@blamejs/pki 0.5.7 → 0.5.9

package/lib/webauthn-mds.js

@@ -13,7 +13,7 @@
 // The ordering is the load-bearing part: the signature and its certificate chain are established
 // against a CALLER-supplied FIDO root before a single byte of the payload is read, so a hostile
 // BLOB never reaches the JSON reader, the entry walk, or any per-entry certificate decode. No
-// root is bundled and there is no trust-on-first-use -- an operator supplies the anchor, exactly
+// root is bundled and there is no trust-on-first-use: an operator supplies the anchor, exactly
 // as pki.trust does for a root store. Retrieval is out of scope: the BLOB is caller-supplied
 // bytes, so this module never touches a socket.
 //
@@ -73,14 +73,14 @@ function _schemeE(kind, message, cause) { return new WebauthnError("webauthn/" +
 // question "which algorithms does this toolkit accept for a JWS?" has exactly one answer, and a
 // row added there reaches here without anybody remembering to copy it.
 //
-// The derivation is TOTAL over the registry -- every algorithm pki.jose verifies gets a row, and an
+// The derivation is total over the registry: every algorithm pki.jose verifies gets a row, and an
 // X.509 SubjectPublicKeyInfo can carry a key of every type in it. EC becomes ECDSA over the curve
 // the alg fixes; RSA with a salt length becomes RSASSA-PSS (RFC 7518 sec. 3.5) and without one
 // RSASSA-PKCS1-v1_5; OKP becomes EdDSA, whose curve the certificate supplies because the algorithm
 // does not name one; AKP becomes the ML-DSA parameter set the algorithm itself fixes.
 //
 // A row's import and verify parameters may therefore depend on the LEAF as well as the alg, which
-// is why they are resolved per-verification rather than frozen into the row: EdDSA over an Ed25519
+// is why they are resolved per-verification and never frozen into the row: EdDSA over an Ed25519
 // certificate and EdDSA over an Ed448 certificate are the same JWS algorithm and two different
 // WebCrypto algorithms.
 //
@@ -129,7 +129,7 @@ var DISQUALIFYING = Object.assign(Object.create(null), {
 // The statuses whose optional `certificate` field NARROWS the report to the certificate it names
 // (MDS v3.0 sec. 3.1.3). Only a compromised attestation key is about one certificate; every other
 // disqualifying status is about the model, and a certificate attached to one of those is a
-// nonconforming field rather than a narrower scope.
+// nonconforming field, not a narrower scope.
 var CERT_SCOPED_STATUS = Object.assign(Object.create(null), { ATTESTATION_KEY_COMPROMISE: 1 });
 
 var _BLOB_OPTS = Object.assign(Object.create(null), {
@@ -141,7 +141,7 @@ function _isPlainObject(v) { return !!v && typeof v === "object" && !Array.isArr
 
 // The results this module actually produced. Membership is the PROVENANCE check: a metadata object
 // is only allowed to decide trust if verifyMetadataBlob made it. Recognising it by shape instead
-// would accept anything carrying the right property names -- including a catalogue deserialized
+// would accept anything carrying the right property names, including a catalogue deserialized
 // from a cache, where nothing establishes that the signature and chain were ever checked, and an
 // attacker who can write that cache chooses which roots an authenticator is allowed to chain to.
 // A WeakSet keys on object IDENTITY, which no serialization survives, so a round-tripped catalogue
@@ -173,9 +173,9 @@ function _deepFreeze(v, depth) {
   return v;
 }
 var AAGUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-// "This authenticator declares no model identity" -- the AAGUID a U2F authenticator carries, since
+// "This authenticator declares no model identity": the AAGUID a U2F authenticator carries, since
 // U2F has no such concept. It is a sentinel, never a lookup key, and lives in one place so the
-// lookup and the dispatch that decides WHICH key space applies cannot disagree about it.
+// lookup and the dispatch that decides which key space applies cannot disagree about it.
 var ZERO_AAGUID = "00000000-0000-0000-0000-000000000000";
 // The JWS header parameters this reader understands (RFC 7515 sec. 4.1). Used only to tell a
 // standard name from an extension name when checking `crit`.
@@ -196,7 +196,7 @@ function _assertLeafSigns(leaf) {
 }
 
