@blamejs/pki 0.8.25 → 0.8.27

package/lib/guard-name.js

@@ -290,8 +290,7 @@ function escapeDnValue(v) {
   return out;
 }
 
-// @enforced-by guard-shape-reinlined
-// @guard-shape lastIndexOf\("@"\)
+// @enforced-by behavioral -- a shape naming the separator cannot fire, since the walk strips string literals before applying one, and the split has no other form that separates it from the authority scans in this tree; the vectors are the guard, where a local part differing in case alone is a different mailbox and a host part that does is the same one
 function emailEqual(a, b) {
   if (typeof a !== "string" || typeof b !== "string") return "not-comparable";
   var ai = _lastIndexOf(a, "@"), bi = _lastIndexOf(b, "@");
@@ -447,7 +446,9 @@ var _SCHEME_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV
  * that needs a host decides what to do with that rather than being handed a guess. `host` is null
  * when the authority carries none, and `bracketed` says the host arrived inside `[]`, which is the
  * only place an IPv6 literal may appear. Percent-escapes are left as written, so a caller comparing
- * the host decides whether to accept one. */
+ * the host decides whether to accept one. `authStart` and `authEnd` bound the authority as written,
+ * userinfo and port included, and are equal on a URI that carries none, so a caller reading the rest
+ * of the URI reads it from the same walk rather than scanning again. */
 // @enforced-by behavioral -- a URI walk has no rename-proof shape that separates it from any other character scan; the vectors reading a scheme, refusing two userinfo separators and stripping a port are the guard
 function uriParts(uri) {
   if (typeof uri !== "string") return null;
@@ -460,7 +461,8 @@ function uriParts(uri) {
   if (_charCodeAt(uri, p) !== 0x3a) return null;
   var scheme = _strSlice(uri, 0, p);
   if (_charCodeAt(uri, p + 1) !== 0x2f || _charCodeAt(uri, p + 2) !== 0x2f) {
-    return { scheme: scheme, hasAuthority: false, host: null, bracketed: false };
+    return { scheme: scheme, hasAuthority: false, host: null, bracketed: false,
+      authStart: p + 1, authEnd: p + 1 };
   }
   p += 3;
   var authStart = p;
@@ -474,12 +476,17 @@ function uriParts(uri) {
   if (firstAt !== _lastIndexOf(authority, "@")) return null;
   if (firstAt !== -1) authority = _strSlice(authority, firstAt + 1);
   var host = _strSlice(authority, 0, _portStripIndex(authority));
-  if (host === "") return { scheme: scheme, hasAuthority: true, host: null, bracketed: false };
+  if (host === "") {
+    return { scheme: scheme, hasAuthority: true, host: null, bracketed: false,
+      authStart: authStart, authEnd: p };
+  }
   var hn = host.length;
   if (hn >= 2 && _charCodeAt(host, 0) === 0x5b && _charCodeAt(host, hn - 1) === 0x5d) {
-    return { scheme: scheme, hasAuthority: true, host: _strSlice(host, 1, hn - 1), bracketed: true };
+    return { scheme: scheme, hasAuthority: true, host: _strSlice(host, 1, hn - 1), bracketed: true,
+      authStart: authStart, authEnd: p };
   }
-  return { scheme: scheme, hasAuthority: true, host: host, bracketed: false };
+  return { scheme: scheme, hasAuthority: true, host: host, bracketed: false,
+    authStart: authStart, authEnd: p };
 }
 
 /** @internal Where a `:port` suffix starts, or the length when there is none. RFC 3986 sec. 3.2.3
@@ -497,6 +504,138 @@ function _portStripIndex(s) {
   return (i > 0 && _charCodeAt(s, i - 1) === 0x3a) ? i - 1 : s.length;
 }
 
