@blamejs/blamejs-shop 0.3.4 → 0.3.6

package/lib/vendor/blamejs/lib/network-tls.js

@@ -821,7 +821,7 @@ function _connectAndCheckOcsp(opts, requireStapled) {
 var OID_BASIC_OCSP_RESPONSE = "1.3.6.1.5.5.7.48.1.1";
 // OCSP nonce extension — id-pkix-ocsp-nonce.
 var OID_OCSP_NONCE          = "1.3.6.1.5.5.7.48.1.2";
-var OID_SHA1                = "1.3.14.3.2.26";                                   // allow:raw-byte-literal — SHA-1 algorithm OID arc
+var OID_SHA1                = "1.3.14.3.2.26";                                   // SHA-1 algorithm OID arc
 var OID_RSA_SHA256          = "1.2.840.113549.1.1.11";
 var OID_RSA_SHA384          = "1.2.840.113549.1.1.12";
 var OID_RSA_SHA512          = "1.2.840.113549.1.1.13";
@@ -834,21 +834,21 @@ function _parseTime(node) {
   // ("YYYYMMDDhhmmssZ") into ms-since-epoch.
   var s = node.value.toString("ascii");
   var year, month, day, hour, min, sec;
-  if (s.length === 13 && s.charAt(12) === "Z") {                                 // allow:raw-byte-literal — UTCTime length per X.690
+  if (s.length === 13 && s.charAt(12) === "Z") {                                 // UTCTime length per X.690
     // UTCTime YYMMDDhhmmssZ — 50+ → 19xx, else 20xx (RFC 5280 §4.1.2.5).
     year  = parseInt(s.slice(0, 2), 10);
-    year += year >= 50 ? 1900 : 2000;                                            // allow:raw-byte-literal allow:raw-time-literal — RFC 5280 century pivot, calendar years
+    year += year >= 50 ? 1900 : 2000;                                            // allow:raw-time-literal — RFC 5280 century pivot, calendar years
     month = parseInt(s.slice(2, 4), 10);
     day   = parseInt(s.slice(4, 6), 10);
-    hour  = parseInt(s.slice(6, 8), 10);                                         // allow:raw-byte-literal — UTCTime hour-byte offsets
-    min   = parseInt(s.slice(8, 10), 10);                                        // allow:raw-byte-literal — UTCTime minute-byte offsets
+    hour  = parseInt(s.slice(6, 8), 10);                                         // UTCTime hour-byte offsets
+    min   = parseInt(s.slice(8, 10), 10);                                        // UTCTime minute-byte offsets
     sec   = parseInt(s.slice(10, 12), 10);
-  } else if (s.length >= 15 && s.charAt(s.length - 1) === "Z") {                 // allow:raw-byte-literal — GeneralizedTime length per X.690
+  } else if (s.length >= 15 && s.charAt(s.length - 1) === "Z") {                 // GeneralizedTime length per X.690
     // GeneralizedTime YYYYMMDDhhmmssZ.
     year  = parseInt(s.slice(0, 4), 10);
     month = parseInt(s.slice(4, 6), 10);
-    day   = parseInt(s.slice(6, 8), 10);                                         // allow:raw-byte-literal — GeneralizedTime day-byte offsets
-    hour  = parseInt(s.slice(8, 10), 10);                                        // allow:raw-byte-literal — GeneralizedTime hour-byte offsets
+    day   = parseInt(s.slice(6, 8), 10);                                         // GeneralizedTime day-byte offsets
+    hour  = parseInt(s.slice(8, 10), 10);                                        // GeneralizedTime hour-byte offsets
     min   = parseInt(s.slice(10, 12), 10);
     sec   = parseInt(s.slice(12, 14), 10);
   } else {
@@ -913,7 +913,7 @@ function parseOcspResponse(der) {
       "BasicOCSPResponse is not a SEQUENCE");
   }
   var basicChildren = asn1.readSequence(basic.value);
-  if (basicChildren.length < 3) {                                                // allow:raw-byte-literal — minimum BasicOCSPResponse fields (tbs + alg + sig)
+  if (basicChildren.length < 3) {                                                // minimum BasicOCSPResponse fields (tbs + alg + sig)
     throw new TlsTrustError("tls/ocsp-bad-shape",
       "BasicOCSPResponse needs tbsResponseData + signatureAlgorithm + signature");
   }
@@ -994,7 +994,7 @@ function parseOcspResponse(der) {
   var responses = [];
   for (var sri = 0; sri < singleResponses.length; sri += 1) {
     var sr = asn1.readSequence(singleResponses[sri].value);
-    if (sr.length < 3) continue;                                                 // allow:raw-byte-literal — minimum SingleResponse fields
+    if (sr.length < 3) continue;                                                 // minimum SingleResponse fields
     // sr[0] = certID SEQUENCE, sr[1] = certStatus CHOICE, sr[2] = thisUpdate.
     var certIdChildren = asn1.readSequence(sr[0].value);
     // certID = SEQUENCE { hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber }
@@ -1232,12 +1232,12 @@ function _extractIssuerNameDerAndKeyBitString(certDer) {
   var idx = 0;
   if (tbsKids.length > 0 &&
       tbsKids[0].tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC &&
-      tbsKids[0].tag === 0) {                                                    // allow:raw-byte-literal — X.509 [0] EXPLICIT version tag
+      tbsKids[0].tag === 0) {                                                    // X.509 [0] EXPLICIT version tag
     idx = 1;
   }
   // After version: serialNumber, signature, issuer, validity, subject, SPKI.
