@blamejs/pki 0.8.59 → 0.8.60

package/CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.60 — 2026-10-07
+
+Build every list a parse or an encode reads from by defining its indexes, so an accessor inherited from the array prototype cannot take an element as it is added.
+
+### Changed
+
+- The library no longer has a storing append to reach for, and a check refuses one that is written anyway: a module that reads `push` or `unshift` off a prototype as a value, quotes either inside brackets, or binds either by destructuring fails the static gates with the non-storing form named in the message. A binding is read from the parse rather than from the text, so the form it is written in does not matter: a declaration, an assignment however deeply nested, a `for`-`of` or `for`-`in` header, a catch parameter, and the parameter list of any function, generator, method or arrow, with a computed, quoted or escaped key read as the name it denotes. An object literal is a different construct and is never read as one, including a literal used as a default inside a pattern. Both grow the list, so both store at an index the array has no own property at; the mutators that remain move or drop elements that already have own slots and reach no inherited accessor. A module prepending to a list counts its elements and appends them in order instead. An escaped spelling of either name is read as the name it denotes, since `p\u0075sh` and `"\x70ush"` are the same property. The ordinary call position is held to a per-module figure instead of a flat refusal, because the module that builds report lines still carries those calls: every other module in the library is held to zero and a new call in any of them fails, the one that is listed cannot grow, and converting calls without lowering a figure fails too. A module may only hold such a figure while nothing else in the library reads it, which is checked rather than asserted: a module another module requires decides something for that caller, so it is held to zero like the rest. What the check cannot settle is a property reached without naming it, through a runtime-assembled key or reflection, or a computed key whose value the program does not determine. What the rest rests on is that neither name is captured or exported anywhere in the library, so there is nothing to bind by habit, and that the non-storing primitives carry the tests for the behavior.
+- The same check now recognizes the variable-width and 64-bit integer writes (`writeUIntBE` and its siblings) alongside the fixed-width ones it already knew, so a module that reads one of those off the prototype at the moment it writes a field is reported like any other.
+
+### Fixed
+
+- The DER codec encodes the bytes a value describes. Four of its byte lists were built by prepending or by assigning at an index, and both are stores: an accessor inherited at an array index took the octets as they were produced, and the decisions read back off those lists were then read through the hole a store leaves. Measured: `pki.asn1.build.integer(128n)` emitted the INTEGER 0, a nine-digit integer emitted as all zeroes, -300 emitted as +212, `pki.asn1.build.oid("1.2.840.113549.1.1.11")` emitted a different OBJECT IDENTIFIER, a SEQUENCE wrapping 300 bytes emitted as `3000`, and tag 31 emitted a truncated identifier. The length octets, the identifier octets and an INTEGER's content octets are written into the output directly now, and an OID's sub-identifier octets are appended by defining each index, so all four describe the value they encode.
+- A decoded value's children are appended by defining the index, in both codecs. Those children are what every format module reads its fields out of. On a SEQUENCE of the integers 1 and 2 the first value came back as 9, and a certificate parsed with the accessor's value in place of its first relative distinguished name, throwing a bare TypeError rather than a typed refusal. The segments a constructed string is joined from, an identifier's arcs, and the checked children of every constructed element are built the same way.
+- Every list the schema engine builds is appended to by defining its index. The engine walks each SEQUENCE OF and SET OF into the list a format's own reader takes its elements from, and collects a structure's fields into the list that is concatenated in order into the bytes it emits, so an accessor at an array index decided both what a parse bound and what an encode wrote. The elements are also mapped through an operation captured at load, which neither dispatches through a replaceable `map` nor builds its result through the receiver's `Symbol.species`.
+- The tables that decide whether a string is a token, a label, a decimal-digit string or a hexadecimal escape held an entry per character they allow and nothing at the codes they do not, and reading one at a code it had no entry for answered from the array prototype. A value installed at index 47 therefore made `pki.acme.keyAuthorization` accept a challenge token carrying `/`, which the base64url set does not allow, instead of refusing it with `acme/bad-token`. The tables have no prototype now, so there is nothing to inherit. The same helper in the name guard was already written this way.
+- The certificate-policy tree is read at the depth a node was placed at. The per-depth layers were held in an array, so a depth with no node yet was a hole and reading it answered from the array prototype, which handed the policy processing a layer of the caller's choosing along with the expected policy sets its nodes carry. Creating a layer was a store at the same index. The layers are keyed in a record with no prototype now, and a generated node takes a qualifier only from a list that holds one.
+- Removing a policy node constructs nothing. The removal went through `splice`, which returns what it removed and therefore builds that result through the receiver's construction protocol: it reads the list's `constructor` and then that constructor's `Symbol.species`, so an accessor installed on `Array.prototype.constructor` ran during the unlink with the live list of policy-node records as its subject, which is a window to change a surviving node's expected-policy set before the walk reads it. Binding `splice` at load does not close that lookup, because the lookup is part of what the function does. The removal now defines the surviving slots and returns nothing. The same change covers the certificate list `pki.cmp` reorders while it accumulates authenticated CA certificates, the extension list every certificate parse builds, and the key-usage list `pki.webcrypto` copies from a caller.
+- An extension or an attribute is found by searching, not by indexing a selection. Written as a filter whose first element is taken, the selection is an empty list when nothing matched, and reading index 0 of an empty list answers from the array prototype: a value installed there stood in for an extension or attribute the input does not carry, and the refusal that follows the lookup was not reached. That covers the subject key identifier a CMS signer is matched by, the message-digest attribute a countersignature and an authenticated-attribute set are checked against, the key usage that decides whether an issuer may sign a CRL, the acmeIdentifier and SubjectAltName extensions a TLS-ALPN validation certificate must carry, and the authority key identifier `pki.acme.ariCertId` reads.
+- Every list a parse builds is appended to by defining its index, across the certificate, CRL, CSR, PKCS#8, CMS, OCSP, TSP, CMP, CMC, PKCS#12, attribute-certificate, trust-anchor and C509 readers, the CBOR codec under C509, and the content-key recovery in `pki.cms.decrypt`, whose key-derivation input is assembled the same way. A SCEP response's certificates and CRLs are checked one at a time and collected the same way, so the certificate returned is the one the check accepted. The trust anchors a path is built against, the addresses a request is allowed to connect to, the anchors a handshake runs under, the distribution-point names a revocation check compares, and the RC2 key schedule a legacy PKCS#12 import derives are all built this way too.
