@blamejs/pki 0.8.54 → 0.8.56

package/lib/http-digest.js

@@ -6,6 +6,7 @@
 var crypto = require("crypto");
 var constants = require("./constants");
 var intrinsic = require("./guard-intrinsic");
+var guardIdentifier = require("./guard-identifier");
 var _hasOwn = intrinsic.hasOwn;
 /** @internal The URL parser, taken at load: the origin it reports is what a challenge is bound to.
  *  Its accessors are taken with it, since the constructor's capture does not cover the prototype the
@@ -16,6 +17,22 @@ var _urlPathname = intrinsic.urlPathname;
 var _urlSearch = intrinsic.urlSearch;
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
+/** @internal The operations the challenge is parsed and classified through. This module decides which
+ * algorithm and which qop a credential is built for, and whether a weak algorithm is refused at all,
+ * so every one of them is a decision: measured, a replaced global `String` rewriting an `MD5`
+ * challenge as `SHA-256` turned `transport/proxy-digest-weak-algorithm` into an accepted credential. */
+var _strTrim = intrinsic.uncurry(String.prototype.trim);
+var _strSplit = intrinsic.uncurry(String.prototype.split);
+/** @internal The LEXER's character reads, captured because the lexer copies the challenge one
+ * character at a time and a replacement therefore chooses the token the parse assembles. Measured,
+ * rewriting `algorithm=MD5` to `algorithm=SHA-256` as the split copies it does NOT reach an accepted
+ * credential: the policy still refuses, as `proxy-digest-unsupported-algorithm` rather than
+ * `proxy-digest-weak-algorithm`. What is steerable is the REASON, so the capture is what keeps a
+ * refusal naming the fault it actually found. A parser is captured at its characters or not at all. */
+var _charAt = intrinsic.uncurry(String.prototype.charAt);
+var _strNormalize = intrinsic.uncurry(String.prototype.normalize);
+var _arrIndexOf = intrinsic.uncurry(Array.prototype.indexOf);
+var _arrJoin = intrinsic.uncurry(Array.prototype.join);
 var _fromCharCode = intrinsic.fromCharCode;
 var pkix = require("./schema-pkix");
 
@@ -29,10 +46,17 @@ var DEFAULT_CODES = intrinsic.assign(intrinsic.create(null), {
   noQop: "digest/no-qop", badChallenge: "digest/bad-challenge",
 });
 
-function H(hash, s) { return crypto.createHash(hash).update(s, "latin1").digest("hex"); }
+/** @internal The hash the credential is computed with, taken at load along with the methods of the
+ * object it returns. Every Digest response value is this function's output, so a replacement chooses
+ * what is sent in place of the password-derived proof. */
+var _createHash = crypto.createHash;
+var _randomBytes = crypto.randomBytes;
+var _hashUpdate = intrinsic.uncurry(crypto.createHash("sha256").update);
+var _hashDigest = intrinsic.uncurry(crypto.createHash("sha256").digest);
+function H(hash, s) { return _hashDigest(_hashUpdate(_createHash(hash), s, "latin1"), "hex"); }
 function KD(hash, secret, data) { return H(hash, secret + ":" + data); }
 function _qstr(v) {
-  var s = String(v), out = "";
+  var s = intrinsic.String(v), out = "";
   for (var i = 0; i < s.length; i++) { var c = _charCodeAt(s, i); if (c === 34 || c === 92) out += "\\"; out += _fromCharCode(c); }
   return "\"" + out + "\"";
 }
@@ -40,20 +64,20 @@ function _qstr(v) {
 function _commaSplitOutsideQuotes(s) {
   var out = [], buf = "", inQ = false, esc = false;
   for (var i = 0; i < s.length; i++) {
-    var c = s.charAt(i);
+    var c = _charAt(s, i);
     if (esc) { buf += c; esc = false; continue; }
     if (inQ && c === "\\") { buf += c; esc = true; continue; }
     if (c === "\"") { inQ = !inQ; buf += c; continue; }
-    if (c === "," && !inQ) { out.push(buf); buf = ""; continue; }
+    if (c === "," && !inQ) { intrinsic.append(out, buf); buf = ""; continue; }
     buf += c;
   }
-  out.push(buf);
+  intrinsic.append(out, buf);
   return out;
 }
 function _firstEqOutsideQuotes(s) {
   var inQ = false, esc = false;
   for (var i = 0; i < s.length; i++) {
-    var c = s.charAt(i);
+    var c = _charAt(s, i);
     if (esc) { esc = false; continue; }
     if (inQ && c === "\\") { esc = true; continue; }
     if (c === "\"") { inQ = !inQ; continue; }
@@ -67,10 +91,10 @@ function _unq(s) {
   return out + _strSlice(s, last, n - 1);
 }
 function _closedQuote(s) {
-  if (s.length < 2 || s.charAt(0) !== "\"") return false;
+  if (s.length < 2 || _charAt(s, 0) !== "\"") return false;
   var esc = false;
   for (var i = 1; i < s.length; i++) {
-    var c = s.charAt(i);
+    var c = _charAt(s, i);
     if (esc) { esc = false; continue; }
     if (c === "\\") { esc = true; continue; }
     if (c === "\"") return i === s.length - 1;
@@ -106,12 +130,12 @@ function _splitWhitespace(s) {
   var out = [], i = 0, n = s.length, ps = 0;
   while (i < n) {
     if (pkix.isJsWhitespace(_charCodeAt(s, i))) {
-      out[out.length] = _strSlice(s, ps, i);
+      intrinsic.append(out, _strSlice(s, ps, i));
       while (i < n && pkix.isJsWhitespace(_charCodeAt(s, i))) i += 1;
       ps = i;
     } else i += 1;
   }
-  out[out.length] = _strSlice(s, ps);
+  intrinsic.append(out, _strSlice(s, ps));
   return out;
 }
 