-  var subjectIdx = idx + 4;                                                      // allow:raw-byte-literal — X.509 TBSCertificate field count
-  var spkiIdx = idx + 5;                                                         // allow:raw-byte-literal — X.509 TBSCertificate field count
+  var subjectIdx = idx + 4;                                                      // X.509 TBSCertificate field count
+  var spkiIdx = idx + 5;                                                         // X.509 TBSCertificate field count
   if (spkiIdx >= tbsKids.length) {
     throw new TlsTrustError("tls/ocsp-bad-issuer-cert", "issuer cert lacks SPKI field");
   }
@@ -1245,7 +1245,7 @@ function _extractIssuerNameDerAndKeyBitString(certDer) {
   var spki = tbsKids[spkiIdx];
   // Within SPKI: SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey BIT STRING }
   var spkiKids = asn1.readSequence(spki.value);
-  if (spkiKids.length < 2) {                                                     // allow:raw-byte-literal — minimum SPKI fields
+  if (spkiKids.length < 2) {                                                     // minimum SPKI fields
     throw new TlsTrustError("tls/ocsp-bad-issuer-cert", "SPKI missing subjectPublicKey BIT STRING");
   }
   var keyBytes = asn1.readBitString(spkiKids[1]);
@@ -1266,7 +1266,7 @@ function _extractLeafSerial(leafCertDer) {
   var idx = 0;
   if (tbsKids.length > 0 &&
       tbsKids[0].tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC &&
-      tbsKids[0].tag === 0) {                                                    // allow:raw-byte-literal — X.509 [0] EXPLICIT version tag
+      tbsKids[0].tag === 0) {                                                    // X.509 [0] EXPLICIT version tag
     idx = 1;
   }
   // serialNumber is the next field after the optional version.
@@ -1323,8 +1323,8 @@ function buildOcspRequest(opts) {
   // talking to a responder that ignores nonces opt out via nonce: false.
   var includeNonce = opts.nonce !== false;
   if (includeNonce) {
-    var nonceLen = typeof opts.nonceLen === "number" ? opts.nonceLen : 16;       // allow:raw-byte-literal — RFC 8954 §2.1 nonce length floor
-    if (nonceLen < 1 || nonceLen > 32) {                                         // allow:raw-byte-literal — RFC 8954 §2.1 nonce length ceiling
+    var nonceLen = typeof opts.nonceLen === "number" ? opts.nonceLen : 16;       // RFC 8954 §2.1 nonce length floor
+    if (nonceLen < 1 || nonceLen > 32) {                                         // RFC 8954 §2.1 nonce length ceiling
       throw new TlsTrustError("tls/ocsp-bad-nonce-len",
         "nonce length out of RFC 8954 range (1..32)");
     }
@@ -1548,7 +1548,7 @@ function _extractSctExtensionFromCert(certDer) {
   var extensionsNode = null;
   for (var i = 0; i < tbsChildren.length; i += 1) {
     var ch = tbsChildren[i];
-    if (ch.tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && ch.tag === 3) {       // allow:raw-byte-literal — X.509 [3] EXPLICIT extensions tag
+    if (ch.tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && ch.tag === 3) {       // X.509 [3] EXPLICIT extensions tag
       extensionsNode = asn1.readNode(ch.value, 0);
       break;
     }
@@ -1605,7 +1605,7 @@ function _extractTlsFeatureExtensionFromCert(certDer) {
   var extensionsNode = null;
   for (var i = 0; i < tbsChildren.length; i += 1) {
     var ch = tbsChildren[i];
-    if (ch.tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && ch.tag === 3) {       // allow:raw-byte-literal — X.509 [3] EXPLICIT extensions tag
+    if (ch.tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && ch.tag === 3) {       // X.509 [3] EXPLICIT extensions tag
       extensionsNode = asn1.readNode(ch.value, 0);
       break;
     }
@@ -1646,17 +1646,17 @@ function _extractTlsFeatureExtensionFromCert(certDer) {
 // Format: 2-byte length + concatenation of individual SCTs, each
 // itself prefixed by a 2-byte length.
