@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/lib/argon2-builtin.js

@@ -0,0 +1,173 @@
+"use strict";
+/**
+ * Thin wrapper over Node's built-in `crypto.argon2` that produces and
+ * parses the PHC string format
+ * (`$argon2id$v=19$m=65536,t=3,p=4$<salt>$<hash>`).
+ *
+ * Replaces the vendored `lib/vendor/argon2/` prebuilds (which the
+ * framework carried since v0.4.x). Node 24+ ships a stable
+ * `crypto.argon2*` API; vendoring the third-party native module is no
+ * longer necessary, eliminates the supply-chain weight of platform-
+ * specific prebuilds, and keeps the framework's "zero npm runtime
+ * deps" posture intact without dragging argon2 prebuild artifacts
+ * across every install.
+ *
+ * Operators wanting to supply their own argon2 implementation (e.g.
+ * pinned to a specific upstream commit, or routed through a hardware-
+ * backed accelerator) override at the call site by passing `argon2:`
+ * in opts to `b.auth.password.hash` / `.verify` / `.needsRehash`. The
+ * supplied object MUST expose the same `hash` / `verify` /
+ * `needsRehash` shape this wrapper exposes.
+ */
+
+var nodeCrypto = require("node:crypto");
+var bCrypto = require("./crypto");
+var C = require("./constants");
+
+var ARGON2ID = "argon2id";
+
+// Argon2 v1.3 — the only version current implementations emit.
+var ARGON2_VERSION = 0x13;                                                       // allow:raw-byte-literal — argon2 algorithm version
+
+var DEFAULT_HASH_LENGTH = C.BYTES.bytes(32);
+var DEFAULT_SALT_LENGTH = C.BYTES.bytes(16);
+
+// Standard PHC base64 — no padding, alphabet [A-Za-z0-9+/].
+// Linear `=`-strip rather than `.replace(/=+$/g, "")` — the regex is
+// polynomial-ReDoS-shaped per CodeQL js/polynomial-redos even though
+// the input here is internal. Also avoids base64url because PHC
+// strings use `+/` (standard b64) not `-_` (url-safe).
+function _b64NoPad(buf) {
+  var s = buf.toString("base64");
+  var end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 0x3D /* = */) end -= 1;
+  return end === s.length ? s : s.slice(0, end);
+}
+
+function _fromB64NoPad(s) {
+  // Node tolerates missing padding in `Buffer.from(s, "base64")` so we
+  // pass straight through; the no-pad form is what PHC strings emit
+  // on the wire.
+  return Buffer.from(s, "base64");
+}
+
+function _phcEncode(salt, hash, params) {
+  return "$argon2id$v=" + ARGON2_VERSION +
+         "$m=" + params.memoryCost +
+         ",t=" + params.timeCost +
+         ",p=" + params.parallelism +
+         "$" + _b64NoPad(salt) +
+         "$" + _b64NoPad(hash);
+}
+
+// Parse a PHC string into structured form. Accepts only argon2id
+// shapes — argon2i / argon2d are intentionally not supported by the
+// framework wrapper.