@@ -119,29 +143,37 @@ function _splitChallenges(s) {
   var segs = _commaSplitOutsideQuotes(s);
   var out = [], cur = null;
   for (var i = 0; i < segs.length; i++) {
-    var seg = segs[i].trim();
+    /** @internal The OUTER trim is captured as well as the inner ones. It controls the complete
+     * auth-param before anything slices it, so a replacement mapping the segment `algorithm=MD5` to
+     * `algorithm=SHA-256` classifies a weak challenge as a strong one and the refusal never fires:
+     * capturing only the key and value slices left the whole parameter steerable. */
+    var seg = _strTrim(segs[i]);
     if (seg === "") continue;
     var eq = _firstEqOutsideQuotes(seg);
-    var pre = (eq < 0 ? seg : _strSlice(seg, 0, eq)).trim();
+    var pre = _strTrim(eq < 0 ? seg : _strSlice(seg, 0, eq));
     var scheme = _matchTokenRest(pre);
-    if (eq < 0) { cur = { scheme: seg, paramText: "" }; out.push(cur); }
-    else if (scheme !== null) { cur = { scheme: scheme, paramText: _strSlice(seg, _stripTokenIndex(seg)) }; out.push(cur); }
+    if (eq < 0) { cur = { scheme: seg, paramText: "" }; intrinsic.append(out, cur); }
+    else if (scheme !== null) { cur = { scheme: scheme, paramText: _strSlice(seg, _stripTokenIndex(seg)) }; intrinsic.append(out, cur); }
     else if (cur) { cur.paramText = cur.paramText ? cur.paramText + "," + seg : seg; }
   }
   return out;
 }
+/** @internal The map this returns IS the challenge the policy is applied to, so the construction is
+ *  captured along with the lexer that fills it. A replaced construction hands back a map already
+ *  carrying an `algorithm` entry, and a challenge that names no algorithm then reads as the strong one
+ *  instead of the MD5 default that `allowMD5: false` refuses. */
 function _parseParams(paramText, E, code) {
-  var segs = _commaSplitOutsideQuotes(paramText), map = Object.create(null);
+  var segs = _commaSplitOutsideQuotes(paramText), map = intrinsic.create(null);
   for (var i = 0; i < segs.length; i++) {
-    var seg = segs[i].trim();
+    var seg = _strTrim(segs[i]);
     if (seg === "") continue;
     var eq = _firstEqOutsideQuotes(seg);
-    if (eq < 0) throw E(code, "malformed Digest auth-param (no '='): " + JSON.stringify(seg));
-    var key = _strSlice(seg, 0, eq).trim().toLowerCase();
-    var rawVal = _strSlice(seg, eq + 1).trim();
-    var quoted = rawVal.charAt(0) === "\"";
+    if (eq < 0) throw E(code, "malformed Digest auth-param (no '='): " + intrinsic.stringify(seg));
+    var key = intrinsic.toLowerCase(_strTrim(_strSlice(seg, 0, eq)));
+    var rawVal = _strTrim(_strSlice(seg, eq + 1));
+    var quoted = _charCodeAt(rawVal, 0) === 34;
     if (quoted && !_closedQuote(rawVal)) throw E(code, "an unterminated or trailing-garbage Digest quoted-string (RFC 7230 sec. 3.2.6)");
-    if (_hasOwn(map, key)) throw E(code, "repeated Digest auth-param " + JSON.stringify(key));
+    if (_hasOwn(map, key)) throw E(code, "repeated Digest auth-param " + intrinsic.stringify(key));
     var value = quoted ? _unq(rawVal) : rawVal;
     if (_hasCtl(value)) throw E(code, "a Digest auth-param value contains a control character (RFC 7230 sec. 3.2.6)");
     map[key] = { value: value, quoted: quoted };
@@ -156,42 +188,50 @@ function _validateDigest(paramText, E, code) {
   var qop = [];
   if (p.qop) {
     if (!p.qop.quoted) throw E(code, "the Digest qop must be a quoted list (RFC 7616 sec. 3.3)");
-    qop = p.qop.value.split(",").map(function (x) { return x.trim().toLowerCase(); }).filter(Boolean);
+    /** @internal The predicate that drops an empty member is written out rather than handed the
+     *  global conversion. It is what leaves `qop=""` with no members, which is the refusal below, so
+     *  a replaced conversion answering true for the empty string returned a challenge whose quality
+     *  of protection is a member the scheme does not define. */
+    qop = intrinsic.selectList(intrinsic.mapList(intrinsic.splitChar(p.qop.value, 44), function (x) {
+      return intrinsic.toLowerCase(_strTrim(x));
+    }), function (x) { return x !== ""; });
     if (qop.length === 0) throw E(code, "a present Digest qop directive must list at least one value (RFC 7616 sec. 3.3)");
   }
   if (p.domain && !p.domain.quoted) throw E(code, "the Digest domain must be a quoted-string (RFC 7616 sec. 3.3)");
-  var domain = (p.domain && p.domain.value.trim() !== "")
-    ? _splitWhitespace(p.domain.value.trim()) : null;
-  if (p.charset && (p.charset.quoted || String(p.charset.value).toUpperCase() !== "UTF-8")) throw E(code, "the Digest charset must be the unquoted token UTF-8 (RFC 7616 sec. 3.3)");
+  var domain = (p.domain && _strTrim(p.domain.value) !== "")
+    ? _splitWhitespace(_strTrim(p.domain.value)) : null;
+  if (p.charset && (p.charset.quoted || intrinsic.toUpperCase(intrinsic.String(p.charset.value)) !== "UTF-8")) throw E(code, "the Digest charset must be the unquoted token UTF-8 (RFC 7616 sec. 3.3)");
   if (p.stale) {
-    var sv = String(p.stale.value).toLowerCase();
+    var sv = intrinsic.toLowerCase(intrinsic.String(p.stale.value));
     if (p.stale.quoted || (sv !== "true" && sv !== "false")) throw E(code, "the Digest stale directive must be the unquoted token true or false (RFC 7616 sec. 3.3)");
   }
   if (p.userhash) {
-    var uhv = String(p.userhash.value).toLowerCase();
+    var uhv = intrinsic.toLowerCase(intrinsic.String(p.userhash.value));
     if (p.userhash.quoted || (uhv !== "true" && uhv !== "false")) throw E(code, "the Digest userhash directive must be the unquoted token true or false (RFC 7616 sec. 3.3)");
   }
   if (p.opaque && !p.opaque.quoted) throw E(code, "the Digest opaque directive must be a quoted-string (RFC 7616 sec. 3.3)");
   return {
     scheme: "Digest", realm: p.realm.value, nonce: p.nonce.value, qop: qop, domain: domain,
-    algorithm: p.algorithm ? p.algorithm.value.toUpperCase() : "MD5",
+    algorithm: p.algorithm ? intrinsic.toUpperCase(p.algorithm.value) : "MD5",
     opaque: p.opaque ? p.opaque.value : null,
-    stale: !!(p.stale && String(p.stale.value).toLowerCase() === "true"),
-    userhash: !!(p.userhash && String(p.userhash.value).toLowerCase() === "true"),
+    stale: !!(p.stale && intrinsic.toLowerCase(intrinsic.String(p.stale.value)) === "true"),
+    userhash: !!(p.userhash && intrinsic.toLowerCase(intrinsic.String(p.userhash.value)) === "true"),
     charset: p.charset ? p.charset.value : null,
   };
 }
 
