@blamejs/pki 0.8.58 → 0.8.60

package/lib/cmp-session.js

@@ -15,6 +15,10 @@ var crmfSign = require("./crmf-sign");
 var cmpBuild = require("./cmp-build");
 var csr = require("./schema-csr");
 var guard = require("./guard-all");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and one of these lists is the accumulated CA certificates a
+ *  later leg is authenticated against. */
+var _push = guard.list.append;
 var compositeSig = require("./composite-sig");
 var constants = require("./constants");
 var webcrypto = require("./webcrypto");
@@ -34,7 +38,7 @@ function setEngine(engine) { _engine = engine; }
 var HASHLESS_SIG_OIDS = Object.create(null);
 (function () {
   var names = ["Ed25519", "Ed448", "id-ml-dsa-44", "id-ml-dsa-65", "id-ml-dsa-87"];
-  ["sha2", "shake"].forEach(function (h) { ["128s", "128f", "192s", "192f", "256s", "256f"].forEach(function (s) { names.push("id-slh-dsa-" + h + "-" + s); }); });
+  ["sha2", "shake"].forEach(function (h) { ["128s", "128f", "192s", "192f", "256s", "256f"].forEach(function (s) { _push(names,"id-slh-dsa-" + h + "-" + s); }); });
   names.forEach(function (n) { var o = oid.byName(n); if (o) HASHLESS_SIG_OIDS[o] = 1; });
 })();
 var SIG_OID_TO_HASH = Object.create(null);
@@ -136,11 +140,11 @@ function _asCertList(v) { return v == null ? [] : (Array.isArray(v) ? guard.list
 function _boundedPool(base, added) {
   var ceiling = constants.LIMITS.PATH_BUILD_MAX_CANDIDATES;
   var seen = Object.create(null), distinctBase = [];
-  base.forEach(function (c) { var k = _certIdentity(c); if (k == null) { distinctBase.push(c); return; } if (!seen[k]) { seen[k] = 1; distinctBase.push(c); } });
+  base.forEach(function (c) { var k = _certIdentity(c); if (k == null) { _push(distinctBase,c); return; } if (!seen[k]) { seen[k] = 1; _push(distinctBase,c); } });
   var room = ceiling - distinctBase.length;
   if (room <= 0) return distinctBase;
   var useful = [];
-  added.forEach(function (c) { var k = _certIdentity(c); if (k != null && seen[k]) return; if (k != null) seen[k] = 1; useful.push(c); });
+  added.forEach(function (c) { var k = _certIdentity(c); if (k != null && seen[k]) return; if (k != null) seen[k] = 1; _push(useful,c); });
   return distinctBase.concat(useful.slice(0, room));
 }
 function _certIdentity(cert) {
@@ -228,7 +232,7 @@ function _responseExtraCerts(responseBytes) {
     seen[key] = true;
     try { x509.parse(c); }
     catch (_e) { continue; }
-    out.push(Buffer.from(c));
+    _push(out,Buffer.from(c));
   }
   return out;
 }
@@ -682,7 +686,13 @@ function session(opts) {
         if (!Buffer.isBuffer(c)) return;
         var k = c.toString("base64");
         if (caPubsSeen[k]) {
-          if (isGrantLeg) { for (var pi = 0; pi < caPubsAccum.length; pi++) { if (caPubsAccum[pi].toString("base64") === k) { guard.list.append(caPubsAccum, caPubsAccum.splice(pi, 1)[0]); if (pi < caPubsWaitingCount) caPubsWaitingCount--; break; } } }
+          /** @internal The entry is read, removed and appended as three steps rather than through
+           * `splice`. `splice` RETURNS what it removed, so it builds that result through
+           * `ArraySpeciesCreate`, which reads the receiver's `constructor` and then its
+           * `Symbol.species`: a getter installed on `Array.prototype.constructor` is handed this
+           * accumulator as its `this` while the move is in progress, and the list holds the CA
+           * certificates a later leg is authenticated against. */
+          if (isGrantLeg) { for (var pi = 0; pi < caPubsAccum.length; pi++) { if (caPubsAccum[pi].toString("base64") === k) { var moved = caPubsAccum[pi]; guard.list.removeAt(caPubsAccum, pi); guard.list.append(caPubsAccum, moved); if (pi < caPubsWaitingCount) caPubsWaitingCount--; break; } } }
           return;
         }
         try { x509.parse(c); } catch (e) { throw _err("cmp/bad-cert-response", "an authenticated caPubs entry is not a valid X.509 certificate", e); }
@@ -963,10 +973,10 @@ function session(opts) {
   async function _validateLeaf(leaf, caPubs) {
     if (_engine == null || opts.trustAnchors == null) return;
     var caPubsList = [];
-    if (Array.isArray(caPubs)) caPubs.forEach(function (c) { if (Buffer.isBuffer(c)) caPubsList.push(c); });
+    if (Array.isArray(caPubs)) caPubs.forEach(function (c) { if (Buffer.isBuffer(c)) _push(caPubsList,c); });
     var added = _asCertList(opts.intermediates);
-    if (Buffer.isBuffer(cachedSignerCert)) added.push(cachedSignerCert);
-    cachedChain.forEach(function (c) { if (Buffer.isBuffer(c)) added.push(c); });
+    if (Buffer.isBuffer(cachedSignerCert)) _push(added,cachedSignerCert);
+    cachedChain.forEach(function (c) { if (Buffer.isBuffer(c)) _push(added,c); });
     var pool = _boundedPool(caPubsList, added);
     var res;
     try { res = await _engine.build(leaf, { trustAnchors: _asCertList(opts.trustAnchors), intermediates: pool, validate: true, time: opts.time != null ? opts.time : new Date() }); }
@@ -1395,7 +1405,7 @@ function session(opts) {
       if (limit.total !== null && total > limit.total) {
         throw _err("cmp/bad-input", "the resumeToken " + name + " exceeds the " + limit.total + "-byte pool a transaction holds");
       }
-      out.push(der);
+      _push(out,der);
     }
     return out;
   }