 // Is this certificate the anchor itself? RFC 5280 sec. 6.1.1 defines a trust anchor as a name and a
-// public key, so that pair -- not the issuer field, and not the certificate's bytes -- is what
+// public key, so that pair (not the issuer field, and not the certificate's bytes) is what
 // decides. The DN comparison is the canonical one, so two spellings of one name still match.
 function _isAnchorItself(cert, anchor) {
   return guard.name.dnEqual(cert.subject.rdns, anchor.subject.rdns, _err, "webauthn/bad-att-cert", "the anchor subject") &&
@@ -205,8 +205,8 @@ function _isAnchorItself(cert, anchor) {
 
 // A parsed anchor certificate, whichever shape the caller supplied it in.
 //
-// An already-parsed certificate is taken as-is rather than re-encoded and re-parsed, but the
-// recognition test names every field the anchor is later READ for -- the subject name, the public
+// An already-parsed certificate is taken as-is, never re-encoded and re-parsed, but the
+// recognition test names every field the anchor is later read for: the subject name, the public
 // key bytes, and the signature algorithm OID. Recognising an object on a looser test lets something
 // that is merely certificate-SHAPED through: a parsed CSR satisfies "has a subject and an SPKI", and
 // a hand-built object literal satisfies it too and then raises a raw TypeError from deep inside the
@@ -214,7 +214,7 @@ function _isAnchorItself(cert, anchor) {
 function _asCert(v, label) {
   // Through the shared certificate door: these become the anchors a metadata BLOB's signer chain is
   // judged against, and an anchor's identity is its subject and its key. A caller-assembled object
-  // could carry a real root's subject beside a substituted key -- every field well-formed, nothing
+  // could carry a real root's subject beside a substituted key, every field well-formed, nothing
   // for a shape test to catch -- so the object is re-derived from the bytes its parser read instead.
   // Bytes in any form (a Buffer, a typed-array view, a DataView, an ArrayBuffer) are parsed here;
   // refusing one of those would make the accepted set depend on how the caller received the file.
@@ -225,7 +225,7 @@ function _asCert(v, label) {
 }
 
 // Verify a FIDO Metadata Service BLOB and return its entries indexed for lookup. `blob` is the
-// BLOB as caller-supplied bytes or a string -- this module never fetches it. The signature is
+// BLOB as caller-supplied bytes or a string; this module never fetches it. The signature is
 // checked under the certificate in the BLOB's own header, that chain is validated to one of
 // `opts.rootCertificates`, and only then is the payload parsed: a BLOB that does not verify never
 // reaches the JSON reader. `no` must exceed a supplied `previousNo` (the rollback check) and
@@ -267,14 +267,14 @@ function _verifyMetadataBlob(blob, opts) {
   }
   var anchors = roots.map(function (r, i) { return _asCert(r, "opts.rootCertificates[" + i + "]"); });
 