 function parseChallenge(www, E, code, policy) {
-  var pol = policy || {};
+  /** @internal An own-key copy with no prototype, for the reason the answer path states: every policy
+   *  field is read off this record, so an inherited read is a way to supply one. */
+  var pol = guardIdentifier.ownOptions(policy);
   var codes = pol.codes || DEFAULT_CODES;
   var preferStale = !!pol.preferStale;
-  var raw = String(www == null ? "" : www);
+  var raw = intrinsic.String(www == null ? "" : www);
   if (raw.length > constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES) throw E(code, "the WWW-Authenticate header exceeds the " + constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES + "-byte cap");
   var challenges = _splitChallenges(raw);
   var best = null, bestUsable = false, bestApplicable = false, bestStale = false, bestRank = -1, sawDigest = false;
   for (var i = 0; i < challenges.length; i++) {
-    if (challenges[i].scheme.toLowerCase() !== "digest") continue;
+    if (intrinsic.toLowerCase(challenges[i].scheme) !== "digest") continue;
     sawDigest = true;
     var parsed;
     try { parsed = _validateDigest(challenges[i].paramText, E, code); }
@@ -216,19 +256,22 @@ function parseChallenge(www, E, code, policy) {
   return null;
 }
 
+/** @internal The bytes a credential is computed over, so the conversion and the encoding both come
+ * from the captures: what this returns is hashed, and a replacement changes the input to the proof. */
 function _octets(s, charset) {
-  var v = s == null ? "" : String(s);
-  return (charset && String(charset).toUpperCase() === "UTF-8") ? Buffer.from(v, "utf8").toString("latin1") : v;
+  var v = s == null ? "" : intrinsic.String(s);
+  return (charset && intrinsic.toUpperCase(intrinsic.String(charset)) === "UTF-8")
+    ? intrinsic.bufToString(intrinsic.bufferFrom(v, "utf8"), "latin1") : v;
 }
 
 function _hasNonAscii(s) {
-  s = String(s == null ? "" : s);
+  s = intrinsic.String(s == null ? "" : s);
   for (var i = 0; i < s.length; i++) { if (_charCodeAt(s, i) > 0x7F) return true; }
   return false;
 }
 