+var _UNRESERVED_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~");
+var _HEXUP = "0123456789ABCDEF";
+
+/** @internal Percent-encoding normalization (RFC 3986 sec. 6.2.2.2, which RFC 3987 sec. 5.3.2.3
+ * carries): a triplet encoding an unreserved character is decoded to that character, and the hex
+ * digits of every triplet that remains are written in uppercase. A `%` that does not introduce two
+ * hex digits is left as written, since a value this cannot read is one the comparison must not
+ * rewrite. */
+function _pctNormalize(s) {
+  var out = "", i = 0, n = s.length;
+  while (i < n) {
+    var c = _charCodeAt(s, i);
+    if (c !== 0x25 || i + 2 >= n) { out += _charAt(s, i); i += 1; continue; }
+    var hi = _hexNibble(_charCodeAt(s, i + 1)), lo = _hexNibble(_charCodeAt(s, i + 2));
+    if (hi < 0 || lo < 0) { out += _charAt(s, i); i += 1; continue; }
+    var v = hi * 16 + lo;
+    out += _UNRESERVED_TABLE[v] ? _fromCharCode(v)
+      : "%" + _charAt(_HEXUP, hi) + _charAt(_HEXUP, lo);
+    i += 3;
+  }
+  return out;
+}
+
+/** @internal Path segment normalization (RFC 3986 sec. 5.2.4's remove_dot_segments, which RFC 3987
+ * sec. 5.3.2.4 carries). The document writes the algorithm as repeated removal from the front of the
+ * input and appending to an output buffer; both are done here with an index and a list of the segments
+ * kept, because rewriting the remaining input on each step costs a copy of it per segment, and a path
+ * of many `a/../` segments then costs time in the square of its length. A certificate can carry a URI
+ * of any length the encoding allows, and this runs on one while an operator waits, so the walk reads
+ * each character once.
+ * A segment is read with the `/` that introduces it, so the kept list holds whole `/segment` units and
+ * removing "the last segment" is removing the last of them. A `.` or `..` that opens a relative path
+ * takes its following `/` with it, which is what sec. 5.2.4 step 2A does. */
+function _removeDotSegments(path) {
+  var kept = [], i = 0, n = path.length;
+  while (i < n) {
+    var lead = _charCodeAt(path, i) === 0x2f;
+    if (lead) i += 1;
+    var segStart = i;
+    while (i < n && _charCodeAt(path, i) !== 0x2f) i += 1;
+    var seg = _strSlice(path, segStart, i);
+    if (seg === "." || seg === "..") {
+      if (!lead) {
+        if (i < n) i += 1;
+        continue;
+      }
+      if (seg === ".." && kept.length) kept.length -= 1;
+      /** @internal The last segment of the input being `.` or `..` leaves the path ending in a
+       * separator, which steps 2B and 2C write as replacing it with `/`. */
+      if (i >= n) _append(kept, "/");
+      continue;
+    }
+    _append(kept, lead ? "/" + seg : seg);
+  }
+  return intrinsic.join(kept, "");
+}
+
+/** @internal The port each scheme RFC 5280 sec. 7.4 names leaves out when it is the default one
+ * (RFC 3986 sec. 6.2.3). The clause requires scheme-based normalization for exactly these four and
+ * says to omit step 5 for any other scheme, so a scheme absent from this table keeps its port. */
+var _SCHEME_DEFAULT_PORT = intrinsic.assign(_create(null),
+  { http: "80", https: "443", ftp: "21", ldap: "389" });
+
+/** @internal A digit string with its leading zeros removed, and "0" for one that is all zeros, so a
+ * port written with them is read as the number RFC 3986 sec. 3.2.3 says it is. */
+function _dropLeadingZeros(digits) {
+  var i = 0;
+  while (i < digits.length - 1 && _charCodeAt(digits, i) === 0x30) i += 1;
+  return _strSlice(digits, i);
+}
+
+/** @internal A URI prepared for comparison as RFC 5280 sec. 7.4 requires, or null for a value that
+ * is not a URI. The clause's step 1 converts an internationalized name to ASCII Compatible Encoding;