-  // Cap BEFORE the copy, not after it. Measuring the CONVERTED buffer would mean an oversized input
-  // is fully materialized in order to discover it should have been refused -- the allocation the
+  // Cap before the copy, not after it. Measuring the converted buffer would mean an oversized input
+  // is fully materialized in order to discover it should have been refused, which is the allocation the
   // ceiling exists to prevent, performed on the way to reporting that it was too large. A string's
   // length is its character count and a BLOB is ASCII base64url + dots, so it bounds the byte count.
   // A byte input is re-viewed through the shared guard, which is where the detached-backing-buffer
-  // case is handled once, rather than re-derived here.
+  // case is handled once and never re-derived here.
   // Every byte form, not only the two a Buffer-shaped API thinks of. A BLOB is retrieved over the
-  // network, and the ordinary way to hold a fetched body is an ArrayBuffer -- so the form an
+  // network, and the ordinary way to hold a fetched body is an ArrayBuffer, so the form an
   // operator most naturally arrives with was the one form this refused. `byteLength` is declared by
   // an ArrayBuffer and by every view over one, so the ceiling below still bites before any copy.
   var raw = (ArrayBuffer.isView(blob) || blob instanceof ArrayBuffer)
@@ -282,7 +282,7 @@ function _verifyMetadataBlob(blob, opts) {
   // A string's `.length` counts UTF-16 code units, not the UTF-8 bytes the conversion produces, so
   // measuring it would let a string of multi-byte characters sit under the ceiling and then expand
   // several-fold past it during the copy -- the allocation the ceiling exists to prevent.
-  // Buffer.byteLength computes the encoded size WITHOUT producing the buffer, so the bound still
+  // Buffer.byteLength computes the encoded size without producing the buffer, so the bound still
   // bites before anything is materialized. (A conforming BLOB is base64url and dots, hence ASCII,
   // where the two counts agree; a non-ASCII one is not a JWS at all and is refused on size or on
   // shape immediately after.)
@@ -308,17 +308,17 @@ function _verifyMetadataBlob(blob, opts) {
   }
   // The signature is bounded on the same principle and for the same reason: it is read before
   // anything is authenticated, and every algorithm here has a tightly bounded signature size, so a
-  // segment consuming the whole envelope allowance is not a signature -- it is a request to
+  // segment consuming the whole envelope allowance is not a signature; it is a request to
   // allocate megabytes and hand them to the verifier without possessing any key.
   if (segs[2].length > Math.ceil(C.MDS_BLOB_SIG_MAX_BYTES / 3) * 4) {
     throw _err("webauthn/too-large", "the metadata BLOB signature is above the " + C.MDS_BLOB_SIG_MAX_BYTES + "-byte ceiling");
   }
   var header, sig;
   try {
-    // The header goes through the SAME bounded reader as the payload -- a duplicate `alg` or `x5c`
+    // The header goes through the same bounded reader as the payload: a duplicate `alg` or `x5c`
     // must not be resolvable to whichever copy a permissive parser happens to keep.
     header = guard.json.parse(Buffer.from(jose.base64url.decode(segs[0])), _err, {
-      // The header is read BEFORE anything is authenticated, so its ceiling is the header's own,
+      // The header is read before anything is authenticated, so its ceiling is the header's own,
       // not the whole BLOB's: a JWS protected header is a few hundred bytes, and giving this reader
       // the 32 MiB envelope cap would let unauthenticated bytes buy an unbounded multiple of that
       // in heap ahead of the signature check. The payload's reader keeps the envelope cap, which is
@@ -346,7 +346,7 @@ function _verifyMetadataBlob(blob, opts) {
   // and a JWS naming one this implementation does not is invalid. Ignoring it is the same fault as
   // ignoring x5u, one parameter over: the producer said "refuse this unless you handle it" and a
   // reader that skips the list accepts a token on terms it never met. Nothing here processes an
-  // extension parameter, so any name is unprocessed -- including a standard name, which sec. 4.1.11
+  // extension parameter, so any name is unprocessed, including a standard name, which sec. 4.1.11
   // forbids listing at all.
   if (Object.prototype.hasOwnProperty.call(header, "crit")) {
     var crit = header.crit;
@@ -404,13 +404,13 @@ function _verifyMetadataBlob(blob, opts) {
     }
   }
 
-  // An Edwards leaf key is validated on-curve and full-order BEFORE it is imported. The identity
+  // An Edwards leaf key is validated on-curve and full-order before it is imported. The identity
   // point and the other low-order points are accepted by the platform and verify a trivial
   // signature over ANY message, so a leaf carrying one authenticates whatever payload it is shown.
   // Chaining to the caller's FIDO root is not protection here: the point is malformed, not
   // unissued, and the certificate that carries it can be perfectly well signed. This is the same
-  // gate every other Edwards key in the toolkit passes -- the attestation path, CMS, the path
-  // validator, sigstore, JOSE -- and a new verification route skipping it is how one key type comes
+  // gate every other Edwards key in the toolkit passes (the attestation path, CMS, the path
+  // validator, sigstore, JOSE), and a new verification route skipping it is how one key type comes
   // to be checked everywhere except the newest door.
   if (leafAlg === "Ed25519" || leafAlg === "Ed448") {
     edwardsPoint.validateSpki(leaf.subjectPublicKeyInfo.bytes, leafAlg === "Ed25519" ? 6 : 7,
@@ -421,7 +421,7 @@ function _verifyMetadataBlob(blob, opts) {
   return webcrypto.webcrypto.subtle.importKey("spki", leaf.subjectPublicKeyInfo.bytes, params.imp, false, ["verify"])
     .then(function (key) {
       // The VERIFY is wrapped as well as the import. A rejection handler attached to the import
-      // alone leaves anything the verify itself rejects with -- a certificate whose RSASSA-PSS
+      // alone leaves anything the verify itself rejects with, such as a certificate whose RSASSA-PSS
       // parameters demand a longer salt than the algorithm supplies imports cleanly and then fails
       // inside OpenSSL -- to escape as a raw platform Error, out of a verb whose whole contract is
       // that every failure is a typed webauthn/* verdict.
@@ -433,7 +433,7 @@ function _verifyMetadataBlob(blob, opts) {
       return _chainToAnchor(chain, anchors, at);
     })
     .then(function () {
-      // ONLY NOW is the payload read. Everything above establishes that these bytes came from the
+      // Only now is the payload read. Everything above establishes that these bytes came from the
       // holder of a key the caller anchored; parsing before that would expose the JSON reader, the
       // entry walk and every per-entry decode to bytes nobody vouched for.
       return _parsePayload(segs[1], at, opts);
@@ -442,11 +442,11 @@ function _verifyMetadataBlob(blob, opts) {
 