+- The lists built outside the readers are appended to the same way: a certificate's extension rows in the CSR, CRL and CRMF readers, the byte strings an HPKE key schedule is computed over, the peer chain `pki.transport.peerChain` returns, and the lists `pki.acme`, `pki.cmp`, `pki.est`, `pki.ct`, `pki.tuf`, `pki.tlog`, `pki.jose`, `pki.webcrypto` and the PKCS#11 URI reader build while they work.
+- A transparency-log tile is requested from the path its index describes. The path segments were prepended into a list and the per-segment prefix was then applied by a read-modify-write through the hole a prepend leaves, so an accessor at an array index reduced `pki.tlog.tilePath(0, 1234067n)` to `tile/0/`.
+- A C509 iPAddress constraint carries the address it encodes. Its octets were prepended into a list whose leading entry is both the prefix length checked for range and a byte the result carries, so an accessor at an array index decided the check and the emitted address together.
+- A length-prefixed vector declares the bytes it writes. The wire writer under `pki.ct`'s signed-certificate-timestamp list measured the caller's view and then wrote from that same view, so a body on a resizable buffer could shrink in between: the frame then declared more bytes than it carried, and the concatenation that assembles the output failed with an error from the runtime rather than a verdict from the writer. A bound was also converted inside the comparison the length is checked by, which ran the bound's own conversion before the prefix was written and let it replace the write that states the length: measured, a vector declared a length of zero over a payload of two bytes. The body is copied into the writer's own allocation before it is measured, the bounds are converted and typed up front, and the writes that place an integer in its field are bound when the module loads.
+- Every component of the preimage `pki.ct.reconstructSignedData` rebuilds is appended by defining its index, and the concatenation is bound at load. Those bytes are what a log's signature is verified over, so an accessor inherited at an array index replacing any one of them, the version, the signature type, the timestamp, the entry type, the certificate or the extensions, would put the verification on bytes the log never signed.
+- The lists `pki.cms.sign` builds while it works are appended to by defining their indexes: a message's signed attributes, its certificate set and its signer infos, including a countersignature's own signing-time attribute, signed-attribute bytes, signature algorithm and signature as they are assembled into the SignerInfo that is then signed.
+- A message carries the fields its caller asked for. The verbs that assemble a structure for signing collected its fields by storing at an index, so an accessor inherited at that index took a field as it was added and the structure was then signed over whatever the accessor answered. Two measured through their own verbs: `pki.cmp.build` returned a protected message carrying a transaction identifier of `eeee...` where the caller had supplied `0707...`, and the failure reason a SCEP CertRep states is a signed attribute that landed on such an index, so a FAILURE response could be signed stating a reason the caller never gave. Every list outside `pki.inspect` is appended to by defining its index now: `pki.cmp`'s messages and its accumulated CA certificates, `pki.ocsp`'s signed requests and responses, `pki.scep`'s responses, the certificate, CRL, attribute-certificate and certification-request signers, `pki.cms.encrypt`'s recipient infos, `pki.cmc`'s controls, the shared extension and name builders every signing verb embeds, the bags a PKCS#12 file carries under its MAC, the headers and parts of an S/MIME message, the key-derivation parameters an encrypted structure declares, the authentication path a hash-based signature is formed from, and the lists `pki.est`, `pki.acme`, `pki.webcrypto` and the TLS and key-description validators build while they work.
+- `pki.path.fetchingChecker` only fetches a revocation location whose address it is allowed to reach, and both halves of that decision are now bound when the module loads. The test for whether a host is an address literal, which decides whether the blocked-address check runs at all, and the blocked-address check itself were each read off their module at the moment they were used. Replacing the first made every host look like a name so the check was skipped; replacing the second made it answer that nothing is blocked. Either way a distribution point naming a loopback or link-local address was fetched. The operations that read a host, a response body and a media type are bound at load for the same reason, and the bracket test around an IPv6 literal reads character codes rather than comparing substrings.
+- A revocation response is read for the fields it carries itself. The transport seam returns a record of a status, headers and a body, and a transport handing back an object carrying none of them had every one of those reads answered from the object prototype, so an inherited status of 200 with an inherited body and headers was accepted as a revocation response. The three fields are read as the response's own now.
+- A revocation response body is bytes, a string, or absent; a status is the number 200; a media type is a string. Anything else was converted, which ran the value's own conversion: a transport handing back an object decided the bytes a CRL or an OCSP response was then parsed from, a header holding one named the media type from itself, and a status holding one ran during the refusal that reports it. Binding the conversion does not close this, because what runs is the value's hook rather than the conversion. A body that is neither bytes nor a string is refused now and names that as the reason, a status is reported through the formatter that does not convert it, and a media type that is not a string reads as absent.
+- A revocation response's media type is read. It was parsed with the MIME entity reader, which takes the bytes of a whole entity rather than one header value, so the attempt failed for every response and the media type was reported as absent each time. The notes that compare it could therefore never appear, including the one stating that a CRL or an OCSP response arrived under an unexpected media type. The header value is read directly now, taking the span before any parameter and folding its case. The media type still only annotates a verdict and never selects a parser, which is chosen by where the location came from.
+- `pki.path.fetchingChecker` asked a certificate for its extension list by a read that answered from `Object.prototype` when the certificate carries none, so a list installed there was decoded and reported on. It is an own read now, and a value that is not an array is treated as no extensions.
+- A signer refuses to emit an artifact that violates the profile it is signing under, and that refusal is now reached. `pki.x509.sign`, `pki.csr.sign` and `pki.crl.sign` lint what the spec describes before they sign and throw `x509/profile-violation`, `csr/profile-violation` or `crl/profile-violation` naming the rule. The findings that decision reads were collected by storing at an index, so an accessor inherited from the array prototype took each finding as it was recorded and the index answered with the accessor's value: a benign severity there stood in for the error finding and the signer emitted the artifact instead. Measured, `pki.x509.sign` returned a signed CA certificate whose key usage omits keyCertSign. The profile-specific report the check adds for a caller-named profile was substituted whole by the same means. Every list in the linting engine is appended to by defining its index now, so the rules a signer refuses on are the rules that ran. The records that decision is read from were plain objects too, so a field a record does not carry was both written and read through the prototype chain: a finding's severity could be taken off it by an inherited setter, a byte reader's success could be answered as a fatal error, and a rule row that omits an optional field read it from `Object.prototype`, where a value supplied for `appliesTo` or `effectiveDate` stops the rule running at all. Those rows now carry no prototype, the optional reads are own reads, and a report's fields are defined rather than assigned.
+
 ## v0.8.59 — 2026-10-07
 
