@blamejs/pki 0.8.31 → 0.8.49

package/lib/guard-list.js

@@ -6,15 +6,43 @@
 var _freeze = require("./guard-intrinsic").freeze;
 var _defineProperty = require("./guard-intrinsic").defineProperty;
 var _isArray = require("./guard-intrinsic").isArray;
+var _arrSort = require("./guard-intrinsic").sort;
+var _isSafeInteger = require("./guard-intrinsic").isSafeInteger;
 
 var MAX_ARRAY_LENGTH = 4294967295;
 
+/** @internal The receiver's length, NARROWED to a number rather than merely captured. `Array.isArray`
+ * is true for a Proxy whose target is an array, and a `get` trap can answer `length` with an OBJECT:
+ * capturing an object captures no value, so every later use coerces it again and each coercion may
+ * answer differently. MEASURED through `pki.merkle.root`, whose captured count was handed to the leaf
+ * cap as 0 and then walked as 4, returning a four-leaf root the cap had approved as empty and clearing
+ * `MERKLE_MAX_LEAVES` the same way. A length that is not already a non-negative safe integer describes
+ * no array any of these walks can take, so it is refused rather than coerced. Every walk below takes
+ * its count from here, so none of them can hold a value that changes between two reads.
+ *
+ * Exported, because the walks in `guard-bytes` and `guard-identifier` take a caller's list too, and one
+ * of them is a DOOR: a Proxy over `["a", "secret"]` whose length coerced to 2 and then to 0 walked
+ * `refuseAccessorFields` past the accessor named `secret` and returned as though it had checked it. A
+ * door that can be walked past is not a door, so the three families share this one narrow.
+ *
+ * @enforced-by behavioral -- `x.length` has no rename-proof shape that separates a caller's list from
+ * a local array, and the RED vectors are the shrinking and object-valued lengths each walk is driven
+ * with.
+ */
+function _count(list, verb) {
+  var n = list.length;
+  if (typeof n !== "number" || !_isSafeInteger(n) || n < 0) {
+    throw new TypeError("guard.list." + verb + ": the receiver's length is not a non-negative integer");
+  }
+  return n;
+}
+
 // @enforced-by guard-shape-reinlined
 // @guard-shape defineProperty\(\s*\w+\s*,\s*\w+\.length\s*,\s*\{\s*value:
 // @guard-via guard\.list\.append\(
 function append(list, value) {
   if (!_isArray(list)) throw new TypeError("guard.list.append: the receiver must be an array");
-  var n = list.length;
+  var n = _count(list, "append");
   if (n >= MAX_ARRAY_LENGTH) throw new RangeError("guard.list.append: the array is at its maximum length");
   _defineProperty(list, n, { value: value, writable: true, enumerable: true, configurable: true });
   return list;
@@ -23,35 +51,35 @@ function append(list, value) {
 // @enforced-by behavioral -- `.indexOf(x) !== -1` has no rename-proof form that separates a
 function contains(list, value) {
   if (!list) return false;
-  for (var i = 0, n = list.length; i < n; i++) if (list[i] === value) return true;
+  for (var i = 0, n = _count(list, "contains"); i < n; i++) if (list[i] === value) return true;
   return false;
 }
 
 // @enforced-by behavioral -- the composition of contains() has no rename-proof shape of its own;
 function containsAll(list, values) {
   if (!values) return true;
-  for (var i = 0, n = values.length; i < n; i++) if (!contains(list, values[i])) return false;
+  for (var i = 0, n = _count(values, "containsAll"); i < n; i++) if (!contains(list, values[i])) return false;
   return true;
 }
 
 // @enforced-by behavioral -- `.some(` has legitimate non-rule siblings (building a list, reporting
 function anyMatches(list, predicate) {
   if (!list) return false;
-  for (var i = 0, n = list.length; i < n; i++) if (predicate(list[i], i)) return true;
+  for (var i = 0, n = _count(list, "anyMatches"); i < n; i++) if (predicate(list[i], i)) return true;
   return false;
 }
 
 // @enforced-by behavioral -- see anyMatches; the RED vector (an untrusted signer keeps
 function allMatch(list, predicate) {
   if (!list) return true;
-  for (var i = 0, n = list.length; i < n; i++) if (!predicate(list[i], i)) return false;
+  for (var i = 0, n = _count(list, "allMatch"); i < n; i++) if (!predicate(list[i], i)) return false;
   return true;
 }
 
