@blamejs/pki 0.6.13 → 0.6.15

package/lib/guard-intrinsic.js

@@ -1,78 +1,25 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) blamejs contributors
 "use strict";
-//
-// @internal -- no operator-facing namespace. The documented surface is every guard that composes
-// this one, which is every guard that performs its work with a captured intrinsic: guard-bytes
-// (the byte-source door), guard-time (the evaluation instant), guard-name (distinguished-name
-// identity), guard-text (the byte-to-string decode), guard-secret (the wipe).
-//
-// guard-intrinsic -- invoke a captured method against a receiver without reading any property of
-// the captured function.
-//
-// Capturing a method at module load closes half of the hole. `var _fill =
-// Uint8Array.prototype.fill` freezes which function the guard will run, so a later
-// `Uint8Array.prototype.fill = noop` changes nothing. Then `_fill.call(view, 0)` reads `call` off
-// that function object, and the object is the one still sitting on the prototype where any caller
-// can reach it. Assigning `Uint8Array.prototype.fill.call = function () {}` installs an own
-// property that shadows `Function.prototype.call`, and the guard runs the caller's function with
-// the same result the un-captured code had. The wipe clears nothing. A distinguished name compares
-// equal to an unrelated one. A decode returns a string the caller chose. Every check around it
-// still runs and still passes.
-//
-// The uncurried form performs no property read at the call site. `_fill(view, 0)` invokes a
-// function object no caller holds a reference to, so nothing on it is left to poison. The binding
-// happens here, at load, while `Function.prototype.call` and `.bind` are still the language's own.
-//
-// The scope of the defense is replacement that happens after this module loads. Code running
-// before it is already inside the trust boundary and can reach further than any single method, so
-// there is no defense here to add for that case. What capture-then-uncurry buys is that a caller
-// who receives control later, through an option accessor or while a verb is suspended on an await,
-// cannot change what a guard does.
+// @internal
 
 var _utilTypes = require("util").types;
 
 var _call = Function.prototype.call;
 var _bind = Function.prototype.bind;
-// The invocation primitive `uncurry` itself is built out of. Binding as `_bind.call(_call, fn)`
-// would read `call` off the captured bind function, which is the very shape this module exists to
-// remove -- and `uncurry` is exported, so it can run long after load, while another guard
-// initializes. `Reflect.apply` is invoked directly, so no property of it is consulted either.
 var _reflectApply = Reflect.apply;
 
-// isArray -- the array test, snapshotted for the same reason as the predicates below. It decides
-// whether a value is walked as a list at all, so one answering `false` makes an index scan report
-// nothing and every rule keyed on what that scan found silently applies to nothing.
 var _isArray = Array.isArray;
 
-// The Buffer constructors, snapshotted for the same reason. `Buffer.from` is a writable property
-// of the `Buffer` global and it is how this toolkit turns a backing store into something it can
-// read or clear; one returning a buffer over DIFFERENT memory hands every later step a decoy, so a
-// wipe zeroes the decoy while the plaintext it was aimed at stays readable.
 var _bufferFrom = Buffer.from;
 var _bufferAlloc = Buffer.alloc;
 var _bufferConcat = Buffer.concat;
 var _bufferIsBuffer = Buffer.isBuffer;
 var _bufferByteLength = Buffer.byteLength;
 var _bufferCompare = Buffer.compare;
-// `Buffer.prototype.equals` is the byte-identity test a binding decides on: an OCSP CertID says the
-// response is about this issuer, a responder ID says this key signed it. Dispatched live, one
-// answering true makes a response about a DIFFERENT certificate match the one being asked about.
 var _bufferEquals = uncurry(Buffer.prototype.equals);
-// Buffer#toString, uncurried at load. Used to build dedup keys (a hex string) from bytes the toolkit
-// owns; dispatched live, a replaced toString could make two distinct values key alike or one value key
-// differently on two reads, so a dedup over untrusted-adjacent bytes would merge or split wrongly.
 var _bufferToString = uncurry(Buffer.prototype.toString);
 