 // The x5c chain must validate to one of the caller's anchors. Every anchor is tried because an
 // operator may hold several across a rotation; the last path verdict is threaded as the cause so a
-// caller can see WHY it did not chain rather than only that it did not.
+// caller can see why it did not chain, and not merely that it did not.
 //
 // `what` and `code` name the caller's subject and its own refusal code, so every chain in the
 // namespace -- the BLOB's, an attestation's, an android-safetynet service chain -- reaches its
-// anchors through THIS walk while keeping the verdict its own callers already handle. A second copy
+// anchors through this same walk while keeping the verdict its own callers already handle. A second copy
 // of the walk is not merely duplication: the anchor-stripping rule is subtle (a terminal
 // certificate that IS the anchor is identified by subject name AND public key, which is what
 // recognises a cross-signed root), and a copy that got it slightly differently would refuse a valid
@@ -459,18 +459,18 @@ function _chainToAnchor(chain, anchors, at, what, code) {
   return anchors.reduce(function (p, anchor) {
     return p.then(function (done) {
       if (done) return true;
-      // A terminal certificate that IS the anchor is the anchor, not a path element -- validating it
+      // A terminal certificate that is the anchor is the anchor, not a path element, so validating it
       // against itself would be a different assertion from the one being made. What identifies it is
       // the trust-anchor identity the validator itself uses: the SUBJECT NAME and the PUBLIC KEY. A
       // self-issued test instead of a key comparison misses the cross-signed form of the same root,
-      // which carries that identity but was signed by a cross-signing CA -- so it would be left in
+      // which carries that identity but was signed by a cross-signing CA, so it would be left in
       // the path and then fail to verify under the anchor that never issued it, refusing an
       // otherwise valid chain. Matching on name AND key cannot be looser: two certificates naming
       // one subject with one key ARE the same entity for anchoring, whoever signed them.
       var path = ordered.slice();
       var strippedAnchor = false;
       if (path.length && _isAnchorItself(path[0], anchor)) { path = path.slice(1); strippedAnchor = true; }
-      // Nothing left to validate. The two ways of getting here are NOT the same, and the difference
+      // Nothing left to validate. The two ways of getting here are not the same, and the difference
       // is the whole verdict. If the anchor itself was the entire chain, then the signature was
       // verified under the anchor's own key -- the identity was established by name AND key, so
       // there is nothing further to chain and it is trusted. If the path was empty for any other
@@ -479,7 +479,7 @@ function _chainToAnchor(chain, anchors, at, what, code) {
       if (path.length === 0) return strippedAnchor;
       return pathValidate.validate(path, {
         time: at,
-        // The anchor tuple names the anchor's own KEY -- its SubjectPublicKeyInfo algorithm and that
+        // The anchor tuple names the anchor's own key: its SubjectPublicKeyInfo algorithm and that
         // algorithm's parameters -- not the algorithm its issuer used to sign it. The validator
         // carries these forward as the working public key, and a certificate below the anchor may
         // inherit its key parameters from them (the DSA-style parameter-inheritance case), so
@@ -497,8 +497,8 @@ function _chainToAnchor(chain, anchors, at, what, code) {
 }
 