 Render an object identifier, match a header name and read a media type through operations a replacement cannot answer.

package/lib/acme.js

@@ -90,7 +90,11 @@ var _lower = intrinsic.toLowerCase;
 var _StringI = intrinsic.String;
 var _acmeTrim = intrinsic.uncurry(String.prototype.trim);
 var _stringify = intrinsic.stringify;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: appending with `push` STORES at the index, and a store
+ *  walks the prototype chain for a setter, so an accessor installed at an array index receives each
+ *  element as it is appended and can define something else in its place. `append` defines the index
+ *  on the array itself. */
+var _push = intrinsic.append;
 var _pop = intrinsic.pop;
 var _shift = intrinsic.shift;
 var _join = intrinsic.join;
@@ -353,7 +357,7 @@ var SPEC_NAMES = intrinsic.create(null);
   var kinds = _objectKeys(SPECS);
   for (var i = 0; i < kinds.length; i++) {
     var fields = SPECS[kinds[i]], names = [];
-    for (var j = 0; j < fields.length; j++) names[j] = fields[j].name;
+    for (var j = 0; j < fields.length; j++) _push(names, fields[j].name);
     SPEC_NAMES[kinds[i]] = names;
   }
 })();
@@ -752,14 +756,18 @@ async function verifyTlsAlpn01(certDer, token, accountJwk, identifier) {
   if (!_isString(idType)) throw E("acme/bad-input", "an identifier { type, value } is required");
   var cert = x509.parse(certDer);
   var exts = cert.extensions || [];
-  var acmeExt = exts.filter(function (e) { return e.oid === OID_ACME_IDENTIFIER; })[0];
+  /** @internal Each selection returns the first matching row or null. `filter(...)[0]` indexes a
+   *  result that is EMPTY when the extension is absent, and index 0 of an empty array answers from
+   *  the array prototype, so a value installed there would stand in for an extension the validation
+   *  certificate does not carry and the refusals below would not be reached. */
+  var acmeExt = guard.list.firstMatch(exts, function (e) { return e.oid === OID_ACME_IDENTIFIER; });
   if (!acmeExt) throw E("acme/bad-tlsalpn", "the validation certificate is missing the acmeIdentifier extension (RFC 8737 sec. 3)");
   if (!acmeExt.critical) throw E("acme/bad-tlsalpn", "the acmeIdentifier extension must be critical (RFC 8737 sec. 3)");
   var auth = _readAcmeIdentifier(acmeExt.value);
   var ka = await keyAuthorization(token, accountJwk);
   var expected = await _sha256(Buffer.from(ka, "ascii"));
   if (!auth.equals(expected)) throw E("acme/bad-tlsalpn", "the acmeIdentifier digest does not match the key authorization");
-  var sanExt = exts.filter(function (e) { return e.oid === OID_SAN; })[0];
+  var sanExt = guard.list.firstMatch(exts, function (e) { return e.oid === OID_SAN; });
   if (!sanExt) throw E("acme/bad-tlsalpn", "the validation certificate is missing the SubjectAltName");
   var san = _extDecoders.byOid[OID_SAN](sanExt.value);
   if (!san.names || san.names.length !== 1) throw E("acme/bad-tlsalpn", "the SubjectAltName must carry EXACTLY ONE entry (RFC 8737 sec. 3)");
@@ -1383,7 +1391,7 @@ async function keyChange(o) {
 function ariCertId(certDer) {
   if (!guard.bytes.isByteSource(certDer)) throw E("acme/bad-input", "ariCertId requires a DER certificate BufferSource");
   var cert = x509.parse(certDer);
-  var akiExt = (cert.extensions || []).filter(function (e) { return e.oid === OID_AKI; })[0];
+  var akiExt = guard.list.firstMatch(cert.extensions || [], function (e) { return e.oid === OID_AKI; });
   if (!akiExt) throw E("acme/bad-certid", "the certificate has no authorityKeyIdentifier extension (RFC 9773 sec. 4.1)");
   var aki = _extDecoders.byOid[OID_AKI](akiExt.value);
   if (!aki || !Buffer.isBuffer(aki.keyIdentifier)) throw E("acme/bad-certid", "the authorityKeyIdentifier has no keyIdentifier field (RFC 9773 sec. 4.1)");
@@ -1835,7 +1843,7 @@ function _parseLinkRelation(headers, base, relName, opts) {
       if (seen[key]) continue;
       seen[key] = true;
       distinctCount += 1;
-      if (key !== baseKey) out.push(resolved);
+      if (key !== baseKey) _push(out,resolved);
     }
   }
   if (opts.singleton && distinctCount > 1) throw E("acme/bad-link", "the Link header names more than one distinct rel=\"" + relName + "\" target (RFC 8288 sec. 3.3, a singleton relation)");
@@ -1933,7 +1941,7 @@ function _resignKeysOf(raw) {
     if (!_isObject(e)) throw E("acme/bad-input", "each resignKeys entry must be { alg: string, key: CryptoKey } (RFC 8555 sec. 6.2); entry " + i + " is not");
     var a = e.alg, k = e.key;
     if (!_isString(a) || !wcEngine.isCryptoKeyLike(k)) throw E("acme/bad-input", "each resignKeys entry must be { alg: string, key: CryptoKey } (RFC 8555 sec. 6.2); entry " + i + " is not");
-    out[i] = intrinsic.freeze({ alg: a, key: k });
+    _push(out, intrinsic.freeze({ alg: a, key: k }));
   }
   return intrinsic.freeze(out);
 }