+function _phcDecode(stored) {
+  if (typeof stored !== "string" || stored.length === 0) return null;
+  var parts = stored.split("$");
+  if (parts.length !== 6) return null;
+  if (parts[0] !== "" || parts[1] !== ARGON2ID) return null;
+  var ver = /^v=(\d+)$/.exec(parts[2]);
+  if (!ver) return null;
+  var version = parseInt(ver[1], 10);
+  if (!isFinite(version) || version <= 0) return null;
+  var paramTokens = parts[3].split(",");
+  var p = { memoryCost: NaN, timeCost: NaN, parallelism: NaN };
+  for (var i = 0; i < paramTokens.length; i += 1) {
+    var t = paramTokens[i];
+    var eq = t.indexOf("=");
+    if (eq === -1) return null;
+    var k = t.slice(0, eq);
+    var v = parseInt(t.slice(eq + 1), 10);
+    if (!isFinite(v)) return null;
+    if (k === "m") p.memoryCost = v;
+    else if (k === "t") p.timeCost = v;
+    else if (k === "p") p.parallelism = v;
+  }
+  if (!isFinite(p.memoryCost) || !isFinite(p.timeCost) || !isFinite(p.parallelism)) return null;
+  var salt;
+  var hash;
+  try { salt = _fromB64NoPad(parts[4]); }
+  catch (_e) { return null; }
+  try { hash = _fromB64NoPad(parts[5]); }
+  catch (_e) { return null; }
+  return { version: version, params: p, salt: salt, hash: hash };
+}
+
+function _runArgon2(message, salt, params, hashLength) {
+  // Use the async variant so the call queues onto the libuv threadpool
+  // instead of blocking the main event loop. argon2 with framework
+  // defaults (64 MiB / 3 passes / 1 lane) takes ~100ms per call;
+  // blocking the loop that long stalls every concurrent timer the
+  // test suite is also running and trips spurious flakes in
+  // safe-async-loops fixtures.
+  return new Promise(function (resolve, reject) {
+    nodeCrypto.argon2(ARGON2ID, {
+      message:     message,
+      nonce:       salt,
+      memory:      params.memoryCost,
+      passes:      params.timeCost,
+      parallelism: params.parallelism,
+      tagLength:   hashLength,
+    }, function (err, result) {
+      if (err) reject(err);
+      else resolve(result);
+    });
+  });
+}
+
+// ---- public surface ----
+
+async function hash(plain, opts) {
+  opts = opts || {};
+  var params = {
+    memoryCost:  opts.memoryCost  || C.BYTES.kib(64),                            // 64 MiB
+    timeCost:    opts.timeCost    || 3,
+    parallelism: opts.parallelism || 1,
+  };
+  var hashLength = opts.hashLength || DEFAULT_HASH_LENGTH;
+  var salt = opts.salt || nodeCrypto.randomBytes(DEFAULT_SALT_LENGTH);
+  var message = Buffer.isBuffer(plain) ? plain : Buffer.from(String(plain), "utf8");
+  var raw = await _runArgon2(message, salt, params, hashLength);
+  // raw: true — return the unwrapped Buffer (used by vault key
+  // derivation + backup KDF where the bytes feed directly into
+  // XChaCha20). Default produces a PHC-string-encoded password hash.
+  if (opts.raw === true) return raw;
+  return _phcEncode(salt, raw, params);
+}
+
+async function verify(stored, plain) {
+  var dec = _phcDecode(stored);
+  if (!dec) return false;
+  var message = Buffer.isBuffer(plain) ? plain : Buffer.from(String(plain), "utf8");
+  var actual;
+  try { actual = await _runArgon2(message, dec.salt, dec.params, dec.hash.length); }
+  catch (_e) { return false; }
+  return bCrypto.timingSafeEqual(actual, dec.hash);
+}
+
+function needsRehash(stored, opts) {
+  opts = opts || {};
+  var dec = _phcDecode(stored);
+  if (!dec) return true;
+  if (dec.version !== ARGON2_VERSION) return true;
+  var memoryCost  = opts.memoryCost  || C.BYTES.kib(64);                         // same defaults as hash()
+  var timeCost    = opts.timeCost    || 3;
+  var parallelism = opts.parallelism || 1;
+  if (dec.params.memoryCost  < memoryCost)  return true;
+  if (dec.params.timeCost    < timeCost)    return true;
+  if (dec.params.parallelism < parallelism) return true;
+  return false;
+}
+
+module.exports = {
+  argon2id:    ARGON2ID,
+  hash:        hash,
+  verify:      verify,
+  needsRehash: needsRehash,
+  // Test-only — let the test harness exercise the PHC encode/decode
+  // round trip without re-running actual hashing.
+  _phcEncode:  _phcEncode,
+  _phcDecode:  _phcDecode,
+};

package/lib/vendor/blamejs/lib/asn1-der.js

@@ -0,0 +1,424 @@
+"use strict";
+/**
+ * asn1-der — minimal ASN.1 DER walker for the framework's narrow
+ * cryptographic uses (OCSP response parsing, CT SCT extension parsing).