 // The instant a catalogue stops being current. `nextUpdate` is a DATE, so the BLOB is current
-// through the END of that UTC day. One home, because the rule is applied twice -- once when the
-// BLOB is verified, and again whenever a verified result is USED -- and two copies would drift.
+// through the end of that UTC day. One home, because the rule is applied twice (once when the
+// BLOB is verified, and again whenever a verified result is used) and two copies would drift.
 function _staleAfter(nextUpdate) {
   var d = rfc3339.parseDate(nextUpdate, function (c, m) { return _err("webauthn/bad-metadata-blob", m); },
     "webauthn/bad-metadata-blob", "the metadata BLOB nextUpdate");
@@ -506,11 +506,11 @@ function _staleAfter(nextUpdate) {
 }
 
 // A verified result is a plain object the caller may hold for as long as it likes, so its freshness
-// has to be re-established every time it DECIDES something -- not only when it was parsed. A
+// has to be re-established every time it decides something, not only when it was parsed. A
 // catalogue fetched before its nextUpdate and reused a month later would otherwise keep authorizing
 // an authenticator whose status reports have since revoked it, which is precisely what nextUpdate
 // exists to prevent. The caller's original allowStale decision is carried on the result and honoured
-// here, so opting out stays opted out rather than silently reappearing at the point of use.
+// here, so opting out stays opted out and never silently reappears at the point of use.
 function assertFresh(metadata, at, label) {
   if (!metadata || metadata.allowStale === true || typeof metadata.nextUpdate !== "string") return;
   var atMs = at instanceof Date ? at.getTime() : NaN;
@@ -542,7 +542,7 @@ function _parsePayload(seg, at, opts) {
   if (typeof payload.legalHeader !== "string") throw _err("webauthn/bad-metadata-blob", "the metadata BLOB payload must carry a string legalHeader");
   if (!Number.isSafeInteger(payload.no) || payload.no < 0) throw _err("webauthn/bad-metadata-blob", "the metadata BLOB payload must carry a non-negative integer no");
   // Rollback: a BLOB older than the one already held would reinstate authenticators whose trust was
-  // withdrawn since, so it is refused rather than merely reported.
+  // withdrawn since, so it is refused, not merely reported.
   if (opts.previousNo !== undefined && payload.no <= opts.previousNo) {
     throw _err("webauthn/metadata-rollback", "the metadata BLOB no " + payload.no + " does not exceed the previously held " + opts.previousNo);
   }
@@ -553,7 +553,7 @@ function _parsePayload(seg, at, opts) {
   //
   // Unreachable as the code stands, and kept deliberately. Both operands are already gated by
   // throwing guards -- `at` by guard.time.assertValid at the entry, `staleAfter` by
-  // rfc3339.parseDate above, which refuses a date that does not exist rather than rolling it over --
+  // rfc3339.parseDate above, which refuses a date that does not exist and never rolls it over,
   // so no caller input reaches here non-finite. It stays because the cost is one comparison and the
   // failure it catches is silent: if either gate is ever relaxed or moved, this is what keeps a NaN
   // from being read as fresh instead of stale.
@@ -585,7 +585,7 @@ function _parsePayload(seg, at, opts) {
         " status reports, above the " + C.MDS_MAX_STATUS_REPORTS_PER_ENTRY + " ceiling");
     }
     // sec. 3.1.3 makes `status` REQUIRED on every report. A report that is not an object, or that
-    // omits it, is refused HERE rather than skipped by the status gate: the gate reads a missing
+    // omits it, is refused here and never skipped by the status gate: the gate reads a missing
     // status as "nothing disqualifying", so a malformed report would be silently read as a clean
     // bill of health for the authenticator whose status it was supposed to carry.
     e.statusReports.forEach(function (r, ri) {
@@ -628,7 +628,7 @@ function _parsePayload(seg, at, opts) {
           // A SHA-1 key identifier is 40 hex digits (RFC 5280 sec. 4.2.1.2 method 1). Anything else
           // cannot be what a certificate hashes to, so accepting it would add a key that never
           // matches -- an entry that silently cannot be found. sec. 3.1.1 requires lower case; the
-          // value is canonicalized rather than refused, so a catalogue that differs only in letter
+          // value is canonicalized, not refused, so a catalogue that differs only in letter
           // case still resolves instead of denying service for every authenticator it lists.
           if (typeof k !== "string" || !/^[0-9a-fA-F]{40}$/.test(k)) {