package/lib/alt-sig.js

@@ -73,7 +73,9 @@ var _forEach = intrinsic.forEach;
 var _map = intrinsic.map;
 var _bufferFrom = intrinsic.bufferFrom;
 var _bufferConcat = intrinsic.bufferConcat;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 
 function _err(code, message, cause) { return new AltSigError(code, message, cause); }
 

package/lib/asn1-der.js

@@ -41,7 +41,6 @@ var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _isArray = intrinsic.isArray;
-var _unshift = intrinsic.unshift;
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 /** @internal A Date's fields are read through the prototype's own getters, captured at load, so
  * a getter the instance carries or one replaced later cannot change what a time encodes to or
@@ -329,7 +328,12 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
         if (cp + 2 > limit) throw new Asn1Error("asn1/truncated", "indefinite-length value is missing its end-of-contents octets");
         if (buf[cp] === 0x00 && buf[cp + 1] === 0x00) break;
         child = _decodeTLV(buf, cp, limit, depth + 1, maxDepth, ber, strDepth, ctr);
-        children.push(child.node);
+        /** @internal The decoded child is APPENDED by defining its index. Stored with `push`, the
+         *  store walks the prototype chain for a setter, so an accessor at an array index received
+         *  each child as it was decoded and could define another node in its place: measured, a
+         *  SEQUENCE of two INTEGERs decoded with its first value changed from 1 to 9. Every format
+         *  module in this toolkit reads its fields out of this list. */
+        intrinsic.append(children, child.node);
         cp = child.end;
       }
       contentEnd = cp;
@@ -337,7 +341,7 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
     } else {
       while (cp < contentEnd) {
         child = _decodeTLV(buf, cp, contentEnd, depth + 1, maxDepth, ber, strDepth, ctr);
-        children.push(child.node);
+        intrinsic.append(children, child.node);
         cp = child.end;
       }
       end = contentEnd;
@@ -366,9 +370,9 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
       if (children[s].tagClass !== "universal" || children[s].tagNumber !== TAGS.OCTET_STRING) {
         throw new Asn1Error("asn1/bad-constructed-string", "a constructed OCTET STRING segment must itself be an OCTET STRING");
       }
-      segments.push(children[s].content);
+      intrinsic.append(segments, children[s].content);
     }
-    node.content = Buffer.concat(segments);
+    node.content = intrinsic.bufferConcat(segments);
     node.constructed = false;
     node.children = null;
   }
@@ -481,9 +485,9 @@ function readOctetStringImplicit(node, tag) {
       if (seg.tagClass !== "universal" || seg.tagNumber !== TAGS.OCTET_STRING || seg.constructed || !seg.content) {
         throw new Asn1Error("asn1/bad-constructed-string", "a constructed OCTET STRING segment must itself be an OCTET STRING");
       }
-      segments.push(seg.content);
+      intrinsic.append(segments, seg.content);
     }
-    return Buffer.concat(segments);
+    return intrinsic.bufferConcat(segments);
   }
   _expectPrimitive(node, "readOctetStringImplicit");
   return node.content;
@@ -766,12 +770,22 @@ function encodeLength(n) {
   if (typeof n !== "number" || !isFinite(n) || n < 0 || Math.floor(n) !== n) {
     throw new Asn1Error("asn1/bad-length", "length must be a non-negative integer");
   }
-  if (n < 0x80) return Buffer.from([n]);
-  var bytes = [];
+  if (n < 0x80) return intrinsic.bufferFrom([n]);
+  /** @internal The octets are counted and then written into the output from its end, rather than
+   *  prepended into an array. A prepend STORES at an index, and a store walks the prototype chain
+   *  for a setter, so an accessor at an array index took each octet as it was produced and left the
+   *  list reading back whatever its getter answers. These are the length octets of every DER element
+   *  longer than 127 bytes: measured, a SEQUENCE wrapping a 300-byte OCTET STRING emitted as `3000`,
+   *  an empty SEQUENCE. A typed array handles its own integer-indexed writes and consults no
+   *  prototype accessor, which is why the output is filled directly. */
+  var count = 0;
+  for (var probe = n; probe > 0; probe = intrinsic.floor(probe / 256)) count++;
+  if (count > 126) throw new Asn1Error("asn1/length-too-large", "length needs more than 126 octets");
+  var out = intrinsic.bufferAlloc(count + 1);
+  out[0] = 0x80 | count;
   var v = n;
-  while (v > 0) { _unshift(bytes, v & 0xff); v = Math.floor(v / 256); }
-  if (bytes.length > 126) throw new Asn1Error("asn1/length-too-large", "length needs more than 126 octets");
-  return Buffer.concat([Buffer.from([0x80 | bytes.length]), Buffer.from(bytes)]);
+  for (var i = count; i >= 1; i--) { out[i] = v & 0xff; v = intrinsic.floor(v / 256); }
+  return out;
 }
 
 /** @internal The identifier comes from the one function that composes one. Writing the octet here
@@ -842,12 +856,24 @@ function encodeIdentifier(classBits, constructed, tagNumber) {
       ") and is not assigned to any type, so no encoding of it is a DER element");
   }
   var lead = cls | (constructed ? CONSTRUCTED_BIT : 0);
-  if (tagNumber < 0x1f) return Buffer.from([lead | tagNumber]);
-  var body = [];
+  if (tagNumber < 0x1f) return intrinsic.bufferFrom([lead | tagNumber]);
+  /** @internal Counted, then written into the output from its end, for the reason `encodeLength` is:
+   *  a prepend stores at an index and a store consults a setter inherited there. These are the
+   *  identifier octets of a high-tag-number element, so they name the type every reader dispatches
+   *  on: measured, tag 31 emitted as `1f00`. Every octet but the last carries the continuation bit. */
+  var count = 0;
+  for (var probe = tagNumber; ; probe = intrinsic.floor(probe / 128)) {
+    count++;
+    if (probe < 128) break;
+  }
+  var out = intrinsic.bufferAlloc(count + 1);
+  out[0] = lead | 0x1f;
   var v = tagNumber;
-  do { _unshift(body, v & 0x7f); v = Math.floor(v / 128); } while (v > 0);
-  for (var i = 0; i < body.length - 1; i++) body[i] |= 0x80;
-  return Buffer.concat([Buffer.from([lead | 0x1f]), Buffer.from(body)]);
+  for (var i = count; i >= 1; i--) {
+    out[i] = (v & 0x7f) | (i === count ? 0x00 : 0x80);
+    v = intrinsic.floor(v / 128);
+  }
+  return out;
 }
 