package/lib/cms-decrypt.js

@@ -121,10 +121,10 @@ function _selectCandidates(recips, km, opts) {
   for (var k = 0; k < recips.length; k++) {
     var r = recips[k];
     if (want === "asym" && (r.type === "ktri" || r.type === "kari" || r.type === "ori")) {
-      if (cert && _ridMatches(r, cert)) out.push({ ri: r, index: k });
-    } else if (want === "pwri" && r.type === "pwri") { out.push({ ri: r, index: k }); }
+      if (cert && _ridMatches(r, cert)) intrinsic.append(out, { ri: r, index: k });
+    } else if (want === "pwri" && r.type === "pwri") { intrinsic.append(out, { ri: r, index: k }); }
     else if (want === "kekri" && r.type === "kekri") {
-      if (km.kekId == null || _kekIdMatches(r, km.kekId)) out.push({ ri: r, index: k });
+      if (km.kekId == null || _kekIdMatches(r, km.kekId)) intrinsic.append(out, { ri: r, index: k });
     }
   }
   if (!out.length) throw _err("cms/no-matching-recipient", "no recipient matches the supplied key material");
@@ -563,19 +563,23 @@ async function _aesKwUnwrap(kek, wrapped) {
     guard.secret.zeroize(new Uint8Array(rawAb), CmsError, "cms/bad-input", "the unwrapped content key");
   }
 }
+/** @internal Both KDF-input structures APPEND by defining the index. A store at an index the list
+ *  has no own property at consults a setter inherited from the array prototype, so an accessor there
+ *  would decide the SharedInfo these bytes become and derive a different KEK from the same shared
+ *  secret. */
 function _eccSharedInfo(wrapName, ukm, kekBytes) {
   var kids = [b.sequence([b.oid(O(wrapName))])];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) intrinsic.append(kids, b.explicit(0, b.octetString(ukm)));
   /** @internal The SuppPubInfo key length is written with the capture, for the same reason the
    *  encrypt side does it: this is KDF input, and a replaced write derives a different KEK from the
    *  same shared secret. */
   var supp = Buffer.alloc(4); intrinsic.writeUInt32BE(supp, kekBytes * 8, 0);
-  kids.push(b.explicit(2, b.octetString(supp)));
+  intrinsic.append(kids, b.explicit(2, b.octetString(supp)));
   return b.sequence(kids);
 }
 function _kemOtherInfo(wrapName, kekBytes, ukm) {
   var kids = [b.sequence([b.oid(O(wrapName))]), b.integer(BigInt(kekBytes))];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) intrinsic.append(kids, b.explicit(0, b.octetString(ukm)));
   return b.sequence(kids);
 }
 function _pwriUnwrap(kek, wrapped, iv, keyBits) {
@@ -631,9 +635,13 @@ var HASH_W3C = intrinsic.create(null); HASH_W3C[O("sha1")] = "SHA-1"; HASH_W3C[O
 function _hashW3c(o) { if (!HASH_W3C[o]) throw _err("cms/unsupported-algorithm", "unsupported OAEP hash " + o); return HASH_W3C[o]; }
 
 var X963_HASH = intrinsic.create(null);
-[["dhSinglePass-stdDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-stdDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-stdDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-stdDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-stdDH-sha512kdf-scheme", "SHA-512"],
+var _X963_ROWS = [["dhSinglePass-stdDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-stdDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-stdDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-stdDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-stdDH-sha512kdf-scheme", "SHA-512"],
  ["dhSinglePass-cofactorDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-cofactorDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-cofactorDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-cofactorDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-cofactorDH-sha512kdf-scheme", "SHA-512"]
-].forEach(function (r) { X963_HASH[O(r[0])] = r[1]; });
+];
+/** @internal The registry is built through the captured walk. The method is read off the live
+ *  prototype at the moment it runs even where the receiver is a literal, and these rows decide which
+ *  hash a key-agreement recipient's KDF uses. */
+intrinsic.forEach(_X963_ROWS, function (r) { X963_HASH[O(r[0])] = r[1]; });
 function _x963Hash(scheme) { if (!X963_HASH[scheme]) throw _err("cms/unsupported-algorithm", "unsupported kari key-agreement scheme " + scheme); return X963_HASH[scheme]; }
 function _kariWrap(kea) {
   var params = asn1.decode(kea.parameters);
@@ -644,7 +652,7 @@ function _originatorSpki(originator) {
   if (!originator || originator.form !== "originatorKey") throw _err("cms/unsupported-algorithm", "kari requires an originatorKey (ephemeral-static ECDH)");
   var v = originator.value;
   var algKids = [b.oid(v.algorithm.oid)];
-  if (v.algorithm.parameters != null) algKids.push(b.raw(v.algorithm.parameters));
+  if (v.algorithm.parameters != null) intrinsic.append(algKids, b.raw(v.algorithm.parameters));
   return b.sequence([b.sequence(algKids), b.bitString(v.publicKey.bytes, v.publicKey.unusedBits)]);
 }
 var MONT = intrinsic.create(null); MONT[O("X25519")] = { name: "X25519", hkdf: "SHA-256" }; MONT[O("X448")] = { name: "X448", hkdf: "SHA-512" };
@@ -706,7 +714,17 @@ async function _verifyAuthenticatedData(parsed, km, opts, requireProtection) {
     guard.der.assertParams(parsed.digestAlgorithm.parameters, "absentOrNull", _err,
       "cms/unsupported-algorithm", parsed.digestAlgorithm.name + " digestAlgorithm (RFC 5754 sec. 2)");
     preimage = _explicitSetOf(parsed.authAttrsBytes);
-    var mdAttr = (parsed.authAttrs || []).filter(function (a) { return a.type === O("messageDigest"); })[0];
+    /** @internal The selection returns the first matching attribute or null. `filter(...)[0]` indexes
+     *  a result that is EMPTY when the attribute is absent, and index 0 of an empty array answers
+     *  from the array prototype, so a value installed there would supply the digest this comparison
+     *  is made against. The refusal restates an invariant the parse already holds: an
+     *  AuthenticatedData with authAttrs is walked through the content-binding check, which requires
+     *  the message-digest attribute (`cms/missing-message-digest`), so this is not reachable from a
+     *  message and is here so the read below cannot be made on something that is not an attribute. */
+    var mdAttr = guard.list.firstMatch(parsed.authAttrs || [], function (a) { return a.type === O("messageDigest"); });
+    if (!mdAttr || mdAttr.values.length !== 1) {
+      throw _err("cms/bad-auth-attrs", "authenticated attributes must carry exactly one message-digest attribute (RFC 5652 sec. 9.2)");
+    }
     mdCheck = { hash: dHash, declared: asn1.read.octetString(asn1.decode(mdAttr.values[0])) };
     /** @internal RFC 6211 sec. 3.2 on this content type: the two comparisons are what make the
      *  outer `digestAlgorithm` and `macAlgorithm` fields mean anything, since the MAC input is the