 function _parseSctList(sctListRaw) {
-  if (!Buffer.isBuffer(sctListRaw) || sctListRaw.length < 2) {                   // allow:raw-byte-literal — outer 2-byte length prefix
+  if (!Buffer.isBuffer(sctListRaw) || sctListRaw.length < 2) {                   // outer 2-byte length prefix
     throw new TlsTrustError("tls/ct-bad-list",
       "SCT list shorter than the outer length prefix");
   }
   var totalLen = sctListRaw.readUInt16BE(0);
-  if (totalLen + 2 !== sctListRaw.length) {                                      // allow:raw-byte-literal — outer length prefix
+  if (totalLen + 2 !== sctListRaw.length) {                                      // outer length prefix
     throw new TlsTrustError("tls/ct-bad-list",
       "SCT list outer length " + totalLen + " does not match buffer " +
       (sctListRaw.length - 2));
   }
-  var pos = 2;                                                                   // allow:raw-byte-literal — past the outer prefix
+  var pos = 2;                                                                   // past the outer prefix
   var scts = [];
   while (pos < sctListRaw.length) {
     var sctLen = sctListRaw.readUInt16BE(pos);
@@ -1680,7 +1680,7 @@ function _parseSctList(sctListRaw) {
 //   ct_extensions        (2-byte len + N) — usually empty
 //   signature            DigitallySigned  (hash + sig algo + 2-byte len + N)
 function _parseSct(sctBuf) {
-  if (sctBuf.length < 1 + 32 + 8 + 2 + 4) {                                      // allow:raw-byte-literal — minimum SCT v1 byte total
+  if (sctBuf.length < 1 + 32 + 8 + 2 + 4) {                                      // minimum SCT v1 byte total
     throw new TlsTrustError("tls/ct-sct-too-short",
       "SCT is shorter than the minimum v1 layout (" + sctBuf.length + " bytes)");
   }
@@ -1689,21 +1689,21 @@ function _parseSct(sctBuf) {
     throw new TlsTrustError("tls/ct-sct-bad-version",
       "SCT version is not 0 (v1): got " + version);
   }
-  var logId = sctBuf.slice(1, 1 + 32);                                           // allow:raw-byte-literal — RFC 6962 32-byte LogID
-  var timestamp = Number(sctBuf.readBigUInt64BE(1 + 32));                        // allow:raw-byte-literal — past LogID
-  var extLen = sctBuf.readUInt16BE(1 + 32 + 8);                                  // allow:raw-byte-literal — past LogID + timestamp
-  var pos = 1 + 32 + 8 + 2;                                                      // allow:raw-byte-literal — past extLen field
+  var logId = sctBuf.slice(1, 1 + 32);                                           // RFC 6962 32-byte LogID
+  var timestamp = Number(sctBuf.readBigUInt64BE(1 + 32));                        // past LogID
+  var extLen = sctBuf.readUInt16BE(1 + 32 + 8);                                  // past LogID + timestamp
+  var pos = 1 + 32 + 8 + 2;                                                      // past extLen field
   var extensions = sctBuf.slice(pos, pos + extLen);
   pos += extLen;
-  if (pos + 4 > sctBuf.length) {                                                 // allow:raw-byte-literal — DigitallySigned header (hash + alg + len)
+  if (pos + 4 > sctBuf.length) {                                                 // DigitallySigned header (hash + alg + len)
     throw new TlsTrustError("tls/ct-sct-truncated",
       "SCT truncated before DigitallySigned");
   }
   var hashAlgo = sctBuf[pos];
   var sigAlgo  = sctBuf[pos + 1];
-  pos += 2;                                                                      // allow:raw-byte-literal — past hash+alg pair
+  pos += 2;                                                                      // past hash+alg pair
   var sigLen = sctBuf.readUInt16BE(pos);
-  pos += 2;                                                                      // allow:raw-byte-literal — past sig length
+  pos += 2;                                                                      // past sig length
   if (pos + sigLen !== sctBuf.length) {
     throw new TlsTrustError("tls/ct-sct-truncated",
       "SCT signature length " + sigLen + " does not match remaining bytes " +
@@ -1729,18 +1729,18 @@ function _parseSct(sctBuf) {
 //   signed_entry (3-byte length || ASN.1 cert without SCT extension) ||
 //   ct_extensions (2-byte length || N)
 function _buildSctSignedEntry(certWithoutSctDer, sct) {
-  var head = Buffer.alloc(1 + 1 + 8 + 2);                                        // allow:raw-byte-literal — fixed-shape header bytes
+  var head = Buffer.alloc(1 + 1 + 8 + 2);                                        // fixed-shape header bytes
   head[0] = sct.version;
   head[1] = 0;                                                                   // signature_type = certificate_timestamp
-  head.writeBigUInt64BE(BigInt(sct.timestamp), 2);                               // allow:raw-byte-literal — past version+sig-type
-  head.writeUInt16BE(0, 10);                                                     // allow:raw-byte-literal — entry_type = x509_entry (2 bytes; high byte = 0, low byte = 0)
+  head.writeBigUInt64BE(BigInt(sct.timestamp), 2);                               // past version+sig-type
+  head.writeUInt16BE(0, 10);                                                     // entry_type = x509_entry (2 bytes; high byte = 0, low byte = 0)
   // signed_entry: 3-byte length prefix + cert DER.
-  var lenBytes = Buffer.alloc(3);                                                // allow:raw-byte-literal — RFC 6962 24-bit length prefix
-  lenBytes[0] = (certWithoutSctDer.length >> 16) & 0xff;                         // allow:raw-byte-literal — base-256 length high byte
-  lenBytes[1] = (certWithoutSctDer.length >> 8) & 0xff;                          // allow:raw-byte-literal — base-256 length mid byte
-  lenBytes[2] = certWithoutSctDer.length & 0xff;                                 // allow:raw-byte-literal — base-256 length low byte
+  var lenBytes = Buffer.alloc(3);                                                // RFC 6962 24-bit length prefix
+  lenBytes[0] = (certWithoutSctDer.length >> 16) & 0xff;                         // base-256 length high byte
+  lenBytes[1] = (certWithoutSctDer.length >> 8) & 0xff;                          // base-256 length mid byte
+  lenBytes[2] = certWithoutSctDer.length & 0xff;                                 // base-256 length low byte
   // ct_extensions: 2-byte length + bytes.