+ *
+ * The standard library does NOT ship an ASN.1 parser; we add a focused
+ * one rather than vendoring asn1.js (40+ KiB of JS for a small subset
+ * of features). The parser is presence-only: it reads tag + length +
+ * value and walks SEQUENCE / SET / context-specific structures. It
+ * does NOT decode arbitrary types — callers cherry-pick OIDs / INTEGER
+ * / OCTET STRING / BIT STRING / GeneralizedTime / UTCTime via the
+ * helpers below.
+ *
+ * Shape:
+ *
+ *   var node = readNode(buf);
+ *   // → { tag, tagClass, constructed, length, value, valueStart, totalLength }
+ *
+ *   var children = readSequence(buf);   // returns array of nodes
+ *   var oidStr   = readOid(buf, node);
+ *   var int      = readUnsignedInt(buf, node);
+ *   var bytes    = readOctetString(buf, node);
+ *
+ * Errors throw `Asn1Error` with a `code` (`asn1/short` / `asn1/bad-length`
+ * / `asn1/oid-malformed` / etc.) so callers can route on a stable shape.
+ */
+
+var { defineClass } = require("./framework-error");
+
+var Asn1Error = defineClass("Asn1Error", { alwaysPermanent: true });
+
+// ASN.1 tag classes per ITU-T X.690 §8.1.2.
+var TAG_CLASS = Object.freeze({
+  UNIVERSAL:        0,                                                          // allow:raw-byte-literal — ASN.1 tag class
+  APPLICATION:      1,                                                          // allow:raw-byte-literal — ASN.1 tag class
+  CONTEXT_SPECIFIC: 2,                                                          // allow:raw-byte-literal — ASN.1 tag class
+  PRIVATE:          3,                                                          // allow:raw-byte-literal — ASN.1 tag class
+});
+
+// Universal tag numbers used by the framework.
+var TAG = Object.freeze({
+  BOOLEAN:          0x01,
+  INTEGER:          0x02,
+  BIT_STRING:       0x03,
+  OCTET_STRING:     0x04,
+  NULL:             0x05,
+  OID:              0x06,
+  ENUMERATED:       0x0a,
+  UTF8_STRING:      0x0c,
+  PRINTABLE_STRING: 0x13,
+  IA5_STRING:       0x16,
+  UTC_TIME:         0x17,
+  GENERALIZED_TIME: 0x18,
+  SEQUENCE:         0x10,
+  SET:              0x11,
+});
+
+// Read a TLV (tag + length + value) starting at offset. Returns:
+//   { tag, tagClass, constructed, length, value, valueStart, totalLength }
+// where:
+//   tag         — numeric tag (universal-class numbers are 0x01..0x1e;
+//                 context-specific [N] tags surface as N with tagClass=2)
+//   constructed — true for SEQUENCE / SET / explicit tags; false for primitive
+//   value       — Buffer slice covering the value bytes
+//   totalLength — number of bytes consumed (header + value)
+function readNode(buf, offset) {
+  offset = offset || 0;
+  if (offset >= buf.length) {
+    throw new Asn1Error("asn1/short", "buffer ended at offset " + offset);
+  }
+
+  var b0 = buf[offset];
+  var tagClass   = (b0 >> 6) & 0x03;                                            // allow:raw-byte-literal — tag-class extraction
+  var constructed = (b0 & 0x20) !== 0;                                          // allow:raw-byte-literal — constructed bit
+  var tag         = b0 & 0x1f;                                                  // allow:raw-byte-literal — short-form tag
+
+  var headerLen = 1;
+  if (tag === 0x1f) {
+    // High-tag-number form (multi-byte tag). Walk continuation octets
+    // (each top bit set means another follows).