package/lib/cms-encrypt.js

@@ -14,6 +14,10 @@ var webcrypto = require("./webcrypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there. These lists become a recipient info and the key-derivation
+ *  input beside it. */
+var _push = intrinsic.append;
 var pbes2 = require("./pbes2");
 var compositeKem = require("./composite-kem");
 var b = asn1.build;
@@ -66,7 +70,7 @@ function _wrapOidForKek(keyBytes) {
 
 function _gcmParams(nonce, icvLen) {
   var kids = [b.octetString(nonce)];
-  if (icvLen !== 12) kids.push(b.integer(BigInt(icvLen)));
+  if (icvLen !== 12) _push(kids,b.integer(BigInt(icvLen)));
   return b.sequence(kids);
 }
 
@@ -124,12 +128,12 @@ MONT_KA[O("X448")] = { name: "X448", hkdf: "SHA-512", scheme: "dhSinglePass-stdD
 
 function _eccSharedInfo(wrapName, ukm, kekBytes) {
   var kids = [_algId(wrapName, "absent")];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) _push(kids,b.explicit(0, b.octetString(ukm)));
   /** @internal The SuppPubInfo key length is written with the capture. It is KDF input, so it is part
    *  of what the key-encryption key derives from, and a replaced write derives a different KEK from
    *  the same shared secret. */
   var supp = Buffer.alloc(4); intrinsic.writeUInt32BE(supp, kekBytes * 8, 0);
-  kids.push(b.explicit(2, b.octetString(supp)));
+  _push(kids,b.explicit(2, b.octetString(supp)));
   return b.sequence(kids);
 }
 async function _buildKari(cek, cert, opts) {
@@ -179,8 +183,9 @@ async function _buildKari(cek, cert, opts) {
     var rek = b.sequence([b.sequence([ridNode, b.octetString(encryptedKey)])]);
     var kekAlg = b.sequence([b.oid(O(origKeyAlgId.scheme)), _algId(wrapName, "absent")]);
     var kariKids = [b.integer(3n), b.explicit(0, originatorKey)];
-    if (ukm) kariKids.push(b.explicit(1, b.octetString(ukm)));
-    kariKids.push(kekAlg, rek);
+    if (ukm) _push(kariKids,b.explicit(1, b.octetString(ukm)));
+    _push(kariKids,kekAlg);
+    _push(kariKids,rek);
     return { tag: 1, node: b.sequence(kariKids) };
   } finally {
     guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
@@ -227,7 +232,7 @@ var KEM_WC = intrinsic.create(null); KEM_WC[O("id-ml-kem-512")] = "ML-KEM-512";
 
 function _kemOtherInfo(wrapName, kekBytes, ukm) {
   var kids = [_algId(wrapName, "absent"), b.integer(BigInt(kekBytes))];
-  if (ukm) kids.push(b.explicit(0, b.octetString(ukm)));
+  if (ukm) _push(kids,b.explicit(0, b.octetString(ukm)));
   return b.sequence(kids);
 }
 async function _kemEncapsulate(keyOid, cert) {
@@ -258,8 +263,9 @@ async function _buildKemri(cek, cert, opts) {
     var encryptedKey = await _aesKwWrap(kek, cek);
     var rid = _rid(cert, opts.keyIdentifier);
     var kemriKids = [b.integer(0n), rid.node, _algId(oid.name(keyOid), "absent"), b.octetString(kemct), _algId("hkdfWithSha256", "absent"), b.integer(BigInt(kekBytes))];
-    if (ukm) kemriKids.push(b.explicit(0, b.octetString(ukm)));
-    kemriKids.push(_algId(wrapName, "absent"), b.octetString(encryptedKey));
+    if (ukm) _push(kemriKids,b.explicit(0, b.octetString(ukm)));
+    _push(kemriKids,_algId(wrapName, "absent"));
+    _push(kemriKids,b.octetString(encryptedKey));
     var kemri = b.sequence(kemriKids);
     return { tag: 4, node: b.sequence([b.oid(O("kem")), kemri]) };
   } finally {
@@ -446,7 +452,7 @@ async function _encryptImpl(content, recipients, opts) {
     if (!recipients.length) throw _err("cms/bad-input", "at least one recipient is required (RFC 5652 sec. 6.1)");
     var recips = [];
     var consumed = intrinsic.create(null);
-    for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(cek, recipients[i], opts, consumed));
+    for (var i = 0; i < recipients.length; i++) _push(recips,await _buildRecipient(cek, recipients[i], opts, consumed));
     _assertDefaultsConsumed(opts, consumed);
     var riNodes = recips.map(_taggedRecipient);
 