-  var extHead = Buffer.alloc(2);                                                 // allow:raw-byte-literal — RFC 6962 2-byte ct_extensions length prefix
+  var extHead = Buffer.alloc(2);                                                 // RFC 6962 2-byte ct_extensions length prefix
   extHead.writeUInt16BE(sct.extensions.length, 0);
   return Buffer.concat([head, lenBytes, certWithoutSctDer, extHead, sct.extensions]);
 }
@@ -1781,7 +1781,7 @@ function _stripSctExtensionFromCert(certDer) {
   var foundExtensions = false;
   for (var i = 0; i < tbsChildren.length; i += 1) {
     var ch = tbsChildren[i];
-    if (ch.tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && ch.tag === 3) {       // allow:raw-byte-literal — [3] EXPLICIT extensions tag
+    if (ch.tagClass === asn1.TAG_CLASS.CONTEXT_SPECIFIC && ch.tag === 3) {       // [3] EXPLICIT extensions tag
       foundExtensions = true;
       // Inner SEQUENCE OF Extensions.
       var inner = asn1.readNode(ch.value, 0);
@@ -1797,11 +1797,8 @@ function _stripSctExtensionFromCert(certDer) {
             if (oid === OID_CT_SCT_LIST) continue;                               // drop the SCT extension
           } catch (_e) { /* not an OID — keep the extension as-is */ }
         }
-        // Re-encode this extension verbatim (we have the original bytes).
-        var origExt = certDer.slice(0, 0);                                       // placeholder; we rebuild from the parsed node below
-        void origExt;
+        // Re-encode this extension verbatim from its parsed bytes.
         keptExtBytes.push(_encodeAsn1(asn1.TAG.SEQUENCE, true, extBytes));
-        void extBytes;
       }
       var newExtSeq = _encodeAsn1(asn1.TAG.SEQUENCE, true, Buffer.concat(keptExtBytes));
       var newExplicit3 = _encodeContextExplicit(3, newExtSeq);
@@ -1828,22 +1825,22 @@ function _stripSctExtensionFromCert(certDer) {
 // SCT extension. Tag class is universal for SEQUENCE; constructed
 // flag wired explicitly.
 function _encodeLength(len) {
-  if (len < 0x80) return Buffer.from([len]);                                     // allow:raw-byte-literal — DER short-form length threshold
+  if (len < 0x80) return Buffer.from([len]);                                     // DER short-form length threshold
   var tmp = [];
   var n = len;
   while (n > 0) {
-    tmp.unshift(n & 0xff);                                                       // allow:raw-byte-literal — base-256 byte
-    n = n >>> 8;                                                                 // allow:raw-byte-literal — byte shift
+    tmp.unshift(n & 0xff);                                                       // base-256 byte
+    n = n >>> 8;                                                                 // byte shift
   }
-  return Buffer.concat([Buffer.from([0x80 | tmp.length]), Buffer.from(tmp)]);    // allow:raw-byte-literal — DER long-form length flag
+  return Buffer.concat([Buffer.from([0x80 | tmp.length]), Buffer.from(tmp)]);    // DER long-form length flag
 }
 function _encodeAsn1(tag, constructed, value) {
-  var tagByte = (constructed ? 0x20 : 0x00) | tag;                               // allow:raw-byte-literal — DER constructed bit + universal tag
+  var tagByte = (constructed ? 0x20 : 0x00) | tag;                               // DER constructed bit + universal tag
   return Buffer.concat([Buffer.from([tagByte]), _encodeLength(value.length), value]);
 }
 function _encodeContextExplicit(num, value) {
   // Context-specific class (10) + constructed (20) | tag.
-  var tagByte = 0xa0 | num;                                                      // allow:raw-byte-literal — DER context-specific + constructed
+  var tagByte = 0xa0 | num;                                                      // DER context-specific + constructed
   return Buffer.concat([Buffer.from([tagByte]), _encodeLength(value.length), value]);
 }
 function _encodeAsn1FromNode(node) {
@@ -1854,10 +1851,10 @@ function _encodeAsn1FromNode(node) {
   // restored directly. This works for the simple shapes we walk.