-// The rest of what a guard reads from the runtime while it is deciding something. These are
-// grouped here rather than captured file by file so the set is enumerable in one place and a guard
-// added later inherits it: a reader asking "what can a caller still reach" has one list to read.
-//
-// The reflective operations are the load-bearing ones. `getOwnPropertyDescriptor` is how the
-// identifier guard learns whether a field is an accessor, `getPrototypeOf` and `ownKeys` are how it
-// walks a chain honestly, and `isView` is how the byte guard recognizes the shape whose backing
-// store it must refuse when shared. A replacement for any of them answers the question the guard
-// asked on the caller's behalf.
 var _isView = ArrayBuffer.isView;
 var _isInteger = Number.isInteger;
 var _isSafeInteger = Number.isSafeInteger;
@@ -93,24 +40,11 @@ var _mathFloor = Math.floor;
 var _mathCeil = Math.ceil;
 var _mathMin = Math.min;
 var _mathMax = Math.max;
-// A numeric parse a bound is then compared against: one answering a larger value widens the bound
-// the comparison was written to enforce.
 var _parseInt = parseInt;
 var _promiseResolve = Promise.resolve;
 var _promiseReject = Promise.reject;
-// The well-known async-iteration symbol, captured at load. `for await` uses this symbol at the
-// language level regardless of the global `Symbol` object, so a classifier that reads
-// `Symbol.asyncIterator` live would disagree with the loop the moment a co-resident replaced the
-// writable `Symbol` global: a real async iterable would be looked up under the wrong key, judged not
-// iterable, and refused where the engine would have consumed it. Reading the captured symbol keeps
-// the door's answer and the loop's behavior the same.
 var _asyncIterator = Symbol.asyncIterator;
 
-// The array operations, uncurried at load. These run on arrays the TOOLKIT owns -- an `ownKeys`
-// result, a local accumulator -- so the receiver is never a caller's object; what is caller-
-// reachable is `Array.prototype` itself. A `forEach` replaced with a no-op makes a scan over
-// perfectly real keys report nothing, and a check keyed on what that scan found then passes
-// vacuously, which is the same fail-open shape as an index test that answers `false`.
 var _arrForEach = uncurry(Array.prototype.forEach);
 var _arrMap = uncurry(Array.prototype.map);
 var _arrFilter = uncurry(Array.prototype.filter);
@@ -123,10 +57,6 @@ var _arrSlice = uncurry(Array.prototype.slice);
 var _arrJoin = uncurry(Array.prototype.join);
 var _arrPush = uncurry(Array.prototype.push);
 
-// The string and byte-view operations a decision is then made on. A `toUpperCase` or `toLowerCase`
-// replaced after load changes which registry row an algorithm name resolves to; a `subarray`
-// returning a different window hands the next step bytes from somewhere else in the same buffer;
-// and a radix conversion is how a key's own numbers are read back before they are compared.
 var _strToUpperCase = uncurry(String.prototype.toUpperCase);
 var _strToLowerCase = uncurry(String.prototype.toLowerCase);
 var _strIndexOf = uncurry(String.prototype.indexOf);
@@ -135,11 +65,6 @@ var _abSlice = uncurry(ArrayBuffer.prototype.slice);
 var _numToString = uncurry(Number.prototype.toString);
 var _bigIntToString = uncurry(BigInt.prototype.toString);
 