@@ -535,8 +541,8 @@ async function _authEnvelopedData(contentBytes, contentStream, cek, ca, contentT
   }
   var eci = b.sequence([b.oid(O(contentType)), b.sequence([b.oid(O(ca.oid)), _gcmParams(nonce, 16)]), b.contextPrimitive(0, g.ct)]);
   var kids = [b.integer(0n), b.setOf(riNodes), eci];
-  if (authAttrsDer) kids.push(authAttrsDer);
-  kids.push(b.octetString(g.tag));
+  if (authAttrsDer) _push(kids,authAttrsDer);
+  _push(kids,b.octetString(g.tag));
   void recips;
   return b.sequence(kids);
 }
@@ -680,7 +686,7 @@ async function _authenticateImpl(content, recipients, opts) {
   try {
     var recips = [];
     var consumedAuth = {};
-    for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(macKey, recipients[i], opts, consumedAuth));
+    for (var i = 0; i < recipients.length; i++) _push(recips,await _buildRecipient(macKey, recipients[i], opts, consumedAuth));
     _assertDefaultsConsumed(opts, consumedAuth);
     var riNodes = recips.map(_taggedRecipient);
 
@@ -705,7 +711,7 @@ async function _authenticateImpl(content, recipients, opts) {
        *  MAC algorithm substitution attack, which is difficult because the attacker does not know
        *  the authentication key". Built from the same values the two outer fields are built from. */
       if (protectionOid) {
-        intrinsic.push(pairs, b.sequence([
+        intrinsic.append(pairs, b.sequence([
           b.oid(protectionOid),
           b.setOf([b.sequence([_algId(digestName), b.implicit(2, _algId(mac.oid))])]),
         ]));
@@ -732,10 +738,10 @@ async function _authenticateImpl(content, recipients, opts) {
 
     var eci = b.sequence([b.oid(O(contentType)), b.explicit(0, b.octetString(contentBytes))]);
     var kids = [b.integer(0n), b.setOf(riNodes), _algId(mac.oid)];
-    if (digestAlgTagged) kids.push(digestAlgTagged);
-    kids.push(eci);
-    if (authAttrsDer) kids.push(authAttrsDer);
-    kids.push(b.octetString(macValue));
+    if (digestAlgTagged) _push(kids,digestAlgTagged);
+    _push(kids,eci);
+    if (authAttrsDer) _push(kids,authAttrsDer);
+    _push(kids,b.octetString(macValue));
     var ci = b.sequence([b.oid(O("authData")), b.explicit(0, b.sequence(kids))]);
     try { schemaCms.parse(ci); } catch (e) { throw (e instanceof CmsError) ? e : _err("cms/bad-input", "the supplied authenticated attributes produced an invalid AuthenticatedData", e); }
     return opts.pem ? schemaCms.pemEncode(ci, "CMS") : ci;

package/lib/cms-sign.js

@@ -15,6 +15,12 @@ var webcrypto = require("./webcrypto");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal `append`, not a captured `push`: appending with `push` STORES at the index, and a store
+ *  walks the prototype chain for a setter, so an accessor installed at an array index receives each
+ *  element as it is appended and can define something else in its place. The lists built here become
+ *  a message's signed attributes, its certificate set and its signer infos. `append` defines the
+ *  index on the array itself. */
+var _push = intrinsic.append;
 /** @internal `resolve` and `all` build their promise from the RECEIVER, so reading the global binding
  *  at the call hands the construction to whatever that binding holds. Each signer's digest and
  *  signature are awaited through one of these, and a replacement that settles without awaiting emits a
@@ -73,7 +79,11 @@ function _digest(digestName, content) {
 