   var tagByte;
   if (node.tagClass === asn1.TAG_CLASS.UNIVERSAL) {
-    tagByte = (node.constructed ? 0x20 : 0x00) | (node.tag & 0x1f);              // allow:raw-byte-literal — DER constructed bit + universal tag
+    tagByte = (node.constructed ? 0x20 : 0x00) | (node.tag & 0x1f);              // DER constructed bit + universal tag
   } else {
-    var classBits = (node.tagClass & 0x03) << 6;                                 // allow:raw-byte-literal — DER tag-class bits
-    tagByte = classBits | (node.constructed ? 0x20 : 0x00) | (node.tag & 0x1f);  // allow:raw-byte-literal — DER constructed bit + low-tag
+    var classBits = (node.tagClass & 0x03) << 6;                                 // DER tag-class bits
+    tagByte = classBits | (node.constructed ? 0x20 : 0x00) | (node.tag & 0x1f);  // DER constructed bit + low-tag
   }
   return Buffer.concat([Buffer.from([tagByte]), _encodeLength(node.value.length), node.value]);
 }
@@ -1874,7 +1871,7 @@ function verifyScts(certDer, opts) {
       "verifyScts: certDer must be a Buffer");
   }
   var logKeys = opts.logKeys || {};
-  var minScts = typeof opts.minScts === "number" ? opts.minScts : 2;             // allow:raw-byte-literal — Chrome CT policy min-2-SCTs
+  var minScts = typeof opts.minScts === "number" ? opts.minScts : 2;             // Chrome CT policy min-2-SCTs
   var ext = _extractSctExtensionFromCert(certDer);
   if (!ext.sctListRaw) {
     return { ok: false, reason: "no-sct-extension", scts: [] };
@@ -1910,9 +1907,9 @@ function verifyScts(certDer, opts) {
         error: (e && e.message) || String(e) });
       continue;
     }
-    var nodeAlgo = sct.hashAlgo === 4 ? "sha256" :                               // allow:raw-byte-literal — TLS 1.2 HashAlgorithm enum sha256
-                   sct.hashAlgo === 5 ? "sha384" :                               // allow:raw-byte-literal — TLS 1.2 HashAlgorithm enum sha384
-                   sct.hashAlgo === 6 ? "sha512" :                               // allow:raw-byte-literal — TLS 1.2 HashAlgorithm enum sha512
+    var nodeAlgo = sct.hashAlgo === 4 ? "sha256" :                               // TLS 1.2 HashAlgorithm enum sha256
+                   sct.hashAlgo === 5 ? "sha384" :                               // TLS 1.2 HashAlgorithm enum sha384
+                   sct.hashAlgo === 6 ? "sha512" :                               // TLS 1.2 HashAlgorithm enum sha512
                    null;
     if (nodeAlgo === null) {
       perSctResults.push({ logIdHex: sct.logIdHex, verified: false,
@@ -1934,8 +1931,8 @@ function verifyScts(certDer, opts) {
     // under one algorithm against a key registered under another.
     var keyType = keyObj.asymmetricKeyType;
     var sctSigAlgo = sct.signatureAlgo;
-    var algoOk = (sctSigAlgo === 1 && keyType === "rsa") ||                       // allow:raw-byte-literal — TLS 1.2 SignatureAlgorithm rsa
-                 (sctSigAlgo === 3 && (keyType === "ec" || keyType === "ecdsa")); // allow:raw-byte-literal — TLS 1.2 SignatureAlgorithm ecdsa
+    var algoOk = (sctSigAlgo === 1 && keyType === "rsa") ||                       // TLS 1.2 SignatureAlgorithm rsa
+                 (sctSigAlgo === 3 && (keyType === "ec" || keyType === "ecdsa")); // TLS 1.2 SignatureAlgorithm ecdsa
     if (!algoOk) {
       perSctResults.push({ logIdHex: sct.logIdHex, verified: false,
         reason: "log-key-algo-mismatch",
@@ -2025,7 +2022,7 @@ function _ctLargestPowerOf2LessThan(n) {
 //   returns: Buffer (32 bytes) — computed root hash to compare
 //   throws:  TlsTrustError on shape errors
 function _ctVerifyInclusionPath(leafHash, leafIndex, treeSize, auditPath) {
-  if (!Buffer.isBuffer(leafHash) || leafHash.length !== 32) {                    // allow:raw-byte-literal — RFC 9162 SHA-256 digest length
+  if (!Buffer.isBuffer(leafHash) || leafHash.length !== 32) {                    // RFC 9162 SHA-256 digest length
     throw new TlsTrustError("tls/ct-bad-leaf-hash",
       "ct.verifyInclusion: leafHash must be a 32-byte Buffer");
   }
@@ -2056,7 +2053,7 @@ function _ctVerifyInclusionPath(leafHash, leafIndex, treeSize, auditPath) {
         "ct.verifyInclusion: audit path exhausted before tree root reached");
     }
     var sibling = auditPath[pathPos++];
-    if (!Buffer.isBuffer(sibling) || sibling.length !== 32) {                    // allow:raw-byte-literal — RFC 9162 SHA-256 digest length
+    if (!Buffer.isBuffer(sibling) || sibling.length !== 32) {                    // RFC 9162 SHA-256 digest length
       throw new TlsTrustError("tls/ct-bad-audit-path",
         "ct.verifyInclusion: audit path entry " + (pathPos - 1) + " is not a 32-byte Buffer");
     }
@@ -2092,7 +2089,7 @@ function _ctVerifyConsistencyPath(m, n, consistencyProof, firstHash) {
     throw new TlsTrustError("tls/ct-bad-second-size",
       "ct.verifyConsistency: n (second tree size) must be an integer >= m");
   }
-  if (!Buffer.isBuffer(firstHash) || firstHash.length !== 32) {                  // allow:raw-byte-literal — RFC 9162 SHA-256 digest length
+  if (!Buffer.isBuffer(firstHash) || firstHash.length !== 32) {                  // RFC 9162 SHA-256 digest length
     throw new TlsTrustError("tls/ct-bad-first-hash",
       "ct.verifyConsistency: firstHash must be a 32-byte Buffer");
   }
@@ -2127,7 +2124,7 @@ function _ctVerifyConsistencyPath(m, n, consistencyProof, firstHash) {
