@blamejs/pki 0.5.5 → 0.5.7

package/CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.7 — 2026-08-16
+
+A CMS signature made over signed attributes can no longer be re-presented as one made over content.
+
+### Added
+
+- The pki.cms.verify verdict carries eContentType, and each signers[i] carries signedAttributesPresent. Signing with attributes and signing the content directly are different claims -- attributes bind a content type and a signing time alongside the digest, content-only binds nothing but the bytes -- and one message may carry a signer of each. A caller whose profile is stricter than RFC 5652's, such as RFC 8551 S/MIME which requires signed attributes, can now enforce that from the verdict instead of parsing the message a second time. A check that needs a second parse is a check most callers will not write.
+
+### Changed
+
+- Because the producing verbs now copy their arguments at entry, each property of a spec or options object -- own or inherited -- is read exactly once, when the verb is called. A field defined as a getter is therefore evaluated at that point even if the verb has no use for it, and a getter that throws surfaces as that module's bad-input fault before its own validation of any other field. Reading each property once is the point rather than a side effect: a getter consulted twice can answer differently the second time, which is the same problem the copy exists to remove. Plain data specs are unaffected.
+- One argument shape is refused rather than copied: an object whose state this toolkit cannot read -- a WeakMap or WeakSet, a promise, a CryptoKey -- carrying its own named fields alongside. There is no safe handling for it, because it cannot be copied and passing it through would leave those fields changeable after the checks had read them, so it fails with the module's bad-input code and says to pass the fields as a plain object. The same objects are accepted as before when they carry only what their kind defines, which is what a real key, a real promise and a real WeakMap do.
+- SECURITY.md previously said an attacker could "neither swap the content out from under a set of signed attributes, nor strip the attributes and present a signature made over them as one made over the content". The first half was true; the second was not, and had not been since the claim was written. The entry now describes what is actually defended and how, and names the case it costs: content which genuinely is an encoded SignedAttributes block must be signed WITH signed attributes. The v0.5.6 notes described the parsed-object re-derivation as closing this forgery; it closed the half reachable through a caller-assembled object, and this release closes the half reachable from bytes.
+
+### Fixed
+
+- pki.cms.verify refuses a SignerInfo with no signed attributes whose content is itself an encoded SignedAttributes block, as cms/ambiguous-content. This is Attack Type 1 of draft-vangeest-lamps-cms-euf-cma-signeddata: take a message signed with attributes present, drop the signedAttrs field, set the encapsulated content to the DER of those attributes, keep the signature. The signature genuinely verifies over those bytes -- the refusal is the shape, not a failed signature check, which is why it has its own code rather than reading as cms/bad-signature. The condition is necessary to the attack rather than a guess at anything SET OF shaped: RFC 5652 section 5.3 requires signed attributes to carry both a content-type and a message-digest attribute, so every message the attack produces has content carrying both, and content that is a set of attributes missing either one is not refused. Ordinary content -- a certificate, a JSON payload, arbitrary bytes -- does not have the shape at all. Verified against the shipped verb before and after, and the standards fixes for this are protocol changes (signing under a context string that names the mode) which no verifier can apply on its own.
+- pki.cms.sign refuses to sign content that is itself an encoded SignedAttributes block when signedAttributes is false. That is the other direction of the same problem (Attack Type 2): such a signature can afterwards be promoted into an attributes-present message, because the signature does not commit to which mode was used -- the attacker attaches the signed bytes AS the SignedAttributes and swaps in whatever content their message-digest attribute names. Refusing to mint the ambiguous signature is the only point at which that direction can be stopped. Sign the same content WITH signed attributes and it is unambiguous again.
+- A byte argument whose backing store has been transferred away is refused instead of read as empty. Transferring an ArrayBuffer -- a structuredClone with transfer, a worker hand-off, a stream that adopts the buffer -- leaves every view of it reading zero-length rather than throwing, so a boundary that passed the caller's object straight on operated on nothing and succeeded: pki.cms.sign produced a sound, verifiable signature covering no content at all, pki.cms.compress the same, and pki.pkcs12.build derived its MAC and encryption keys from the empty password. Every boundary that takes caller bytes now re-views the input first and refuses a detached one with that module's own bad-input code. Where the empty read already failed further down -- an empty certificate does not parse, an empty private key does not import -- the refusal now carries the calling module's code and names the argument, rather than surfacing whatever the later failure raised.
+- A producing verb reads its arguments once, at entry. Every one of them does work across more than one promise turn, so a caller still holding a spec, an options object or a signer could change a field after the call returned and have a later turn read the new value -- the checks ran against one input and the artifact was built from another. Every argument of pki.cms.sign, pki.cms.countersign, pki.x509.sign, pki.csr.sign, pki.crl.sign, pki.attrcert.sign, pki.crmf.build, pki.cmc.build, pki.cmp.build, pki.ocsp.buildRequest, pki.ocsp.sign, pki.tsp.sign and pki.pkcs12.build is now copied whole at entry, at every depth, and each copy is cleared when the call settles. Reachable cases included flipping signedAttributes from true to false to skip the content check the entry above describes, rewriting a certificate's key identifier or a CRL's authority key identifier between the check and the encoding, changing the encoding pki.x509.sign returns after the signature came back, rewriting the PKCS#12 password partway through so the file's MAC and its bag encryption were keyed to two different values, and rewriting the nested pki.cmp.build MAC secret so the message went out authenticated under a value the caller never supplied. Copying at one level does not cover the last of those and copying without clearing duplicates the secret, so both halves are the rule. A parsed structure passed inside a spec keeps its identity rather than being copied, so it still satisfies the verbs that require parser provenance, and a CryptoKey is used rather than cloned.
+- The verbs documented as returning a Promise now run their body at the call, not a turn later. Ten of them deferred everything -- including reading the caller's arguments -- until after the call had already returned, which left the window above open even for a verb that copies its input on the first line. They still report a fault by rejecting rather than throwing; only the timing of the work changed.