 
 function _skiValue(cert) {
-  var ext = (cert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
+  /** @internal The selection returns the first matching row or null, because `filter(...)[0]` indexes
+   *  a result that is EMPTY when the extension is absent, and index 0 of an empty array answers from
+   *  the array prototype: the refusal below would then not be reached for a certificate that carries
+   *  no SKI. */
+  var ext = guard.list.firstMatch(cert.extensions || [], function (e) { return e.oid === OID_SKI; });
   if (!ext) throw _err("cms/no-ski", "a subjectKeyIdentifier signer identifier requires the signer certificate to carry an SKI extension");
   try { return asn1.read.octetString(asn1.decode(ext.value)); }
   catch (e) { throw _err("cms/no-ski", "the signer certificate's subjectKeyIdentifier extension value is not an OCTET STRING", e); }
@@ -216,10 +226,10 @@ async function _finishSignerInfo(rc, md, content, eContentType, opts) {
       { type: O("contentType"), values: [b.oid(eContentType)] },
       { type: O("messageDigest"), values: [b.octetString(md)] },
     ];
-    if (opts.signingTime !== false) intrinsic.push(pairs, { type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
+    if (opts.signingTime !== false) _push(pairs, { type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
     var apOid = cms.algorithmProtectionOid(opts.algorithmProtection, _err);
     if (apOid) {
-      intrinsic.push(pairs, _algorithmProtectionPair(apOid,
+      _push(pairs, _algorithmProtectionPair(apOid,
         rc.scheme.digestAlgId, rc.scheme.sigAlgId, 1));
     }
     pairs = intrinsic.concat(pairs, _resolveAttrPairs(opts.additionalSignedAttributes, "a signed attribute value"));
@@ -230,10 +240,13 @@ async function _finishSignerInfo(rc, md, content, eContentType, opts) {
   var sig = await signScheme.signOverTbs(rc.scheme, rc.soKey, signedBytes, _signE);
   await _assertKeyMatchesSpki(rc.keyOnly, rc.soKey, rc.soSpki, rc.scheme, sig, signedBytes, rc.cert);
   var fields = [b.integer(BigInt(rc.version)), rc.sid, rc.scheme.digestAlgId];
-  if (toSign.wire) intrinsic.push(fields, toSign.wire);
-  intrinsic.push(fields, rc.scheme.sigAlgId, b.octetString(sig));
+  if (toSign.wire) _push(fields, toSign.wire);
+  /** @internal Two appends, because `append` takes one value where `push` took many: the algorithm
+   *  identifier and the signature it describes are adjacent fields of the same SignerInfo. */
+  _push(fields, rc.scheme.sigAlgId);
+  _push(fields, b.octetString(sig));
   var ua = _buildUnsignedAttrs(opts.unsignedAttributes);
-  if (ua) intrinsic.push(fields, ua);
+  if (ua) _push(fields, ua);
   return { si: b.sequence(fields), digestAlgId: rc.scheme.digestAlgId, version: rc.version, certDer: rc.certDer };
 }
 
@@ -367,7 +380,7 @@ async function _signStream(stream, signers, opts) {
   if (opts.signingTime != null && opts.signingTime !== false) guard.time.assertEncodable(opts.signingTime, _err, "cms/bad-input", "signingTime");
   var rcs = intrinsic.map(list, function (s) { return _resolveSignerContext(s, opts); });
   var digestNames = [], seenDigest = intrinsic.create(null);
-  intrinsic.forEach(rcs, function (r) { if (!seenDigest[r.scheme.digest]) { seenDigest[r.scheme.digest] = 1; intrinsic.push(digestNames, r.scheme.digest); } });
+  intrinsic.forEach(rcs, function (r) { if (!seenDigest[r.scheme.digest]) { seenDigest[r.scheme.digest] = 1; _push(digestNames, r.scheme.digest); } });
   var wcNames = intrinsic.map(digestNames, function (n) { return DIGEST_HASH[n]; });
   var digests;
   try {
@@ -379,7 +392,7 @@ async function _signStream(stream, signers, opts) {
   intrinsic.forEach(digestNames, function (n, i) { byName[n] = intrinsic.bufferFrom(digests[i]); });
   var built = [];
   for (var _ip = 0; _ip < rcs.length; _ip++) {
-    intrinsic.push(built, await _finishSignerInfo(rcs[_ip], byName[rcs[_ip].scheme.digest], null, eContentType, opts));
+    _push(built, await _finishSignerInfo(rcs[_ip], byName[rcs[_ip].scheme.digest], null, eContentType, opts));
   }
   return _assembleSignedData(built, eContentType, opts, null);
 }
@@ -420,19 +433,19 @@ function _sign(content, signers, opts) {
 
 function _assembleSignedData(built, eContentType, opts, contentBuf) {
   var seen = intrinsic.create(null), digestAlgs = [];
-  intrinsic.forEach(built, function (x) { var k = intrinsic.bufToString(x.digestAlgId, "hex"); if (!seen[k]) { seen[k] = 1; intrinsic.push(digestAlgs, x.digestAlgId); } });
+  intrinsic.forEach(built, function (x) { var k = intrinsic.bufToString(x.digestAlgId, "hex"); if (!seen[k]) { seen[k] = 1; _push(digestAlgs, x.digestAlgId); } });
   var v3 = intrinsic.some(built, function (x) { return x.version === 3; }) || eContentType !== OID_DATA;
   var version = v3 ? 3 : 1;
   var encapFields = [b.oid(eContentType)];
-  if (!opts.detached) intrinsic.push(encapFields, b.explicit(0, b.octetString(contentBuf)));
+  if (!opts.detached) _push(encapFields, b.explicit(0, b.octetString(contentBuf)));
   var encap = b.sequence(encapFields);
   var sdFields = [b.integer(BigInt(version)), b.set(digestAlgs), encap];
   if (opts.certificates !== false) {
     var certDers = intrinsic.sort(_dedupe(intrinsic.filter(intrinsic.map(built, function (x) { return x.certDer; }),
       function (d) { return d != null; })), intrinsic.compare);
-    if (certDers.length) intrinsic.push(sdFields, b.contextConstructed(0, intrinsic.bufferConcat(certDers)));
+    if (certDers.length) _push(sdFields, b.contextConstructed(0, intrinsic.bufferConcat(certDers)));
   }
-  intrinsic.push(sdFields, b.set(intrinsic.map(built, function (x) { return x.si; })));
+  _push(sdFields, b.set(intrinsic.map(built, function (x) { return x.si; })));
   var signedData = b.sequence(sdFields);
   var contentInfo = b.sequence([b.oid(OID_SIGNED_DATA), b.explicit(0, signedData)]);
   return opts.pem ? pkix.pemEncode(contentInfo, "CMS", frameworkError.PemError) : contentInfo;
@@ -450,7 +463,7 @@ function _digestAlgIdentifier(der) {
 
 function _dedupe(ders) {
   var seen = intrinsic.create(null), out = [];
-  intrinsic.forEach(ders, function (d) { var k = intrinsic.bufToString(d, "hex"); if (!seen[k]) { seen[k] = 1; intrinsic.push(out, d); } });
+  intrinsic.forEach(ders, function (d) { var k = intrinsic.bufToString(d, "hex"); if (!seen[k]) { seen[k] = 1; _push(out, d); } });
   return out;
 }
 