             throw _err("webauthn/bad-metadata-blob", "metadata entry " + i + " has a malformed attestation certificate key identifier");
@@ -636,14 +636,14 @@ function _parsePayload(seg, at, opts) {
           var lower = k.toLowerCase();
           // The entry and its statement legitimately repeat an identifier; that is one entry naming
           // itself twice, not two entries claiming one authenticator, so it is deduplicated here
-          // rather than reaching the cross-entry duplicate check below.
+          // and never reaches the cross-entry duplicate check below.
           if (!seenKeyId[lower]) { seenKeyId[lower] = 1; keyIds.push(lower); }
         });
       });
     var out = { index: i, aaguid: aaguid, keyIdentifiers: keyIds, statusReports: e.statusReports,
       metadataStatement: st || null, timeOfLastStatusChange: e.timeOfLastStatusChange || null };
     if (aaguid) {
-      // A duplicate identifier is refused rather than resolved by position: two entries claiming
+      // A duplicate identifier is refused, never resolved by position: two entries claiming
       // one authenticator give the lookup a choice the specification does not define.
       if (byAaguid[aaguid]) throw _err("webauthn/duplicate-metadata-entry", "two metadata entries claim aaguid " + aaguid);
       byAaguid[aaguid] = out;
@@ -656,21 +656,21 @@ function _parsePayload(seg, at, opts) {
   });
   // The rollback rule leaves a trace, exactly as the freshness rule does either side of it. It runs
   // only when a caller supplies the sequence number it already holds, so a result that does not say
-  // whether it ran cannot be told apart from one where the check was skipped -- and the whole point
+  // whether it ran cannot be told apart from one where the check was skipped, and the whole point
   // of the rule is that a caller can show its catalogue never went backwards. `previousNo` is the
-  // baseline it was compared against, so the claim is auditable rather than merely asserted.
+  // baseline it was compared against, so the claim is auditable, not merely asserted.
   var result = { no: payload.no, legalHeader: payload.legalHeader, nextUpdate: payload.nextUpdate,
     stale: stale, allowStale: opts.allowStale === true,
     rollbackChecked: opts.previousNo !== undefined,
     previousNo: opts.previousNo === undefined ? null : opts.previousNo,
     entries: entries, byAaguid: byAaguid, byKeyIdentifier: byKeyIdentifier,
     statusPolicy: opts.statusPolicy || "any", rejectUnknownStatus: opts.rejectUnknownStatus === true };
-  // Frozen FIRST, then recorded as verified: the mark means "this exact catalogue passed the
+  // Frozen first, then recorded as verified: the mark means "this exact catalogue passed the
   // signature, chain, rollback and freshness gates", and that claim only holds if the object cannot
   // be edited afterwards. This is the only place a catalogue can have been through those gates.
   _deepFreeze(result, 0);
   _verifiedResults.add(result);
-  // Recorded AFTER the freeze, alongside the provenance mark and for the same reason: an entry may
+  // Recorded after the freeze, alongside the provenance mark and for the same reason: an entry may
   // only be judged against the catalogue it was read out of.
   entries.forEach(function (e) { _entryOrigin.set(e, result); });
   return result;
@@ -679,10 +679,10 @@ function _parsePayload(seg, at, opts) {
 // The verified metadata entry for an AAGUID, or `null` when the BLOB lists none. `metadata` is a
 // `verifyMetadataBlob` result -- never raw bytes, so a lookup cannot be answered from an
 // unverified BLOB. The all-zero AAGUID means "no model identity" and never matches.
-// It also accepts the identifier a U2F authenticator is keyed by instead -- the key identifier of
+// It also accepts the identifier a U2F authenticator is keyed by instead: the key identifier of
 // its attestation certificate -- so one verb covers both of the catalogue's key spaces. The two are
 // disjoint by shape (a dashed 36-character UUID against 40 hex digits), so the form is DISPATCHED
-// ON, never guessed at: anything matching neither is a miss rather than a lookup in whichever table
+// on, never guessed at: anything matching neither is a miss, not a lookup in whichever table
 // happens to answer.
 function metadataFor(metadata, identifier) {
   if (!isVerifiedResult(metadata)) throw _err("webauthn/bad-input", "metadataFor expects a verifyMetadataBlob result -- an object that merely resembles one, such as a catalogue restored from a cache, has not been through the signature and chain checks");
@@ -701,7 +701,7 @@ function metadataFor(metadata, identifier) {
 var _ANCHOR_OPTS = Object.assign(Object.create(null), { metadata: 1, time: 1, certificate: 1 });
 