+ * a `uniformResourceIdentifier` is an IA5String, so a value read out of a certificate is already
+ * ASCII and that step has nothing to do, and a caller handing this a non-ASCII string gets it back
+ * unconverted rather than guessed at. Step 2 lowercases the scheme and the host, step 3 normalizes
+ * percent-encoding, step 4 normalizes path segments, and step 5 drops a default port and writes an
+ * empty path as `/` for the four schemes the clause names. Everything else keeps its case, which is
+ * what makes the exact match the clause then calls for answer correctly. The steps run in the order
+ * the clause numbers them, so a host is lowercased before its percent-encoding is read and a triplet
+ * standing for an unreserved character contributes that character's own case. */
+function _uriPrepare(uri) {
+  var p = uriParts(uri);
+  if (p === null) return null;
+  var scheme = lowerAscii(p.scheme);
+  var rest = _pctNormalize(_strSlice(uri, p.authEnd));
+  var authority = "";
+  if (p.hasAuthority) {
+    var auth = _strSlice(uri, p.authStart, p.authEnd);
+    var at = _lastIndexOf(auth, "@");
+    var userinfo = at === -1 ? "" : _pctNormalize(_strSlice(auth, 0, at + 1));
+    var hostPort = _strSlice(auth, at + 1);
+    var cut = _portStripIndex(hostPort);
+    var host = _pctNormalize(lowerAscii(_strSlice(hostPort, 0, cut)));
+    var port = _strSlice(hostPort, cut);
+    /** @internal RFC 3986 sec. 6.2.3, which step 5 runs for the four schemes the clause names: an
+     * explicit `:port` whose port is empty, or is that scheme's default, is the same URI as one
+     * written without it. sec. 3.2.3 writes `port = *DIGIT`, so the port is a number and `:080` on
+     * http is the default one; the digits are read as a number rather than compared as text, which is
+     * what the clause's own purpose, reducing false negatives, asks for. A scheme the clause does not
+     * name keeps the port as written, since step 5 is omitted for it, and no step removes a trailing
+     * dot from a host, so one is kept too. */
+    if (_hasOwn(_SCHEME_DEFAULT_PORT, scheme) &&
+      (port === ":" || _dropLeadingZeros(_strSlice(port, 1)) === _SCHEME_DEFAULT_PORT[scheme])) {
+      port = "";
+    }
+    authority = "//" + userinfo + host + port;
+  }
+  var pathEnd = rest.length;
+  for (var i = 0; i < rest.length; i++) {
+    var c = _charCodeAt(rest, i);
+    if (c === 0x3f || c === 0x23) { pathEnd = i; break; }
+  }
+  var path = _removeDotSegments(_strSlice(rest, 0, pathEnd));
+  if (path === "" && p.hasAuthority && _hasOwn(_SCHEME_DEFAULT_PORT, scheme)) path = "/";
+  return scheme + ":" + authority + path + _strSlice(rest, pathEnd);
+}
+
+/** @internal Whether two URIs name the same resource, under the preparation RFC 5280 sec. 7.4
+ * requires before the "case-sensitive exact match" it then calls for. Folding case over the whole
+ * value instead reads two URIs differing only in a path or a userinfo as one name, and comparing the
+ * values as written reads two differing only in the case of a scheme or a host as two. Returns
+ * "not-comparable" for a value that is not a URI, which leaves the caller to say that rather than
+ * report a verdict this did not reach. */
+// @enforced-by behavioral -- the preparation is five character scans with no shape that separates it from any other; the vectors driving each step, and the pair that differs only in a path, are the guard
+function uriEqual(a, b) {
+  if (typeof a !== "string" || typeof b !== "string") return "not-comparable";
+  var pa = _uriPrepare(a), pb = _uriPrepare(b);
+  if (pa === null || pb === null) return "not-comparable";
+  return pa === pb ? "match" : "no-match";
+}
+
 var _ATEXT_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$%&'*+-/=?^_`{|}~");
 