-// The collection operations, uncurried. A guard's cycle-safe chain walk is a `Set` it owns, and
-// `has` is what stops it: one answering `true` ends the walk at the first prototype, so a scan that
-// should have found an accessor two levels up reports nothing and the rule keyed on it passes. The
-// registry lookups are the same shape from the other side -- a `get` that answers for a key never
-// stored hands a guard a member list for an object it has never seen.
 var _setAdd = uncurry(Set.prototype.add);
 var _setHas = uncurry(Set.prototype.has);
 var _mapGet = uncurry(Map.prototype.get);
@@ -149,32 +74,17 @@ var _weakGet = uncurry(WeakMap.prototype.get);
 var _weakSet = uncurry(WeakMap.prototype.set);
 var _weakHas = uncurry(WeakMap.prototype.has);
 var _taSet = uncurry(Uint8Array.prototype.set);
-// Own-membership, which is how this toolkit asks whether a key is really in a table rather than
-// inherited from a prototype somebody extended. Spelled `Object.prototype.hasOwnProperty.call(t, k)`
-// it reads two replaceable properties to answer one question, and either of them answering yes puts
-// a name into an allowlist that never contained it.
 var _hasOwn = uncurry(Object.prototype.hasOwnProperty);
-// The conversions, which are globals and so ordinary writable properties of globalThis. They read
-// like language rather than like code, which is why they were the last of these to be noticed: an
-// index test is `String(Number(k)) === k`, a narrow is `Number(v)`, and a header value is
-// `String(value)` before it is scanned for injection. A replacement decides all three.
 var _String = String;
 var _Number = Number;
 var _Boolean = Boolean;
 var _BigInt = BigInt;
 var _Date = Date;
 var _isFinite = globalThis.isFinite;
-// The byte-view constructors, for the same reason: a private copy is only private if the store and
-// the view over it are the ones this code asked for. A replaced constructor hands back a view over
-// storage of its own choosing, while the cleanup still tracks the store that was allocated.
 var _ArrayBuffer = ArrayBuffer;
 var _Uint8Array = Uint8Array;
 var _DataView = DataView;
-// Boxing a primitive, which decides what a reflection scan then sees.
 var _ObjectFn = Object;
-// The prototype OBJECTS, used as identity sentinels: "is this a plain object", "is this a Buffer",
-// "has the chain walk reached the top". Each is reached as a property of a replaceable global, so
-// after a replacement the sentinel is a different object and every comparison against it is false.
 var _ObjectProto = Object.prototype;
 var _BufferProto = Buffer.prototype;
 var _ArrayProto = Array.prototype;
@@ -182,15 +92,6 @@ var _Set = Set;
 var _Map = Map;
 var _WeakMap = WeakMap;
 
-// types -- the slot predicates, snapshotted at load.
-//
-// `util.types` is an ordinary object on an ordinary module export, so `util.types.isDate = () =>
-// true` reaches every guard that asks it at call time. These predicates are how this toolkit
-// answers "what IS this value", in preference to a prototype test a caller can satisfy, so a
-// caller who gets to answer them instead has replaced the one question a lookalike cannot lie
-// about. Every own function property is carried across rather than a written-out list, because a
-// list is a thing to get wrong and a predicate added by a later runtime would silently be missing
-// from it.
 var _types = Object.create(null);
 var _typeNames = Object.getOwnPropertyNames(_utilTypes);
 for (var _i = 0; _i < _typeNames.length; _i++) {
@@ -200,15 +101,6 @@ for (var _i = 0; _i < _typeNames.length; _i++) {
 }
 Object.freeze(_types);
 
-// uncurry(fn) -> function (receiver, ...args) { return fn.call(receiver, ...args); }
-//   fn : the intrinsic captured from a prototype, or an intrinsic getter function.
-//
-// The returned function is private to whichever module called `uncurry`, so no property of it is
-// reachable from outside.
-//
-// A `.call` on a captured intrinsic is the shape this replaces. It reads as safe while being as
-// reachable as the un-captured method was, so it is flagged anywhere in lib/, including a guard
-// not yet written. The safe spelling is also the tripwire for the next one.
 // @enforced-by guard-shape-reinlined
 // @guard-shape \b_[A-Za-z][A-Za-z0-9_$]*\.(?:call|apply)\s*\(
 function uncurry(fn) {
@@ -218,21 +110,7 @@ function uncurry(fn) {
   return _reflectApply(_bind, _call, [fn]);
 }
 
