@blamejs/pki 0.5.23 → 0.5.24

package/lib/guard-encoding.js

@@ -132,4 +132,6 @@ function hex(text, maxBytes, E, code, label) {
   return buf;
 }
 
-module.exports = { base64url: base64url, base64: base64, hex: hex };
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = _intrinsic.freeze({ base64url: base64url, base64: base64, hex: hex });

package/lib/guard-header.js

@@ -21,6 +21,7 @@ var C = require("./constants");
 // Taken at load. `byteLength` is what the RFC 5322 line limit is measured with, so a replacement
 // decides whether an over-long header line is refused. See guard-intrinsic for the whole set.
 var _byteLength = require("./guard-intrinsic").byteLength;
+var _freeze = require("./guard-intrinsic").freeze;
 // The character-code read the RFC 5322 ftext and CR/LF/NUL checks are built on. One that never
 // reports a control byte is a header-injection defense that inspects nothing.
 var _charCodeAt = require("./guard-intrinsic").uncurry(String.prototype.charCodeAt);
@@ -60,4 +61,6 @@ function assertField(name, value, E, code) {
   return v;
 }
 
-module.exports = { assertField: assertField };
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = _freeze({ assertField: assertField });

package/lib/guard-identifier.js

@@ -851,7 +851,9 @@ function _settle(opts, E, code, label) {
   return opts;
 }
 
-module.exports = {
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = intrinsic.freeze({
   assertCanonicalOid: assertCanonicalOid,
   assertKnownKeys: assertKnownKeys,
   optionsObject: optionsObject,
@@ -864,4 +866,4 @@ module.exports = {
   // Exported for the same reason as its sibling: a caller copying an array has to reach the
   // elements a read reaches, and the own keys are not that set.
   readableIndices: readableIndices
-};
+});

package/lib/guard-intrinsic.js

@@ -260,7 +260,12 @@ function sizeOf(value) {
     (value === null ? "null" : typeof value));
 }
 
-module.exports = {
+// Frozen, and that is what makes the capture worth taking. A consumer binds these at load, but it
+// also reads several of them as `intrinsic.<name>(...)` at the call itself, and the module registry
+// hands every caller this same object: assigning one property would redirect that call in every
+// module at once, which is the substitution the captures exist to refuse. Freezing costs nothing
+// here because nothing writes to it after load.
+module.exports = Object.freeze({
   uncurry: uncurry,
   getter: getter,
   sizeOf: sizeOf,
@@ -347,4 +352,4 @@ module.exports = {
   Set: _Set,
   Map: _Map,
   WeakMap: _WeakMap,
-};
+});

package/lib/guard-json.js

@@ -27,6 +27,7 @@ var text = require("./guard-text");
 // setter, and `fromCharCode` is how an escape becomes the character it names; a replacement for
 // either decides what this parser produces. See guard-intrinsic for the whole captured set.
 var _defineProperty = require("./guard-intrinsic").defineProperty;
+var _freeze = require("./guard-intrinsic").freeze;
 var _fromCharCode = require("./guard-intrinsic").fromCharCode;
 // The character-code read the whole scanner is built on: whitespace, escapes and the control-byte
 // reject all consult it, so one that lies decides what this parser sees in the input.
@@ -209,4 +210,6 @@ function parse(input, ErrorClass, spec) {
   return result;
 }
 
-module.exports = { parse: parse };
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = _freeze({ parse: parse });

package/lib/guard-limits.js

@@ -27,6 +27,7 @@ var constants = require("./constants");
 // one returning true admits a NaN or fractional cap, which makes the comparison it guards always
 // false. See guard-intrinsic for the whole captured set.
 var _isInteger = require("./guard-intrinsic").isInteger;
+var _freeze = require("./guard-intrinsic").freeze;
 // And the size measurement, for the same reason one step further in: a cap compares against a
 // length, and on a byte view `length` is a replaceable accessor. One reporting a small number for a
 // large buffer leaves every byteCap below always-false, which is the size defense silently dead.
@@ -137,4 +138,6 @@ function byteCap(buf, max, E, code, label) {
   return buf;
 }
 
-module.exports = { cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap };
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = _freeze({ cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap });

package/lib/guard-list.js

@@ -28,6 +28,8 @@
 // over `===` has nothing to replace, so it holds whatever the prototype says, in a module that has
 // been swept and in one that has not.
 
+var _freeze = require("./guard-intrinsic").freeze;
+
 // contains(list, value) -> boolean. Strict-equality membership, the `indexOf(v) !== -1` rule.
 // A null / undefined list is honestly empty, never a throw: these run on verdict paths.
 // @enforced-by behavioral -- `.indexOf(x) !== -1` has no rename-proof form that separates a
@@ -77,9 +79,11 @@ function allMatch(list, predicate) {
   return true;
 }
 
-module.exports = {
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = _freeze({
   contains: contains,
   containsAll: containsAll,
   anyMatches: anyMatches,
   allMatch: allMatch,
-};
+});

package/lib/guard-name.js

@@ -273,7 +273,7 @@ function emailEqual(a, b) {
   var aHost = _strSlice(a, ai + 1), bHost = _strSlice(b, bi + 1);
   if (!_asciiHost(aHost) || !_asciiHost(bHost)) return "not-comparable";
   if (aLocal !== bLocal) return "no-match";
-  return _lowerAscii(aHost) === _lowerAscii(bHost) ? "match" : "no-match";
+  return lowerAscii(aHost) === lowerAscii(bHost) ? "match" : "no-match";
 }
 