+    tag = 0;
+    while (true) {
+      if (offset + headerLen >= buf.length) {
+        throw new Asn1Error("asn1/short", "tag continuation truncated");
+      }
+      var byte = buf[offset + headerLen];
+      headerLen += 1;
+      tag = (tag << 7) | (byte & 0x7f);                                         // allow:raw-byte-literal — base-128 tag bits
+      if ((byte & 0x80) === 0) break;                                           // allow:raw-byte-literal — continuation bit
+    }
+  }
+
+  if (offset + headerLen >= buf.length) {
+    throw new Asn1Error("asn1/short", "length-byte missing");
+  }
+  var lenByte = buf[offset + headerLen];
+  headerLen += 1;
+  var length;
+  if ((lenByte & 0x80) === 0) {
+    // Short form — length is the byte itself.
+    length = lenByte;
+  } else {
+    // Long form — bottom 7 bits = number of length octets.
+    var lenOctets = lenByte & 0x7f;
+    if (lenOctets === 0) {
+      // Indefinite length — only valid in BER, not DER. Refuse.
+      throw new Asn1Error("asn1/indefinite-length",
+        "indefinite-length form is not allowed in DER");
+    }
+    if (lenOctets > 4) {                                                        // allow:raw-byte-literal — DER length cap (>4 GiB)
+      throw new Asn1Error("asn1/bad-length",
+        "length octets " + lenOctets + " exceeds 4 — refusing >4 GiB structure");
+    }
+    if (offset + headerLen + lenOctets > buf.length) {
+      throw new Asn1Error("asn1/short", "length octets truncated");
+    }
+    length = 0;
+    for (var i = 0; i < lenOctets; i += 1) {
+      length = (length * 256) + buf[offset + headerLen + i];                    // allow:raw-byte-literal — base-256 length bytes
+    }
+    headerLen += lenOctets;
+  }
+
+  var valueStart = offset + headerLen;
+  if (valueStart + length > buf.length) {
+    throw new Asn1Error("asn1/short",
+      "value extends past buffer: needs " + length + " bytes at " + valueStart);
+  }
+  return {
+    tag:         tag,
+    tagClass:    tagClass,
+    constructed: constructed,
+    length:      length,
+    value:       buf.slice(valueStart, valueStart + length),
+    raw:         buf.slice(offset, offset + headerLen + length),
+    valueStart:  valueStart,
+    totalLength: headerLen + length,
+  };
+}
+
+function readSequence(buf) {
+  // Walk the children of a SEQUENCE / SET. The buffer passed in IS
+  // the value of an outer node (already past the header).
+  var out = [];
+  var offset = 0;
+  while (offset < buf.length) {
+    var node = readNode(buf, offset);
+    out.push(node);
+    offset += node.totalLength;
+  }
+  return out;
+}
+
+// Decode an OBJECT IDENTIFIER (ITU-T X.690 §8.19) into dotted-decimal.
+function readOid(node) {
+  if (node.tag !== TAG.OID || node.tagClass !== TAG_CLASS.UNIVERSAL) {
+    throw new Asn1Error("asn1/wrong-tag",
+      "expected OID (tag 0x06), got " + node.tag);
+  }
+  var bytes = node.value;
+  if (bytes.length === 0) {
+    throw new Asn1Error("asn1/oid-empty", "OID value is empty");
+  }
+  // First two arcs are encoded as `40*X + Y`.
+  var first = Math.floor(bytes[0] / 40);                                        // allow:raw-byte-literal — OID encoding constant
+  var second = bytes[0] % 40;                                                   // allow:raw-byte-literal — OID encoding constant
+  // Per X.690, when first byte >= 80 the first arc is 2 and second is byte-80.