 function _pctEncodeUtf8(s) {
-  var bytes = Buffer.from(String(s == null ? "" : s), "utf8");
+  var bytes = intrinsic.bufferFrom(intrinsic.String(s == null ? "" : s), "utf8");
   var out = "";
   for (var i = 0; i < bytes.length; i++) {
     var b = bytes[i];
@@ -237,7 +280,7 @@ function _pctEncodeUtf8(s) {
         b === 0x2E || b === 0x5E || b === 0x5F || b === 0x60 || b === 0x7C || b === 0x7E) {
       out += _fromCharCode(b);
     } else {
-      out += "%" + (b < 0x10 ? "0" : "") + b.toString(16).toUpperCase();
+      out += "%" + (b < 0x10 ? "0" : "") + intrinsic.toUpperCase(intrinsic.numberToString(b, 16));
     }
   }
   return out;
@@ -249,25 +292,48 @@ function _rejection(challenge, pol, codes) {
   if (alg.hash === "md5" && !pol.allowMD5) return { code: codes.weakAlgorithm, msg: "MD5 Digest refused by default (RFC 7616 sec. 3.4 discourages it); set opts.auth.allowMD5 for legacy interop" };
   if (challenge.qop.length === 0) {
     if (!pol.allowLegacyQop) return { code: codes.noQop, msg: "a no-qop (RFC 2069) Digest challenge is refused by default; set opts.auth.allowLegacyQop for legacy interop" };
-  } else if (challenge.qop.indexOf("auth") === -1 && challenge.qop.indexOf("auth-int") === -1) {
+    /** @internal The qop membership tests come from the capture. This arm REFUSES a challenge whose
+     * qop offers nothing this client supports, and the one below SELECTS which qop the credential is
+     * computed for, so a replaced `indexOf` either skips the refusal or changes the computation. */
+  } else if (_arrIndexOf(challenge.qop, "auth") === -1 && _arrIndexOf(challenge.qop, "auth-int") === -1) {
     return { code: codes.badChallenge, msg: "the Digest qop offered no member this client supports (auth / auth-int)" };
   }
   return null;
 }
 
 function answer(challenge, params, E) {
-  var pol = params.policy || {};
+  /** @internal The whole bag is taken as an OWN-key copy with no prototype, once, and every field
+   *  below is read off that copy. Each field is a separate way to supply a value the caller did not:
+   *  `Object.prototype.policy` answered for a caller who passed no policy and `Object.prototype
+   *  .allowMD5` for one who passed an empty one, either turning the default MD5 refusal into an
+   *  issued credential; and `Object.prototype.rng` answered for the client nonce, which makes every
+   *  credential this function issues carry the same cnonce and so replayable. The policy is copied
+   *  the same way for the same reason, since it is a record of its own. */
+  params = guardIdentifier.ownOptions(params);
+  var pol = guardIdentifier.ownOptions(_hasOwn(params, "policy") ? params.policy : null);
   var codes = pol.codes || DEFAULT_CODES;
   var rej = _rejection(challenge, pol, codes);
   if (rej) throw E(rej.code, rej.msg);
   var alg = ALGS[challenge.algorithm];
-  var useQop = challenge.qop.indexOf("auth") !== -1 ? "auth" : (challenge.qop.indexOf("auth-int") !== -1 ? "auth-int" : null);
-  var cnonce = String((params.rng || function () { return crypto.randomBytes(18).toString("base64"); })());
+  var useQop = _arrIndexOf(challenge.qop, "auth") !== -1 ? "auth"
+    : (_arrIndexOf(challenge.qop, "auth-int") !== -1 ? "auth-int" : null);
+  /** @internal The client nonce comes from the captured random source. Read off the module export it
+   * is replaceable, and a predictable cnonce is a replayable response: the whole point of the value
+   * is that the server cannot have seen it before. A caller's own `rng` still wins, as before. */
+  /** @internal The ENCODING of the random bytes is captured too. Capturing the random source alone
+   * left the value it produced readable through a replaced `Buffer.prototype.toString`, which can
+   * answer with a fixed string: the unpredictability is a property of what reaches the header, not of
+   * where the bytes came from. A caller's own `rng` still wins. */
+  var cnonce = intrinsic.String((params.rng || function () {
+    return intrinsic.bufToString(_randomBytes(18), "base64");
+  })());
   var realm = challenge.realm, nonce = challenge.nonce;
-  var isUtf8 = String(challenge.charset || "").toUpperCase() === "UTF-8";
-  var pUser = params.username == null ? "" : String(params.username);
-  var pPass = params.password == null ? "" : String(params.password);
-  if (isUtf8) { pUser = pUser.normalize("NFC"); pPass = pPass.normalize("NFC"); }
+  var isUtf8 = intrinsic.toUpperCase(intrinsic.String(challenge.charset || "")) === "UTF-8";
+  var pUser = params.username == null ? "" : intrinsic.String(params.username);
+  var pPass = params.password == null ? "" : intrinsic.String(params.password);
+  /** @internal The credentials are normalized through the capture: what this produces is hashed, so a
+   * replaced `normalize` changes the input to the proof the server checks. */
+  if (isUtf8) { pUser = _strNormalize(pUser, "NFC"); pPass = _strNormalize(pPass, "NFC"); }
   var user = _octets(pUser, challenge.charset);
   var pass = _octets(pPass, challenge.charset);
   var HA1 = H(alg.hash, user + ":" + realm + ":" + pass);
@@ -276,8 +342,8 @@ function answer(challenge, params, E) {
     ? params.method + ":" + params.uri + ":" + H(alg.hash, params.body == null ? "" : params.body)
     : params.method + ":" + params.uri;
   var HA2 = H(alg.hash, A2);
-  var ncNum = (typeof params.nc === "number" && params.nc >= 1) ? Math.floor(params.nc) : 1;
-  var nc = _strSlice("0000000" + ncNum.toString(16), -8);
+  var ncNum = (typeof params.nc === "number" && params.nc >= 1) ? intrinsic.floor(params.nc) : 1;
+  var nc = _strSlice("0000000" + intrinsic.numberToString(ncNum, 16), -8);
   var response = useQop
     ? KD(alg.hash, HA1, nonce + ":" + nc + ":" + cnonce + ":" + useQop + ":" + HA2)
     : KD(alg.hash, HA1, nonce + ":" + HA2);
@@ -288,34 +354,52 @@ function answer(challenge, params, E) {
     var sentUser = challenge.userhash ? H(alg.hash, _octets(pUser, challenge.charset) + ":" + realm) : _octets(pUser, challenge.charset);
     parts = ["username=" + _qstr(sentUser)];
   }
-  parts.push("realm=" + _qstr(realm), "nonce=" + _qstr(nonce), "uri=" + _qstr(params.uri), "algorithm=" + challenge.algorithm);
-  if (useQop) { parts.push("qop=" + useQop); parts.push("nc=" + nc); }
-  if (useQop || alg.sess) { parts.push("cnonce=" + _qstr(cnonce)); }
-  parts.push("response=" + _qstr(response));
-  if (challenge.opaque != null) parts.push("opaque=" + _qstr(challenge.opaque));
-  if (challenge.userhash) parts.push("userhash=true");
-  return "Digest " + parts.join(", ");
+  /** @internal The header is assembled through the captures. These decide which parameters reach the
+   * server: a dropped `cnonce` or `nc` is a credential the server reads under different rules than
+   * the one it was computed under. */
+  /** @internal Appended with the operation that writes an OWN property. `push` writes through Set,
+   *  which walks the prototype for a numeric setter, so an accessor installed at `Array.prototype[0]`
+   *  takes the value and the index reads back as whatever its getter answers: a dropped `cnonce` or
+   *  nonce count, or a substituted `qop`, is a credential the server reads under different rules than
+   *  the one it was computed under. */
+  intrinsic.append(parts, "realm=" + _qstr(realm));
+  intrinsic.append(parts, "nonce=" + _qstr(nonce));
+  intrinsic.append(parts, "uri=" + _qstr(params.uri));
+  intrinsic.append(parts, "algorithm=" + challenge.algorithm);
+  if (useQop) { intrinsic.append(parts, "qop=" + useQop); intrinsic.append(parts, "nc=" + nc); }
+  if (useQop || alg.sess) { intrinsic.append(parts, "cnonce=" + _qstr(cnonce)); }
+  intrinsic.append(parts, "response=" + _qstr(response));
+  if (challenge.opaque != null) intrinsic.append(parts, "opaque=" + _qstr(challenge.opaque));
+  if (challenge.userhash) intrinsic.append(parts, "userhash=true");
+  return "Digest " + _arrJoin(parts, ", ");
 }
 