 /**
@@ -944,19 +970,29 @@ function intToDer(v) {
     v = BigInt(v);
   }
   if (typeof v !== "bigint") throw new Asn1Error("asn1/bad-integer", "integer must be number or BigInt");
-  if (v === 0n) return Buffer.from([0]);
-  var bytes = [];
+  if (v === 0n) return intrinsic.bufferFrom([0]);
+  /** @internal The content octets are written into the output directly, in both signs. The positive
+   *  branch prepended into an array and then read `bytes[0]` to decide whether the value needed a
+   *  leading zero to read as positive, and the negative branch stored at each index; both are stores,
+   *  so an accessor inherited at an array index took the octets and answered the decision. Measured:
+   *  128 encoded as the INTEGER 0, a nine-digit value as all zeroes, and -300 as +212. A typed array
+   *  consults no prototype accessor for an integer-indexed write, and `bufferAlloc` zero-fills, so
+   *  the leading zero is the allocation rather than a second prepend. */
   if (v > 0n) {
-    var t = v;
-    while (t > 0n) { _unshift(bytes, Number(t & 0xffn)); t >>= 8n; }
-    if (bytes[0] & 0x80) _unshift(bytes, 0x00);
-  } else {
-    var len = 1;
-    while (v < -(1n << BigInt(8 * len - 1))) len += 1;
-    var tc = (1n << BigInt(8 * len)) + v;
-    for (var i = len - 1; i >= 0; i--) { bytes[i] = Number(tc & 0xffn); tc >>= 8n; }
+    var n = 0;
+    for (var t = v; t > 0n; t >>= 8n) n++;
+    var pad = ((v >> intrinsic.BigInt(8 * (n - 1))) & 0xffn) >= 0x80n ? 1 : 0;
+    var outP = intrinsic.bufferAlloc(n + pad);
+    var tp = v;
+    for (var i = n + pad - 1; i >= pad; i--) { outP[i] = intrinsic.Number(tp & 0xffn); tp >>= 8n; }
+    return outP;
   }
-  return Buffer.from(bytes);
+  var len = 1;
+  while (v < -(1n << intrinsic.BigInt(8 * len - 1))) len += 1;
+  var tc = (1n << intrinsic.BigInt(8 * len)) + v;
+  var outN = intrinsic.bufferAlloc(len);
+  for (var j = len - 1; j >= 0; j--) { outN[j] = intrinsic.Number(tc & 0xffn); tc >>= 8n; }
+  return outN;
 }
 
 function encodeOidContent(dotted) {
@@ -969,15 +1005,22 @@ function encodeOidContent(dotted) {
   var subids = intrinsic.concat([a1 * 40n + a2], arcs.slice(2));
   var out = [];
   for (var s = 0; s < subids.length; s++) {
-    var body = [];
     var v = subids[s];
-    do { _unshift(body, Number(v & 0x7fn)); v >>= 7n; } while (v > 0n);
-    if (body.length > constants.LIMITS.OID_MAX_SUBIDENTIFIER_BYTES) {
+    /** @internal Each sub-identifier's octets are counted and then appended most-significant first,
+     *  rather than prepended into a list and patched in place. A prepend stores at an index, and the
+     *  continuation bit was then set by a read-modify-write that read back through the hole a store
+     *  leaves under an inherited setter. This is the OID an algorithm or a signature is named by:
+     *  measured, sha256WithRSAEncryption emitted as `0609000000008000000000`, a different OID. */
+    var count = 1;
+    for (var probe = v >> 7n; probe > 0n; probe >>= 7n) count++;
+    if (count > constants.LIMITS.OID_MAX_SUBIDENTIFIER_BYTES) {
       throw new OidError("oid/subidentifier-too-large",
         "OID sub-identifier exceeds " + constants.LIMITS.OID_MAX_SUBIDENTIFIER_BYTES + " octets");
     }
-    for (var k = 0; k < body.length - 1; k++) body[k] |= 0x80;
-    for (var j = 0; j < body.length; j++) out.push(body[j]);
+    for (var k = count - 1; k >= 0; k--) {
+      var octet = intrinsic.Number((v >> intrinsic.BigInt(7 * k)) & 0x7fn);
+      intrinsic.append(out, k === 0 ? octet : octet | 0x80);
+    }
   }
   return Buffer.from(out);
 }
@@ -1171,7 +1214,12 @@ function _intContent(v, who) {
 function _asBufferArray(arr, who) {
   if (!_isArray(arr)) throw new Asn1Error("asn1/bad-children", who + ": expected an array of TLV buffers");
   var n = arr.length, out = [];
-  for (var i = 0; i < n; i++) out[i] = _asBuffer(arr[i], who);
+  /** @internal Each checked child is APPENDED by defining its index. Assigning at the index is a
+   *  store, and a store walks the prototype chain for a setter, so an accessor inherited at an array
+   *  index took the child and left the list reading back its getter's value instead. This list is
+   *  every constructed element's children: measured, a SEQUENCE wrapping a 300-byte OCTET STRING
+   *  emitted as `3000`, an empty SEQUENCE, with the checked child discarded. */
+  for (var i = 0; i < n; i++) intrinsic.append(out, _asBuffer(arr[i], who));
   return out;
 }
 