+  if (first > 2) { first = 2; second = bytes[0] - 80; }                         // allow:raw-byte-literal — OID encoding constant
+  var arcs = [String(first), String(second)];
+
+  var i = 1;
+  while (i < bytes.length) {
+    var arc = 0;
+    var j = i;
+    while (j < bytes.length) {
+      var b = bytes[j];
+      arc = (arc * 128) + (b & 0x7f);                                           // allow:raw-byte-literal — base-128 OID arc
+      j += 1;
+      if ((b & 0x80) === 0) break;                                              // allow:raw-byte-literal — continuation bit
+    }
+    if (j === i) {
+      throw new Asn1Error("asn1/oid-malformed", "OID arc never terminated");
+    }
+    arcs.push(String(arc));
+    i = j;
+  }
+  return arcs.join(".");
+}
+
+function readOctetString(node) {
+  if (node.tag !== TAG.OCTET_STRING || node.tagClass !== TAG_CLASS.UNIVERSAL) {
+    throw new Asn1Error("asn1/wrong-tag",
+      "expected OCTET STRING (tag 0x04), got " + node.tag);
+  }
+  return node.value;
+}
+
+function readUnsignedInt(node) {
+  if (node.tag !== TAG.INTEGER && node.tag !== TAG.ENUMERATED) {
+    throw new Asn1Error("asn1/wrong-tag",
+      "expected INTEGER/ENUMERATED, got " + node.tag);
+  }
+  // DER INTEGER may have a leading 0x00 byte to disambiguate from
+  // negative values when the high bit is set; strip it for unsigned
+  // interpretation.
+  var bytes = node.value;
+  if (bytes.length === 0) {
+    throw new Asn1Error("asn1/int-empty", "INTEGER value is empty");
+  }
+  if (bytes.length > 8) {                                                       // allow:raw-byte-literal — JS safe-int byte cap
+    // Caller wanted an unsigned int — for big serials they want the raw
+    // bytes instead. Surface as hex string so caller decides.
+    return { hex: bytes.toString("hex") };
+  }
+  var n = 0;
+  var start = (bytes[0] === 0 && bytes.length > 1) ? 1 : 0;                     // allow:raw-byte-literal — DER zero-pad
+  for (var k = start; k < bytes.length; k += 1) {
+    n = (n * 256) + bytes[k];                                                   // allow:raw-byte-literal — base-256 byte
+  }
+  return n;
+}
+
+function readBitString(node) {
+  if (node.tag !== TAG.BIT_STRING || node.tagClass !== TAG_CLASS.UNIVERSAL) {
+    throw new Asn1Error("asn1/wrong-tag",
+      "expected BIT STRING (tag 0x03), got " + node.tag);
+  }
+  // BIT STRING value: first byte is "unused bits in last byte" count;
+  // remaining bytes are the bit content. For signature blobs we want
+  // just the bytes — the unused count is always 0 for full-byte sigs.
+  if (node.value.length === 0) {
+    throw new Asn1Error("asn1/bit-string-empty", "BIT STRING is empty");
+  }
+  var unused = node.value[0];
+  if (unused !== 0) {
+    throw new Asn1Error("asn1/bit-string-unused-bits",
+      "BIT STRING with unused bits is unsupported (got " + unused + ")");
+  }
+  return node.value.slice(1);
+}
+
+// Read a context-specific [N] EXPLICIT-tagged child. Returns the
+// inner node (the tag inside the explicit wrapper).
+function unwrapExplicit(node, expectedTag) {
+  if (node.tagClass !== TAG_CLASS.CONTEXT_SPECIFIC || node.tag !== expectedTag) {
+    throw new Asn1Error("asn1/wrong-tag",
+      "expected context-specific [" + expectedTag + "], got class=" +
+      node.tagClass + " tag=" + node.tag);
+  }
+  return readNode(node.value, 0);
+}
+
+// ---- DER writers (minimal — just the shapes the framework needs) ----
+//
+// Encoders for the small ASN.1 set the framework currently constructs:
+// SEQUENCE / OCTET STRING / OID / INTEGER / NULL / context-specific
+// [N] EXPLICIT. Fewer than 100 lines because we only emit the DER that
+// crosses the wire (OCSP requests today; future TLSA encoding tomorrow).
+// All length fields use the standard X.690 short / long-form encoding.