+
+## v0.5.6 — 2026-08-15
+
+A CMS SignedData is verified over the bytes it was parsed from, an omitted PKCS#12 password is refused rather than encoded as the empty one, and a verb documented as returning a Promise rejects instead of throwing past your .catch.
+
+### Changed
+
+- A verb documented as returning a Promise now rejects; it never throws synchronously. An operator reads -> Promise<...> in the reference and writes the documented shape, pki.cms.sign(content, signers).catch(handleIt) -- and a validation that ran before the promise was created threw straight past that .catch, so a misspelled option or a malformed input became an uncaught exception in code that already handles errors. Nothing in the shape of the call said which verbs did it. Eleven did: pki.cms.verify, pki.cms.sign, pki.cms.countersign, pki.ocsp.sign, pki.tsp.sign, and six pki.acme verbs. Nine more on the client pki.acme.client(...) returns did the same, including getAuthorization, which an ordinary ACME loop reaches with a URL that came from the CA rather than from the caller. The checks still run synchronously, so a caller's mutable options are read before any turn passes; only the way a fault leaves has changed. If you wrapped one of these verbs in a synchronous try/catch without awaiting it -- which the documented signature never supported, but which worked by accident on exactly these verbs -- that catch no longer fires and the rejection surfaces as an unhandled one instead. Await the call, or attach .catch to it.
+- pki.tsp.verify reports whether revocation was established, not only whether the timestamp authority chained. Revocation runs only when a revocationChecker is supplied, so a token whose TSA was never checked against a CRL or an OCSP responder read identically to one established un-revoked -- and that is the default. The verdict now carries revocationChecked and anchorConstraints from the path validation, in pki.path.validate's own vocabulary, so a timestamp archived to be re-read years later can still answer what was actually checked. The trustAnchor documentation no longer lists revocation unconditionally.
+
+### Fixed
+
+- pki.cms.verify computes its verdict over the bytes the parser read. A SignedData's meaning is a signature over a byte range, but a parsed one presents that range, the signature, the algorithms and the certificates as separate properties, and the verb read them as though the parser had produced them together. The forgery that follows is concrete: take a message a trusted signer really signed, keep its SignerInfo and signature untouched, set signedAttrsBytes to null, and present the signature's own preimage -- the signed attributes re-tagged as the SET OF the signature covers -- as the encapsulated content under any content type you like. With no signed attributes the signature is checked against the content directly, which is exactly those bytes, and neither the content-type nor the message-digest check runs, so the message verifies as valid content the signer never signed. pki.schema.cms.parse now records what it read, pki.cms.verify re-derives from that record, and a SignedData a caller assembled rather than parsed is refused with a typed error instead of dereferenced into a raw TypeError. Passing DER, PEM, or the parser's own unmodified result is unaffected.
+- pki.pkcs12.build refuses a store with no password instead of building one under the empty password. An omitted password and the empty password are different credentials, and the difference was invisible at the call site: pki.pkcs12.build(spec) with no options at all, or with the option name misspelled, returned a well-formed store whose shrouded private key opened under "" -- a key protected by nothing, with no error anywhere. The empty password is still available; it has to be asked for, as "".
+- pki.pkcs12.build validates opts.integrity.mode against the value it accepts. Compared against a single literal, any other spelling read as "not public-key" and silently selected password integrity, dropping the signer with it: a caller who wrote mode: 'publicKey' asked for a CMS signature over the AuthenticatedSafe and got a password MAC. Combined with the previous item, a caller who misspelled both options got a store MACed under the empty password while believing it was signature-protected. An unrecognized key on opts.integrity is refused too.
+- pki.pkcs12.open bounds the key-derivation work of a modern store, not only a legacy one. The aggregate budget existed because a per-bag iteration cap resets on every bag, so a store that repeats a costly bag up to the parser's element limit multiplies the cap by that limit -- but it was charged only on the RFC 7292 Appendix C path, leaving the RFC 8018 PBES2 path -- the one OpenSSL and NSS emit, and the one this toolkit itself builds -- free to do exactly that. Measured before the fix: ten bags at a million iterations each ran ten million aggregate rounds of blocking PBKDF2 with no refusal. Both schemes now charge one budget, and it is charged before the derivation runs rather than after.
+- A PKCS#12 password this toolkit encoded is cleared once the derivation has consumed it, on the PBES2 and PBMAC1 paths as well as the classic ones. The Appendix B.1 copy taken from a password argument was wiped while the UTF-8 copy taken from the same argument in the same call was not, leaving a plaintext password in the heap after every modern bag encryption, bag decryption and MAC. A Buffer you supply is never written to: it is yours, and clearing it would destroy your credential rather than protect it.
+- pki.tsp.request validates a pre-encoded extension instead of splicing it in. Elements of opts.extensions were checked only for being byte-like and then concatenated straight into the request, so a caller relaying an extension blob it did not author put fully chosen bytes into the structure -- and the encoder emitted requests its own pki.tsp.parseRequest refuses: an undecodable value, a repeated extension identifier, an explicit critical=FALSE that DER requires be omitted. Each element now goes through the same pre-encoded-Extension gate every other request builder in the toolkit applies, including the duplicate-identifier check.
+- pki.tsp.sign, pki.tsp.request and pki.tsp.verify report a bad serial number or nonce as a typed tsp/bad-input. A value that is not an integer reached BigInt() directly and raised a raw SyntaxError or RangeError out of a public verb -- an untyped fault a caller handling tsp/* codes cannot catch.
+- pki.sigstore.verifyBundle refuses an option it does not recognize. The identity policy one level down already did, for the reason that applies just as much at the top: the signer pin goes by other names in other Sigstore tooling, and a spelling this verb swallowed checked nothing under a name the operator believed pinned the signer. At the top level the same slip also loses the SLSA predicate pin, and unlike the identity fields there is no report field to reveal it -- the verdict said verified: true with the signer and the predicate entirely unpinned.
+
 ## v0.5.5 — 2026-08-15
 