-// getter(proto, name, who) -> the prototype's own accessor, uncurried.
-//   proto : the intrinsic prototype the accessor lives on.
-//   name  : the accessor's property name.
-//   who   : how the prototype is named in the refusal, for a runtime that has no such accessor.
-//
-// A view's size, offset and backing store are accessors on a prototype, which means they are
-// replaceable, which means every rule keyed on one is answerable by whoever replaced it. Taking the
-// descriptor's `get` at load and uncurrying it reads the value's own slot and consults nothing.
-// A runtime without the accessor is refused rather than fallen back from: a fallback here would be
-// the value's own `length`, which is the property this exists to stop reading.
 // @enforced-by behavioral -- reading a descriptor's `get` is not distinguishable from testing one
-//   for presence (`!!d.get`, which four guards do legitimately), so a lexical detector would
-//   false-fire on every accessor-shape check in the tree; the vectors that replace an accessor and
-//   drive the composing guard are the guard. The `.call` half of the shape is covered by uncurry's
-//   guard-shape-reinlined detector.
 function getter(proto, name, who) {
   var d = _getOwnPropertyDescriptor(proto, name);
   if (!d || typeof d.get !== "function") {
@@ -245,24 +123,7 @@ function getter(proto, name, who) {
 var _taByteLength = getter(_getPrototypeOf(Uint8Array.prototype), "byteLength", "%TypedArray%.prototype");
 var _dvByteLength = getter(DataView.prototype, "byteLength", "DataView.prototype");
 
-// sizeOf(value) -> how large the value is: a string's character count, a view's byte count.
-//
-// The size of an input decides a cap, a bound, an emptiness gate and a loop end all over this
-// toolkit, and `value.length` asks the prototype for it. On a view that property is a replaceable
-// accessor: one reporting a small number for a large buffer disables every size cap at once, and
-// one reporting a positive number for an empty buffer passes an empty secret, an empty DER element
-// and an empty name through the gates that exist to refuse them. So a view is measured from its
-// slot, and a DataView carries its own accessor rather than the typed-array one.
-//
-// A primitive string's `length` is a data property the language maintains and no code can redefine,
-// so the string arm reads it directly. The two arms are one function because a size comparison
-// should have one spelling: a second way to measure is a second thing to get wrong, and the arm
-// that gets skipped is the one that was replaceable. Anything that is neither is refused rather
-// than measured, since its `length` would be whatever its author wrote.
 // @enforced-by behavioral -- `x.length` on a byte view is the same three tokens as on a string or
-//   an array, where the read is safe and ubiquitous, and the receiver's kind is not knowable
-//   statically in this codebase's style; a detector would flag every array bound in the tree. The
-//   over-cap and control-byte vectors under a replaced accessor are the guard.
 function sizeOf(value) {
   if (typeof value === "string") return value.length;
   if (_types.isDataView(value)) return _dvByteLength(value);
@@ -271,11 +132,6 @@ function sizeOf(value) {
     (value === null ? "null" : typeof value));
 }
 
-// Frozen, and that is what makes the capture worth taking. A consumer binds these at load, but it
-// also reads several of them as `intrinsic.<name>(...)` at the call itself, and the module registry
-// hands every caller this same object: assigning one property would redirect that call in every
-// module at once, which is the substitution the captures exist to refuse. Freezing costs nothing
-// here because nothing writes to it after load.
 module.exports = Object.freeze({
   uncurry: uncurry,
   getter: getter,
@@ -333,12 +189,7 @@ module.exports = Object.freeze({
   arraySlice: _arrSlice,
   join: _arrJoin,
   hasOwn: _hasOwn,
-  // Invocation itself. `fn.apply(...)` reads `apply` off Function.prototype, so a replacement
-  // decides whether a verb's body runs at all and what it appears to return; `Reflect.apply` is
-  // invoked directly and consults no property of the function.
   apply: _reflectApply,
-  // And the cleanup half of a promise chain: `.finally` is where a copied secret is released, so a
-  // replacement that drops its callback leaves the plaintext copy alive for the process's lifetime.
   promiseFinally: uncurry(Promise.prototype["finally"]),
   String: _String,
   Number: _Number,