package/lib/attrcert-sign.js

@@ -24,6 +24,9 @@ var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become the bytes that get signed. */
+var _push = intrinsic.append;
 /** @internal The promise a signature verdict is awaited through, built from the constructor captured at
  *  load. `Promise.resolve` builds from its RECEIVER, so reading the global binding at the call hands the
  *  construction to whatever that binding holds: one settling without awaiting its argument drops the
@@ -195,7 +198,7 @@ function _issuerSerialContent(is) {
   var parts = [_b.encodeGeneralNames(_gnList(is.issuer)), _b.serialInteger(is.serial)];
   if (is.issuerUID != null) {
     if (!Buffer.isBuffer(is.issuerUID)) throw _err("attrcert/bad-input", "baseCertificateID.issuerUID must be a Buffer");
-    parts.push(b.bitString(is.issuerUID, 0));
+    _push(parts,b.bitString(is.issuerUID, 0));
   }
   return Buffer.concat(parts);
 }
@@ -251,8 +254,8 @@ function _encodeRole(role) {
   _assertFields(role, KNOWN_ROLE_KEYS, "role");
   if (role.roleName == null) throw _err("attrcert/bad-input", "role must be an object with a roleName GeneralName");
   var parts = [];
-  if (role.roleAuthority != null) parts.push(_b.encodeGeneralNames(_gnList(role.roleAuthority), 0));
-  parts.push(b.explicit(1, _b.encodeGeneralName(role.roleName)));
+  if (role.roleAuthority != null) _push(parts,_b.encodeGeneralNames(_gnList(role.roleAuthority), 0));
+  _push(parts,b.explicit(1, _b.encodeGeneralName(role.roleName)));
   return b.sequence(parts);
 }
 function _encodeClearance(cl) {
@@ -269,11 +272,11 @@ function _encodeClearance(cl) {
       return pos;
     });
     var isDefault = positions.length === 1 && positions[0] === CLASSLIST_BIT.unclassified;
-    if (!isDefault) parts.push(b.namedBitString(positions));
+    if (!isDefault) _push(parts,b.namedBitString(positions));
   }
   if (cl.securityCategories != null) {
     if (!Array.isArray(cl.securityCategories) || !cl.securityCategories.length) throw _err("attrcert/bad-input", "clearance.securityCategories must be a non-empty array");
-    parts.push(b.set(guard.list.copyMap(cl.securityCategories, _encodeSecurityCategory)));
+    _push(parts,b.set(guard.list.copyMap(cl.securityCategories, _encodeSecurityCategory)));
   }
   return b.sequence(parts);
 }
@@ -291,8 +294,8 @@ function _encodeIetfAttrSyntax(ia) {
   _assertFields(ia, KNOWN_IETF_ATTR_KEYS, "IetfAttrSyntax");
   if (!Array.isArray(ia.values) || !ia.values.length) throw _err("attrcert/bad-input", "an IetfAttrSyntax attribute must be an object with a non-empty values array");
   var parts = [];
-  if (ia.policyAuthority != null) parts.push(_b.encodeGeneralNames(_gnList(ia.policyAuthority), 0));
-  parts.push(b.sequence(guard.list.copyMap(ia.values, function (v) {
+  if (ia.policyAuthority != null) _push(parts,_b.encodeGeneralNames(_gnList(ia.policyAuthority), 0));
+  _push(parts,b.sequence(guard.list.copyMap(ia.values, function (v) {
     if (v == null || typeof v !== "object") throw _err("attrcert/bad-input", "each IetfAttrSyntax value must be { octets }, { oid }, or { string }");
     _assertFields(v, KNOWN_IETF_ATTR_VALUE_KEYS, "IetfAttrSyntax value");
     if (v.octets != null) { if (!Buffer.isBuffer(v.octets)) throw _err("attrcert/bad-input", "IetfAttrSyntax octets must be a Buffer"); return b.octetString(v.octets); }
@@ -310,7 +313,7 @@ function _encodeSvceAuthInfo(sai, authInfoAllowed, label) {
   if (sai.authInfo != null) {
     if (!authInfoAllowed) throw _err("attrcert/bad-input", "accessIdentity must not carry authInfo (RFC 5755 sec. 4.4.2)");
     if (!Buffer.isBuffer(sai.authInfo)) throw _err("attrcert/bad-input", label + " authInfo must be a Buffer");
-    parts.push(b.octetString(sai.authInfo));
+    _push(parts,b.octetString(sai.authInfo));
   }
   return b.sequence(parts);
 }
@@ -349,11 +352,11 @@ function _encodeAAControls(aac) {
   var parts = [];
   if (aac.pathLenConstraint != null) {
     if (typeof aac.pathLenConstraint !== "number" || !Number.isInteger(aac.pathLenConstraint) || aac.pathLenConstraint < 0 || aac.pathLenConstraint > 0x7fffffff) throw _err("attrcert/bad-input", "aaControls.pathLenConstraint must be an integer in 0..2147483647 (RFC 5755 sec. 7.4)");
-    parts.push(b.integer(BigInt(aac.pathLenConstraint)));
+    _push(parts,b.integer(BigInt(aac.pathLenConstraint)));
   }
-  if (aac.permittedAttrs != null) parts.push(_attrSpec(aac.permittedAttrs, 0, "permittedAttrs"));
-  if (aac.excludedAttrs != null) parts.push(_attrSpec(aac.excludedAttrs, 1, "excludedAttrs"));
-  if (aac.permitUnSpecified === false) parts.push(b.boolean(false));
+  if (aac.permittedAttrs != null) _push(parts,_attrSpec(aac.permittedAttrs, 0, "permittedAttrs"));
+  if (aac.excludedAttrs != null) _push(parts,_attrSpec(aac.excludedAttrs, 1, "excludedAttrs"));
+  if (aac.permitUnSpecified === false) _push(parts,b.boolean(false));
   else if (aac.permitUnSpecified != null && aac.permitUnSpecified !== true) throw _err("attrcert/bad-input", "aaControls.permitUnSpecified must be a boolean");
   return b.sequence(parts);
 }
@@ -388,7 +391,7 @@ function _buildAttributes(attrSpec) {
     if (seen[type]) throw _err("attrcert/duplicate-attribute", "duplicate " + (oid.name(type) || type) + " attribute (RFC 5755 sec. 4.2.7)");
     seen[type] = true;
     _assertAttributeProfile(type, attrcert.validateAttributeValue(type, valueTlv));
-    attrs.push(b.sequence([b.oid(type), b.set([valueTlv])]));
+    _push(attrs,b.sequence([b.oid(type), b.set([valueTlv])]));
   }
   if (Array.isArray(attrSpec)) {
     /** @internal Through the captured walk, never the caller's own `forEach`: these attributes are the
@@ -409,7 +412,7 @@ function _buildAttributes(attrSpec) {
         catch (err) { if (err instanceof AttrCertError) throw err; throw _err("attrcert/bad-input", "pre-encoded " + (oid.name(at) || at) + " attribute value is malformed", err); }
         _assertAttributeProfile(at, decoded);
       });
-      attrs.push(b.raw(der));
+      _push(attrs,b.raw(der));
     });
     if (!attrs.length) throw _err("attrcert/bad-attributes", "attributes must carry at least one Attribute (RFC 5755 sec. 4.2.7)");
     return b.sequence(attrs);
@@ -442,7 +445,7 @@ function _emitNamedExtension(out, seen, k, val, ctx) {
   seen[eOid] = true;
   var valueDer = _extensionValue(k, val, ctx);
   _assertExtensionProfile(eOid, _decodeExtensionValue(eOid, valueDer), ctx);
-  out.push(_b.ext(eOid, meta.critical, valueDer));
+  _push(out,_b.ext(eOid, meta.critical, valueDer));
 }
 function _buildExtensions(extSpec, ctx) {
   if (extSpec == null) extSpec = {};
@@ -593,7 +596,7 @@ function _sign(spec, issuer, opts) {
     b.integer(1n), holderDer, issuerDer, scheme.sigAlgId,
     _b.serialInteger(spec.serialNumber), validityDer, attributesDer,
   ];
-  if (extsDer) acinfoChildren.push(extsDer);
+  if (extsDer) _push(acinfoChildren,extsDer);
   var acinfoDer = b.sequence(acinfoChildren);
 