 // @enforced-by caller-array-copied-live
 function snapshot(list) {
   if (!_isArray(list)) throw new TypeError("guard.list.snapshot: the receiver must be an array");
-  var n = list.length;
+  var n = _count(list, "snapshot");
   var out = [];
   for (var i = 0; i < n; i++) {
     _defineProperty(out, i, { value: list[i], writable: true, enumerable: true, configurable: true });
@@ -59,11 +87,36 @@ function snapshot(list) {
   return out;
 }
 
+/** @internal A sorted COPY, taken and ordered through the captured operations. A DER SET OF is ordered
+ *  by its encoded bytes, so the sort decides the bytes emitted and the comparison decides the order:
+ *  MEASURED, replacing either `Array.prototype.slice` or `Array.prototype.sort` made a certification
+ *  request's attribute set encode a member other than the one that had just been validated, on a path
+ *  whose output is then signed. The snapshot comes first, so the caller's array is never reordered.
+ *
+ * @enforced-by behavioral -- `x.slice().sort(cmp)` has no rename-proof shape of its own beyond the two
+ * method names, and the conformance vector is the SET-OF ordering one each format already carries.
+ */
+function sortedCopy(list, compare) {
+  var out = snapshot(list);
+  return _arrSort(out, compare);
+}
+
+/** @internal `onCount`, where a caller passes one, is handed the count this walk will use, before any
+ *  slot is read. It is how a caller caps the length WITHOUT reading it a second time. A caller that read
+ *  `list.length` itself to cap it and then called this had two reads of one quantity, and they can
+ *  disagree: `Array.isArray` is true for a Proxy whose target is an array, and a `get` trap answers
+ *  "length" afresh each time, so MEASURED, a cap that saw 0 passed while the walk below saw 1 and the
+ *  caller committed to a one-element result the cap had approved as empty. The caller keeps its own typed
+ *  error and its own message; only the number is the guard's to hand over. */
 // @enforced-by caller-array-copied-live
-function copyMap(list, fn) {
+function copyMap(list, fn, onCount) {
   if (!_isArray(list)) throw new TypeError("guard.list.copyMap: the receiver must be an array");
   if (typeof fn !== "function") throw new TypeError("guard.list.copyMap: the second argument must be a function");
-  var n = list.length;
+  if (onCount !== undefined && typeof onCount !== "function") {
+    throw new TypeError("guard.list.copyMap: onCount must be a function when supplied");
+  }
+  var n = _count(list, "copyMap");
+  if (onCount !== undefined) onCount(n);
   var out = [];
   for (var i = 0; i < n; i++) {
     _defineProperty(out, i, { value: fn(list[i], i), writable: true, enumerable: true, configurable: true });
@@ -72,7 +125,9 @@ function copyMap(list, fn) {
 }
 
 module.exports = _freeze({
+  count: _count,
   append: append,
+  sortedCopy: sortedCopy,
   contains: contains,
   containsAll: containsAll,
   anyMatches: anyMatches,

package/lib/guard-name.js

@@ -4,7 +4,8 @@
 // @internal
 
 var intrinsic = require("./guard-intrinsic");
-var _append = require("./guard-list").append;
+var guardList = require("./guard-list");
+var _append = guardList.append;
 var _assertCanonicalOid = require("./guard-identifier").assertCanonicalOid;
 var _ipUtils = require("./ip-utils");
 var _isIPv4 = _ipUtils.isIPv4;
@@ -33,6 +34,12 @@ var _getOwnPropertyDescriptor = intrinsic.getOwnPropertyDescriptor;
 
 // @enforced-by behavioral -- the control-byte reject has no rename-proof code
 function assertNoControlBytes(str, E, code, label) {
+  /** @internal A PRIMITIVE string, required rather than assumed. Every lib caller passes one, but this
+   * is exported, and on anything else the scan reads a `length` and a character through hooks that can
+   * answer differently on each of the two reads per position: a scan that is handed an allowed
+   * character at each position it tests never examines one stable value. A primitive's length and
+   * characters cannot change, which is what makes every read below the same read. */
+  if (typeof str !== "string") throw E(code, label + " must be a string to be scanned for control bytes");
   for (var i = 0; i < str.length; i++) {
     var c = _charCodeAt(str, i);
     if (c === 0 || (c < 0x20 && c !== 0x09)) {
@@ -46,7 +53,11 @@ function assertNoControlBytes(str, E, code, label) {
 function assertPrintableIa5(buf, E, code, label) {
   var n = intrinsic.sizeOf(buf);
   for (var i = 0; i < n; i++) {
-    if (buf[i] < 0x20 || buf[i] > 0x7e) {
+    /** @internal ONE read per position. Written `buf[i] < 0x20 || buf[i] > 0x7e` the byte was read
+     * twice whenever the first test was false, so two answers could pass both tests although neither
+     * is printable: a high answer clears the low bound and a low answer clears the high one. */
+    var byte = buf[i];
+    if (byte < 0x20 || byte > 0x7e) {
       throw E(code, label + " must be a printable IA5String (no control bytes)");
     }
   }
@@ -66,29 +77,51 @@ function _canonAttrValue(v, E, code, label) {
   }
   return _toLowerCase(out);
 }
+/** @internal Both lengths are NARROWED where they are taken, and every test and walk below asks the
+ * local. `Array.isArray` is true for a Proxy whose target is an array and a `get` trap answers `length`
+ * afresh on each read, so the equality test and the walk that follows it could see two different counts:
+ * a length answering equal to its partner and then shorter had two names that differ in a later element
+ * compare EQUAL, and this comparison is what chains a certificate to its issuer, matches a CRL to its
+ * scope and applies a name constraint. Returned as a pair so the caller holds one count per side. */
 function _assertSequence(a, b, E, code, label, what) {
   if (!_isArray(a) || !_isArray(b)) {
     throw E(code, "cannot compare " + label + ": " + what + " comparison requires the RDN sequence on both sides (pass name.rdns, not the parsed Name)");
   }
-  if (_hasHole(a) || _hasHole(b)) {
+  var na = guardList.count(a, "name comparison");
+  var nb = guardList.count(b, "name comparison");
+  if (_hasHole(a, na) || _hasHole(b, nb)) {
     throw E(code, "cannot compare " + label + ": " + what + " comparison requires a dense sequence on both sides");
   }
+  return { a: na, b: nb };
 }
 
-function _hasHole(arr) {
-  for (var i = 0; i < arr.length; i++) { if (!_hasOwn(arr, i)) return true; }
+function _hasHole(arr, n) {
+  for (var i = 0; i < n; i++) { if (!_hasOwn(arr, i)) return true; }
   return false;
 }
 // @enforced-by guard-shape-reinlined  (shares the canonicalization shape declared on dnEqual)
 function rdnEqual(a, b, E, code, label) {
-  _assertSequence(a, b, E, code, label, "an RDN");
-  if (a.length !== b.length) return false;
+  var n = _assertSequence(a, b, E, code, label, "an RDN");
+  if (n.a !== n.b) return false;
   var used = _create(null);
-  for (var i = 0; i < a.length; i++) {
+  for (var i = 0; i < n.a; i++) {
+    /** @internal ONE read of the element, and one of each field, into locals the comparison then asks.
+     *  Written `a[i].type === b[j].type && canon(a[i].value) === canon(b[j].value)` the element was read
+     *  TWICE per side, so a Proxy answering a different attribute on each index read had the type come
+     *  from one attribute and the value from another: measured, an RDN whose first read answered
+     *  `{2.5.4.3, "evil"}` and whose second answered `{2.5.4.10, "good"}` compared EQUAL to
+     *  `{2.5.4.3, "good"}`, matching neither. A name that equals a name it does not hold is this
+     *  comparison's one unacceptable answer, since it is what chains a certificate to its issuer. */
+    var ea = a[i];
+    var typeA = ea == null ? undefined : ea.type;
+    var valueA = _canonAttrValue(ea == null ? undefined : ea.value, E, code, label);
     var found = false;
-    for (var j = 0; j < b.length; j++) {
+    for (var j = 0; j < n.b; j++) {
       if (used[j]) continue;
-      if (a[i].type === b[j].type && _canonAttrValue(a[i].value, E, code, label) === _canonAttrValue(b[j].value, E, code, label)) {
+      var eb = b[j];
+      var typeB = eb == null ? undefined : eb.type;
+      if (typeA !== typeB) continue;
+      if (valueA === _canonAttrValue(eb == null ? undefined : eb.value, E, code, label)) {
         used[j] = true; found = true; break;
       }
     }
@@ -99,9 +132,9 @@ function rdnEqual(a, b, E, code, label) {
 // @enforced-by guard-shape-reinlined
 // @guard-shape replace\(/\\s\+/g,
 function dnEqual(rdnsA, rdnsB, E, code, label) {
-  _assertSequence(rdnsA, rdnsB, E, code, label, "a distinguished-name");
-  if (rdnsA.length !== rdnsB.length) return false;
-  for (var i = 0; i < rdnsA.length; i++) {
+  var n = _assertSequence(rdnsA, rdnsB, E, code, label, "a distinguished-name");
+  if (n.a !== n.b) return false;
+  for (var i = 0; i < n.a; i++) {
     if (!rdnEqual(rdnsA[i], rdnsB[i], E, code, label)) return false;
   }
   return true;
@@ -331,6 +364,11 @@ function _allCharsIn(s, table) {
   return true;
 }
 
+/** @internal The one trailing dot a host name may be written with, removed before it is compared.
+ *
+ * @enforced-by behavioral -- reading the last character and slicing it off is the shape of any string
+ * trim; the guard is the vector that a base written with the dot and a name written without it reach the
+ * same verdict, and that a name of one dot alone does not become the empty string */
 function stripTrailingDot(s) { return _charAt(s, s.length - 1) === "." ? _strSlice(s, 0, -1) : s; }
 
 /** @internal Whether `s` opens with `scheme` followed by a colon, the scheme compared without
@@ -349,7 +387,11 @@ function uriSchemeIs(s, scheme) {
  * label is a host like any other and `com` constrains a top-level domain. The host is read by its
  * labels rather than by which characters it holds: a character test admits an empty label and a
  * hyphen at a label edge, and the suffix comparison below would then match a base against a name
- * that is not a name. */
+ * that is not a name.
+ *
+ * @enforced-by behavioral -- the rule is which strings are host names and which are addresses, which no
+ * code shape states; the guard is the vector set driving a dotted-quad, a single label, an empty label and
+ * a hyphen at a label edge through a URI name constraint */
 function isFqdnHost(host) {
   if (typeof host !== "string") return false;
   var h = stripTrailingDot(host);
@@ -636,6 +678,88 @@ function uriEqual(a, b) {
   return pa === pb ? "match" : "no-match";
 }
 
+/** @internal Whether two dNSName values name the same host. RFC 4343 makes DNS comparison
+ * case-insensitive, and RFC 5280 sec. 4.2.1.6 puts a dNSName in the preferred name syntax, so the value
+ * is ASCII and folding its case is the whole comparison. A value carrying a byte above 0x7f is not that
+ * syntax and is "not-comparable" rather than compared as written.
+ *
+ * Case is the only thing folded. A trailing dot is a different encoded value and stays one here, unlike in
+ * the name-constraint readers, where `stripTrailingDot` removes the dot an operator writes a base with:
+ * this compares what two artifacts encode, and folding the dot would report a match their bytes do not
+ * support.
+ *
+ * @enforced-by behavioral -- the case fold is `lowerAscii`, whose own shape detector catches a re-inlined
+ * 0x41..0x5a arithmetic anywhere in lib/; what this adds is applying it to a whole dNSName, which no shape
+ * separates from any other string comparison, and the guard is the pair differing only in case that
+ * matches beside the pair differing in a label that does not */
+function dnsNameEqual(a, b) {
+  if (typeof a !== "string" || typeof b !== "string") return "not-comparable";
+  if (!_asciiHost(a) || !_asciiHost(b)) return "not-comparable";
+  return lowerAscii(a) === lowerAscii(b) ? "match" : "no-match";
+}
+
+/** @internal Whether two decoded GeneralName entries name the same thing, each form under its own rule.
+ * Takes the entries `pki.schema.x509.decodeExtensions` puts in a subjectAltName's `names`, keyed by the
+ * context tag number RFC 5280 sec. 4.2.1.6 assigns the form.
+ *
+ * Rendering every form to a string and comparing the renderings reads two names as different that name
+ * one entity, and two as the same that do not. A dNSName is case-insensitive, an rfc822Name is
+ * case-insensitive in its host and case-sensitive in its local part, a URI needs the sec. 7.4 preparation
+ * before an exact match, a directoryName needs the sec. 7.1 attribute-by-attribute comparison, and an
+ * iPAddress is bytes. Comparing renderings answers all five the same way, so `EXAMPLE.com` and
+ * `example.com` read as two hosts while a re-encoded but equivalent DN reads as two names.
+ *
+ * Returns "match", "no-match", or "not-comparable" for a form whose values this cannot hold to its rule,
+ * which the caller reports rather than resolving either way. A form with no comparison rule of its own,
+ * including otherName, compares by its encoded bytes: two such entries are equal when they are the same
+ * bytes and otherwise unequal, which is the only verdict available without knowing the form's semantics.
+ *
+ * `E`, `code` and `label` are the caller's, for the directoryName arm, which holds a malformed rdns
+ * sequence to the caller's own domain.
+ *
+ * @enforced-by behavioral -- a switch over GeneralName tag numbers is the shape of every reader of the
+ * type, so a pattern matching it cannot tell a comparison from a decode; the guard is the matrix of
+ * thirteen vectors, one pair per form in each direction, where the pair differing only where its rule folds
+ * MATCHES and the pair differing where its rule is exact does NOT. A single arm would pass for a
+ * comparison that folded case everywhere, which is the opposite defect.
+ */
+function generalNameEqual(a, b, E, code, label) {
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return "not-comparable";
+  /** @internal Each member is read ONCE, and the tag, the dispatch and every comparison below ask the
+   *  local. Read again per arm, the tag that was MATCHED need not be the tag that was DISPATCHED on: a
+   *  getter reporting 8 to the equality test and 2 to the switch had two otherName values compared under
+   *  the case-insensitive dNSName rule, which is looser than the rule their own tag names. The same
+   *  shape sat on `value` and `bytes` in four arms, where the form check and the comparison were two
+   *  reads: the check saw a Buffer and the comparison got whatever answered next. This verb decides
+   *  whether a name matches a name constraint, so a match it reports is a subtree a certificate is
+   *  allowed to speak for. */
+  var tagA = a.tagNumber, tagB = b.tagNumber;
+  if (tagA !== tagB) return "no-match";
+  var valueA = a.value, valueB = b.value;
+  switch (tagA) {
+    case 1: return emailEqual(valueA, valueB);
+    case 2: return dnsNameEqual(valueA, valueB);
+    case 4: {
+      var ra = valueA == null ? undefined : valueA.rdns;
+      var rb = valueB == null ? undefined : valueB.rdns;
+      if (!_isArray(ra) || !_isArray(rb)) return "not-comparable";
+      return dnEqual(ra, rb, E, code, label) ? "match" : "no-match";
+    }
+    case 6: return uriEqual(valueA, valueB);
+    case 7:
+      if (!_isBuffer(valueA) || !_isBuffer(valueB)) return "not-comparable";
+      return _bufferEquals(valueA, valueB) ? "match" : "no-match";
+    case 8:
+      if (typeof valueA !== "string" || typeof valueB !== "string") return "not-comparable";
+      return valueA === valueB ? "match" : "no-match";
+    default: {
+      var bytesA = a.bytes, bytesB = b.bytes;
+      if (!_isBuffer(bytesA) || !_isBuffer(bytesB)) return "not-comparable";
+      return _bufferEquals(bytesA, bytesB) ? "match" : "no-match";
+    }
+  }
+}
+
 var _ATEXT_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$%&'*+-/=?^_`{|}~");
 
 /** @internal A quoted local part (RFC 5321 sec. 4.1.2 Quoted-string): printable ASCII between
@@ -693,7 +817,11 @@ function _isAddressLiteral(s) {
 
 /** @internal The two halves of a mailbox, `null` when it carries no separator and the string
  * "ambiguous" when it carries more than one. This is the split the rfc822Name comparison runs, so a
- * constraint the comparison cannot separate is one this answers the same way. */
+ * constraint the comparison cannot separate is one this answers the same way.
+ *
+ * @enforced-by behavioral -- splitting on a separator has no shape distinct from any other split; the
+ * guard is the vector that an address carrying two at-signs answers "ambiguous" rather than splitting on
+ * one of them, which is what a boundary using `indexOf` alone would do */
 function splitMailbox(addr) {
   var first = _indexOf(addr, "@");
   if (first === -1) return null;
@@ -761,7 +889,11 @@ function constraintBaseUnreadable(tag, base) {
  * form its tag names is not a narrower namespace: an empty dNSName base matches every name, and a
  * base holding characters no host name can hold matches none, so the same value that reads as a
  * restriction either lifts one or applies to nothing. The comparisons this mirrors are in
- * lib/path-validate.js, and a base refused here is one they would answer with no verdict. */
+ * lib/path-validate.js, and a base refused here is one they would answer with no verdict.
+ *
+ * @enforced-by behavioral -- a per-tag switch over name forms is the shape of every GeneralName reader in
+ * the toolkit, so no pattern tells a refusal from a decode; the guard is the vector set proving each tag's
+ * unenforceable base is refused where an anchor is built, an empty dNSName base among them */
 function constraintBaseRefusal(tag, base) {
   if (typeof base !== "string") return "must be a string for tag " + tag;
   if (tag === 1) {
@@ -811,7 +943,12 @@ var _ATV_KEYS = ["type", "value", "name"];
  * descriptors only. A Proxy answers its own reads and an accessor runs caller code, so either one
  * at any level is refused before anything is copied: a name that decides what it says while it is
  * being read can show a narrow value to a check and a wide one to the use, and where the name is a
- * namespace restriction that is the difference between a certificate being refused and admitted. */
+ * namespace restriction that is the difference between a certificate being refused and admitted.
+ *
+ * @enforced-by behavioral -- `getOwnPropertyDescriptor` is read legitimately across lib/, so a shape built
+ * on it would fire on every honest reader; the guard is the vector set handing an anchor builder a name
+ * whose attribute is an accessor, one inheriting from a Proxy, and one carrying an index hole, each refused
+ * before a value is copied */
 function copyDnRdns(rdns, E, code, who) {
   assertPlainDnRdns(rdns, E, code, who);
   /** @internal A name of no relative names is a prefix of every name, so as a constraint it reaches
@@ -857,7 +994,13 @@ function copyDnRdns(rdns, E, code, who) {
 /** @internal The shape check the copy above relies on. */
 function assertPlainDnRdns(rdns, E, code, who) {
   if (intrinsic.types.isProxy(rdns)) throw E(code, who + " must be a plain array, not a Proxy");
-  for (var i = 0; i < rdns.length; i++) {
+  /** @internal An ARRAY, and its count narrowed where it is taken. The Proxy refusal above covers a
+   * Proxy; a plain object carrying a `length` GETTER is neither a Proxy nor an array, and it answered
+   * one count to this validation pass and another to the copy that follows, so the two passes covered
+   * different elements and the copy carried what was never checked. */
+  if (!_isArray(rdns)) throw E(code, who + " must be an array of relative distinguished names");
+  var n = guardList.count(rdns, "assertPlainDnRdns");
+  for (var i = 0; i < n; i++) {
     var rd = intrinsic.getOwnPropertyDescriptor(rdns, i);
     if (rd === undefined) continue;
     if (!_hasOwn(rd, "value")) throw E(code, who + " entry " + i + " must be a data property, not an accessor");
@@ -885,7 +1028,11 @@ function assertPlainDnRdns(rdns, E, code, who) {
 /** @internal The `rdns` of a directoryName base, captured the same way. An inherited Proxy answers
  * `in` through its has trap, which is caller code running inside a read meant to be getter-free, so
  * the prototype chain is walked before the property is asked for at all. Returns undefined when the
- * base carries no rdns array, which the caller reads as "not a directoryName base". */
+ * base carries no rdns array, which the caller reads as "not a directoryName base".
+ *
+ * @enforced-by behavioral -- walking a prototype chain before a read has no shape distinct from any other
+ * chain walk; the guard is the vector that a base inheriting from a Proxy is refused rather than having its
+ * has trap answer the `in` test, which is the read this ordering exists to keep getter-free */
 function capturedRdns(base, E, code, who) {
   if (intrinsic.types.isProxy(base)) throw E(code, who + " must not be a Proxy");
   var baseProto = intrinsic.getPrototypeOf(base);
@@ -912,7 +1059,7 @@ module.exports = intrinsic.freeze({
   lowerAscii: lowerAscii, uriSchemeIs: uriSchemeIs,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,
   isHostName: isHostName, hostLabels: hostLabels, isXnLabel: isXnLabel, uriParts: uriParts,
-  uriEqual: uriEqual,
+  uriEqual: uriEqual, dnsNameEqual: dnsNameEqual, generalNameEqual: generalNameEqual,
   constraintBaseRefusal: constraintBaseRefusal,
   constraintBaseUnreadable: constraintBaseUnreadable,
 });

package/lib/guard-range.js

@@ -3,10 +3,12 @@
 "use strict";
 // @internal
 
-var _isSafeInteger = require("./guard-intrinsic").isSafeInteger;
-var _freeze = require("./guard-intrinsic").freeze;
-var _Number = require("./guard-intrinsic").Number;
-var _BigInt = require("./guard-intrinsic").BigInt;
+var intrinsic = require("./guard-intrinsic");
+var _isSafeInteger = intrinsic.isSafeInteger;
+var _freeze = intrinsic.freeze;
+var _Number = intrinsic.Number;
+var _BigInt = intrinsic.BigInt;
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 
 var UINT31_MAX = 2147483647n;
 var SAFE_MAX   = 9007199254740991n;
@@ -56,8 +58,43 @@ function uint64(value, E, code, label) {
   return v;
 }
 
+var ASCII_ZERO = 48;
+var ASCII_NINE = 57;
+var UINT64_MAX_DIGITS = 20;
+
+/** @internal An ASCII decimal integer arriving as TEXT: a C2SP checkpoint's tree-size line, or
+ *  protojson, which encodes int64 and uint64 as JSON strings. `BigInt(s)` is the wrong tool here
+ *  and silently converts "", " 12 ", "007", "+7", "-0", "0x10", "0b11" and "0o17"; the empty string
+ *  becoming 0n turns a missing size into a claim about an empty tree. The scan accepts ASCII digits
+ *  and nothing else, so a radix or sign notation added later is refused without being enumerated.
+ *  UINT64_MAX_DIGITS is the width of 18446744073709551615, so a longer run is out of range before
+ *  a value is built and a hostile run of digits never becomes a BigInt. */
+// @enforced-by guard-shape-reinlined
+// @guard-shape \* 10n \+
+function decimalUint64(value, E, code, label) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw E(code, label + " must be a non-empty string holding an ASCII decimal integer");
+  }
+  if (value.length > 1 && _charCodeAt(value, 0) === ASCII_ZERO) {
+    throw E(code, label + " must not carry a leading zero");
+  }
+  if (value.length > UINT64_MAX_DIGITS) {
+    throw E(code, label + " must be a uint64 in [0, 2^64)");
+  }
+  var v = 0n;
+  for (var i = 0; i < value.length; i++) {
+    var c = _charCodeAt(value, i);
+    if (c < ASCII_ZERO || c > ASCII_NINE) {
+      throw E(code, label + " must be ASCII decimal digits with no sign, radix prefix or whitespace");
+    }
+    v = v * 10n + _BigInt(c - ASCII_ZERO);
+  }
+  if (v > UINT64_MAX) throw E(code, label + " must be a uint64 in [0, 2^64)");
+  return v;
+}
+
 // @enforced-by guard-shape-reinlined
-// @guard-shape Number\.isSafeInteger\(\s*[A-Za-z_$][\w$]*\s*\)\s*\)\s*return BigInt
+// @guard-shape Number\.isSafeInteger\(\s*[A-Za-z_$][\w$]*\s*\)\s*\)\s*return BigInt|typeof\s+[A-Za-z_$][\w$.\[\]]*\s*===\s*""\s*\?\s*[A-Za-z_$][\w$.\[\]]*\s*:\s*_?BigInt\(
 function authoredInteger(value, E, code, label) {
   if (typeof value === "bigint") return value;
   if (typeof value === "number" && _isSafeInteger(value)) return _BigInt(value);
@@ -66,5 +103,6 @@ function authoredInteger(value, E, code, label) {
 
 module.exports = _freeze({
   int: int, uint31: uint31, positiveInt31: positiveInt31, uint64: uint64,
+  decimalUint64: decimalUint64,
   authoredInteger: authoredInteger,
 });

package/lib/guard-text.js

@@ -7,6 +7,7 @@ var bytes = require("./guard-bytes");
 var intrinsic = require("./guard-intrinsic");
 
 var _toString = intrinsic.uncurry(Buffer.prototype.toString);
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _decode = intrinsic.uncurry(TextDecoder.prototype.decode);
 var _byteLength = Buffer.byteLength;
 var _isInteger = Number.isInteger;
@@ -37,6 +38,45 @@ function decode(input, maxBytes, ErrorClass, spec) {
   throw new ErrorClass(spec.badInput, spec.label + " expects a string or a byte source (Buffer / TypedArray / DataView / ArrayBuffer)");
 }
 
+/** A string is well-formed UTF-16 before it is converted to UTF-8 bytes. An unpaired surrogate has no
+ * UTF-8 encoding, and every conversion in the platform substitutes U+FFFD for it rather than failing:
+ * `Buffer.from(s, "utf8")`, `TextEncoder.encode` and `Buffer.byteLength` all do. So two strings that
+ * differ only in that code unit produce the SAME bytes, and wherever those bytes are signed, hashed or
+ * compared the substitution is a collision: a signature made over one verifies over the other, and the
+ * value a caller reads back is the other one. The string is scanned by code unit, per the project rule
+ * against regular expressions in lib/, and a well-formed pair is left alone, being an ordinary code
+ * point above the BMP.
+ *
+ * `label` names the string in the fault. The caller supplies its own ErrorClass and code so each
+ * boundary keeps its own domain/reason.
+ *
+ * The shape is a surrogate-boundary constant followed, inside the same function, by a throw: a range
+ * test that REFUSES. A function that tests the same range to MEASURE a string rather than to reject it
+ * is not this rule and is not matched, which is why the throw is part of the shape rather than the
+ * constants alone. Bounded by the function-closing brace rather than a character count, so it does not
+ * stop matching as a body grows.
+ *
+ * @enforced-by guard-shape-reinlined
+ * @guard-shape 0x[dD](?:[bB][fF][fF]|[cC]00)(?:(?!\n\})[\s\S])*?throw
+ */
+function assertWellFormedUtf16(s, ErrorClass, code, label) {
+  for (var i = 0; i < s.length; i++) {
+    var u = _charCodeAt(s, i);
+    if (u < 0xd800 || u > 0xdfff) continue;
+    if (u > 0xdbff) {
+      throw new ErrorClass(code, label + " has an unpaired low surrogate at index " + i +
+        "; it has no UTF-8 encoding and would be converted to U+FFFD, colliding with other strings");
+    }
+    var next = i + 1 < s.length ? _charCodeAt(s, i + 1) : -1;
+    if (next < 0xdc00 || next > 0xdfff) {
+      throw new ErrorClass(code, label + " has an unpaired high surrogate at index " + i +
+        "; it has no UTF-8 encoding and would be converted to U+FFFD, colliding with other strings");
+    }
+    i += 1;
+  }
+  return s;
+}
+
 // @enforced-by behavioral -- a safe error-message formatter has no rename-proof code shape; the RED vector (a BigInt or cyclic caller value renders to a typed error, never a native TypeError out of a raw JSON.stringify) is the guard.
 function showValue(v) {
   if (typeof v === "string") return intrinsic.stringify(v);
@@ -82,4 +122,5 @@ function _thrownFallback(e) {
 
 module.exports = intrinsic.freeze({
   decode: decode, showValue: showValue, keyOf: keyOf, describeThrown: describeThrown,
+  assertWellFormedUtf16: assertWellFormedUtf16,
 });

package/lib/guard-verdict.js

@@ -20,17 +20,45 @@ function _copyOwn(out, src) {
   }
 }
 
+/** @internal Resolving a promise reads `then` off the value, so an inherited accessor would run with
+ * the verdict as its receiver and could rewrite a field or hand the caller a different object. An own
+ * `then` ends that lookup, and is non-enumerable so keys, JSON, a spread and a deep-equality
+ * comparison do not see it.
+ *
+ * `shield` adds that sentinel to the object it is given. It is the form for a result whose SHAPE must
+ * survive: a parse result carrying nested structure, a row inside an array a caller indexes, an
+ * object whose prototype is null. `of` copies, which is right for a verdict assembled from a literal
+ * and wrong for anything whose non-enumerable members, accessors or identity a caller reads.
+ *
+ * @enforced-by behavioral -- the defect is the ABSENCE of this call at a construction site, which has
+ * no code shape of its own. The guard is the conformance vector per verb: a verdict-shaped object
+ * returned to a caller while an inherited `Object.prototype.then` is installed must still report the
+ * toolkit's answer.
+ */
+function shield(target) {
+  if (target === null || typeof target !== "object") return target;
+  /** @internal An own `then` the object already carries is left alone when it is not callable: the
+   * lookup ends there already, and overwriting it would DELETE a member. A parsed JSON document may
+   * carry a `then` of its own, and `{"then":42,"other":1}` round-tripped as `{"other":1}` when this
+   * replaced it unconditionally. A CALLABLE own `then` is the thenable itself rather than data, and
+   * JSON cannot produce one, so it is replaced. */
+  if (_hasOwn(target, "then")) {
+    var d = _getOwnPropertyDescriptor(target, "then");
+    /** @internal A DATA property only. An own accessor is replaced without being read: it answers each
+     * read separately, so one that returns a non-function now can return a function when the promise
+     * machinery looks, and reading it to decide would be the one read that does not count. */
+    if (d && _hasOwn(d, "value") && typeof d.value !== "function") return target;
+  }
+  _defineProperty(target, "then", { value: undefined, enumerable: false, configurable: true, writable: true });
+  return target;
+}
+
 // @enforced-by behavioral -- the defect is the ABSENCE of this call at a construction site, not a
 function of(src, extras) {
   var out = {};
   _copyOwn(out, src);
   if (extras != null) _copyOwn(out, extras);
-  /** @internal Resolving a promise reads `then` off the value, so an inherited accessor would run
-   * with the verdict as its receiver and could rewrite a field or hand the caller a different
-   * object. An own `then` ends that lookup, and is non-enumerable so keys, JSON, a spread and a
-   * deep-equality comparison do not see it. */
-  _defineProperty(out, "then", { value: undefined, enumerable: false, configurable: true, writable: true });
-  return out;
+  return shield(out);
 }
 
 // @enforced-by behavioral -- Object.hasOwn and hasOwnProperty are replaceable at any time, and a
@@ -41,7 +69,10 @@ function carries(obj, key) {
 // @enforced-by behavioral -- for a target that cannot be rebuilt, an Error carrying a field a
 function set(target, key, value) {
   _defineProperty(target, key, { value: value, enumerable: true, configurable: true, writable: true });
-  return target;
+  /** @internal The target leaves here carrying the sentinel as well. A field set on an object is the
+   * same kind of value a verdict is, and a target that reached a promise resolution without one would
+   * hand the lookup to Object.prototype however it was assembled. */
+  return shield(target);
 }
 
-module.exports = _freeze({ of: of, carries: carries, set: set });
+module.exports = _freeze({ of: of, shield: shield, carries: carries, set: set });