@@ -496,9 +509,9 @@ function certsOnly(certs, opts) {
   var crlDers = intrinsic.sort(_dedupe(intrinsic.map(crlList, function (c) { return _normEntityDer(c, "a CRL", "X509 CRL", _parseCrl); })), intrinsic.compare);
   var encap = b.sequence([b.oid(OID_DATA)]);
   var sdFields = [b.integer(1n), b.set([]), encap];
-  if (certDers.length) intrinsic.push(sdFields, b.contextConstructed(0, intrinsic.bufferConcat(certDers)));
-  if (crlDers.length) intrinsic.push(sdFields, b.contextConstructed(1, intrinsic.bufferConcat(crlDers)));
-  intrinsic.push(sdFields, b.set([]));
+  if (certDers.length) _push(sdFields, b.contextConstructed(0, intrinsic.bufferConcat(certDers)));
+  if (crlDers.length) _push(sdFields, b.contextConstructed(1, intrinsic.bufferConcat(crlDers)));
+  _push(sdFields, b.set([]));
   var signedData = b.sequence(sdFields);
   var contentInfo = b.sequence([b.oid(OID_SIGNED_DATA), b.explicit(0, signedData)]);
   return opts.pem ? pkix.pemEncode(contentInfo, "CMS", frameworkError.PemError) : contentInfo;
@@ -512,7 +525,7 @@ function _toBuf(v, what) {
 
 function _resolveSignerIndices(spec, n) {
   if (spec == null) { if (n < 1) throw _err("cms/bad-input", "the SignedData carries no SignerInfo to countersign"); return [0]; }
-  if (spec === "all") { var all = []; for (var i = 0; i < n; i++) all.push(i); return all; }
+  if (spec === "all") { var all = []; for (var i = 0; i < n; i++) _push(all, i); return all; }
   var arr = Array.isArray(spec) ? spec : [spec];
   if (!arr.length) throw _err("cms/bad-input", "signerIndex must select at least one signer");
   arr.forEach(function (i) { if (typeof i !== "number" || !Number.isInteger(i) || i < 0 || i >= n) throw _err("cms/bad-input", "signerIndex out of range: " + i); });
@@ -534,10 +547,10 @@ function _buildCountersignature(targetSigOctets, countersigner, opts) {
     if (opts.signedAttributes === false) return null;
     return intrinsic.chain(_digest(scheme.digest, targetSigOctets), function (md) {
       var pairs = [{ type: O("messageDigest"), values: [b.octetString(md)] }];
-      if (opts.signingTime !== false) pairs.push({ type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
+      if (opts.signingTime !== false) _push(pairs, { type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
       var csApOid = cms.algorithmProtectionOid(opts.algorithmProtection, _err);
       if (csApOid) {
-        intrinsic.push(pairs, _algorithmProtectionPair(csApOid, scheme.digestAlgId, scheme.sigAlgId, 1));
+        _push(pairs, _algorithmProtectionPair(csApOid, scheme.digestAlgId, scheme.sigAlgId, 1));
       }
       var extra = _resolveAttrPairs(opts.additionalSignedAttributes, "a countersignature signed attribute value");
       extra.forEach(function (p) { if (p.type === O("contentType")) throw _err("cms/bad-input", "a countersignature must not carry a content-type attribute (RFC 5652 sec. 11.4)"); });
@@ -556,8 +569,9 @@ function _buildCountersignature(targetSigOctets, countersigner, opts) {
       });
       return intrinsic.chain(selfChecked, function () {
         var fields = [b.integer(BigInt(sidv.version)), sidv.sid, scheme.digestAlgId];
-        if (attrs) fields.push(attrs.wire);
-        fields.push(scheme.sigAlgId, b.octetString(sig));
+        if (attrs) _push(fields, attrs.wire);
+        _push(fields, scheme.sigAlgId);
+        _push(fields, b.octetString(sig));
         return { value: b.sequence(fields), certDer: certDer, digestAlgId: scheme.digestAlgId };
       });
     });
@@ -568,13 +582,17 @@ function _mergeCountersig(uaNode, newCsValues) {
   var CS = O("countersignature");
   var others = [], csValues = [];
   if (uaNode) uaNode.children.forEach(function (attr) {
-    if (asn1.read.oid(attr.children[0]) === CS) attr.children[1].children.forEach(function (v) { csValues.push(v.bytes); });
-    else others.push(attr.bytes);
+    if (asn1.read.oid(attr.children[0]) === CS) intrinsic.forEach(attr.children[1].children, function (v) { _push(csValues, v.bytes); });
+    else _push(others, attr.bytes);
   });
-  newCsValues.forEach(function (v) { csValues.push(v); });
+  intrinsic.forEach(newCsValues, function (v) { _push(csValues, v); });
   var csAttr = b.sequence([b.oid(CS), b.set(csValues)]);
-  var setOf = b.set(others.concat([csAttr]));
-  var wire = Buffer.from(setOf); wire[0] = 0xA1;
+  /** @internal `concatList`, not `concat`: `Array.prototype.concat` builds its result through the
+   *  species constructor, so a species answering with a Proxy intercepted the countersignature
+   *  attribute as it was inserted and the merged value went out without it. `concatList` copies own
+   *  indexes into an array it made itself. */
+  var setOf = b.set(intrinsic.concatList(others, [csAttr]));
+  var wire = intrinsic.bufferFrom(setOf); wire[0] = 0xA1;
   return wire;
 }
 