+/** @internal The protection-space entries are parsed through the captures. They decide whether a
+ * request is inside the space a credential was issued for, so an entry read differently is a
+ * credential sent to an origin the challenge did not cover. */
 function _domainEntry(d) {
-  d = String(d == null ? "" : d);
-  if (d.charAt(0) === "/") return { origin: null, full: d };
-  try { var u = new _URL(d); return { origin: _urlOrigin(u).toLowerCase(), full: (_urlPathname(u) || "/") + (_urlSearch(u) || "") }; }
+  d = intrinsic.String(d == null ? "" : d);
+  if (_charAt(d, 0) === "/") return { origin: null, full: d };
+  try { var u = new _URL(d); return { origin: intrinsic.toLowerCase(_urlOrigin(u)), full: (_urlPathname(u) || "/") + (_urlSearch(u) || "") }; }
   catch (_e) { return null; }
 }
 
 function inProtectionSpace(challenge, requestOrigin, requestPathAndSearch) {
   var domain = challenge && challenge.domain;
   if (!domain || !domain.length) return true;
-  var origin = String(requestOrigin == null ? "" : requestOrigin).toLowerCase();
-  var full = String(requestPathAndSearch == null ? "" : requestPathAndSearch);
+  /** @internal This answers whether a credential may be sent to this request's origin, so every
+   * operation it compares through is captured: `true` here is what lets the credential go out. */
+  var origin = intrinsic.toLowerCase(intrinsic.String(requestOrigin == null ? "" : requestOrigin));
+  var full = intrinsic.String(requestPathAndSearch == null ? "" : requestPathAndSearch);
   for (var i = 0; i < domain.length; i++) {
     var e = _domainEntry(domain[i]);
     if (e === null) continue;
     if (e.origin !== null && e.origin !== origin) continue;
-    if (full.indexOf(e.full) === 0) return true;
+    if (intrinsic.stringIndexOf(full, e.full) === 0) return true;
   }
   return false;
 }
 