 A verdict is computed over the bytes the parser read, an identity is derived from the bytes that carry it, and the guards match no patterns.

package/MIGRATING.md

@@ -14,6 +14,69 @@ The toolkit has no `deprecate()`-marked surface awaiting removal.
 
 Listed newest-first.
 
+### v0.5.7 — `content that is an encoded SignedAttributes block`
+
+Signing or verifying such content WITHOUT signed attributes is refused as cms/ambiguous-content.
+
+A CMS signature does not commit to whether signed attributes were present, so a signature made
+over a SignedAttributes block can be re-presented as one made over content. The shape is now
+refused at both ends.
+
+This only affects you if your CMS content genuinely IS a DER SET OF Attribute carrying both a
+content-type and a message-digest attribute -- the shape RFC 5652 sec. 5.3 gives a
+SignedAttributes -- AND you sign it with `signedAttributes: false`. Ordinary content is
+unaffected, and so is a set of attributes missing either of those two.
+
+```js
+await pki.cms.sign(attrShapedContent, signer, { signedAttributes: false });  // cms/ambiguous-content
+await pki.cms.sign(attrShapedContent, signer);                              // signed attributes: fine
+```
+
+Signing it WITH signed attributes makes the message unambiguous and it verifies normally.
+Existing messages of this shape already in your archive will not verify; re-sign them with
+signed attributes.
+
+### v0.5.6 — `try { pki.<verb>(...) } catch`
+
+A verb documented `-> Promise` rejects on a bad input instead of throwing before the promise exists.
+
+If you awaited the call, or attached `.catch`, nothing changes and there is nothing to do.
+
+What changes is the undocumented shape: a synchronous `try`/`catch` that never consumed the
+returned promise.
+
+```js
+try {
+  pki.cms.verify(bytes);            // no await, no .catch
+} catch (e) { /* used to fire on a malformed input */ }
+```
+
+That `catch` no longer runs, and the rejection surfaces as an unhandled one. It worked by
+accident on exactly the verbs where a check happened to run before the promise existed --
+`pki.cms.verify`, `pki.cms.sign`, `pki.cms.countersign`, `pki.ocsp.sign`, `pki.tsp.sign`, six
+`pki.acme` verbs, and nine verbs on the client `pki.acme.client(...)` returns. Which verbs
+those were was not visible from the call, which is why they are now uniform.
+
+```js
+await pki.cms.verify(bytes);        // or pki.cms.verify(bytes).catch(handleIt)
+```
+
+### v0.5.6 — `pki.pkcs12.build(spec)`
+
+An omitted password is refused rather than encoded as the empty one.
+
+A store whose password option was missing or misspelled no longer builds silently under `""`.
+
+```js
+await pki.pkcs12.build(spec);                    // now pkcs12/bad-input
+await pki.pkcs12.build(spec, { password: "" });  // the empty password, asked for
+```
+
+If you were relying on the default, the second form restores the previous output byte for
+byte. `opts.integrity.mode` is validated the same way: a spelling other than `"public-key"`
+is now `pkcs12/bad-integrity-mode` instead of silently selecting password integrity and
+dropping the signer.
+
 ### v0.5.5 — `require("@blamejs/pki/lib/...")`
 