 /** @internal A quoted local part (RFC 5321 sec. 4.1.2 Quoted-string): printable ASCII between
@@ -773,6 +912,7 @@ module.exports = intrinsic.freeze({
   lowerAscii: lowerAscii, uriSchemeIs: uriSchemeIs,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,
   isHostName: isHostName, hostLabels: hostLabels, isXnLabel: isXnLabel, uriParts: uriParts,
+  uriEqual: uriEqual,
   constraintBaseRefusal: constraintBaseRefusal,
   constraintBaseUnreadable: constraintBaseUnreadable,
 });

package/lib/http-retry-after.js

@@ -4,6 +4,7 @@
 // @internal
 
 var constants = require("./constants");
+var guard = require("./guard-all");
 
 var MAX_RETRY_AFTER_SECONDS = constants.TIME.days(365) / constants.TIME.seconds(1);
 
@@ -28,12 +29,27 @@ function _isAllDigits(s) {
   return true;
 }
 
-function _rfc850Year(yy, refMs) {
-  if (typeof refMs !== "number" || !isFinite(refMs)) return yy + (yy < 70 ? 2000 : 1900);
-  var refYear = new Date(refMs).getUTCFullYear();
-  var full = Math.floor(refYear / 100) * 100 + yy;
-  if (full - refYear > 50) full -= 100;
-  return full;
+/** @internal RFC 7231 sec. 7.1.1.1: a recipient "MUST interpret a timestamp that appears to be more
+ * than 50 years in the future as representing the most recent year in the past that had the same last
+ * two digits". The reading therefore depends on when the value is received, and a caller that does not
+ * say when that was is receiving it now. A fixed cutoff instead is this rule evaluated once, for the
+ * year the cutoff was chosen in, and it misreads a widening band of two-digit years for every year
+ * that passes after it.
+ * THE CLAUSE COMPARES TIMESTAMPS, so this compares timestamps, which is why it runs once the month, day
+ * and time are read. A comparison of years alone reads a timestamp in the fiftieth year ahead as inside
+ * the window whatever its month: received on 28 September 2026, `31-Dec-76` is fifty years and three
+ * months ahead, which is more than fifty, and names 1976. */
+function _rfc850Year(yy, mon, day, hh, mi, ss, refMs) {
+  var ref = (typeof refMs === "number" && isFinite(refMs)) ? refMs : Date.now();
+  var refDate = new Date(ref);
+  var refInstant = guard.time.instantOf(refDate);
+  if (isNaN(refInstant)) return yy + (yy < 70 ? 2000 : 1900);
+  var full = Math.floor(refDate.getUTCFullYear() / 100) * 100 + yy;
+  var horizon = new Date(refInstant);
+  horizon.setUTCFullYear(horizon.getUTCFullYear() + 50);
+  var horizonInstant = guard.time.instantOf(horizon);
+  if (isNaN(horizonInstant)) return full;
+  return Date.UTC(full, mon, day, hh, mi, ss) > horizonInstant ? full - 100 : full;
 }
 
 function _scanImf(s) {
@@ -52,7 +68,12 @@ function _scanRfc850(s, refMs) {
   var mo = _monthAt(s, p); if (!mo || s.charAt(p + 3) !== "-") return null; p += 4;
   var yy = _digits2(s, p); if (yy < 0 || s.charAt(p + 2) !== " ") return null; p += 3;
   var t = _timeAt(s, p); if (!t || s.slice(t.next, t.next + 4) !== " GMT" || t.next + 4 !== s.length) return null;
-  return { day: dd, monName: mo, year: _rfc850Year(yy, refMs), hh: t.hh, mi: t.mi, ss: t.ss };
+  /** @internal The century is resolved once the whole timestamp is read, since the clause compares the
+   * timestamp rather than its year. A month the calendar does not hold is refused by the round-trip
+   * check in `httpDateMs`, which reads the resolved year this returns. */
+  var mon = MONTHS.indexOf(mo);
+  var year = _rfc850Year(yy, mon, dd, t.hh, t.mi, t.ss, refMs);
+  return { day: dd, monName: mo, year: year, hh: t.hh, mi: t.mi, ss: t.ss };
 }
 function _scanAsctime(s) {
   var p = _matchName(s, 0, DOW_SHORT);

package/lib/inspect.js

@@ -164,16 +164,17 @@ var KU_LABEL = NAMES.KEY_USAGE;
 var EKU_LABEL = NAMES.EXT_KEY_USAGE;
 var GN_KIND = NAMES.GENERAL_NAME;
 
+/** @internal A 4- or 16-octet buffer is ONE address, rendered by the shared home so that one address
+ *  reads the same wherever a report carries it: the RFC 3779 blocks reach that home through
+ *  `_ipAddressText`, and a GeneralName reaching it through a second renderer would print the same
+ *  octets two ways in one report. An 8- or 32-octet buffer is a name constraint's address AND mask,
+ *  which is not an address, so each half is rendered and the two are joined. The home is not widened
+ *  to take those widths, because a mask reaching it as an address would render as one everywhere. */
 function _ipString(buf) {
   if (!Buffer.isBuffer(buf)) return "";
-  if (buf.length === 4) return buf[0] + "." + buf[1] + "." + buf[2] + "." + buf[3];
+  if (buf.length === 4 || buf.length === 16) return ipUtils.textFromOctets(buf) || _hexColon(buf, {});
   if (buf.length === 8) return _ipString(buf.subarray(0, 4)) + "/" + _ipString(buf.subarray(4));
-  if (buf.length === 16 || buf.length === 32) {
-    var groups = [];
-    for (var i = 0; i < 16; i += 2) groups.push((((buf[i] << 8) | buf[i + 1]) >>> 0).toString(16).toUpperCase());
-    var s = groups.join(":");
-    return buf.length === 32 ? s + "/" + _ipString(buf.subarray(16)) : s;
-  }
+  if (buf.length === 32) return _ipString(buf.subarray(0, 16)) + "/" + _ipString(buf.subarray(16));
   return _hexColon(buf, {});
 }