         "ct.verifyConsistency: consistency proof exhausted before second-tree root");
     }
     var sibling = path.shift();
-    if (!Buffer.isBuffer(sibling) || sibling.length !== 32) {                    // allow:raw-byte-literal — RFC 9162 SHA-256 digest length
+    if (!Buffer.isBuffer(sibling) || sibling.length !== 32) {                    // RFC 9162 SHA-256 digest length
       throw new TlsTrustError("tls/ct-bad-consistency-entry",
         "ct.verifyConsistency: consistency-proof entry is not a 32-byte Buffer");
     }
@@ -2249,13 +2246,13 @@ var ct = Object.freeze({
     if (typeof ts !== "number" && typeof ts !== "bigint") {
       return { valid: false, reason: "bad-sct-timestamp" };
     }
-    var tsBuf = Buffer.alloc(8);                                                 // allow:raw-byte-literal — TLS uint64 width
+    var tsBuf = Buffer.alloc(8);                                                 // TLS uint64 width
     var tsBig = typeof ts === "bigint" ? ts : BigInt(Math.floor(ts));
     tsBuf.writeBigUInt64BE(tsBig);
     var entryTypeBuf = Buffer.from([0x00, 0x00]);
-    var lenBuf = Buffer.alloc(3);                                                // allow:raw-byte-literal — TLS uint24 length prefix
+    var lenBuf = Buffer.alloc(3);                                                // TLS uint24 length prefix
     lenBuf.writeUIntBE(signedEntryDer.length, 0, 3);
-    var extensionsBuf = Buffer.from([0x00, 0x00]);                               // allow:raw-byte-literal — empty extensions vector
+    var extensionsBuf = Buffer.from([0x00, 0x00]);                               // empty extensions vector
     var leafBytes = Buffer.concat([
       Buffer.from([0x00]),                                                       // version v1
       Buffer.from([0x00]),                                                       // leaf_type timestamped_entry
@@ -2281,7 +2278,7 @@ var ct = Object.freeze({
       try { sthRoot = Buffer.from(sthRoot, "hex"); }
       catch (_e) { return { valid: false, reason: "bad-sth-root-encoding" }; }
     }
-    if (!Buffer.isBuffer(sthRoot) || sthRoot.length !== 32) {                    // allow:raw-byte-literal — RFC 9162 SHA-256 digest length
+    if (!Buffer.isBuffer(sthRoot) || sthRoot.length !== 32) {                    // RFC 9162 SHA-256 digest length
       return { valid: false, reason: "bad-sth-root" };
     }
     if (!bCrypto.timingSafeEqual(computedRoot, sthRoot)) {
@@ -2344,10 +2341,10 @@ var ct = Object.freeze({
       try { secondRoot = Buffer.from(secondRoot, "hex"); }
       catch (_e) { return { valid: false, reason: "bad-second-root-encoding" }; }
     }
-    if (!Buffer.isBuffer(firstRoot) || firstRoot.length !== 32) {                // allow:raw-byte-literal — RFC 9162 SHA-256 digest length
+    if (!Buffer.isBuffer(firstRoot) || firstRoot.length !== 32) {                // RFC 9162 SHA-256 digest length
       return { valid: false, reason: "bad-first-root" };
     }
-    if (!Buffer.isBuffer(secondRoot) || secondRoot.length !== 32) {              // allow:raw-byte-literal — RFC 9162 SHA-256 digest length
+    if (!Buffer.isBuffer(secondRoot) || secondRoot.length !== 32) {              // RFC 9162 SHA-256 digest length
       return { valid: false, reason: "bad-second-root" };
     }
     var computed;
@@ -2416,7 +2413,7 @@ var ct = Object.freeze({
 //                                        each (uint16 kdf_id, uint16
 //                                        aead_id) — 4 bytes apiece)
 
-var ECH_CONFIG_VERSION_DRAFT_22 = 0xfe0d;                                        // allow:raw-byte-literal — draft-ietf-tls-esni-22 ECH version codepoint
+var ECH_CONFIG_VERSION_DRAFT_22 = 0xfe0d;                                        // draft-ietf-tls-esni-22 ECH version codepoint
 
 function _echReadU8(buf, off) {
   if (off + 1 > buf.length) {
@@ -2426,7 +2423,7 @@ function _echReadU8(buf, off) {
   return buf[off];
 }
 function _echReadU16(buf, off) {
-  if (off + 2 > buf.length) {                                                    // allow:raw-byte-literal — uint16 width
+  if (off + 2 > buf.length) {                                                    // uint16 width
     throw new NetworkTlsError("tls/ech-config-malformed",
       "ECHConfigList: truncated reading uint16 at offset " + off);
   }
@@ -2434,7 +2431,7 @@ function _echReadU16(buf, off) {
 }
 function _echReadVarOpaqueU16(buf, off) {
   var len = _echReadU16(buf, off);
-  off += 2;                                                                      // allow:raw-byte-literal — uint16 length-prefix width
+  off += 2;                                                                      // uint16 length-prefix width
   if (off + len > buf.length) {
     throw new NetworkTlsError("tls/ech-config-malformed",
       "ECHConfigList: opaque vector overflows buffer (declared " + len +
@@ -2500,20 +2497,20 @@ function parseEchConfigList(raw) {
     throw new NetworkTlsError("tls/ech-config-malformed",
       "parseEchConfigList: input must be a non-empty Buffer or base64 string");
   }
-  if (raw.length < 2) {                                                          // allow:raw-byte-literal — uint16 outer length prefix
+  if (raw.length < 2) {                                                          // uint16 outer length prefix
     throw new NetworkTlsError("tls/ech-config-malformed",