package/lib/guard-json.js

@@ -1,72 +1,27 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) blamejs contributors
 "use strict";
-//
-// @internal -- no operator-facing namespace. The documented surface is the
-// consumers whose JSON integrity composes this guard (pki.jose message parsing,
-// pki.acme resource objects, pki.webcrypto JWK unwrap).
-//
-// guard-json -- strict, bounded parse of an untrusted JSON document. JSON.parse
-// silently takes the last value of a duplicate member, so a signed or wrapped
-// object carrying two members of the same name resolves differently for a
-// verifier than for a consumer. That is the JSON smuggling / parser-differential
-// class (CWE-20 / CWE-436). It also caps neither size nor nesting (CWE-770 /
-// CWE-400), and over a Buffer substitutes U+FFFD for invalid UTF-8 instead of failing.
-//
-// This is a single hand-written recursive-descent reader that composes
-// guard.text.decode (the byte cap runs before the strict/fatal UTF-8 decode, so
-// an oversized document is rejected before it is materialized), then rejects a
-// duplicate member at every nesting depth, caps nesting, assigns each member as
-// an own data property (a "__proto__" key becomes a normal member: it cannot
-// mutate the prototype nor, being a non-own assignment for a primitive, silently
-// defeat the duplicate-member gate), and enforces the RFC 8259 number/string
-// grammar (no leading zero, a fraction/exponent needs a digit, no bare "-").
-//
+// @internal
 var text = require("./guard-text");
-// Taken at load. `defineProperty` is how a decoded member lands on the result without consulting a
-// setter, and `fromCharCode` is how an escape becomes the character it names; a replacement for
-// either decides what this parser produces. See guard-intrinsic for the whole captured set.
 var _defineProperty = require("./guard-intrinsic").defineProperty;
 var _freeze = require("./guard-intrinsic").freeze;
 var _fromCharCode = require("./guard-intrinsic").fromCharCode;
-// The character-code read the whole scanner is built on: whitespace, escapes and the control-byte
-// reject all consult it, so one that lies decides what this parser sees in the input.
 var _charCodeAt = require("./guard-intrinsic").uncurry(String.prototype.charCodeAt);
-// The scanner has already found where a number literal starts and ends; this is the step that cuts
-// it out. A replacement hands `Number` a different span than the one the parser validated, so the
-// value the document is understood to carry is not the value its bytes spell.
 var _strSlice = require("./guard-intrinsic").uncurry(String.prototype.slice);
-// The duplicate-member gate below asks whether a key is already present. Spelled
-// `Object.prototype.hasOwnProperty.call(...)` it reads two replaceable properties to answer that,
-// and either of them answering wrongly lets a document carry the same member twice.
 var _hasOwn = require("./guard-intrinsic").hasOwn;
-// The conversion that turns a validated number literal into the value the document is understood to
-// carry. A replacement returns something else for text this parser has already checked.
 var _Number = require("./guard-intrinsic").Number;
-// The gate that refuses a numeric token that overflowed to Infinity. A replacement answering true
-// admits it, and the document is understood to carry a value its bytes cannot spell.
 var _isFinite = require("./guard-intrinsic").isFinite;
 var _stringify = require("./guard-intrinsic").stringify;
-// Appended by index rather than through `push`, so the growth reads no prototype method at all.
 function _append(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
 var limits = require("./guard-limits");
 
-// One hex digit's value, or -1. Written out because the three ranges ARE the rule.
 function _hexVal(c) {
-  if (c >= 0x30 && c <= 0x39) return c - 0x30;          // 0-9
-  if (c >= 0x61 && c <= 0x66) return c - 0x61 + 10;     // a-f
-  if (c >= 0x41 && c <= 0x46) return c - 0x41 + 10;     // A-F
+  if (c >= 0x30 && c <= 0x39) return c - 0x30;
+  if (c >= 0x61 && c <= 0x66) return c - 0x61 + 10;
+  if (c >= 0x41 && c <= 0x46) return c - 0x41 + 10;
   return -1;
 }
 