+
+function _encodeLength(n) {
+  if (n < 128) return Buffer.from([n]);                                          // allow:raw-byte-literal — X.690 short-form length boundary
+  // Long-form: first byte is 0x80 | numLengthOctets, then the length
+  // big-endian.
+  var bytes = [];
+  while (n > 0) {
+    bytes.unshift(n & 0xff);                                                     // allow:raw-byte-literal — base-256 length encoding mask
+    n = n >>> 8;                                                                 // allow:raw-byte-literal — base-256 length encoding shift
+  }
+  return Buffer.concat([Buffer.from([0x80 | bytes.length]), Buffer.from(bytes)]);
+}
+
+function writeNode(tagByte, value) {
+  return Buffer.concat([Buffer.from([tagByte]), _encodeLength(value.length), value]);
+}
+
+function writeSequence(children) {
+  // children: Array<Buffer> of already-encoded child nodes.
+  return writeNode(TAG.SEQUENCE | 0x20, Buffer.concat(children));                // allow:raw-byte-literal — DER constructed bit
+}
+
+function writeOctetString(value) {
+  return writeNode(TAG.OCTET_STRING, value);
+}
+
+function writeNull() {
+  return writeNode(TAG.NULL, Buffer.alloc(0));
+}
+
+function writeInteger(buf) {
+  // INTEGER values are big-endian. If high bit of leading byte is set
+  // and the value is positive (cert serials always are here), prepend
+  // 0x00 to disambiguate from a negative two's complement.
+  if (buf.length === 0) return writeNode(TAG.INTEGER, Buffer.from([0]));
+  if (buf[0] & 0x80) {                                                           // allow:raw-byte-literal — sign-bit disambiguation
+    return writeNode(TAG.INTEGER, Buffer.concat([Buffer.from([0]), buf]));
+  }
+  return writeNode(TAG.INTEGER, buf);
+}
+
+function writeOid(dotted) {
+  // Encode dotted-decimal OID per X.690 §8.19.
+  var parts = String(dotted).split(".").map(function (s) { return parseInt(s, 10); });
+  if (parts.length < 2) {
+    throw new Asn1Error("asn1/oid-too-short", "OID needs at least 2 arcs");
+  }
+  var bytes = [parts[0] * 40 + parts[1]];                                        // allow:raw-byte-literal — OID first-arc encoding
+  for (var i = 2; i < parts.length; i += 1) {
+    var arc = parts[i];
+    if (arc === 0) { bytes.push(0); continue; }
+    var stack = [];
+    while (arc > 0) {
+      stack.unshift(arc & 0x7f);                                                 // allow:raw-byte-literal — base-128 mask
+      arc = arc >>> 7;                                                           // allow:raw-byte-literal — base-128 shift
+    }
+    for (var j = 0; j < stack.length - 1; j += 1) stack[j] |= 0x80;              // allow:raw-byte-literal — continuation bit
+    for (var k = 0; k < stack.length; k += 1) bytes.push(stack[k]);
+  }
+  return writeNode(TAG.OID, Buffer.from(bytes));
+}
+
+function writeContextExplicit(tagNumber, child) {
+  // [N] EXPLICIT — context-specific class (0xA0 | tag) + constructed.
+  var tagByte = 0xa0 | (tagNumber & 0x1f);                                       // allow:raw-byte-literal — context-specific constructed mask
+  return writeNode(tagByte, child);
+}
+
+function writeContextImplicit(tagNumber, value, opts) {
+  // [N] IMPLICIT — context-specific class with no constructed flag for
+  // primitives; opts.constructed=true sets the constructed bit for
+  // wrapping a structured value (e.g. IMPLICIT [0] OCTET STRING vs
+  // IMPLICIT [0] SEQUENCE OF). Value is the raw inner bytes (already
+  // encoded for constructed cases).
+  var tagByte = 0x80 | (tagNumber & 0x1f);                                       // allow:raw-byte-literal — context-specific primitive mask
+  if (opts && opts.constructed) tagByte |= 0x20;                                 // allow:raw-byte-literal — constructed bit
+  return writeNode(tagByte, value);
+}
+
+function writeBitString(value, unusedBits) {
+  // BIT STRING — first content byte is `unusedBits` (0..7), then the
+  // bit string bytes. `unusedBits` is 0 for byte-aligned content
+  // (RSA / ECDSA signatures, SubjectPublicKeyInfo bit strings).