-module.exports = { parseChallenge: parseChallenge, answer: answer, inProtectionSpace: inProtectionSpace };
+/** @internal Frozen, so a consumer that reads one of these off this object at the call cannot be
+ *  handed a replacement in place of it. */
+module.exports = intrinsic.freeze({ parseChallenge: parseChallenge, answer: answer, inProtectionSpace: inProtectionSpace });

package/lib/http-transport.js

@@ -67,7 +67,21 @@
 var nodeHttps = require("node:https");
 var nodeHttp = require("node:http");
 var nodeNet = require("node:net");
+/** @internal The address-family classification, captured at load. It is consulted BEFORE any of the
+ * string operations in `_isBlockedIp`, and the export is writable: answering `0` for `127.0.0.1`
+ * makes the function fall through to "not blocked", so a request under `blockPrivateAddresses`
+ * reaches the private address no matter how carefully the operations after it are captured. */
+var _isIP = nodeNet.isIP;
+/** @internal The TLS identity check, captured at load. It RETURNS A VERDICT about whether a
+ * certificate belongs to the host that was asked for, and the export is writable: a replacement
+ * answering with no error is the server-authentication step reporting success for a certificate
+ * issued to someone else. Every route that asks the question reads this one reference. */
 var nodeTls = require("node:tls");
+/** @internal The TLS identity check, captured where `nodeTls` is in scope. It RETURNS A VERDICT about
+ * whether a certificate belongs to the host that was asked for, and the export is writable: a
+ * replacement answering with no error is the server-authentication step reporting success for a
+ * certificate issued to someone else. Every route that asks the question reads this one reference. */
+var _checkServerIdentity = nodeTls.checkServerIdentity;
 var nodeDns = require("node:dns");
 var nodeUtil = require("node:util");
 var constants = require("./constants");
@@ -84,6 +98,11 @@ var _Promise = intrinsic.Promise;
  *  with it, since a replacement answers with a host of its own. */
 var _URL = intrinsic.URL;
 var _stringOf = intrinsic.String;
+/** @internal The split an address literal is classified by. Read off the live prototype, it decides
+ * which octets the blocklist sees, and a replacement answering with a public address's octets is
+ * admitted: measured, `127.0.0.1` split into `93.184.216.34` cleared the private-address refusal and
+ * the request went out. */
+var _strSplit = intrinsic.uncurry(String.prototype.split);
 /** @internal The parts of that destination are read through the accessors captured at load, not off the
  *  prototype the parsed value reads through: a replaced `URL.prototype.hostname` names the host this
  *  module then opens a socket to. */
@@ -201,9 +220,22 @@ function _systemCa() {
 }
 
 function _isBlockedIp(ip) {
-  var fam = nodeNet.isIP(ip);
+  /** @internal The argument has to BE a string, and what cannot be classified is blocked. `isIP`
+   * converts its argument, so a value whose conversion answers a loopback literal to the family
+   * check and a public one to the octet scan was classified twice and the second answer decided:
+   * measured, such a value came back NOT blocked while the family check had seen `127.0.0.1`. A
+   * caller-supplied `lookup` reaches this with whatever it yields, and `pki.transport.isBlockedIp`
+   * takes the value directly. A non-IP STRING is still not an address literal and answers false. */
+  if (typeof ip !== "string") return true;
+  var fam = _isIP(ip);
   if (fam === 4) {
-    var o = ip.split("."), a = +o[0], b = +o[1], c = +o[2];
+    /** @internal The literal is scanned on the delimiter CHARACTER rather than split on a separator
+     * string. `String.prototype.split` is specified to look the separator's `Symbol.split` method up
+     * and call it, so the separator's prototype chain is part of the operation and capturing `split`
+     * does not close it; hard rule 11 bans `split` in lib/ for that reason. MEASURED on Node 24.21,
+     * the supported runtime: a hook answering with a public address's octets made this refusal clear
+     * for `127.0.0.1` and a request to loopback proceeded. */
+    var o = intrinsic.splitChar(ip, 46), a = +o[0], b = +o[1], c = +o[2];
     return a === 0 || a === 10 || a === 127 || a >= 224 ||
       (a === 100 && b >= 64 && b <= 127) ||
       (a === 169 && b === 254) ||
@@ -216,12 +248,22 @@ function _isBlockedIp(ip) {
       (a === 203 && b === 0 && c === 113);
   }
   if (fam === 6) {
-    var l = ip.toLowerCase();
-    if (l.indexOf("::ffff:") === 0) return true;
-    var parts = l.split(":");
-    var h = parseInt(parts[0], 16);
+    /** @internal The fold and the index read come from the load-time captures. This classification
+     * ADMITS anything inside global unicast, so a replaced `toLowerCase` answering with a
+     * global-unicast spelling for a private address turns a refusal into a connection attempt:
+     * measured, `fc00::1` folded to `2606:4700::1` was admitted past this blocklist and the request
+     * went out. The substitute has to be an address this function admits, or the refusal comes from
+     * another rule and the probe measures nothing. */
+    var l = intrinsic.toLowerCase(ip);
+    if (intrinsic.stringIndexOf(l, "::ffff:") === 0) return true;
+    var parts = intrinsic.splitChar(l, 58);
+    /** @internal The numeric conversion is captured too. The fold and the split were converted first
+     * and this was still live, so `parseInt("fc00", 16)` answering `0x2606` put the address inside
+     * global unicode and the refusal was skipped: converting the operations that produce the hextets
+     * without the one that reads them leaves the gate exactly as open. */
+    var h = intrinsic.parseInt(parts[0], 16);
     if (!(h >= 0x2000 && h <= 0x3fff)) return true;
-    var h2 = parts[1] ? parseInt(parts[1], 16) : 0;
+    var h2 = parts[1] ? intrinsic.parseInt(parts[1], 16) : 0;
     if (h === 0x2002) return true;
     if (h === 0x2001 && h2 < 0x0200) return true;
     if (h === 0x2001 && h2 === 0x0db8) return true;
@@ -380,7 +422,7 @@ function _validateProxy(request, defaults, E, C, originHost, originStatedPort, o
       if (scheme !== "digest") throw E(C("bad-proxy"), "opts.proxy.auth." + kn + " applies only to Digest authentication");
       if (typeof kv !== "boolean") throw E(C("bad-proxy"), "opts.proxy.auth." + kn + " must be a boolean, got " + guard.text.showValue(kv));
     }
-    if (scheme === "basic" && proxy.auth.username.indexOf(":") !== -1) throw E(C("bad-proxy"), "a Basic proxy user-id must not contain a colon (RFC 7617 sec. 2)");
+    if (scheme === "basic" && intrinsic.stringIndexOf(proxy.auth.username, ":") !== -1) throw E(C("bad-proxy"), "a Basic proxy user-id must not contain a colon (RFC 7617 sec. 2)");
     auth = { scheme: scheme, username: proxy.auth.username, password: proxy.auth.password,
       allowMD5: proxy.auth.allowMD5 === true, allowLegacyQop: proxy.auth.allowLegacyQop === true };
   }
@@ -394,6 +436,10 @@ function _validateProxy(request, defaults, E, C, originHost, originStatedPort, o
       guard.identifier.assertKnownKeys(ptls, PROXY_TLS_KEYS, E, C("bad-proxy"), "opts.proxy.tls has an unknown option ");
       if (ptls.servername !== undefined && ptls.servername !== null && typeof ptls.servername !== "string") throw E(C("bad-proxy"), "opts.proxy.tls.servername must be a string");
     }
+    /** @internal Taken here, so the value the tunnel is opened under is the one typed above rather
+     * than a later read of the caller's record. The door refuses an accessor and refuses a Proxy, so
+     * the two reads cannot differ today; holding the value keeps that true without depending on it. */
+    var pServername = (ptls && ptls.servername) || null;
     var pAnchors = ptls ? ptls.anchors : undefined;
     if (pAnchors !== undefined && pAnchors !== null && typeof pAnchors === "object" && nodeUtil.types.isProxy(pAnchors)) throw E(C("bad-proxy"), "opts.proxy.tls.anchors must not be a Proxy");
     var pUseSystem = ptls ? ptls.useSystemStore === true : false;
@@ -412,10 +458,10 @@ function _validateProxy(request, defaults, E, C, originHost, originStatedPort, o
     var pCa = [];
     if (pHasAnchors) pCa = pCa.concat(_pemifyAnchors(pAnchors));
     if (pUseSystem) pCa = pCa.concat(_systemCa());
-    proxyTls = { ca: pCa.length ? pCa : undefined, minVersion: pMinVersion, servername: (ptls && ptls.servername) || null };
+    proxyTls = { ca: pCa.length ? pCa : undefined, minVersion: pMinVersion, servername: pServername };
   }
 
