+// certificate boundary uses -- never from the fields of the object handed in. Deriving it from a
+// caller-shaped object would let two different certificates collapse onto one key, which is the one
+// outcome this must not have. Failure returns null (the caller's contract here): an underivable
+// identity leaves a redundant pool slot, which is safe, while a wrong merge is not.
 function _certKey(c) {
-  var p = c;
-  if (Buffer.isBuffer(c) || c instanceof Uint8Array) { try { p = x509.parse(c); } catch (_e) { return null; } }
-  if (!p || !p.tbsBytes) return null;
-  return p.tbsBytes.toString("base64") + "|" + (p.signatureValue && p.signatureValue.bytes ? p.signatureValue.bytes.toString("base64") : "");
+  try {
+    var p = guard.parsed.acceptDerived(c, "certificate", x509.parse, _err, "cmp/bad-input", "a pool certificate");
+    if (!guard.parsed.isCert(p)) return null;
+    return p.tbsBytes.toString("base64") + "|" + p.signatureValue.bytes.toString("base64");
+  } catch (_e) {
+    return null;   // underivable: kept as its own slot, never merged onto another certificate's
+  }
 }
 
 async function _chainSigner(signer, m, opts, extra) {

package/lib/cms-decrypt.js

@@ -211,41 +211,55 @@ async function _acquireCek(ri, km, opts) {
 // ktri: OAEP or PKCS#1 v1.5 (v1.5 = decrypt-only + RFC 3218 implicit rejection).
 async function _ktriCek(ri, km) {
   var kea = ri.keyEncryptionAlgorithm;
-  var keyDer = _normKeyDer(km.key);
-  if (kea.oid === O("rsaesOaep")) {
-    var hash = _oaepHashFromParams(kea.parameters);
-    var pub = await subtle.importKey("pkcs8", keyDer, { name: "RSA-OAEP", hash: hash }, false, ["decrypt"]);
-    return Buffer.from(await subtle.decrypt({ name: "RSA-OAEP" }, pub, ri.encryptedKey));
-  }
-  if (kea.oid === O("rsaEncryption")) {
-    // RFC 3218 sec. 2.3.2 implicit rejection: NEVER surface a v1.5 failure here. Any decode fault
-    // yields a fresh random CEK of the content-alg length; the mismatch emerges at stage 3.
-    var keyObj = nodeCrypto.createPrivateKey({ key: keyDer, format: "der", type: "pkcs8" });
-    try { return nodeCrypto.privateDecrypt({ key: keyObj, padding: nodeCrypto.constants.RSA_PKCS1_PADDING }, ri.encryptedKey); }
-    catch (_e) { return null; } // signal: use a random CEK (length decided at open time)
+  var k = _normKeyDer(km.key);
+  // The wipe is in a `finally` so it happens on the reject path too: a message crafted to fail the
+  // unwrap must not be a way to leave the key copy in memory.
+  try {
+    if (kea.oid === O("rsaesOaep")) {
+      var hash = _oaepHashFromParams(kea.parameters);
+      var pub = await subtle.importKey("pkcs8", k.der, { name: "RSA-OAEP", hash: hash }, false, ["decrypt"]);
+      return Buffer.from(await subtle.decrypt({ name: "RSA-OAEP" }, pub, ri.encryptedKey));
+    }
+    if (kea.oid === O("rsaEncryption")) {
+      // RFC 3218 sec. 2.3.2 implicit rejection: NEVER surface a v1.5 failure here. Any decode fault
+      // yields a fresh random CEK of the content-alg length; the mismatch emerges at stage 3.
+      var keyObj = nodeCrypto.createPrivateKey({ key: k.der, format: "der", type: "pkcs8" });
+      try { return nodeCrypto.privateDecrypt({ key: keyObj, padding: nodeCrypto.constants.RSA_PKCS1_PADDING }, ri.encryptedKey); }
+      catch (_e) {
+        return null; // signal: use a random CEK (length decided at open time)
+      }
+    }
+    // Coverage residual: reachable only from a hostile message (our encrypt emits only OAEP; OpenSSL
+    // emits OAEP or rsaEncryption) -- a fail-closed reject the fuzz harness exercises.
+    throw _err("cms/unsupported-algorithm", "unsupported ktri keyEncryptionAlgorithm " + kea.oid);
+  } finally {
+    _releaseKeyDer(k);
   }
-  // Coverage residual: reachable only from a hostile message (our encrypt emits only OAEP; OpenSSL
-  // emits OAEP or rsaEncryption) -- a fail-closed reject the fuzz harness exercises.
-  throw _err("cms/unsupported-algorithm", "unsupported ktri keyEncryptionAlgorithm " + kea.oid);
 }
 