 The package resolves one entry point; a path into the package no longer resolves.

package/lib/acme.js

@@ -684,6 +684,12 @@ function _payloadBuf(obj) {
   if (obj === undefined) return Buffer.alloc(0);                 // POST-as-GET
   return Buffer.from(JSON.stringify(obj), "utf8");
 }
+// A verb documented `-> Promise` refuses by REJECTING, never by throwing (guard-async).
+//
+// The validation stays SYNCHRONOUS: these verbs read a caller's options object -- the key, the
+// nonce, the identifiers -- and resolving those before any turn passes is what stops a value being
+// swapped between the check and the use. Only the exit changes.
+var _promised = guard.async.deferred;
 function _signOuter(o, payloadObj) {
   if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
   if (!o.key) throw E("acme/bad-input", "a signing key (opts.key) is required");
@@ -707,10 +713,12 @@ function _signOuter(o, payloadObj) {
  *   await pki.acme.postAsGet({ key, alg: "ES256", nonce, url: orderUrl, kid });
  */
 function postAsGet(o) {
-  if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
-  // An authenticated read is ALWAYS kid-signed; copy only the kid-mode fields so a
-  // leftover jwk (e.g. reused from a newAccount options object) cannot embed a key.
-  return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, undefined);
+  return _promised(function () {
+    if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
+    // An authenticated read is ALWAYS kid-signed; copy only the kid-mode fields so a
+    // leftover jwk (e.g. reused from a newAccount options object) cannot embed a key.
+    return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, undefined);
+  });
 }
 
 // A contact URL (RFC 8555 sec. 7.3): a `mailto:` addr-spec carries no header
@@ -750,6 +758,7 @@ function _assertContacts(contacts) {
  *   await pki.acme.newAccount({ key, alg: "ES256", nonce, url, jwk, termsOfServiceAgreed: true });
  */
 function newAccount(o) {
+  return _promised(function () {
   if (!_isObject(o) || !_isObject(o.jwk)) throw E("acme/bad-input", "newAccount must embed the account public jwk (RFC 8555 sec. 7.3)");
   var payload = {};
   if (o.contact !== undefined) { _assertContacts(o.contact); payload.contact = o.contact; }
@@ -769,6 +778,7 @@ function newAccount(o) {
     payload.externalAccountBinding = o.externalAccountBinding;
   }
   return jose.sign({ protected: { alg: o.alg, nonce: o.nonce, url: o.url, jwk: o.jwk }, payload: _payloadBuf(payload), key: o.key, jwk: o.jwk, profile: "acme-outer" });
+  });
 }
 
 var _HMAC_HASH = { HS256: "SHA-256", HS384: "SHA-384", HS512: "SHA-512" };
@@ -855,6 +865,7 @@ function _validateOrderIdentifier(id) {
  *   await pki.acme.newOrder({ key, alg: "ES256", nonce, url, kid, identifiers: [{ type: "dns", value: "example.org" }] });
  */
 function newOrder(o) {
+  return _promised(function () {
   if (!_isObject(o) || !Array.isArray(o.identifiers) || o.identifiers.length === 0) throw E("acme/bad-order", "newOrder requires a non-empty identifiers array (RFC 8555 sec. 7.4)");
   // Serialize the CANONICAL { type, value } each validator returns, never the caller's objects (which may carry
   // getter-backed / inherited fields JSON.stringify would drop, or extra enumerable fields it would send).
@@ -863,6 +874,7 @@ function newOrder(o) {
   if (o.notAfter !== undefined) { if (!_isRfc3339(o.notAfter)) throw E("acme/bad-order", "notAfter must be an RFC 3339 date-time"); payload.notAfter = o.notAfter; }
   if (o.replaces !== undefined) { if (!_isString(o.replaces)) throw E("acme/bad-order", "replaces must be an ARI certID string (RFC 9773 sec. 5)"); payload.replaces = o.replaces; }
   return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload);
+  });
 }
 