-  var originAuthHost = nodeNet.isIP(originHost) === 6 ? "[" + originHost + "]" : originHost;
+  var originAuthHost = _isIP(originHost) === 6 ? "[" + originHost + "]" : originHost;
   var phost = _stripIpv6Brackets(_urlHostname(purl));
   /** @internal The CONNECT target is the origin's own authority, so an origin URL that states no
    * port takes the default for the origin's scheme, not the proxy's. Defaulting it to 443 opens
@@ -435,7 +481,9 @@ function _basicProxyHeader(auth) {
  * the request line carries (RFC 9112 sec. 3.2.3), which is the pair the proxy checks it against. */
 function _digestProxyCredential(headers, pinfo, C, E) {
   var httpDigest = require("./http-digest");   // allow:inline-require -- circular load: http-digest -> schema-pkix -> ct -> this module
-  var offered = String((headers && headers["proxy-authenticate"]) || "");
+  /** @internal Captured: this is the challenge the digest credential is computed against, so the
+   * conversion decides which parameters, and which algorithm, the response is built for. */
+  var offered = intrinsic.String((headers && headers["proxy-authenticate"]) || "");
   var policy = {
     allowMD5: pinfo.auth.allowMD5, allowLegacyQop: pinfo.auth.allowLegacyQop,
     codes: {
@@ -579,7 +627,13 @@ function httpsTransport(defaults) {
     var callerCsi = typeof reqTls.checkServerIdentity === "function" ? reqTls.checkServerIdentity
       : (typeof tlsDefaults.checkServerIdentity === "function" ? tlsDefaults.checkServerIdentity : null);
     var sni = (reqTls.servername !== undefined ? reqTls.servername : tlsDefaults.servername) || host;
-    if (sni && !nodeNet.isIP(sni)) options.servername = sni;
+    /** @internal Typed here, the way `opts.proxy.tls.servername` is typed on the proxy arm. The value
+     * is read three times after this point and each read is a separate conversion: once to decide it
+     * is not an address literal, once by the TLS layer for the name sent in the handshake, and once
+     * as `idHost` for the name the server certificate is matched against. A value answering a
+     * different string per read sends one name and verifies another. */
+    if (typeof sni !== "string") throw E(C("bad-input"), "tls.servername must be a string, got " + guard.text.showValue(sni));
+    if (sni && !_isIP(sni)) options.servername = sni;
     var caList = [];
     if (hasAnchors) caList = caList.concat(_pemifyAnchors(anchors));
     if (useSystem) caList = caList.concat(_systemCa());
@@ -588,10 +642,18 @@ function httpsTransport(defaults) {
     if (key) options.key = key;
     if (callerCsi) {
       options.checkServerIdentity = function (host, cert2) {
-        var baseErr = nodeTls.checkServerIdentity(host, cert2);
+        var baseErr = _checkServerIdentity(host, cert2);
         if (baseErr) return baseErr;
         return callerCsi(host, cert2);
       };
+    } else {
+      /** @internal With no caller hook, the option is set to the CAPTURE rather than left out. Left
+       * out, node's own TLS stack looks the function up on its module export when the handshake
+       * completes, so a replacement there answers the identity question and a certificate issued to
+       * another host is accepted. Measured: with this absent, a request asking for a name the
+       * server's certificate does not carry was admitted. The function is node's own default, taken
+       * at load, so the verdict is the one it would have reached anyway. */
+      options.checkServerIdentity = _checkServerIdentity;
     }
     var proxyInfo;
     try { proxyInfo = _validateProxy(request, defaults, E, C, host, statedPort, scheme); }
@@ -649,7 +711,10 @@ function httpsTransport(defaults) {
           var client = prep.plaintext ? nodeHttp : nodeHttps;
           req = client.request(options, function (res) {
             var tlsInfo = _tlsInfo(res.socket);
-            var declared = parseInt((res.headers || {})["content-length"], 10);
+            /** @internal Captured for consistency with the rest of the file, not because this gates
+             * anything: an understated `content-length` only skips this EARLY refusal, and the cap is
+             * enforced below on the bytes actually counted as they arrive. */
+            var declared = intrinsic.parseInt((res.headers || {})["content-length"], 10);
             if (Number.isFinite(declared) && declared > prep.maxBytes) { fail(C("response-too-large"), "the declared content-length " + declared + " exceeds the " + prep.maxBytes + "-byte cap (RFC 7030 sec. 6)"); return; }
             var buf = Buffer.allocUnsafe(0);
             var len = 0;
@@ -727,8 +792,8 @@ function httpsTransport(defaults) {
             connectOpts.rejectUnauthorized = true;
             connectOpts.minVersion = pinfo.proxyTls.minVersion;
             var pIdentity = pinfo.proxyTls.servername || pinfo.host;
-            connectOpts.servername = (pIdentity && !nodeNet.isIP(pIdentity)) ? pIdentity : "";
-            connectOpts.checkServerIdentity = function (host, cert) { return nodeTls.checkServerIdentity(pIdentity, cert); };
+            connectOpts.servername = (pIdentity && !_isIP(pIdentity)) ? pIdentity : "";
+            connectOpts.checkServerIdentity = function (host, cert) { return _checkServerIdentity(pIdentity, cert); };
             cr = nodeHttps.request(connectOpts);
           } else {
             cr = nodeHttp.request(connectOpts);
@@ -775,7 +840,7 @@ function httpsTransport(defaults) {
                 minVersion: prep.options.minVersion,
                 rejectUnauthorized: true,
                 checkServerIdentity: function (host, cert) {
-                  var baseErr = nodeTls.checkServerIdentity(idHost, cert);
+                  var baseErr = _checkServerIdentity(idHost, cert);
                   if (baseErr) return baseErr;
                   return prep.callerCsi ? prep.callerCsi(idHost, cert) : undefined;
                 },