@@ -583,7 +601,7 @@ function _appendCountersigs(siNode, newCsValues) {
   var last = kids[kids.length - 1];
   var hasUa = last.tagClass === "context" && last.tagNumber === 1;
   var base = (hasUa ? kids.slice(0, kids.length - 1) : kids).map(function (k) { return k.bytes; });
-  base.push(_mergeCountersig(hasUa ? last : null, newCsValues));
+  _push(base, _mergeCountersig(hasUa ? last : null, newCsValues));
   return b.sequence(base);
 }
 
@@ -603,7 +621,7 @@ function _spliceNested(siNode, j, newCsValues) {
   if (!found) throw _err("cms/bad-input", "the target signer carries no countersignature to countersign");
   var setOf = b.set(attrs); var wire = Buffer.from(setOf); wire[0] = 0xA1;
   var base = kids.slice(0, kids.length - 1).map(function (k) { return k.bytes; });
-  base.push(wire);
+  _push(base, wire);
   return b.sequence(base);
 }
 
@@ -619,7 +637,11 @@ function _targetPreimage(siNode, opts) {
   var last = siNode.children[siNode.children.length - 1];
   var CS = O("countersignature");
   if (!last || last.tagClass !== "context" || last.tagNumber !== 1) throw _err("cms/bad-input", "the target signer carries no countersignature to countersign");
-  var attr = last.children.filter(function (a) { return asn1.read.oid(a.children[0]) === CS; })[0];
+  /** @internal The selection returns the first matching attribute or null, because `filter(...)[0]`
+   *  indexes a result that is EMPTY when the signer carries no countersignature attribute, and index
+   *  0 of an empty array answers from the array prototype: the refusal below would then not be
+   *  reached and the signature bytes would be taken from whatever the accessor answered with. */
+  var attr = guard.list.firstMatch(last.children, function (a) { return asn1.read.oid(a.children[0]) === CS; });
   if (!attr) throw _err("cms/bad-input", "the target signer carries no countersignature to countersign");
   var values = attr.children[1].children;
   var j = opts.countersignatureOf;
@@ -653,15 +675,15 @@ function _countersign(cmsInput, signers, opts) {
   var jobs = [];
   targets.forEach(function (t) {
     var preimage = _targetPreimage(siSet.children[t], opts);
-    list.forEach(function (cs) { jobs.push({ t: t, p: _buildCountersignature(preimage, cs, opts) }); });
+    intrinsic.forEach(list, function (cs) { _push(jobs, { t: t, p: _buildCountersignature(preimage, cs, opts) }); });
   });
   return intrinsic.chain(intrinsic.allOf(intrinsic.mapList(jobs, function (j) { return j.p; })), function (built) {
     var byTarget = intrinsic.create(null), certDers = [], csDigestAlgs = [];
     intrinsic.forEach(built, function (res, i) {
       var slot = byTarget[jobs[i].t] || (byTarget[jobs[i].t] = []);
-      intrinsic.push(slot, res.value);
-      intrinsic.push(certDers, res.certDer);
-      intrinsic.push(csDigestAlgs, res.digestAlgId);
+      _push(slot, res.value);
+      _push(certDers, res.certDer);
+      _push(csDigestAlgs, res.digestAlgId);
     });
 
     var newSiSet = b.set(siSet.children.map(function (siNode, idx) {
@@ -675,8 +697,8 @@ function _countersign(cmsInput, signers, opts) {
       else if (sdKids[i].tagClass === "context" && sdKids[i].tagNumber === 1) crlsNode = sdKids[i];
     }
     var existing = [];
-    if (certsNode) certsNode.children.forEach(function (c) { existing.push(c.bytes); });
-    if (opts.certificates !== false) certDers.forEach(function (d) { existing.push(d); });
+    if (certsNode) intrinsic.forEach(certsNode.children, function (c) { _push(existing, c.bytes); });
+    if (opts.certificates !== false) intrinsic.forEach(certDers, function (d) { _push(existing, d); });
     /** @internal The DER SET ordering through the captured copy, sort AND comparator: read off its own
      * home, any of the three decides which certificate lands where in the set this message carries. */
     var allCerts = guard.list.sortedCopy(_dedupe(existing), intrinsic.compare);
@@ -693,20 +715,20 @@ function _countersign(cmsInput, signers, opts) {
      * comparison would list it a second time. */
     var listed = [];
     intrinsic.forEach(intrinsic.isArray(parsed.digestAlgorithms) ? parsed.digestAlgorithms : [],
-      function (a) { intrinsic.push(listed, a); });
+      function (a) { _push(listed, a); });
     var digestAlgs = intrinsic.map(sdKids[1].children, function (d) { return d.bytes; });
     intrinsic.forEach(csDigestAlgs, function (der) {
       var info = _digestAlgIdentifier(der);
       var already = false;
       intrinsic.forEach(listed, function (alg) { if (cms.sameDigestAlgorithm(alg, info)) already = true; });
       if (already) return;
-      intrinsic.push(listed, info);
-      intrinsic.push(digestAlgs, der);
+      _push(listed, info);
+      _push(digestAlgs, der);
     });
     var newSdFields = [sdKids[0].bytes, b.set(digestAlgs), sdKids[2].bytes];
-    if (allCerts.length) newSdFields.push(b.contextConstructed(0, Buffer.concat(allCerts)));
-    if (crlsNode) newSdFields.push(crlsNode.bytes);
-    newSdFields.push(newSiSet);
+    if (allCerts.length) _push(newSdFields, b.contextConstructed(0, intrinsic.bufferConcat(allCerts)));
+    if (crlsNode) _push(newSdFields, crlsNode.bytes);
+    _push(newSdFields, newSiSet);
     var newCi = b.sequence([root.children[0].bytes, b.explicit(0, b.sequence(newSdFields))]);
     return opts.pem ? pkix.pemEncode(newCi, "CMS", frameworkError.PemError) : newCi;
   });
@@ -732,7 +754,7 @@ function _appendUnsignedAttr(siNode, attrDer) {
   var existing = hasUa ? intrinsic.map(last.children, function (a) { return a.bytes; }) : [];
   var setOf = b.set(intrinsic.concat(existing, [attrDer]));
   var wire = intrinsic.bufferFrom(setOf); wire[0] = 0xA1;
-  intrinsic.push(base, wire);
+  _push(base, wire);
   return b.sequence(base);
 }
 