 // kari: reconstruct Z from the originatorKey + recipient private key, KDF -> KEK, AES-KW unwrap.
 async function _kariCek(ri, km) {
-  var keyDer = _normKeyDer(km.key);
-  var kea = ri.keyEncryptionAlgorithm;
-  var wrapAlg = _kariWrap(kea);
-  var scheme = kea.oid;
-  var origSpki = _originatorSpki(ri.originator);
-  // Unwrap THIS recipient's RecipientEncryptedKey (matched by rid), not element 0 -- a kari may list
-  // several recipients under one ephemeral key.
-  var rek = (km.cert != null && _kariRekFor(ri, x509.parse(_normCertDer(km.cert)))) || ri.recipientEncryptedKeys[0];
-  var kekBytes = WRAP_KEK_LENGTHS[wrapAlg.oid];
-  if (!kekBytes) throw _err("cms/unsupported-algorithm", "unsupported kari key-wrap");
-  var ukm = ri.ukm || null;
+  // The copy is taken and the protected region opens IMMEDIATELY. Everything between them would
+  // otherwise be an unprotected window, and it is not a narrow one: reading the wrap algorithm, the
+  // originator's key, the recipient's certificate and the matching RecipientEncryptedKey all parse
+  // attacker-supplied structure and all throw on malformed input. A message crafted to fail any one
+  // of them would be a way to leave the key copy in the heap -- the exact outcome the wipe is for.
+  var k = _normKeyDer(km.key);
   // The agreement secret and the KEK derived from it are both allocated here; one `finally` clears
   // whichever branch produced them, including when the unwrap below throws on a tampered key.
   var kek, z, mz;
   try {
+    var keyDer = k.der;
+    var kea = ri.keyEncryptionAlgorithm;
+    var wrapAlg = _kariWrap(kea);
+    var scheme = kea.oid;
+    var origSpki = _originatorSpki(ri.originator);
+    // Unwrap THIS recipient's RecipientEncryptedKey (matched by rid), not element 0 -- a kari may list
+    // several recipients under one ephemeral key.
+    var rek = (km.cert != null && _kariRekFor(ri, x509.parse(_normCertDer(km.cert)))) || ri.recipientEncryptedKeys[0];
+    var kekBytes = WRAP_KEK_LENGTHS[wrapAlg.oid];
+    if (!kekBytes) throw _err("cms/unsupported-algorithm", "unsupported kari key-wrap");
+    var ukm = ri.ukm || null;
     if (_isMont(origSpki)) {
       var mont = _montName(origSpki);
       var recipPriv = await subtle.importKey("pkcs8", keyDer, { name: mont.name }, false, ["deriveBits"]);
@@ -275,6 +289,7 @@ async function _kariCek(ri, km) {
     return await _aesKwUnwrap(kek, rek.encryptedKey);
   } finally {
     guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
+    _releaseKeyDer(k);
   }
 }
 