 /**
@@ -1035,10 +1047,12 @@ async function finalize(o) {
  *   await pki.acme.challengeResponse({ key, alg: "ES256", nonce, url: challUrl, kid });
  */
 function challengeResponse(o) {
-  if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
-  var payload = o.payload !== undefined ? o.payload : {};
-  if (!_isObject(payload)) throw E("acme/bad-input", "a challenge response payload must be a JSON object (RFC 8555 sec. 7.5.1)");
-  return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload);
+  return _promised(function () {
+    if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
+    var payload = o.payload !== undefined ? o.payload : {};
+    if (!_isObject(payload)) throw E("acme/bad-input", "a challenge response payload must be a JSON object (RFC 8555 sec. 7.5.1)");
+    return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, payload);
+  });
 }
 
 /**
@@ -1061,8 +1075,10 @@ function challengeResponse(o) {
  *   await pki.acme.deactivate({ key, alg: "ES256", nonce, url: authzUrl, kid });
  */
 function deactivate(o) {
-  if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
-  return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, { status: "deactivated" });
+  return _promised(function () {
+    if (!_isObject(o)) throw E("acme/bad-input", "a request options object is required");
+    return _signOuter({ key: o.key, alg: o.alg, nonce: o.nonce, url: o.url, kid: o.kid }, { status: "deactivated" });
+  });
 }
 
 /**
@@ -1091,6 +1107,7 @@ function deactivate(o) {
  *   await pki.acme.revokeCert({ key, alg: "ES256", nonce, url, kid, certificate: certDer, reason: 1 });
  */
 function revokeCert(o) {
+  return _promised(function () {
   if (!_isObject(o) || !Buffer.isBuffer(o.certificate)) throw E("acme/bad-input", "revokeCert requires a DER certificate Buffer (opts.certificate)");
   x509.parse(o.certificate);                              // structural validation of the target
   var hasKid = Object.prototype.hasOwnProperty.call(o, "kid");
@@ -1106,6 +1123,7 @@ function revokeCert(o) {
   var header = { alg: o.alg, nonce: o.nonce, url: o.url };
   if (hasKid) header.kid = o.kid; else header.jwk = o.jwk;
   return jose.sign({ protected: header, payload: _payloadBuf(payload), key: o.key, jwk: o.jwk, profile: "acme-outer" });
+  });
 }
 
 /**
@@ -2015,12 +2033,18 @@ function client(directoryUrl, opts) {
     });
     });
   }
-  function _getOrder(url) { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("order", _json(res)); }); }
-  function _getAuthorization(url) { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("authorization", _json(res)); }); }
-  function _getChallenge(url) { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("challenge", _json(res)); }); }
-  function _respondToChallenge(url) { return _post(_clientUrl(url), challengeResponse, null, "kid").then(function (res) { return validate("challenge", _json(res)); }); }
-
-  function _finalize(order, o) {
+  // A bad URL leaves as a REJECTION, like every other verb on this client. It is not only a caller
+  // typo that reaches here: the message layer deliberately accepts http as well as https, so an
+  // order whose `authorizations` array carries an http URL validates, and the very next step --
+  // getAuthorization(order.authorizations[0]) -- threw out of the middle of an async ACME loop
+  // rather than rejecting into the handler already wrapped around it.
+  function _getOrder(url) { return _promised(function () { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("order", _json(res)); }); }); }
+  function _getAuthorization(url) { return _promised(function () { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("authorization", _json(res)); }); }); }
+  function _getChallenge(url) { return _promised(function () { return _postAsGet(_clientUrl(url)).then(function (res) { return validate("challenge", _json(res)); }); }); }
+  function _respondToChallenge(url) { return _promised(function () { return _post(_clientUrl(url), challengeResponse, null, "kid").then(function (res) { return validate("challenge", _json(res)); }); }); }
+
+  function _finalize(order, o) { return _promised(function () { return _finalizeBody(order, o); }); }
+  function _finalizeBody(order, o) {
     o = o || {};
     if (!_isObject(order) || !_isString(order.finalize)) throw E("acme/bad-input", "finalize requires the order object with its finalize URL");
     if (!Array.isArray(order.identifiers)) throw E("acme/bad-input", "finalize requires the order's identifiers to enforce the RFC 8555 sec. 7.4 CSR-set match");
@@ -2155,10 +2179,11 @@ function client(directoryUrl, opts) {
     });
   }
 
-  function _deactivateAccount() { return _post(_requireKid(), deactivate, null, "kid").then(function (res) { return validate("account", _json(res)); }); }
-  function _deactivateAuthorization(url) { return _post(_clientUrl(url), deactivate, null, "kid").then(function (res) { return validate("authorization", _json(res)); }); }
+  function _deactivateAccount() { return _promised(function () { return _post(_requireKid(), deactivate, null, "kid").then(function (res) { return validate("account", _json(res)); }); }); }
+  function _deactivateAuthorization(url) { return _promised(function () { return _post(_clientUrl(url), deactivate, null, "kid").then(function (res) { return validate("authorization", _json(res)); }); }); }
 