 // The attestation root certificates an entry's authenticator chains to, decoded on demand. Decoding
-// is deliberately per entry rather than for the whole BLOB: a handful of the certificates in the
+// is deliberately per entry, and not for the whole BLOB: a handful of the certificates in the
 // live metadata do not parse under a strict decoder, and decoding everything up front would let one
 // vendor's malformed root refuse the entire BLOB for every authenticator in it.
 function metadataAnchors(entry, opts) {
@@ -709,7 +709,7 @@ function metadataAnchors(entry, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Array.isArray(opts)) throw _err("webauthn/bad-input", "metadataAnchors opts must be an object");
   guard.identifier.assertKnownKeys(opts, _ANCHOR_OPTS, _err, "webauthn/bad-input", "metadataAnchors opts has an unknown key ");
-  // ONE read of the caller's object: the status gate below decides on these values, and a value
+  // One read of the caller's object: the status gate below decides on these values, and a value
   // read twice is a value that can differ between the check and the use.
   opts = Object.assign({}, opts);
   if (opts.time !== undefined) guard.time.assertValid(opts.time, _err, "webauthn/bad-input", "opts.time");
@@ -738,7 +738,7 @@ function metadataAnchors(entry, opts) {
   // Judged with the same inputs the attestation path uses, so the two readings cannot diverge: the
   // caller's own statusPolicy when the verified result is supplied, the instant being judged, and
   // the attestation certificate actually presented (so a report naming a single certificate is
-  // judged against that one rather than denying every device the entry covers). With none of them,
+  // judged against that one, so the entry does not deny every device it covers). With none of them,
   // the strictest reading applies -- any disqualifying report, judged now.
   var at = opts.time === undefined ? new Date() : opts.time;
   if (opts.metadata !== undefined) assertFresh(opts.metadata, at, "metadataAnchors");
@@ -761,11 +761,11 @@ function metadataAnchors(entry, opts) {
 