@@ -333,7 +348,12 @@ async function _kemriCek(ri, km) {
   var kekBytes = Number(k.kekLength);
   var wrapAlg = k.wrap;
   if (WRAP_KEK_LENGTHS[wrapAlg.oid] !== kekBytes) throw _fail(); // M29 re-check on the consumer path
-  var priv = await subtle.importKey("pkcs8", _normKeyDer(km.key), { name: wcName }, false, ["decapsulateBits"]);
+  // The decapsulation key copy is released as soon as the engine has imported it -- the import is
+  // the only thing that reads it, so its lifetime does not need to span the decapsulation below.
+  var keyCopy = _normKeyDer(km.key);
+  var priv;
+  try { priv = await subtle.importKey("pkcs8", keyCopy.der, { name: wcName }, false, ["decapsulateBits"]); }
+  finally { _releaseKeyDer(keyCopy); }
   var ss = null, kek = null, ssAb = null, kekAb = null;
   try {
     // The engine hands back an ArrayBuffer it allocated, and the Buffer below is a copy of it. Both
@@ -706,12 +726,33 @@ async function _verifyAuthenticatedData(parsed, km, opts) {
 //   * the `macKey == null` half of the random-key substitution fires only for a hand-crafted RSA v1.5
 //     ktri (this producer emits OAEP); its behaviour is identical to the tested below-floor path (a
 //     random key -> the MAC verify fails uniformly), so the < 16 vector covers the substitution.
+// _normKeyDer(key) -> { der, owned } -- the recipient private key as PKCS#8 DER, and whether the
+// buffer is one THIS module made.
+//
+// The distinction decides who may wipe it. A caller handing in their own Buffer keeps a live
+// reference and will use it again; wiping that would destroy the key out from under them. The other
+// two forms produce a NEW buffer here -- a Uint8Array is copied, a PEM string is decoded -- and that
+// buffer is a second copy of a private key which nothing else can reach, so it lives until the
+// garbage collector happens to reuse the page unless this module clears it.
+//
+// Returning the flag rather than always copying keeps the caller's buffer un-duplicated: making our
+// own copy of every key so we could uniformly wipe it would ADD a copy of the secret to solve the
+// problem of having one.
 function _normKeyDer(key) {
-  if (Buffer.isBuffer(key)) return key;
-  if (key instanceof Uint8Array) return Buffer.from(key);
-  if (typeof key === "string") { try { return pkcs8.pemDecode(key); } catch (e) { throw _err("cms/bad-input", "the recipient private-key PEM could not be decoded", e); } }
+  if (Buffer.isBuffer(key)) return { der: key, owned: false };
+  if (key instanceof Uint8Array) return { der: Buffer.from(key), owned: true };
+  if (typeof key === "string") {
+    var der;
+    try { der = pkcs8.pemDecode(key); }
+    catch (e) { throw _err("cms/bad-input", "the recipient private-key PEM could not be decoded", e); }
+    return { der: der, owned: true };
+  }
   throw _err("cms/bad-input", "the recipient private key must be a PKCS#8 DER Buffer or PEM string");
 }
+// Wipe a key buffer this module owns. A no-op for the caller's own Buffer, which is theirs.
+function _releaseKeyDer(k) {
+  if (k && k.owned) guard.secret.zeroize(k.der, CmsError, "cms/bad-input", "the recipient private-key copy");
+}
 function _normCertDer(cert) {
   if (Buffer.isBuffer(cert)) return cert;
   if (cert instanceof Uint8Array) return Buffer.from(cert);

package/lib/cms-sign.js

@@ -337,7 +337,13 @@ function _pemToDer(text) {
 }
 
 // pki.cms.sign -- documented by the @primitive block in cms-verify.js (the @module pki.cms home).
+// Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async); the checks stay
+// synchronous because they read the caller's mutable content and signer list.
 function sign(content, signers, opts) {
+  return guard.async.deferred(function () { return _sign(content, signers, opts); });
+}
+
+function _sign(content, signers, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.sign options must be an object");
   var contentBuf = _toBuf(content, "content");
@@ -533,7 +539,12 @@ function _targetPreimage(siNode, opts) {
 }
 
 // pki.cms.countersign -- documented by the @primitive block in cms-verify.js (the @module pki.cms home).
+// Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async).
 function countersign(cmsInput, signers, opts) {
+  return guard.async.deferred(function () { return _countersign(cmsInput, signers, opts); });
+}
+
+function _countersign(cmsInput, signers, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.countersign options must be an object");
   var list = Array.isArray(signers) ? signers : [signers];