       "ECHConfigList: too short for outer length prefix");
   }
   var totalLen = raw.readUInt16BE(0);
-  if (2 + totalLen !== raw.length) {                                             // allow:raw-byte-literal — uint16 prefix width
+  if (2 + totalLen !== raw.length) {                                             // uint16 prefix width
     throw new NetworkTlsError("tls/ech-config-malformed",
       "ECHConfigList: outer length " + totalLen + " does not match buffer " +
       "tail length " + (raw.length - 2));
   }
-  var off = 2;                                                                   // allow:raw-byte-literal — uint16 prefix width
+  var off = 2;                                                                   // uint16 prefix width
   var configs = [];
   while (off < raw.length) {
-    if (off + 4 > raw.length) {                                                  // allow:raw-byte-literal — uint16 ver + uint16 len
+    if (off + 4 > raw.length) {                                                  // uint16 ver + uint16 len
       throw new NetworkTlsError("tls/ech-config-malformed",
         "ECHConfig: truncated header at offset " + off);
     }
@@ -2530,19 +2527,19 @@ function parseEchConfigList(raw) {
       var p = bodyOff;
       // HpkeKeyConfig
       var configId = _echReadU8(raw, p); p += 1;
-      var kemId    = _echReadU16(raw, p); p += 2;                                // allow:raw-byte-literal — uint16 KEM id width
+      var kemId    = _echReadU16(raw, p); p += 2;                                // uint16 KEM id width
       var pkOpaque = _echReadVarOpaqueU16(raw, p); p = pkOpaque.nextOff;
-      var suitesLen = _echReadU16(raw, p); p += 2;                               // allow:raw-byte-literal — uint16 length prefix width
+      var suitesLen = _echReadU16(raw, p); p += 2;                               // uint16 length prefix width
       if (p + suitesLen > bodyEnd) {
         throw new NetworkTlsError("tls/ech-config-malformed",
           "ECHConfig: cipher_suites vector overflows config body");
       }
-      if (suitesLen % 4 !== 0 || suitesLen < 4) {                                // allow:raw-byte-literal — kdf+aead = 4 bytes per suite
+      if (suitesLen % 4 !== 0 || suitesLen < 4) {                                // kdf+aead = 4 bytes per suite
         throw new NetworkTlsError("tls/ech-config-malformed",
           "ECHConfig: cipher_suites length must be a positive multiple of 4");
       }
       var suites = [];
-      for (var sp = p; sp < p + suitesLen; sp += 4) {                            // allow:raw-byte-literal — 4-byte cipher suite stride
+      for (var sp = p; sp < p + suitesLen; sp += 4) {                            // 4-byte cipher suite stride
         suites.push({
           kdfId:  raw.readUInt16BE(sp),
           aeadId: raw.readUInt16BE(sp + 2),
@@ -2552,7 +2549,7 @@ function parseEchConfigList(raw) {
       // remainder of contents
       var maxNameLen = _echReadU8(raw, p); p += 1;
       var publicName = _echReadVarOpaqueU8(raw, p); p = publicName.nextOff;
-      var extLen = _echReadU16(raw, p); p += 2;                                  // allow:raw-byte-literal — uint16 length prefix width
+      var extLen = _echReadU16(raw, p); p += 2;                                  // uint16 length prefix width
       if (p + extLen !== bodyEnd) {
         throw new NetworkTlsError("tls/ech-config-malformed",
           "ECHConfig: extensions vector does not consume remaining body " +
@@ -2561,7 +2558,7 @@ function parseEchConfigList(raw) {
       var extensions = [];
       var extEnd = p + extLen;
       while (p < extEnd) {
-        var extType = _echReadU16(raw, p); p += 2;                               // allow:raw-byte-literal — uint16 ext type
+        var extType = _echReadU16(raw, p); p += 2;                               // uint16 ext type
         var extData = _echReadVarOpaqueU16(raw, p); p = extData.nextOff;
         extensions.push({ type: extType, data: extData.value });
       }
@@ -2685,9 +2682,9 @@ function connectWithEch(opts) {
     "network.tls.connectWithEch");
   validateOpts.requireNonEmptyString(opts.host, "connectWithEch: host",
     NetworkTlsError, "tls/ech-bad-opts");
-  var port = opts.port === undefined ? 443 : opts.port;                          // allow:raw-byte-literal — HTTPS default port
+  var port = opts.port === undefined ? 443 : opts.port;                          // HTTPS default port
   if (typeof port !== "number" || !isFinite(port) ||
-      port <= 0 || port > 65535 || Math.floor(port) !== port) {                  // allow:raw-byte-literal — TCP port range
+      port <= 0 || port > 65535 || Math.floor(port) !== port) {                  // TCP port range
     throw new NetworkTlsError("tls/ech-bad-opts",
       "connectWithEch: port must be an integer in 1..65535");
   }
@@ -2874,7 +2871,7 @@ function _normalizeAsciiHost(host) {
   if (typeof host !== "string" || host.length === 0) return null;
   for (var i = 0; i < host.length; i += 1) {
     var cc = host.charCodeAt(i);
-    if (cc > 0x7f) return null;                                                  // allow:raw-byte-literal — ASCII upper bound codepoint
+    if (cc > 0x7f) return null;                                                  // ASCII upper bound codepoint
   }
   // Strip a trailing dot (FQDN absolute form) for matching.