package/lib/identity-match.js

@@ -212,7 +212,7 @@ var _SNAPSHOTS = new WeakSet();
 /** @internal Whether this list is one `snapshotReferences` produced. The record is kept off the
  * value, so a caller cannot make an arbitrary array pass by writing a field on it. */
 function _isSnapshot(v) {
-  return _isArray(v) && _SNAPSHOTS.has(v);
+  return _isArray(v) && intrinsic.weakSetHas(_SNAPSHOTS, v);
 }
 
 /** @internal The reference identities, read and copied in one pass, so a caller that mutates its
@@ -233,7 +233,7 @@ function snapshotReferences(references) {
     intrinsic.freeze(parsed[i]);
   }
   intrinsic.freeze(parsed);
-  _SNAPSHOTS.add(parsed);
+  intrinsic.weakSetAdd(_SNAPSHOTS, parsed);
   return parsed;
 }
 

package/lib/merkle.js

@@ -516,7 +516,7 @@ function consistencyProof(opts) {
   return _subproof(leaves, 0, n, m, true);
 }
 
-module.exports = {
+module.exports = intrinsic.freeze({
   leafHash:          leafHash,
   nodeHash:          nodeHash,
   emptyRootHash:     emptyRootHash,
@@ -525,4 +525,4 @@ module.exports = {
   verifyConsistency: verifyConsistency,
   inclusionProof:    inclusionProof,
   consistencyProof:  consistencyProof,
-};
+});

package/lib/ocsp-request-verify.js

@@ -12,4 +12,4 @@ function verifyRequestSignature(signatureAlgorithm, signature, signerSpkiBytes,
   return _seam.verify(signatureAlgorithm, signature, signerSpkiBytes, tbsRequestBytes);
 }
 
-module.exports = { setEngine: _seam.setEngine, verifyRequestSignature: verifyRequestSignature };
+module.exports = Object.freeze({ setEngine: _seam.setEngine, verifyRequestSignature: verifyRequestSignature });