+  var unused = typeof unusedBits === "number" ? (unusedBits & 0x07) : 0;         // allow:raw-byte-literal — 3-bit unused-bits count
+  return writeNode(TAG.BIT_STRING, Buffer.concat([Buffer.from([unused]), value]));
+}
+
+function writeSet(children) {
+  // children: Array<Buffer> of already-encoded child nodes.
+  // DER requires SET-OF children to be sorted by their encoded bytes.
+  var sorted = children.slice().sort(Buffer.compare);
+  return writeNode(TAG.SET | 0x20, Buffer.concat(sorted));                       // allow:raw-byte-literal — DER constructed bit
+}
+
+function writeUtf8String(s) {
+  if (typeof s !== "string") {
+    throw new Asn1Error("asn1/bad-utf8-input",
+      "writeUtf8String: input must be a string (got " + typeof s + ")");
+  }
+  return writeNode(TAG.UTF8_STRING, Buffer.from(s, "utf8"));
+}
+
+function writePrintableString(s) {
+  // PrintableString character set: A-Z a-z 0-9 ' ( ) + , - . / : = ? space
+  // Refuse non-printable input rather than silently encoding as latin1.
+  var str = String(s);
+  if (/[^A-Za-z0-9 '()+,\-./:=?]/.test(str)) {
+    throw new Asn1Error("asn1/bad-printable",
+      "writePrintableString: '" + str + "' contains characters outside the PrintableString set");
+  }
+  return writeNode(TAG.PRINTABLE_STRING, Buffer.from(str, "ascii"));
+}
+
+function writeIa5String(s) {
+  // IA5String is 7-bit ASCII. RFC 5280 §4.2.1.6 mandates IA5String for
+  // dNSName values inside the SubjectAltName extension.
+  var str = String(s);
+  /* eslint-disable-next-line no-control-regex */
+  if (/[^\x00-\x7f]/.test(str)) {
+    throw new Asn1Error("asn1/bad-ia5",
+      "writeIa5String: '" + str + "' contains non-ASCII characters");
+  }
+  return writeNode(TAG.IA5_STRING, Buffer.from(str, "ascii"));
+}
+
+function writeBoolean(b) {
+  return writeNode(TAG.BOOLEAN, Buffer.from([b ? 0xff : 0x00]));                 // allow:raw-byte-literal — DER true=0xff, false=0x00
+}
+
+// Find a child node of a SEQUENCE / SET by predicate. Returns null if
+// no child matches.
+function findChild(children, predicate) {
+  for (var i = 0; i < children.length; i += 1) {
+    if (predicate(children[i])) return children[i];
+  }
+  return null;
+}
+
+module.exports = {
+  TAG_CLASS:           TAG_CLASS,
+  TAG:                 TAG,
+  readNode:            readNode,
+  readSequence:        readSequence,
+  readOid:             readOid,
+  readOctetString:     readOctetString,
+  readUnsignedInt:     readUnsignedInt,
+  readBitString:       readBitString,
+  unwrapExplicit:      unwrapExplicit,
+  findChild:           findChild,
+  writeNode:           writeNode,
+  writeSequence:       writeSequence,
+  writeOctetString:    writeOctetString,
+  writeInteger:        writeInteger,
+  writeNull:           writeNull,
+  writeOid:            writeOid,
+  writeBitString:      writeBitString,
+  writeSet:            writeSet,
+  writeUtf8String:     writeUtf8String,
+  writePrintableString: writePrintableString,
+  writeIa5String:      writeIa5String,
+  writeBoolean:        writeBoolean,
+  writeContextExplicit: writeContextExplicit,
+  writeContextImplicit: writeContextImplicit,
+  Asn1Error:           Asn1Error,
+};