@blamejs/pki 0.8.11 → 0.8.14

package/lib/guard-identifier.js

@@ -100,6 +100,38 @@ function snapshotOptions(obj, known) {
   return out;
 }
 
+/** @internal The option names a bag carries, read the way assertKnownKeys read them: every own
+ *  string key, whatever its descriptor says. Object.keys reports only the enumerable ones, so an
+ *  option written with `enumerable: false` clears the door and then vanishes from the read.
+ *  `known` narrows the result to the declared options. */
+// @enforced-by option-bag-read-by-enumerable-key
+function optionNames(obj, known) {
+  if (obj === null || obj === undefined) return [];
+  var out = [];
+  _forEach(_ownKeys(_Object(obj)), function (k) {
+    if (typeof k !== "string") return;
+    if (known !== null && known !== undefined && !_hasOwn(known, k)) return;
+    _append(out, k);
+  });
+  return out;
+}
+
+/** @internal A caller's options bag copied onto a prototype-less object, keyed by every own string
+ *  property, not the enumerable ones alone. Each is read once, so an accessor-backed option
+ *  answers the copy and not the later reads. Inherited properties are left behind: the copy is
+ *  what the decisions read, and a name reaching it from a prototype is not one the caller set. */
+// @enforced-by option-bag-read-by-enumerable-key
+function ownOptions(obj) {
+  var out = _create(null);
+  if (obj === null || obj === undefined) return out;
+  var o = _Object(obj);
+  _forEach(_ownKeys(o), function (k) {
+    if (typeof k !== "string") return;
+    out[k] = o[k];
+  });
+  return out;
+}
+
 var _PRISTINE_OBJECT_PROTO = (function () {
   var s = _create(null);
   _forEach(["constructor", "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable", "toLocaleString",
@@ -528,6 +560,8 @@ module.exports = intrinsic.freeze({
   optionsObject: optionsObject,
   refuseAccessorFields: refuseAccessorFields,
   snapshotOptions: snapshotOptions,
+  optionNames: optionNames,
+  ownOptions: ownOptions,
   readableNames: readableNames,
   readableIndices: readableIndices
 });

package/lib/hpke.js

@@ -228,7 +228,11 @@ function _extractAndExpand(kem, dh, kemContext) {
   try { return _labeledExpand(kdf, sid, eaePrk, "shared_secret", kemContext, kem.Nsecret); }
   finally { guard.secret.zeroize(eaePrk, HpkeError, "hpke/bad-input", "the KEM extract PRK"); }
 }
-function _kemId(kem) { for (var k in KEMS) if (KEMS[k] === kem) return Number(k); return 0; }
+function _kemId(kem) {
+  var names = guard.identifier.optionNames(KEMS);
+  for (var i = 0; i < names.length; i++) if (KEMS[names[i]] === kem) return Number(names[i]);
+  return 0;
+}
 
 function _ephemeral(kem, eph) {
   if (eph != null) {
@@ -429,7 +433,8 @@ var _COMMON_KEYS = intrinsic.assign(intrinsic.create(null), { mode: 1, info: 1,
 function _withCommon(extra) {
   var out = intrinsic.create(null);
   Object.keys(_COMMON_KEYS).forEach(function (k) { out[k] = 1; });
-  Object.keys(extra).forEach(function (k) { out[k] = 1; });
+  var en = guard.identifier.optionNames(extra);
+  for (var ei = 0; ei < en.length; ei++) out[en[ei]] = 1;
   return out;
 }
 var _SETUP_S_KEYS = _withCommon({