   return signScheme.signOverTbs(scheme, issuer.key, acinfoDer, _signE).then(function (sig) {

package/lib/byte-writer.js

@@ -18,20 +18,58 @@
  * in a format module.
  */
 
+var intrinsic = require("./guard-intrinsic");
+/** @internal Every operation this writer decides a field's width, range or bytes with is bound at
+ *  load. Each one participates in what gets emitted: the integer tests decide whether a value fits
+ *  the field, the allocation decides how wide the field is, and the concatenation decides the byte
+ *  string a caller signs or sends. */
+var _isInteger = intrinsic.isInteger;
+var _isSafeInteger = intrinsic.isSafeInteger;
+var _bufferAlloc = intrinsic.bufferAlloc;
+var _isBuffer = intrinsic.isBuffer;
+var _bufferConcat = intrinsic.bufferConcat;
+var _BigInt = intrinsic.BigInt;
+var _taSet = intrinsic.typedArraySet;
+/** @internal The two writes that place an integer into its field, bound at load. A bound's own
+ *  `valueOf` runs inside the comparison the length is checked by, which is a window to replace a
+ *  method the write that follows would otherwise read off the prototype: measured, a vector declared
+ *  a length of 0 over a payload of two bytes that way. */
+var _writeUIntBE = intrinsic.uncurry(Buffer.prototype.writeUIntBE);
+var _writeBigUInt64BE = intrinsic.uncurry(Buffer.prototype.writeBigUInt64BE);
+
+/** @internal A real copy of the bytes, in this writer's own allocation. A slice of a view shares the
+ *  backing buffer, so a buffer that can be resized takes the slice out of bounds with it, and the
+ *  copy has to be taken before anything else in the call can run code. */
+function _copyOf(view) {
+  var n = intrinsic.sizeOf(view);
+  var out = _bufferAlloc(n);
+  if (n !== 0) _taSet(out, view, 0);
+  return out;
+}
+
 function ByteWriter(E, defaultCode) {
   this.parts = [];
   this.len = 0;
   this.E = E;
   this.defaultCode = defaultCode || "byte-writer/bad-value";
 }
-ByteWriter.prototype._push = function (buf) { this.parts.push(buf); this.len += buf.length; };
+/** @internal The piece is APPENDED by defining its index, not stored by `push`. A store walks the
+ *  prototype chain for a setter, so an accessor installed at an array index receives each piece as it
+ *  is added and can define something else in its place, and these pieces are the bytes this writer
+ *  emits. The length is accumulated from the buffer's own byte length rather than a `length`
+ *  property, so a view that overstates itself cannot make the declared length disagree with the
+ *  bytes. */
+ByteWriter.prototype._push = function (buf) {
+  intrinsic.append(this.parts, buf);
+  this.len += intrinsic.sizeOf(buf);
+};
 ByteWriter.prototype._uint = function (v, width, code) {
-  if (!Number.isInteger(width) || width < 1 || width > 4) throw new this.E(code || this.defaultCode, "an integer width must be 1..4, got " + width);
+  if (!_isInteger(width) || width < 1 || width > 4) throw new this.E(code || this.defaultCode, "an integer width must be 1..4, got " + width);
   var max = width === 4 ? 0xffffffff : (1 << (8 * width)) - 1;
-  if (typeof v !== "number" || !Number.isSafeInteger(v) || v < 0 || v > max) {
+  if (typeof v !== "number" || !_isSafeInteger(v) || v < 0 || v > max) {
     throw new this.E(code || this.defaultCode, "a uint" + (8 * width) + " must be an integer in 0.." + max + ", got " + v);
   }
-  var b = Buffer.alloc(width); b.writeUIntBE(v, 0, width); this._push(b);
+  var b = _bufferAlloc(width); _writeUIntBE(b, v, 0, width); this._push(b);
 };
 ByteWriter.prototype.u8 = function (v, code) { this._uint(v, 1, code); return this; };
 ByteWriter.prototype.u16 = function (v, code) { this._uint(v, 2, code); return this; };
@@ -40,25 +78,37 @@ ByteWriter.prototype.u32 = function (v, code) { this._uint(v, 4, code); return t
 ByteWriter.prototype.u64 = function (v, code) {
   var big;
   if (typeof v === "bigint") big = v;
-  else if (typeof v === "number" && Number.isSafeInteger(v) && v >= 0) big = BigInt(v);
+  else if (typeof v === "number" && _isSafeInteger(v) && v >= 0) big = _BigInt(v);
   else throw new this.E(code || this.defaultCode, "a uint64 must be a non-negative integer or BigInt, got " + v);
   if (big < 0n || big > 0xffffffffffffffffn) throw new this.E(code || this.defaultCode, "a uint64 must be in 0..2^64-1");
-  var b = Buffer.alloc(8); b.writeBigUInt64BE(big); this._push(b);
+  var b = _bufferAlloc(8); _writeBigUInt64BE(b, big); this._push(b);
   return this;
 };
 ByteWriter.prototype.bytes = function (buf, code) {
-  if (!Buffer.isBuffer(buf)) throw new this.E(code || this.defaultCode, "bytes() requires a Buffer");