-// parse(input, ErrorClass, spec) -> value. `input` is a Buffer or a string.
-// spec = { maxBytes, maxDepth, badJson, tooDeep, duplicateMember, tooLarge,
-//   badInput, label }, the caller's caps and frozen domain/reason codes.
-// Both caps are required authoring inputs: an omitted, NaN or fractional cap
-// would silently disable the bound it configures (a depth-uncapped recursive
-// descent escapes as a raw stack-overflow RangeError), so they are validated
-// through the shared cap guards at entry, maxDepth additionally against the
-// stack-safe recursion ceiling, so no caller cap can exceed frame safety.
 // @enforced-by json-parse-not-via-guard
 function parse(input, ErrorClass, spec) {
   function E(code, message, cause) { return new ErrorClass(code, message, cause); }
@@ -75,8 +30,6 @@ function parse(input, ErrorClass, spec) {
   }
   var maxBytes = limits.cap(spec.maxBytes, "guard.json.parse spec.maxBytes", undefined);
   var maxDepth = limits.depthCap(spec.maxDepth, "guard.json.parse spec.maxDepth", undefined);
-  // Byte cap before the fatal UTF-8 decode (an oversized/ill-encoded document is
-  // rejected before it is turned into a string).
   var str = text.decode(input, maxBytes, ErrorClass, {
     charset: "utf-8", fatal: true, tooLarge: spec.tooLarge, badDecode: spec.badJson, badInput: spec.badInput, label: spec.label,
   });
@@ -92,8 +45,6 @@ function parse(input, ErrorClass, spec) {
     if (c === "[") return array(depth);
     if (c === "\"") return string();
     if (c === "-" || (c >= "0" && c <= "9")) return number();
-    // Through the captured slice, not `substr`: these three comparisons ARE the literal grammar, so
-    // one returning something else accepts a token the document does not spell.
     if (_strSlice(str, i, i + 4) === "true") { i += 4; return true; }
     if (_strSlice(str, i, i + 5) === "false") { i += 5; return false; }
     if (_strSlice(str, i, i + 4) === "null") { i += 4; return null; }
@@ -101,7 +52,7 @@ function parse(input, ErrorClass, spec) {
     return undefined;
   }
   function object(depth) {
-    i++; // {
+    i++;
     var out = {};
     ws();
     if (str[i] === "}") { i++; return out; }
@@ -113,8 +64,6 @@ function parse(input, ErrorClass, spec) {
       ws();
       if (str[i] !== ":") fail("expected ':'");
       i++;
-      // Own data property (not out[key]=...): a "__proto__" key becomes a normal
-      // member, never a prototype mutation nor a silent duplicate-gate bypass.
       _defineProperty(out, key, { value: value(depth + 1), writable: true, enumerable: true, configurable: true });
       ws();
       if (str[i] === ",") { i++; continue; }
@@ -123,7 +72,7 @@ function parse(input, ErrorClass, spec) {
     }
   }
   function array(depth) {
-    i++; // [
+    i++;
     var out = [];
     ws();
     if (str[i] === "]") { i++; return out; }
@@ -136,7 +85,7 @@ function parse(input, ErrorClass, spec) {
     }
   }
   function string() {
-    i++; // opening quote
+    i++;
     var s = "";
     for (;;) {
       if (i >= n) fail("unterminated string");
@@ -154,9 +103,6 @@ function parse(input, ErrorClass, spec) {
         else if (e === "r") s += "\r";
         else if (e === "t") s += "\t";
         else if (e === "u") {
-          // Four hex digits, read as digits instead of matched as a pattern: the
-          // scanner is already walking this string one character at a time, and a
-          // parser handed hostile input should not hand any of it to a second engine.
           var cp = 0;
           if (i + 4 > n) fail("bad \\u escape");
           for (var h = 0; h < 4; h++) {
@@ -172,13 +118,6 @@ function parse(input, ErrorClass, spec) {
       } else s += c;
     }
   }
-  // RFC 8259 sec. 6, enforced by the walk itself and not by re-matching the token
-  // afterwards. The scan already knows where each part starts and ends, so the
-  // grammar's three rules (an integer part that is "0" or has no leading zero, a
-  // fraction with at least one digit, an exponent with at least one digit) are
-  // checked as it goes. Re-matching what the scanner just read meant maintaining
-  // the same grammar twice, in two notations, and the pattern was the copy whose
-  // cost on a rejecting token could not be bounded from outside.
   function number() {
     var start = i;
     if (str[i] === "-") i++;
@@ -186,19 +125,19 @@ function parse(input, ErrorClass, spec) {
     while (i < n && str[i] >= "0" && str[i] <= "9") i++;
     var intLen = i - intStart;
     if (intLen === 0) fail("malformed number");
-    if (intLen > 1 && str[intStart] === "0") fail("malformed number");   // no leading zero
+    if (intLen > 1 && str[intStart] === "0") fail("malformed number");
     if (str[i] === ".") {
       i++;
       var fracStart = i;
       while (i < n && str[i] >= "0" && str[i] <= "9") i++;
-      if (i === fracStart) fail("malformed number");                     // "1." has no fraction
+      if (i === fracStart) fail("malformed number");
     }
     if (str[i] === "e" || str[i] === "E") {
       i++;
       if (str[i] === "+" || str[i] === "-") i++;
       var expStart = i;
       while (i < n && str[i] >= "0" && str[i] <= "9") i++;
-      if (i === expStart) fail("malformed number");                      // "1e" has no exponent
+      if (i === expStart) fail("malformed number");
     }
     var v = _Number(_strSlice(str, start, i));
     if (!_isFinite(v)) fail("bad number");
@@ -210,6 +149,4 @@ function parse(input, ErrorClass, spec) {
   return result;
 }
 
-// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
-// call, so a writable export would let a caller replace the check rather than pass it.
 module.exports = _freeze({ parse: parse });

package/lib/guard-limits.js

@@ -1,63 +1,18 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) blamejs contributors
 "use strict";
-//
-// @internal -- no operator-facing namespace. The documented surface is the
-// decoders whose option validation composes these guards (pki.asn1.decode,
-// pki.cbor.decode).
-//
-// guard-limits -- fail-closed validation of operator-supplied decode limits at
-// config time (the tier that throws on a bad argument so the operator catches
-// the typo at boot). Enforced choke point: a codebase-patterns detector requires
-// the stack-safe recursion ceiling to live only here, so a new decoder cannot be
-// configured past it.
-//
-// Defends the parser-DoS / resource-exhaustion class (CWE-834 excessive
-// recursion, CWE-770 allocation without limits; MITRE T1499.001; D3FEND
-// Recursion-Bounding + Input-Size-Restriction). A recursive-descent decoder
-// bounded only by a caller-tunable maxDepth overflows the native call stack (a
-// raw RangeError, not a typed verdict) once the cap is raised past the frame
-// limit; depthCap refuses a maxDepth above the stack-safe ceiling. A bad limit
-// is an authoring bug, so this tier throws a TypeError (not a PkiError). NIST
-// 800-53 SI-10 / SC-5 do not require these bounds (framework lag). The control
-// that actually holds is the bound at the parser.
+// @internal
 
 var constants = require("./constants");
-// The integer test, taken at load. Every bound below is only a bound while this answers honestly:
-// one returning true admits a NaN or fractional cap, which makes the comparison it guards always
-// false. See guard-intrinsic for the whole captured set.
 var _isInteger = require("./guard-intrinsic").isInteger;
 var _freeze = require("./guard-intrinsic").freeze;
-// And the size measurement, for the same reason one step further in: a cap compares against a
-// length, and on a byte view `length` is a replaceable accessor. One reporting a small number for a
-// large buffer leaves every byteCap below always-false, which is the size defense silently dead.
 var _sizeOf = require("./guard-intrinsic").sizeOf;
 
-// cap(value, key, dflt, opts) -> a validated bounded integer, or dflt when value
-// is undefined. A non-integer / non-finite / negative value fails closed
-// (Number.isInteger already rejects non-numbers, NaN, and Infinity).
-//
-// With no opts it is the config-time codec default: a bare TypeError with the
-// "decode:" prefix and a >= 0 floor (the asn1-der / cbor-det callers are
-// untouched). opts lets a caller in another currency reuse the same integer
-// floor with its own typed verdict and bounds, so a fractional/negative/NaN
-// bound cannot be spelled a fifth way with a dropped Number.isInteger:
-//   E     - a (code, message) -> Error factory; when given, an out-of-range
-//           value throws E(code, ...) instead of the bare TypeError.
-//   code  - the domain/reason code passed to E.
-//   label - names the argument in the message (defaults to key).
-//   min   - inclusive lower bound (default 0).
-//   max   - inclusive upper bound (optional).
 // @enforced-by behavioral -- a config-time cap validator has no rename-proof code
-//   shape; the decode-rejects-a-bad-cap RED vectors (asn1/cbor/path) are the guard.
 function cap(value, key, dflt, opts) {
   if (value === undefined) return dflt;
   opts = opts || {};
   var min = opts.min === undefined ? 0 : opts.min;
-  // The bounds themselves are authoring inputs: a NaN / fractional min or max
-  // compares false against every value, silently disabling the check (a NaN min
-  // even REPLACES the default >= 0 floor). Always a config-time TypeError --
-  // the bound wiring is broken regardless of the value currency opts.E selects.
   if (!_isInteger(min) || (opts.max !== undefined && !_isInteger(opts.max))) {
     throw new TypeError("guard.limits.cap: the min/max bounds for " + key + " must be integers");
   }
@@ -70,9 +25,6 @@ function cap(value, key, dflt, opts) {
   return value;
 }
 