package/lib/http-transport.js

@@ -279,10 +279,10 @@ function _copyableArray(a) {
 function snapshotProxy(p) {
   try {
     if (!_copyableRecord(p)) return p;
-    var out = Object.assign(Object.create(null), p);
-    if (_copyableRecord(p.auth)) out.auth = Object.assign(Object.create(null), p.auth);
+    var out = guard.identifier.ownOptions(p);
+    if (_copyableRecord(p.auth)) out.auth = guard.identifier.ownOptions(p.auth);
     if (_copyableRecord(p.tls)) {
-      out.tls = Object.assign(Object.create(null), p.tls);
+      out.tls = guard.identifier.ownOptions(p.tls);
       var a = p.tls.anchors;
       if (_copyableArray(a)) {
         var copied = [];
@@ -492,7 +492,7 @@ function httpsTransport(defaults) {
     var bodyIsFn = typeof body === "function";
     if (!bodyIsFn && guard.bytes.isByteSource(body)) body = guard.bytes.source(body, E, C("bad-input"), "the request body");
 
-    var reqHeaders = Object.assign(Object.create(null), request.headers || {});
+    var reqHeaders = guard.identifier.ownOptions(request.headers);
     Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "proxy-authorization" || lk === "proxy-connection") delete reqHeaders[k]; });
     if (bodyIsFn) {
       Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "content-length" || lk === "transfer-encoding" || lk === "expect") delete reqHeaders[k]; });
@@ -609,8 +609,7 @@ function httpsTransport(defaults) {
               if (settled) return;
               settled = true;
               clearTimer();
-              var lower = Object.create(null);
-              Object.keys(res.headers || {}).forEach(function (k) { lower[k.toLowerCase()] = res.headers[k]; });
+              var lower = guard.header.lowerCased(res.headers);
               resolve({
                 status: res.statusCode,
                 headers: lower,

package/lib/identity-match.js

@@ -199,9 +199,10 @@ function _reference(r, index) {
  * afterwards would otherwise name an identity nothing compared. A string is already a value; bytes
  * are the copy taken at the door. */
 function _reported(record) {
-  var out = intrinsic.create(null), k;
-  for (k in record) {
-    if (intrinsic.hasOwn(record, k) && record[k] !== undefined) out[k] = record[k];
+  var out = intrinsic.create(null);
+  var names = guard.identifier.optionNames(record);
+  for (var i = 0; i < names.length; i++) {
+    if (record[names[i]] !== undefined) out[names[i]] = record[names[i]];
   }
   return intrinsic.freeze(out);
 }

package/lib/ocsp.js

@@ -390,7 +390,10 @@ function _snapshotSignerKey(key, owned) {
     return copy;
   }
   if (key && typeof key === "object" && (key.mldsa != null || key.trad != null)) {
-    return Object.assign({}, key, { mldsa: _snapshotSignerKey(key.mldsa, owned), trad: _snapshotSignerKey(key.trad, owned) });
+    var ks = guard.identifier.ownOptions(key);
+    ks.mldsa = _snapshotSignerKey(key.mldsa, owned);
+    ks.trad = _snapshotSignerKey(key.trad, owned);
+    return ks;
   }
   return key;
 }
@@ -925,8 +928,7 @@ function httpRequest(der, responderUrl, opts) {
 var HTTP_REQUEST_OPTS = Object.assign(Object.create(null), { method: 1 });
 
 function _frozenHeaders(h) {
-  var out = Object.create(null), k;
-  for (k in h) { if (Object.prototype.hasOwnProperty.call(h, k)) out[k] = h[k]; }
+  var out = guard.identifier.ownOptions(h);
   return Object.freeze(out);
 }
 

package/lib/oid.js

@@ -217,7 +217,7 @@ var FAMILIES = Object.assign(Object.create(null), {
     hmacWithSHA1: 7, hmacWithSHA224: 8, hmacWithSHA256: 9,
     hmacWithSHA384: 10, hmacWithSHA512: 11 } },
 
-  smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4, compressedData: 9, encKeyWithID: 21, authEnvelopedData: 23 } },
+  smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4, compressedData: 9, encKeyWithID: 21, authEnvelopedData: 23, trustAnchorList: 34 } },
 
   smimeOri: { base: [1, 2, 840, 113549, 1, 9, 16, 13], of: { kem: 3 } },