-  function _keyChange(o) {
+  function _keyChange(o) { return _promised(function () { return _keyChangeBody(o); }); }
+  function _keyChangeBody(o) {
     o = o || {};
     if (!o.newKey || !_isObject(o.newJwk) || !_isString(o.newAlg)) throw E("acme/bad-input", "keyChange requires newKey, newJwk, and newAlg");
     var account = _requireKid();
@@ -2181,6 +2206,9 @@ function client(directoryUrl, opts) {
 
   // ARI RenewalInfo (RFC 9773 sec. 4.1) -- the SOLE UNAUTHENTICATED GET (no JWS, no nonce).
   function _renewalInfo(certDer, clockFn, retryAfterCapSeconds) {
+    return _promised(function () { return _renewalInfoBody(certDer, clockFn, retryAfterCapSeconds); });
+  }
+  function _renewalInfoBody(certDer, clockFn, retryAfterCapSeconds) {
     if (!Buffer.isBuffer(certDer)) throw E("acme/bad-input", "renewalInfo requires a DER certificate Buffer");
     var _rawClk = typeof clockFn === "function" ? clockFn : clock;   // renewalWindow may pass a per-call clock
     // The clock MUST return finite epoch ms: a NaN / Infinity would make the expiry comparison below silently

package/lib/attrcert-sign.js

@@ -456,7 +456,11 @@ function _buildExtensions(extSpec, aaSpki) {
  *   pki.schema.attrcert.parse(ac).attributes[0].type;   // the role attribute OID
  */
 function sign(spec, issuer, opts) {
-  return Promise.resolve().then(function () { return _sign(spec, issuer, opts); });
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign.
+  return guard.bytes.fixedCall(AttrCertError, "attrcert/bad-input", [
+    [spec, "the attribute-certificate spec"], [issuer, "the issuer"], [opts, "pki.attrcert.sign options"],
+  ], _sign);
 }
 
 function _sign(spec, issuer, opts) {

package/lib/cmc-build.js

@@ -365,8 +365,7 @@ function _assertNoDuplicateBinding(callerControls, spec) {
 function _asBigInt(v, what) { return guard.range.authoredInteger(v, E, "cmc/bad-input", what); }
 
 function _der(v, what) {
-  if (Buffer.isBuffer(v)) return v;
-  if (v instanceof Uint8Array) return Buffer.from(v);
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmcError, "cmc/bad-input", what);
   throw E("cmc/bad-input", what + " must be DER bytes");
 }
 function _oidOf(v) {
@@ -481,17 +480,13 @@ function popLinkWitnessV2(secret, R) {
 // The operator-facing @primitive block for this function lives beside its
 // re-export in cmc-verify.js, the pki.cmc @module home.
 function build(spec, signer, opts) {
-  // Assembled SYNCHRONOUSLY. _build reads the spec, every request buffer and the
-  // signer as it goes, so deferring that work would read them a turn after the
-  // call -- and a caller reusing a pooled CSR buffer, or reaching back into the
-  // spec on the next line, would have the message signed over something other
-  // than what was handed in. Only the signing itself is async, and by then the
-  // bytes are fixed.
-  try {
-    return _build(spec, signer, opts);
-  } catch (e) {
-    return Promise.reject(e);   // the surface stays promise-rejecting, never throwing
-  }
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign. It matters most here: the Identity Proof and POP Link witnesses
+  // are computed over the bytes this builder is about to emit, so a spec that changed in between
+  // would witness a different request than the one that goes out.
+  return guard.bytes.fixedCall(CmcError, "cmc/bad-input", [
+    [spec, "the CMC request spec"], [signer, "the signer"], [opts, "pki.cmc.build options"],
+  ], _build);
 }
 
 function _build(spec, signer, opts) {

package/lib/cmc-verify.js

@@ -318,7 +318,7 @@ function verify(response, sent) {
   } catch (e) {
     return Promise.reject(e);   // the surface stays promise-rejecting, never throwing
   }
-  return Promise.resolve().then(function () { return _verify(frozenResponse, frozenSent); });
+  return guard.async.deferred(function () { return _verify(frozenResponse, frozenSent); });
 }
 
 function _assertOpts(sent) {
@@ -354,7 +354,7 @@ function _snapshotIfBytes(input) {
 // the very gap this closes -- reopening the window for exactly the inputs that came in by the
 // wider one. A DataView is copied over its OWN window, not the whole buffer it happens to sit in.
 function _copyAnyBytes(v) {
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return Buffer.from(v);
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmcError, "cmc/bad-input", "a byte field of the request");
   if (ArrayBuffer.isView(v)) return Buffer.from(new Uint8Array(v.buffer, v.byteOffset, v.byteLength));
   if (v instanceof ArrayBuffer) return Buffer.from(new Uint8Array(v));
   return v;

package/lib/cmp-build.js

@@ -550,7 +550,12 @@ function _resolveProtection(opts) {
 // ---- orchestrator ----
 