@@ -955,7 +977,7 @@ function _attachTimestamp(input, token, opts) {
   }));
   var sdKids = t.sd.children;
   var newSdFields = intrinsic.map(intrinsic.arraySlice(sdKids, 0, sdKids.length - 1), function (k) { return k.bytes; });
-  intrinsic.push(newSdFields, newSiSet);
+  _push(newSdFields, newSiSet);
   var out = b.sequence([t.root.children[0].bytes, b.explicit(0, b.sequence(newSdFields))]);
   return opts.pem ? pkix.pemEncode(out, "CMS", frameworkError.PemError) : out;
 }

package/lib/cms-verify.js

@@ -126,9 +126,9 @@ var SIG_SCHEME = intrinsic.assign(intrinsic.create(null), {
   ecdsaWithSHA384: { kind: "ec", hash: "SHA-384", params: "absent" },
   ecdsaWithSHA512: { kind: "ec", hash: "SHA-512", params: "absent" },
 });
-["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
- "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + s.toUpperCase(), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
+intrinsic.forEach(["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+], function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + intrinsic.toUpperCase(s), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
 function _isDerNull(p) { return guard.der.isNull(p); }
 function _algParamsOk(shape, p) { return shape === "null" ? _isDerNull(p) : (p === null || p === undefined); }
 var EC_CURVE = intrinsic.create(null);
@@ -203,7 +203,11 @@ function _preferBoundCandidate(si, candidates) {
 }
 
 function _certSki(cert) {
-  var ext = (cert.extensions || []).filter(function (e) { return e.oid === oid.byName("subjectKeyIdentifier"); })[0];
+  /** @internal The selection returns the first matching row or null. `filter(...)[0]` indexes a
+   *  result that is EMPTY when the extension is absent, and index 0 of an empty array answers from
+   *  the array prototype, so a value installed there reads at the test below as an extension the
+   *  certificate does not carry. */
+  var ext = guard.list.firstMatch(cert.extensions || [], function (e) { return e.oid === oid.byName("subjectKeyIdentifier"); });
   if (!ext) return null;
   try {
     return asn1.read.octetString(asn1.decode(ext.value));
@@ -359,7 +363,7 @@ async function _computeCountersigBytes(si, csTarget) {
     attrs = _decodeSignedAttrs(reTagged);
   } catch (e) { if (e instanceof CmsError) throw e; throw _err("cms/bad-signed-attrs", "the countersignature signedAttrs is not a valid SET OF Attribute", e); }
   if (intrinsic.filter(attrs, function (a) { return a.type === OID_CONTENT_TYPE; }).length) throw _err("cms/misplaced-attr", "a countersignature must not carry a content-type attribute (RFC 5652 sec. 11.4)");
-  var mdAttr = intrinsic.filter(attrs, function (a) { return a.type === OID_MESSAGE_DIGEST; })[0];
+  var mdAttr = guard.list.firstMatch(attrs, function (a) { return a.type === OID_MESSAGE_DIGEST; });
   if (!mdAttr || mdAttr.values.length !== 1) throw _err("cms/bad-signed-attrs", "a countersignature's signedAttrs must carry exactly one message-digest attribute (RFC 5652 sec. 11.4)");
   var declared;
   try {
@@ -402,7 +406,7 @@ async function _computeSignedBytes(si, content, eContentType, digestByName) {
     ctOid = asn1.read.oid(ctAttr[0].values[0]);
   } catch (e) { throw _err("cms/bad-signed-attrs", "the content-type attribute value is not an OBJECT IDENTIFIER", e); }
   if (ctOid !== eContentType) return { mismatch: { code: "cms/content-type-mismatch", message: "the content-type signed attribute does not match the SignedData eContentType (RFC 5652 sec. 5.3)" } };
-  var mdAttr = intrinsic.filter(attrs, function (a) { return a.type === OID_MESSAGE_DIGEST; })[0];
+  var mdAttr = guard.list.firstMatch(attrs, function (a) { return a.type === OID_MESSAGE_DIGEST; });
   if (!mdAttr || mdAttr.values.length !== 1) throw _err("cms/bad-signed-attrs", "signedAttrs must carry exactly one message-digest attribute (RFC 5652 sec. 5.4)");
   var declared;
   try {
@@ -1172,7 +1176,7 @@ var _permitsSigning = pkix.keyUsagePermits(pkix.makeNS("cms", CmsError, oid),
   ["digitalSignature", "contentCommitment", "nonRepudiation"]);
 
 function _keyUsagePermitsSigning(parsedCerts, der) {
-  var entry = intrinsic.filter(parsedCerts, function (c) { return intrinsic.bufferEquals(c.der, der); })[0];
+  var entry = guard.list.firstMatch(parsedCerts, function (c) { return intrinsic.bufferEquals(c.der, der); });
   if (!entry) return true;
   return _permitsSigning(entry.cert);
 }