 // A host-part this comparison can decide: ASCII, and carrying no A-label. Anything else
@@ -292,11 +292,18 @@ function _asciiHost(h) {
   return true;
 }
 
+// lowerAscii(s) -> string
 // ASCII-only lowercase. String.toLowerCase() is Unicode-aware and would fold characters
-// outside ASCII (the Kelvin sign lowercases to "k"), which is precisely the mapping the
-// host-part rule does not authorize; _asciiHost has already excluded those inputs, so this
-// stays a plain A-Z shift rather than inheriting a locale-sensitive transform.
-function _lowerAscii(s) {
+// outside ASCII (the Kelvin sign lowercases to "k"), which is precisely the mapping a
+// name comparison does not authorize: a name folded that way is one the certificate or
+// message does not carry, and comparing it equal to a name that was asked for is the
+// defect. Every case-insensitive name comparison in the toolkit -- a host part, a CMP
+// domain, an ACME identifier set -- folds through this one definition, so none of them can
+// disagree about which characters case-fold.
+//
+// @enforced-by guard-shape-reinlined
+// @guard-shape 0x41\s*&&\s*[A-Za-z_$][\w$]*\s*<=\s*0x5[aA]\s*\)\s*\?[^:]*\+\s*(?:32|0x20)\s*\)
+function lowerAscii(s) {
   var out = "";
   for (var i = 0; i < s.length; i++) {
     var c = _charCodeAt(s, i);
@@ -305,8 +312,11 @@ function _lowerAscii(s) {
   return out;
 }
 
-module.exports = {
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = intrinsic.freeze({
   assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5,
   dnEqual: dnEqual, rdnEqual: rdnEqual, emailEqual: emailEqual,
   escapeControlBytes: escapeControlBytes, escapeDnValue: escapeDnValue,
-};
+  lowerAscii: lowerAscii,
+});

package/lib/guard-parsed.js

@@ -44,6 +44,7 @@ var time = require("./guard-time");
 // one answering `false` makes each of those checks reject a well-formed parsed structure -- the
 // fail-closed direction, and still a caller deciding what this guard recognizes.
 var _isArray = require("./guard-intrinsic").isArray;
+var _freezeExports = require("./guard-intrinsic").freeze;
 // The copy that becomes the recorded provenance bytes. A replacement returning a buffer over the
 // caller's own memory would let those bytes change after they were recorded, which is the one
 // thing provenance exists to prevent.
@@ -598,10 +599,12 @@ function acceptDerived(input, kind, parse, E, code, label) {
     ".parse result: " + _WHY[kind]);
 }
 
-module.exports = {
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = _freezeExports({
   accept: accept, acceptDerived: acceptDerived,
   fromTrustedSource: fromTrustedSource, recordingParser: recordingParser,
   recordingWalker: recordingWalker,
   isCert: certShape, isCrl: crlShape, isRecorded: isRecorded,
   isRecordedAsProduced: isRecordedAsProduced,
-};
+});

package/lib/guard-range.js

@@ -25,6 +25,7 @@
 // Number at all, so one answering true for an unsafe magnitude reopens the precision loss this
 // guard exists to prevent. See guard-intrinsic for the whole captured set.
 var _isSafeInteger = require("./guard-intrinsic").isSafeInteger;
+var _freeze = require("./guard-intrinsic").freeze;
 // The narrow itself. This module exists to turn a bounded BigInt into a Number without losing the
 // bound, and `Number` is a writable property of globalThis, so a replacement returns whatever it
 // likes from a value this function has just certified as in range.
@@ -131,7 +132,9 @@ function authoredInteger(value, E, code, label) {
   throw E(code, label + " must be an integer (a safe-integer number, or a bigint for a large value)");
 }
 
-module.exports = {
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = _freeze({
   int: int, uint31: uint31, positiveInt31: positiveInt31, uint64: uint64,
   authoredInteger: authoredInteger,
-};
+});

package/lib/guard-secret.js

@@ -138,4 +138,6 @@ function cipherFinish(transform, input, ErrorClass, code, label) {
   }
 }
 
-module.exports = { zeroize: zeroize, zeroizeAll: zeroizeAll, cipherFinish: cipherFinish };
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = intrinsic.freeze({ zeroize: zeroize, zeroizeAll: zeroizeAll, cipherFinish: cipherFinish });

package/lib/guard-text.js

@@ -99,4 +99,6 @@ function decode(input, maxBytes, ErrorClass, spec) {
   throw new ErrorClass(spec.badInput, spec.label + " expects a string or Buffer");
 }
 
-module.exports = { decode: decode };
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = intrinsic.freeze({ decode: decode });

package/lib/guard-time.js

@@ -32,6 +32,7 @@
 // the global `isNaN` is writable, and one returning false makes an invalid Date pass the check
 // below, which is the fail-open direction.
 var util = { types: require("./guard-intrinsic").types };
+var _freeze = require("./guard-intrinsic").freeze;
 var _isNaN = Number.isNaN;
 
 // assertValid(value, E, code, label) -> the same Date, once proven valid.
@@ -130,9 +131,11 @@ function isDate(value) {
   return util.types.isDate(value);
 }
 
-module.exports = {
+// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
+// call, so a writable export would let a caller replace the check rather than pass it.
+module.exports = _freeze({
   assertValid: assertValid,
   instantOf: instantOf,
   isDate: isDate,
   within: within,
-};
+});