 function build(message, opts) {
-  return Promise.resolve().then(function () { return _build(message, opts); });
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign. `opts.mac.secret` is why the copy has to be deep: it sits a
+  // level below the options object and is read by the PBMAC1 derivation after the first turn.
+  return guard.bytes.fixedCall(CmpError, "cmp/bad-input", [
+    [message, "the PKIMessage spec"], [opts, "pki.cmp.build options"],
+  ], _build);
 }
 
 function _build(message, opts) {
@@ -733,7 +738,7 @@ function _classifyCmpResponse(status, headers, body, tls) {
 }
 
 function transfer(url, message, opts) {
-  return Promise.resolve().then(function () { return _transfer(url, message, opts); });
+  return guard.async.deferred(function () { return _transfer(url, message, opts); });
 }
 
 function _transfer(url, message, opts) {

package/lib/cmp-session.js

@@ -892,8 +892,10 @@ function session(opts) {
       catch (_e) { /* allow:swallow-unverified an unparseable p10cr CSR fails closed at the cmp.build boundary; the key-match is simply not applied to a request that never sends */ return null; }
     }
     var pk = armSpec && armSpec.certTemplate ? armSpec.certTemplate.publicKey : null;
-    if (Buffer.isBuffer(pk)) return pk;
-    if (pk instanceof Uint8Array) return Buffer.from(pk);
+    // SNAPSHOT: this is held in session state across the transport round trip and then compared
+    // against the issued certificate's key, so an alias would let the caller rewrite the key the
+    // response is checked against after the request went out.
+    if (Buffer.isBuffer(pk) || pk instanceof Uint8Array) return guard.bytes.snapshot(pk, CmpError, "cmp/bad-input", "the certTemplate publicKey");
     return null;
   }
 

package/lib/cmp-verify.js

@@ -618,7 +618,7 @@ function _nonEmptySecret(s) {
 }
 
 function verify(message, opts) {
-  return Promise.resolve().then(function () { return _verify(message, opts); });
+  return guard.async.deferred(function () { return _verify(message, opts); });
 }
 
 async function _verify(message, opts) {

package/lib/cms-compress.js

@@ -86,8 +86,7 @@ async function decompress(input, opts) {
 }
 
 function _toDer(input) {
-  if (Buffer.isBuffer(input)) return input;
-  if (input instanceof Uint8Array) return Buffer.from(input);
+  if (Buffer.isBuffer(input) || input instanceof Uint8Array) return guard.bytes.snapshot(input, CmsError, "cms/bad-input", "input");
   if (typeof input === "string") { try { return schemaCms.pemDecode(input); } catch (e) { throw _err("cms/bad-input", "the CMS PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
 }

package/lib/cms-decrypt.js

@@ -106,8 +106,7 @@ function _parse(input) {
   return schemaCms.parse(_toDer(input));
 }
 function _toDer(input) {
-  if (Buffer.isBuffer(input)) return input;
-  if (input instanceof Uint8Array) return Buffer.from(input);
+  if (Buffer.isBuffer(input) || input instanceof Uint8Array) return guard.bytes.snapshot(input, CmsError, "cms/bad-input", "input");
   if (typeof input === "string") { try { return schemaCms.pemDecode(input); } catch (e) { throw _err("cms/bad-input", "the CMS PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
 }
@@ -754,8 +753,7 @@ function _releaseKeyDer(k) {
   if (k && k.owned) guard.secret.zeroize(k.der, CmsError, "cms/bad-input", "the recipient private-key copy");
 }
 function _normCertDer(cert) {
-  if (Buffer.isBuffer(cert)) return cert;
-  if (cert instanceof Uint8Array) return Buffer.from(cert);
+  if (Buffer.isBuffer(cert) || cert instanceof Uint8Array) return guard.bytes.snapshot(cert, CmsError, "cms/bad-input", "the recipient certificate");
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("cms/bad-input", "the recipient certificate PEM could not be decoded", e); } }
   throw _err("cms/bad-input", "the recipient certificate must be a DER Buffer or PEM string");
 }

package/lib/cms-encrypt.js

@@ -40,8 +40,7 @@ function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(nam
 // A certificate descriptor -> raw DER (the recipient cert is parsed for dispatch + rid; the caller
 // supplies bytes, not a re-encoded parse).
 function _normCertDer(cert, what) {
-  if (Buffer.isBuffer(cert)) return cert;
-  if (cert instanceof Uint8Array) return Buffer.from(cert);
+  if (Buffer.isBuffer(cert) || cert instanceof Uint8Array) return guard.bytes.snapshot(cert, CmsError, "cms/bad-input", what || "a certificate");
   if (typeof cert === "string") { try { return x509.pemDecode(cert); } catch (e) { throw _err("cms/bad-input", (what || "a certificate") + " PEM could not be decoded", e); } }
   throw _err("cms/bad-input", (what || "a certificate") + " must be a DER Buffer, Uint8Array, or PEM string");
 }