   var h = host.toLowerCase();
@@ -2975,17 +2972,17 @@ function _ipv6ToBytes(addr) {
     ];
   }
   var left = halves[0], right = halves[1];
-  var fillCount = 8 - (left.length + right.length);                              // allow:raw-byte-literal — IPv6 has 8 hextets
+  var fillCount = 8 - (left.length + right.length);                              // IPv6 has 8 hextets
   if (fillCount < 0) return null;
   var hextets = left.concat(new Array(fillCount).fill("0")).concat(right);
-  if (hextets.length !== 8) return null;                                         // allow:raw-byte-literal — IPv6 hextet count
-  var bytes = Buffer.alloc(16);                                                  // allow:raw-byte-literal — IPv6 = 16 bytes
-  for (var i = 0; i < 8; i += 1) {                                               // allow:raw-byte-literal — IPv6 hextet count
+  if (hextets.length !== 8) return null;                                         // IPv6 hextet count
+  var bytes = Buffer.alloc(16);                                                  // IPv6 = 16 bytes
+  for (var i = 0; i < 8; i += 1) {                                               // IPv6 hextet count
     var h = hextets[i];
     if (!safeBuffer.IPV6_HEXTET_RE.test(h)) return null;
-    var v = parseInt(h, 16);                                                     // allow:raw-byte-literal — hex radix
-    bytes[i * 2]     = (v >> 8) & 0xff;                                          // allow:raw-byte-literal — uint8 mask + uint16-half shift
-    bytes[i * 2 + 1] = v & 0xff;                                                 // allow:raw-byte-literal — uint8 mask
+    var v = parseInt(h, 16);                                                     // hex radix
+    bytes[i * 2]     = (v >> 8) & 0xff;                                          // uint8 mask + uint16-half shift
+    bytes[i * 2 + 1] = v & 0xff;                                                 // uint8 mask
   }
   return bytes;
 }
@@ -3066,9 +3063,13 @@ function checkServerIdentity9525(host, cert) {
   }
   var rawSan = cert.subjectaltname;
   if (typeof rawSan !== "string" || rawSan.length === 0) {
-    // RFC 9525 §6.4.4 forbids CN fallback. If there's no SAN we refuse,
-    // never inspect cert.subject.CN — a CN-only cert violates the
-    // modern PKIX baseline and the operator chose the strict checker.
+    // RFC 9525 §6.4.4 forbids CN fallback. A CN-only legacy cert (CN
+    // present, no SAN) surfaces the distinct `tls/pkix-cn-fallback-refused`
+    // code so audit logs can tell it apart from a cert carrying neither;
+    // a cert with no SAN and no CN falls through to `tls/pkix-san-required`.
+    // Both refuse — we never fall back to matching on the Common Name.
+    var cnRefusal = _refuseCnFallback(host, cert);
+    if (cnRefusal) return cnRefusal;
     return new NetworkTlsError("tls/pkix-san-required",
       "checkServerIdentity9525: certificate has no subjectAltName " +
       "extension (RFC 9525 §6.4.4 forbids Common Name fallback)");
@@ -3117,10 +3118,11 @@ function _refuseCnFallback(host, cert) {
   return null;
 }
 
-// Public combined verifier — applies both the SAN-required check and
-// the CN-fallback explicit refusal so operators get the more specific
-// of the two error codes when applicable. checkServerIdentity9525 is
-// the drop-in name; this internal helper is what `connect` wires in.
+// Explicit combined verifier kept for tests + callers that want the
+// CN-fallback / SAN-required split spelled out. The exported drop-in
+// `checkServerIdentity9525` already performs the CN-fallback refusal in
+// its no-SAN branch, so the `_refuseCnFallback` call here is a redundant
+// (idempotent) belt-and-suspenders; the more specific code wins either way.
 function _checkServerIdentityStrict(host, cert) {
   var cnRefusal = _refuseCnFallback(host, cert);
   if (cnRefusal) return cnRefusal;