-// depthCap(value, key, dflt) -> a validated recursion-depth cap: cap() plus the
-// stack-safe ceiling, so a raised maxDepth cannot drive recursive descent into a
-// raw RangeError past the native frame limit.
 // @enforced-by guard-shape-reinlined
 // @guard-scope file
 // @guard-shape \bopts\.maxDepth\b
@@ -86,20 +38,8 @@ function depthCap(value, key, dflt) {
   return n;
 }
 
-// counter(max, E, code, label) -> { tick }. A parse-time item counter: the
-// recursive decoder calls tick() once per decoded element so a small input
-// cannot fan out into a massive eager node/element tree (CWE-770 / CWE-400 memory
-// amplification -- the class pki.cbor closed with CBOR_MAX_ITEMS). Unlike cap
-// (config-time TypeError), this is Tier-2 parse validation: an over-count throws
-// the caller's typed PkiError via the E(code, message) factory. `max` is the
-// caller's already-validated ceiling (an opts.maxItems run through cap()).
 // @enforced-by behavioral -- a monotone counter has no rename-proof code shape
-//   distinct from any `n++ > max` loop bound; the memory-fanout RED vectors (a
-//   dense TLV run rejects at the cap) driving the composing decoders are the guard.
 function counter(max, E, code, label) {
-  // The ceiling is an authoring input: an undefined / NaN / fractional max
-  // builds a counter whose `n > max` never fires, leaving a silently dead fanout
-  // defense. Reject at construction (config-time TypeError).
   if (!_isInteger(max) || max < 0) {
     throw new TypeError("guard.limits.counter: max must be a non-negative integer");
   }
@@ -112,22 +52,8 @@ function counter(max, E, code, label) {
   };
 }
 
-// byteCap(buf, max, E, code, label) -> the same buffer, once proven within `max`
-// bytes. Bounds a caller-supplied buffer before an expensive hash / verify / parse
-// materializes over it (CWE-400 uncontrolled resource consumption / CWE-770
-// allocation without limits -- the class guard.text.decode closes for a decoded
-// string and counter closes for element fanout, here for a raw byte input). Tier-2:
-// an over-size input is hostile / malformed content, so it throws the caller's typed
-// PkiError via the E(code, message) factory. `max` is the caller's ceiling (a
-// C.LIMITS.* constant, or an operator max already run through cap()).
 // @enforced-by behavioral -- a `buf.length > cap` size gate has no rename-proof code
-//   shape distinct from an arity / field-width check (children.length > 2,
-//   ext.length > 0xffff), so a codebase-patterns detector would false-fire; the
-//   over-size RED vectors driving the composing verifiers are the guard.
 function byteCap(buf, max, E, code, label) {
-  // The ceiling is an authoring input: an undefined / NaN / fractional / negative
-  // max makes `length > max` never fire, and the size defense is then silently
-  // dead. Reject at config time (TypeError), regardless of the value currency E selects.
   if (!_isInteger(max) || max < 0) {
     throw new TypeError("guard.limits.byteCap: max must be a non-negative integer");
   }
@@ -138,6 +64,4 @@ function byteCap(buf, max, E, code, label) {
   return buf;
 }
 
-// Frozen for the reason the family header gives: a boundary reads its guard off this object at the
-// call, so a writable export would let a caller replace the check rather than pass it.
 module.exports = _freeze({ cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap });