@blamejs/pki 0.8.54 → 0.8.56

package/lib/crmf-sign.js

@@ -43,10 +43,9 @@ var _Promise = intrinsic.Promise;
 var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 /** @internal `verifyPop`'s verdict is the aggregate of the per-message results, so a replaced `all`
  *  that resolves a fabricated array reports an unverified proof of possession as verified. */
-var _promiseAll = intrinsic.uncurry(intrinsic.promiseAll);
 var _hasOwn = intrinsic.hasOwn;
 var _isBuffer = intrinsic.isBuffer;
-var _push = intrinsic.push, _String = intrinsic.String;
+var _String = intrinsic.String;
 var _stringify = intrinsic.stringify;
 var cms = require("./schema-cms");
 var possession = require("./possession");
@@ -108,7 +107,7 @@ function _ctlPossession(v) {
     b.raw(_b.reqDer(issuerRaw, "statementOfPossession signer.issuer (the signature certificate's issuer Name DER)")),
     b.integer(guard.range.authoredInteger(signer.serialNumber, _err, "crmf/bad-controls", "statementOfPossession signer.serialNumber")),
   ])];
-  if (v.certificate != null) _push(fields, b.raw(_b.reqDer(v.certificate, "statementOfPossession certificate")));
+  if (v.certificate != null) guard.list.append(fields, b.raw(_b.reqDer(v.certificate, "statementOfPossession certificate")));
   var der = b.sequence(fields);
   try { possession.parse(der); }
   catch (e) { throw _err("crmf/bad-controls", "statementOfPossession: " + ((e && e.message) || _String(e)), e); }
@@ -177,8 +176,8 @@ function _encodeOptionalValidity(validity) {
   var nb = validity.notBefore, na = validity.notAfter;
   if (nb == null && na == null) throw _err("crmf/bad-validity", "validity must contain notBefore or notAfter (RFC 4211 sec. 5)");
   var parts = [];
-  if (nb != null) parts.push(b.explicit(0, _b.timeDer(nb, "validity notBefore")));
-  if (na != null) parts.push(b.explicit(1, _b.timeDer(na, "validity notAfter")));
+  if (nb != null) guard.list.append(parts, b.explicit(0, _b.timeDer(nb, "validity notBefore")));
+  if (na != null) guard.list.append(parts, b.explicit(1, _b.timeDer(na, "validity notAfter")));
   // allow:nan-date-comparison-unguarded -- both instants passed timeDer's guard.time.assertEncodable above.
   if (nb != null && na != null && guard.time.instantOf(nb) > guard.time.instantOf(na)) throw _err("crmf/bad-validity", "notBefore must not be after notAfter");
   return b.implicit(4, b.sequence(parts));
@@ -190,19 +189,22 @@ function _encodeCertTemplate(tpl, opts) {
   var fields = [];
   if (tpl.version != null) {
     if (tpl.version !== 2) throw _err("crmf/bad-version", "certTemplate version MUST be 2 (v3) if supplied (RFC 4211 sec. 5)");
-    fields.push(b.implicit(0, b.integer(2n)));
+    guard.list.append(fields, b.implicit(0, b.integer(2n)));
   }
-  if (tpl.serialNumber != null) fields.push(b.implicit(1, _b.serialInteger(tpl.serialNumber)));
-  if (tpl.issuer != null) fields.push(b.explicit(3, _b.encodeName(tpl.issuer)));
-  if (tpl.validity != null) fields.push(_encodeOptionalValidity(tpl.validity));
-  if (tpl.subject != null) fields.push(b.explicit(5, _b.encodeName(tpl.subject)));
+  /** @internal Appended through the guard. These members are the template a proof of possession is
+   * computed over and a CA issues from, so a replaced append that drops or substitutes one changes
+   * what was requested from what was proven. */
+  if (tpl.serialNumber != null) guard.list.append(fields, b.implicit(1, _b.serialInteger(tpl.serialNumber)));
+  if (tpl.issuer != null) guard.list.append(fields, b.explicit(3, _b.encodeName(tpl.issuer)));
+  if (tpl.validity != null) guard.list.append(fields, _encodeOptionalValidity(tpl.validity));
+  if (tpl.subject != null) guard.list.append(fields, b.explicit(5, _b.encodeName(tpl.subject)));
   var spki = null;
   if (tpl.publicKey != null) {
     spki = _b.reqDer(tpl.publicKey, "certTemplate.publicKey (the SPKI DER of the requested key)");
     _b.assertValidSpki(spki, "certTemplate.publicKey");
-    fields.push(b.implicit(6, spki));
+    guard.list.append(fields, b.implicit(6, spki));
   }
-  if (tpl.extensions != null) fields.push(b.implicit(9, _b.requestedExtensions(tpl.extensions, spki)));
+  if (tpl.extensions != null) guard.list.append(fields, b.implicit(9, _b.requestedExtensions(tpl.extensions, spki)));
   return { der: b.sequence(fields), spki: spki, complete: tpl.subject != null && tpl.publicKey != null };
 }
 
@@ -237,7 +239,7 @@ function _buildAttrTypeAndValues(spec, code, label, valueMap, collect) {
     var typeOid = O(k);
     if (seen[typeOid]) throw _err(code, "duplicate " + label + " type " + k);
     seen[typeOid] = true;
-    out.push(b.sequence([b.oid(typeOid), enc(spec[k])]));
+    guard.list.append(out, b.sequence([b.oid(typeOid), enc(spec[k])]));
   });
   if (!out.length) throw _err(code, label + " must carry at least one entry");
   return b.sequence(out);
@@ -916,19 +918,23 @@ function _buildEncryptedKeyPop(pop, outerTag, template) {
       "the proof is that the enclosed private key is the one being certified (RFC 4211 sec. 4.2)");
   }
   encKeyWithIdDer = _encKeyWithID(privateKeyDer, pop.identifier);
-  return _assertEnclosedKeyMatches(privateKeyDer, template.spki).then(function () {
-    return cmsEncrypt.encrypt(encKeyWithIdDer, recipients, { contentType: "encKeyWithID", contentEncryptionAlgorithm: cea })
-      .then(null, function (e) {
-        if (e instanceof CrmfError) throw e;
-        throw _err("crmf/bad-input", "the encryptedKey proof of possession could not envelope the private key to " +
-          "pop.recipients: " + ((e && e.message) || e), e);
-      });
-  })
-    .then(function (contentInfo) {
-      var inner = _bareEnvelopedData(contentInfo);
-      return b.explicit(outerTag, b.implicit(4, inner));
-    })
-    .then(function (out) { wipe(); return out; }, function (e) { wipe(); throw e; });
+  /** @internal Each step is continued through the capture. The first decides whether the enclosed
+   * private key IS the one being certified, which is the whole proof, and the last is what wipes the
+   * key material whichever way the chain settles. */
+  var enveloped = intrinsic.chain(_assertEnclosedKeyMatches(privateKeyDer, template.spki), function () {
+    var encrypted = cmsEncrypt.encrypt(encKeyWithIdDer, recipients,
+      { contentType: "encKeyWithID", contentEncryptionAlgorithm: cea });
+    return intrinsic.chain(encrypted, null, function (e) {
+      if (e instanceof CrmfError) throw e;
+      throw _err("crmf/bad-input", "the encryptedKey proof of possession could not envelope the private key to " +
+        "pop.recipients: " + ((e && e.message) || e), e);
+    });
+  });
+  var wrapped = intrinsic.chain(enveloped, function (contentInfo) {
+    var inner = _bareEnvelopedData(contentInfo);
+    return b.explicit(outerTag, b.implicit(4, inner));
+  });
+  return intrinsic.chain(wrapped, function (out) { wipe(); return out; }, function (e) { wipe(); throw e; });
   }
 }
 
@@ -964,9 +970,9 @@ function _assertEnclosedKeyMatches(privateKeyDer, templateSpki) {
    * cannot use it, so those are proven by USING the key against the template. */
   var enclosedAlg = key.algorithmOidAt(privateKeyDer, 1);
   if (enclosedAlg !== null && !key.isDhOid(enclosedAlg)) return _assertEnclosedKeyCorresponds(privateKeyDer, templateSpki);
-  return _promiseResolve(_Promise, undefined)
-    .then(function () { return key.publicFromPrivate(privateKeyDer); })
-    .then(function (derivedSpki) {
+  var derivedP = intrinsic.chain(_promiseResolve(_Promise, undefined),
+    function () { return key.publicFromPrivate(privateKeyDer); });
+  return intrinsic.chain(derivedP, function (derivedSpki) {
       var derived = guard.bytes.view(derivedSpki, CrmfError, "crmf/bad-input", "the derived public key");
       var wanted = guard.bytes.view(templateSpki, CrmfError, "crmf/bad-input", "certTemplate.publicKey");
       /** @internal A finite-field key names itself in either encoding here too, and an enclosed key
@@ -1074,12 +1080,20 @@ function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts, po
     signedRegion = poposkSeq;
     poposkInputField = b.implicit(0, poposkSeq);
   }
-  return signScheme.signOverTbs(scheme, signingKey, signedRegion, _signE).then(function (sig) {
-    return _promiseResolve(_Promise, _b.assertSignatureVerifies(signedRegion, sig, provingSpki, scheme)).then(function () {
+  /** @internal Both continuations are captured. The inner one runs after the proof's own signature
+   * has been verified against the key being certified, so a replacement settling it emits a proof
+   * whose signature was never checked against that key. */
+  return intrinsic.chain(signScheme.signOverTbs(scheme, signingKey, signedRegion, _signE), function (sig) {
+    var selfChecked = _promiseResolve(_Promise, _b.assertSignatureVerifies(signedRegion, sig, provingSpki, scheme));
+    return intrinsic.chain(selfChecked, function () {
       var popoChildren = [];
-      if (poposkInputField) popoChildren.push(poposkInputField);
-      popoChildren.push(scheme.sigAlgId);
-      popoChildren.push(b.bitString(sig, 0));
+      /** @internal Appended through the guard, which defines the index rather than calling a method
+       * the prototype answers for. These three members ARE the proof: the signature value is added
+       * AFTER it has been verified against the key being certified, so a replaced append that alters
+       * it emits a proof whose bytes nothing checked. */
+      if (poposkInputField) guard.list.append(popoChildren, poposkInputField);
+      guard.list.append(popoChildren, scheme.sigAlgId);
+      guard.list.append(popoChildren, b.bitString(sig, 0));
       return b.implicit(1, b.sequence(popoChildren));
     });
   }, function (e) {
@@ -1171,7 +1185,7 @@ function _buildCertReqMsg(spec, key, opts) {
   var template = _encodeCertTemplate(spec.certTemplate);
   var certReqChildren = [b.integer(_certReqId(spec.certReqId)), template.der];
   var encodedControls = [];
-  if (spec.controls != null) certReqChildren.push(_buildAttrTypeAndValues(spec.controls, "crmf/bad-controls", "controls", CONTROL_VALUE, encodedControls));
+  if (spec.controls != null) guard.list.append(certReqChildren, _buildAttrTypeAndValues(spec.controls, "crmf/bad-controls", "controls", CONTROL_VALUE, encodedControls));
   var certReqDer = b.sequence(certReqChildren);
 
   /** @internal The key the RFC 9883 control names, when the request carries one: that key makes the
@@ -1196,10 +1210,12 @@ function _buildCertReqMsg(spec, key, opts) {
     possessionSpki = _encodedPossessionSpki(encodedControls);
   }
 
-  return _promiseResolve(_Promise, _buildProofOfPossession(spec.pop, certReqDer, template, signingKey, opts, possessionSpki)).then(function (popoDer) {
+  var popoP = _promiseResolve(_Promise,
+    _buildProofOfPossession(spec.pop, certReqDer, template, signingKey, opts, possessionSpki));
+  return intrinsic.chain(popoP, function (popoDer) {
     var msgChildren = [certReqDer];
-    if (popoDer) msgChildren.push(popoDer);
-    if (spec.regInfo != null) msgChildren.push(_buildAttrTypeAndValues(spec.regInfo, "crmf/bad-reg-info", "regInfo", REGINFO_VALUE));
+    if (popoDer) guard.list.append(msgChildren, popoDer);
+    if (spec.regInfo != null) guard.list.append(msgChildren, _buildAttrTypeAndValues(spec.regInfo, "crmf/bad-reg-info", "regInfo", REGINFO_VALUE));
     return b.sequence(msgChildren);
   });
 }
@@ -1218,7 +1234,9 @@ function _build(spec, key, opts) {
     specs = [spec];
   }
   if (!specs.length) throw _err("crmf/bad-input", "at least one certificate request message is required (RFC 4211 sec. 3)");
-  return _promiseAll(_Promise, specs.map(function (s) { return _buildCertReqMsg(s, key, opts); })).then(function (msgs) {
+  return intrinsic.chain(intrinsic.allOf(intrinsic.mapList(specs, function (s) {
+    return _buildCertReqMsg(s, key, opts);
+  })), function (msgs) {
     var der = b.sequence(msgs);
     if (opts.pem != null) {
       if (typeof opts.pem !== "string" || !opts.pem) throw _err("crmf/bad-input", "opts.pem must be a non-empty PEM label string");
@@ -1310,7 +1328,10 @@ function _verifyOne(msg) {
     spki = sopSpki;
     bound = false;
   }
-  return crmfVerify.verifyPopSignature(popo, spki, preimage).then(function (ok) {
+  /** @internal The continuation comes from the capture. It is where the signature answer becomes this
+   * message's verdict, so a replacement settling it hands back a record stating `verified: true` for
+   * a proof nothing checked, and the aggregate above then reports the whole set as verified. */
+  return intrinsic.chain(crmfVerify.verifyPopSignature(popo, spki, preimage), function (ok) {
     return guard.verdict.of(base, {
       valid: ok === true, verified: ok === true, method: "signature", cryptographicallyVerified: ok === true,
       subject: bound ? base.subject : null,
@@ -1368,9 +1389,17 @@ function _verifyOne(msg) {
 function verifyPop(messages) { return guard.async.deferred(function () { return _verifyPop(messages); }); }
 function _verifyPop(messages) {
   var parsed = _coerceMessages(messages);
-  return _promiseAll(_Promise, parsed.messages.map(_verifyOne)).then(function (out) {
-    var allVerified = out.length > 0 && out.every(function (m) { return m.verified === true; });
-    return guard.verdict.of({ valid: allVerified, verified: allVerified, messages: out });
+  /** @internal The aggregate, the projection into it and the universal test over its results all come
+   * from the captures. This IS the proof-of-possession verdict for a set of requests: the aggregate's
+   * static form reads `resolve` off the constructor at each call, so a replacement answers for every
+   * message without one being verified, and the test below is what requires all of them to have
+   * verified. */
+  return intrinsic.chain(intrinsic.allOf(intrinsic.mapList(parsed.messages, _verifyOne)), function (out) {
+    var allVerified = out.length > 0 && intrinsic.everyOwn(out, function (m) { return m && m.verified === true; });
+    /** @internal Copied before it is handed back. The aggregate's own list carries no prototype, so
+     * that a `then` installed on `Array.prototype` cannot settle the aggregate with something else;
+     * a caller reading `result.messages` expects an ordinary array it can iterate and map. */
+    return guard.verdict.of({ valid: allVerified, verified: allVerified, messages: intrinsic.copyList(out) });
   });
 }
 

package/lib/crmf-verify.js

@@ -12,4 +12,4 @@ function verifyPopSignature(popo, spkiBytes, preimage) {
   return _seam.verify(popo.algorithmIdentifier, popo.signature, spkiBytes, preimage);
 }
 
-module.exports = { setEngine: _seam.setEngine, verifyPopSignature: verifyPopSignature };
+module.exports = Object.freeze({ setEngine: _seam.setEngine, verifyPopSignature: verifyPopSignature });

package/lib/csr-verify.js

@@ -13,4 +13,4 @@ function verifyCsrSignature(parsed) {
     parsed.subjectPublicKeyInfo.bytes, parsed.certificationRequestInfoBytes);
 }
 
-module.exports = { setEngine: _seam.setEngine, verifyCsrSignature: verifyCsrSignature };
+module.exports = Object.freeze({ setEngine: _seam.setEngine, verifyCsrSignature: verifyCsrSignature });

package/lib/ct.js

@@ -1353,18 +1353,16 @@ function _clientDoor(opts, keyName) {
 }
 
 /** @internal Every DECLARED option the bag can answer, read once into a record of plain values, before
- *  anything derives from one. `in` is used rather than an enumeration because the door accepts an option
- *  supplied through a caller's defaults object, and an enumeration omits an inherited FUNCTION member,
- *  which silently dropped a `transport` and fell through to opening a real connection. It consults the
- *  prototype chain exactly as the direct reads it replaces did, so it carries no new exposure, and
- *  absence survives: a name the bag cannot answer is left out rather than materialized as `undefined`,
- *  which a guard that tells absent from present-and-undefined depends on. */
+ *  anything derives from one. The presence-preserving snapshot is the one this module needs: absence
+ *  survives, so a name the bag cannot answer is left out rather than materialized as `undefined`,
+ *  which is what lets an absent `transport` still mean "open the connection yourself, under the
+ *  pinned anchors". It consults the prototype chain exactly as the direct reads it replaces did,
+ *  because the door accepts an option supplied through a caller's defaults object and an enumeration
+ *  omits an inherited FUNCTION member, which silently dropped a `transport` and fell through to
+ *  opening a real connection. */
+// @guard-via guard.identifier.snapshotPresentOptions
 function _takeTopLevel(bag, known) {
-  var o = intrinsic.create(null);
-  intrinsic.forEach(intrinsic.keys(known), function (k) {
-    if (k in bag) o[k] = bag[k];
-  });
-  return o;
+  return guard.identifier.snapshotPresentOptions(bag, known);
 }
 
 /** @internal The two values a verdict rests on, made IMMUNE rather than merely taken. Holding a
@@ -2255,7 +2253,7 @@ async function fetchLogList(opts) {
   });
 }
 
-module.exports = {
+module.exports = intrinsic.freeze({
   parseSctList: parseSctList,
   reconstructSignedData: reconstructSignedData,
   verifySct: verifySct,
@@ -2278,4 +2276,4 @@ module.exports = {
   addPreChain: addPreChain,
   HASH_ALGORITHMS: HASH_ALGORITHMS,
   SIGNATURE_ALGORITHMS: SIGNATURE_ALGORITHMS,
-};
+});

package/lib/edwards-point.js

@@ -73,4 +73,4 @@ function validateSpki(spkiBytes, crv, E, code) {
   }
 }
 
-module.exports = { validate: validate, validateSpki: validateSpki };
+module.exports = Object.freeze({ validate: validate, validateSpki: validateSpki });

package/lib/est.js

@@ -287,7 +287,7 @@ function _findMultipartMarks(text, boundary) {
       if (lsN !== -1) { var r1 = _matchDelimAt(text, lsN, boundary); if (r1) { found = r1; foundAt = p; break; } }
     }
     if (!found) break;
-    marks[marks.length] = { at: foundAt, bodyStart: found.end, close: found.close };
+    guard.list.append(marks, { at: foundAt, bodyStart: found.end, close: found.close });
     searchStart = found.end === foundAt ? found.end + 1 : found.end;
   }
   return marks;
@@ -328,9 +328,9 @@ function _splitCrlf(s) {
     var nlLen = 0;
     if (_charCodeAt(s, i) === 0x0d && i + 1 < n && _charCodeAt(s, i + 1) === 0x0a) nlLen = 2;
     else if (_charCodeAt(s, i) === 0x0a) nlLen = 1;
-    if (nlLen > 0) { out[out.length] = _strSlice(s, last, i); i += nlLen; last = i; } else i += 1;
+    if (nlLen > 0) { guard.list.append(out, _strSlice(s, last, i)); i += nlLen; last = i; } else i += 1;
   }
-  out[out.length] = _strSlice(s, last, n);
+  guard.list.append(out, _strSlice(s, last, n));
   return out;
 }
 

package/lib/guard-async.js

@@ -22,6 +22,26 @@ function deferred(body) {
   catch (e) { return _reject(_Promise, e); }
 }
 
+// @internal
+/** @internal A continuation taken from the capture, for a module that holds the guards rather than
+ * the intrinsic captures directly. `p.then(f)` reads `then` off the promise at the call, so a
+ * replacement settles the chain without running `f`, and `f` is where a step's result becomes the
+ * next step's input. */
+// @enforced-by behavioral -- the RED vectors live with each consumer's own verdict
+function chain(p, onOk, onFail) {
+  return _intrinsic.chain(p, onOk, onFail);
+}
+
+// @internal
+/** @internal Run `body` once the work settles, either way, and pass the outcome through unchanged.
+ * `Promise.prototype.finally` is not this: it calls the receiver's own `then`, which is the live
+ * method, so a replacement there settles the chain with a value of its own AND skips the callback.
+ * Cleanup that wipes key material is exactly the callback that must not be skipped. */
+// @enforced-by behavioral -- each consumer's RED vector drives its own cleanup
+function cleanup(p, body) {
+  return _intrinsic.chain(p, function (out) { body(); return out; }, function (e) { body(); throw e; });
+}
+
 // @internal
 // @enforced-by behavioral -- a RED vector in each client suite refuses a transport yielding no thenable
 function awaited(value, E, code, label) {
@@ -96,4 +116,5 @@ function bounded(value, ms, E, code, label) {
   });
 }
 
-module.exports = _intrinsic.freeze({ deferred: deferred, awaited: awaited, invoked: invoked, bounded: bounded });
+module.exports = _intrinsic.freeze({ deferred: deferred, awaited: awaited, invoked: invoked, bounded: bounded,
+  chain: chain, cleanup: cleanup });

package/lib/guard-bytes.js

@@ -34,7 +34,6 @@ var _mapForEach = intrinsic.uncurry(Map.prototype.forEach);
 var _String = intrinsic.String;
 var _Date = intrinsic.Date;
 var _apply = intrinsic.apply;
-var _promiseFinally = intrinsic.promiseFinally;
 var _ArrayBuffer = intrinsic.ArrayBuffer;
 var _Uint8Array = intrinsic.Uint8Array;
 var _DataView = intrinsic.DataView;
@@ -559,10 +558,14 @@ function fixArguments(ErrorClass, code, args) {
 // @enforced-by behavioral -- an arrangement of two calls has no rename-proof shape to detect. The
 function fixedCall(ErrorClass, code, args, body) {
   var handle = null;
-  return _promiseFinally(async.deferred(function () {
+  /** @internal The release is attached on BOTH outcomes rather than through `finally`, which calls
+   * the receiver's own `then` and so reads the live method: a replacement there settles the chain
+   * with a value of its own AND skips this callback, so the fixed views stay pinned. */
+  var ran = async.deferred(function () {
     handle = fixArguments(ErrorClass, code, args);
     return _apply(body, null, handle.values);
-  }), function () { if (handle) handle.release(); });
+  });
+  return async.cleanup(ran, function () { if (handle) handle.release(); });
 }
 
 /**

package/lib/guard-identifier.js

@@ -69,7 +69,7 @@ function assertCanonicalOid(str, E, code, label, boundsCode, countCode) {
   }
   if (boundsCode === null) return str;
   var bcode = boundsCode === undefined ? code : boundsCode;
-  var parts = _strSplit(str, ".");
+  var parts = intrinsic.splitChar(str, 46);
   if (parts.length - 1 > constants.LIMITS.OID_MAX_SUBIDENTIFIERS) {
     throw E(countCode || bcode, who + " carries more than " + constants.LIMITS.OID_MAX_SUBIDENTIFIERS + " sub-identifiers");
   }
@@ -101,6 +101,28 @@ function snapshotOptions(obj, known) {
   return out;
 }
 
+/** @internal The same one-read capture, for a caller that tells an ABSENT option from one present
+ *  and holding `undefined`. `snapshotOptions` materializes every declared name, which is correct for
+ *  a caller testing `!== undefined` and wrong for one testing presence: an omitted option becomes an
+ *  own key, and a presence-based guard then sees an option the caller never passed. Measured, a bag
+ *  omitting `transport` is ACCEPTED by `assertCallableOption` and REFUSED after `snapshotOptions`,
+ *  because the materialized `undefined` is a transport that is not callable.
+ *
+ *  Presence consults the prototype chain, because a caller supplying options through a defaults
+ *  object is supplying them, and an enumeration omits an inherited FUNCTION member: that is how a
+ *  copy once dropped a `transport` and fell through to opening a real connection where the caller
+ *  had passed a fake one. The VALUE is still read once per name, which is what the snapshot is for.
+ *  The two live side by side rather than behind a flag so a caller chooses between them knowingly. */
+// @enforced-by guard-shape-reinlined
+// @guard-shape if \(\w+ in \w+\) \w+\[\w+\] = \w+\[\w+\];
+function snapshotPresentOptions(obj, known) {
+  var out = _create(null);
+  if (obj === null || obj === undefined) return out;
+  var o = _Object(obj);
+  _forEach(_getOwnPropertyNames(known), function (k) { if (k in o) out[k] = o[k]; });
+  return out;
+}
+
 /** @internal The option names a bag carries, read the way assertKnownKeys read them: every own
  *  string key, whatever its descriptor says. Object.keys reports only the enumerable ones, so an
  *  option written with `enumerable: false` clears the door and then vanishes from the read.
@@ -656,6 +678,7 @@ module.exports = intrinsic.freeze({
   optionsObject: optionsObject,
   refuseAccessorFields: refuseAccessorFields,
   snapshotOptions: snapshotOptions,
+  snapshotPresentOptions: snapshotPresentOptions,
   optionNames: optionNames,
   ownOptions: ownOptions,
   pickSettings: pickSettings,