+  if (!_isBuffer(buf)) throw new this.E(code || this.defaultCode, "bytes() requires a Buffer");
   this._push(buf); return this;
 };
 ByteWriter.prototype.vector = function (lenWidth, min, max, body, code) {
-  if (!Buffer.isBuffer(body)) throw new this.E(code || this.defaultCode, "vector() body must be a Buffer");
-  if (body.length < min) throw new this.E(code || this.defaultCode, "vector body " + body.length + " below minimum " + min);
-  if (max != null && body.length > max) throw new this.E(code || this.defaultCode, "vector body " + body.length + " above maximum " + max);
-  this._uint(body.length, lenWidth, code);
-  this._push(body);
+  if (!_isBuffer(body)) throw new this.E(code || this.defaultCode, "vector() body must be a Buffer");
+  /** @internal The body is COPIED before it is measured, and the copy is what gets written. The
+   *  bounds, the length prefix and the bytes then all describe one byte string that nothing else
+   *  holds. Measuring the caller's view instead left a window: a resizable backing buffer shrunk
+   *  between the measurement and the write (a `min` whose `valueOf` resizes it is enough) and the
+   *  vector declared two bytes over a payload of one. The bounds are converted to numbers up front
+   *  for the same reason, so a bound cannot run code in the middle of the comparison it is part of. */
+  var bytes = _copyOf(body);
+  var bodyLen = intrinsic.sizeOf(bytes);
+  var lo = intrinsic.Number(min);
+  if (!_isSafeInteger(lo) || lo < 0) throw new this.E(code || this.defaultCode, "a vector minimum must be a non-negative integer, got " + lo);
+  var hi = max == null ? null : intrinsic.Number(max);
+  if (hi !== null && (!_isSafeInteger(hi) || hi < lo)) throw new this.E(code || this.defaultCode, "a vector maximum must be an integer not below the minimum, got " + hi);
+  if (bodyLen < lo) throw new this.E(code || this.defaultCode, "vector body " + bodyLen + " below minimum " + lo);
+  if (hi !== null && bodyLen > hi) throw new this.E(code || this.defaultCode, "vector body " + bodyLen + " above maximum " + hi);
+  this._uint(bodyLen, lenWidth, code);
+  this._push(bytes);
   return this;
 };
 ByteWriter.prototype.length = function () { return this.len; };
-ByteWriter.prototype.build = function () { return Buffer.concat(this.parts, this.len); };
+ByteWriter.prototype.build = function () { return _bufferConcat(this.parts, this.len); };
 
 module.exports = ByteWriter;

package/lib/cbor-det.js

@@ -40,6 +40,12 @@ var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
+/** @internal The append every list in this module is built with. `push` STORES at the index, and a
+ *  store walks the prototype chain for a setter, so an accessor inherited at an array index receives
+ *  each element as it is appended and the index then reads back whatever its getter answers. The
+ *  decoded children below are what every C509 field is read out of, so a replaced element there is a
+ *  field this codec never decoded. */
+var _push = guard.list.append;
 
 var CborError = frameworkError.CborError;
 
@@ -141,7 +147,7 @@ function _decodeItem(buf, start, limit, depth, maxD, rules, state) {
     var cp = contentStart;
     for (var i = 0n; i < argument; i++) {
       var el = _decodeItem(buf, cp, limit, depth + 1, maxD, rules, state);
-      children.push(el.node);
+      _push(children, el.node);
       cp = el.end;
     }
     end = cp;
@@ -158,7 +164,7 @@ function _decodeItem(buf, start, limit, depth, maxD, rules, state) {
         if (cmp > 0) throw new CborError("cbor/unsorted-map-keys", "map keys are not in bytewise-ascending order");
         if (cmp === 0) throw new CborError("cbor/duplicate-map-key", "duplicate map key");
       }
-      children.push([k.node, v.node]);
+      _push(children, [k.node, v.node]);
     }
     end = mp;
   } else if (mt === 6) {
@@ -682,7 +688,7 @@ var build = Object.assign(Object.create(null), {
     enc = guard.list.sortedCopy(enc, function (a, b) { return guard.bytes.compare(a[0], b[0]); });
     for (var i = 1; i < enc.length; i++) { if (guard.bytes.compare(enc[i - 1][0], enc[i][0]) === 0) throw new CborError("cbor/duplicate-map-key", "build.map: duplicate map key"); }
     var flat = [_head(5, pairs.length, "build.map")];
-    enc.forEach(function (p) { flat.push(p[0], p[1]); });
+    enc.forEach(function (p) { _push(flat, p[0]); _push(flat, p[1]); });
     return _assertDecodes(Buffer.concat(flat), "build.map");
   },
   tag: function (tagNum, inner) { return _assertDecodes(Buffer.concat([_head(6, tagNum, "build.tag"), _cbItem(inner, "build.tag content")]), "build.tag"); },