package/lib/cms-sign.js

@@ -325,8 +325,10 @@ function _keyOnlyKeyId(so) {
 
 function _normCertDer(c) {
   if (c == null) throw _err("cms/bad-input", "each signer requires a certificate (cert)");
-  if (c instanceof Uint8Array && !Buffer.isBuffer(c)) c = Buffer.from(c);   // a Uint8Array -> Buffer (below)
-  if (Buffer.isBuffer(c)) return c[0] === 0x30 ? c : _pemToDer(c.toString("latin1"));   // DER as-is, else PEM
+  if (c instanceof Uint8Array || Buffer.isBuffer(c)) {
+    c = guard.bytes.snapshot(c, CmsError, "cms/bad-input", "a signer certificate");
+    return c[0] === 0x30 ? c : _pemToDer(c.toString("latin1"));   // DER as-is, else PEM
+  }
   if (typeof c === "string") return _pemToDer(c);
   throw _err("cms/bad-input", "a signer certificate must be a DER Buffer or a PEM string");
 }
@@ -337,9 +339,24 @@ function _pemToDer(text) {
 }
 
 // pki.cms.sign -- documented by the @primitive block in cms-verify.js (the @module pki.cms home).
+// Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async); the checks stay
+// synchronous because they read the caller's mutable content and signer list.
 function sign(content, signers, opts) {
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign. Here it is what makes the attribute-shaped-content refusal below
+  // hold: the value that decides it and the value that gets signed are now the same read.
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+    [content, "content"], [signers, "the signer list"], [opts, "pki.cms.sign options"],
+  ], _sign);
+}
+
+function _sign(content, signers, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.sign options must be an object");
+  // The arguments were copied at entry (see `sign` above), which is what makes the refusal below
+  // hold: flipping signedAttributes from true to false after the call returns would otherwise skip
+  // the attribute-shaped-content check while the signer signs that content directly -- the very
+  // signature the stripping attack needs.
   var contentBuf = _toBuf(content, "content");
   var list = Array.isArray(signers) ? signers : [signers];
   if (!list.length) throw _err("cms/bad-input", "pki.cms.sign requires at least one signer");
@@ -363,6 +380,18 @@ function sign(content, signers, opts) {
   if (opts.signedAttributes === false && eContentType !== OID_DATA) {
     throw _err("cms/bad-input", "signed attributes are required when eContentType is not id-data (RFC 5652 sec. 5.3)");
   }
+  // The signer's half of the signed-attribute stripping problem
+  // (draft-vangeest-lamps-cms-euf-cma-signeddata, Attack Type 2). Signing attribute-shaped content
+  // WITHOUT attributes produces a signature that can afterwards be promoted into an
+  // attributes-present message, because the signature does not commit to which mode was used: the
+  // attacker attaches the signed bytes AS the SignedAttributes and swaps in whatever content their
+  // message-digest attribute names. Refusing to mint the ambiguous signature is the only point at
+  // which this direction can be stopped -- by the time it is a message, the damage is done.
+  if (opts.signedAttributes === false && cms.looksLikeSignedAttributes(contentBuf)) {
+    throw _err("cms/ambiguous-content", "this content is itself an encoded SignedAttributes block, so signing " +
+      "it WITHOUT signed attributes would produce a signature that could be re-presented as one over " +
+      "attributes (RFC 5652 sec. 5.4); sign it with signed attributes instead");
+  }
   // A supplied signing-time MUST be a valid Date (or false to omit the attribute) -- never a
   // silently-ignored non-Date or an Invalid Date that would encode a garbage Time.
   if (opts.signingTime != null && opts.signingTime !== false) guard.time.assertValid(opts.signingTime, _err, "cms/bad-input", "signingTime");
@@ -405,8 +434,7 @@ function _dedupe(ders) {
 }
 
 function _toBuf(v, what) {
-  if (Buffer.isBuffer(v)) return v;
-  if (v instanceof Uint8Array) return Buffer.from(v);
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmsError, "cms/bad-input", what);
   throw _err("cms/bad-input", what + " must be a Buffer");
 }
 
@@ -533,7 +561,17 @@ function _targetPreimage(siNode, opts) {
 }
 
 // pki.cms.countersign -- documented by the @primitive block in cms-verify.js (the @module pki.cms home).
+// Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async).
 function countersign(cmsInput, signers, opts) {
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign. `signerIndex` and `countersignatureOf` SELECT which signature is
+  // countersigned, so a late read could attach the countersignature to a different one.
+  return guard.bytes.fixedCall(CmsError, "cms/bad-input", [
+    [cmsInput, "the CMS message"], [signers, "the signer list"], [opts, "pki.cms.countersign options"],
+  ], _countersign);
+}
+
+function _countersign(cmsInput, signers, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.countersign options must be an object");
   var list = Array.isArray(signers) ? signers : [signers];