 // Does this entry's status deny trust? Default: ANY disqualifying report denies, wherever it sits
 // in the array. The array is not stated to be chronological, `effectiveDate` is optional, and in
-// the live metadata a number of entries are not in date order -- one of them flipping its verdict
+// the live metadata a number of entries are not in date order, and one of them flipping its verdict
 // between "last element" and "newest by date", in the direction that matters. A caller who wants
 // the by-date reading asks for it.
 // A status report may name the single certificate it concerns (MDS v3.0 sec. 3.1.3 `certificate`),
-// and a key-compromise report that does so is about THAT attestation key -- not about every
+// and a key-compromise report that does so is about that one attestation key, not about every
 // authenticator the entry covers. A whole batch is often listed under one entry, so ignoring the
 // scoping would refuse registrations from devices whose key was never compromised. A report that
 // names nothing applies to the entry as a whole, and a report whose named certificate cannot be
@@ -788,7 +788,7 @@ function _reportInForceAt(report, atMs) {
   var d = rfc3339.parseDate(report.effectiveDate, function (c, m) { return _err("webauthn/bad-metadata-blob", m); },
     "webauthn/bad-metadata-blob", "a status report effectiveDate");
   // Only ever called with a report whose effectiveDate rfc3339.isValidDate already accepted, and
-  // parseDate throws rather than returning an Invalid Date, so d is finite; atMs was isFinite-
+  // parseDate throws and never returns an Invalid Date, so d is finite; atMs was isFinite-
   // checked by the caller before this runs.
   // allow:nan-date-comparison-unguarded -- both operands are source-validated, as described above.
   return d.getTime() <= atMs;
@@ -805,17 +805,17 @@ function statusDenied(entry, metadata, leaf, at) {
   // For the built-in policies, reports that demonstrably concern a DIFFERENT certificate are removed
   // first, before recency is considered. Scope has to be settled before recency, or under
   // latest-by-date such a report could be selected as the newest, displace an older model-wide
-  // revocation, and then be discarded as inapplicable -- clearing the entry using a report that was
+  // revocation, and then be discarded as inapplicable, clearing the entry using a report that was
   // never about this authenticator at all.
   reports = reports.filter(function (r) {
     return !(r && typeof r.status === "string" && CERT_SCOPED_STATUS[r.status] && _reportNamesOtherCert(r, leaf));
   });
-  // A report dated AFTER the instant being judged has not taken effect, whatever the policy. This
-  // belongs here rather than inside one policy's branch: under the default reading, a scheduled
-  // revocation would otherwise deny every registration from the moment it is published rather than
+  // A report dated after the instant being judged has not taken effect, whatever the policy. This
+  // belongs here, not inside one policy's branch: under the default reading, a scheduled
+  // revocation would otherwise deny every registration from the moment it is published instead of
   // from the date it names, and a deliberately historical verification would see reports filed
   // after the time it asks about. When every dated report is still in the future, the answer is
-  // that none of them is in force -- not that all of them are.
+  // that none of them is in force, not that all of them are.
   var isDated = function (r) { return r && typeof r.effectiveDate === "string" && rfc3339.isValidDate(r.effectiveDate); };
   var atMs = (at instanceof Date && isFinite(at.getTime())) ? at.getTime() : null;
   if (atMs !== null) {
@@ -825,14 +825,14 @@ function statusDenied(entry, metadata, leaf, at) {
   if (policy === "latest-by-date") {
     var dated = reports.filter(isDated);
     if (dated.length) {
-      // EVERY report on the newest date, not the first one found there. Reducing to a single report
+      // Every report on the newest date, not the first one found there. Reducing to a single report
       // makes a tie resolve by array position: a same-day clean report and a same-day REVOKED would
       // deny or not depending purely on which the catalogue happened to list first, and reversing
       // the array would flip the verdict. Reports that are equally recent are equally current, so a
       // disqualifying one among them cannot be discarded.
       var newest = dated.reduce(function (a, b) { return a.effectiveDate >= b.effectiveDate ? a : b; }).effectiveDate;
       // effectiveDate is OPTIONAL (sec. 3.1.3), and a report without one cannot be shown to be
-      // older than anything -- so it is KEPT rather than dropped. Discarding it would let an entry
+      // older than anything, so it is kept and never dropped. Discarding it would let an entry
       // clear an undated REVOKED simply by adding a dated clean report, which is the fail-open this
       // policy is most likely to be reached for. Where the ordering cannot be established, the
       // report still counts.
@@ -875,12 +875,12 @@ function aaguidToString(buf) {
 // match nothing in the catalogue and silently turn every U2F lookup into a miss.
 //
 // This is the same value pki-build's spkiKeyId derives for the subjectKeyIdentifier extension, from
-// the DER rather than from a parsed certificate. Two derivations of one definition can drift, and a
+// the DER, and not from a parsed certificate. Two derivations of one definition can drift, and a
 // drift here is silent -- every U2F lookup simply stops matching -- so a vector pins the value
-// against a real certificate's OWN subjectKeyIdentifier extension, which is the independent oracle
+// against a real certificate's own subjectKeyIdentifier extension, which is the independent oracle
 // for method 1 and fails the moment either derivation changes.
 //
-// The algorithm is not a choice: SHA-1 is what the standard names, this is an IDENTIFIER rather than
+// The algorithm is not a choice: SHA-1 is what the standard names, and this is an identifier, not
 // a signature or an integrity check, and the identity it labels is re-established by the certificate
 // chain validation that follows. Choosing a stronger hash would produce a value the catalogue does
 // not contain.
@@ -891,13 +891,13 @@ function certKeyIdentifier(cert) {
   }
   // Collision resistance is not the property relied on here: a second key hashing to the same
   // identifier would resolve to the same catalogue entry, and its certificate would then still have
-  // to validate to the roots THAT entry registers -- which is the check that actually grants trust.
+  // to validate to the roots that same entry registers, which is the check that actually grants trust.
   // nosemgrep: pki-weak-hash-md5-sha1
   return nodeCrypto.createHash("sha1").update(pk.bytes).digest("hex");
 }
 
 // The verified metadata entry registering an attestation-certificate key identifier, or null. This
-// is the lookup for an authenticator with no AAGUID -- the U2F case -- and it takes a
+// is the lookup for an authenticator with no AAGUID (the U2F case) and it takes a
 // verifyMetadataBlob result for the same reason metadataFor does: an unverified catalogue must not
 // be able to answer which roots an authenticator is allowed to chain to.
 function metadataForKeyIdentifier(metadata, keyId) {