@blamejs/pki 0.8.55 → 0.8.56

package/lib/schema-attrcert.js

@@ -736,7 +736,7 @@ var decodeExtensions = DOOR.decodeExtensions;
  */
 var decodeExtension = DOOR.decodeExtension;
 
-module.exports = {
+module.exports = intrinsic.freeze({
   parse: parse,
   parseV1: parseV1,
   pemDecode: pemDecode,
@@ -749,4 +749,4 @@ module.exports = {
   readGeneralName: readGeneralName,
   validateAttributeValue: validateAttributeValue,
   validateExtensionValue: validateExtensionValue,
-};
+});

package/lib/schema-cmc.js

@@ -802,7 +802,7 @@ function parse(input, callerOpts) {
   return body;
 }
 
-module.exports = {
+module.exports = Object.freeze({
   parseEncryptedPop: parseEncryptedPop,
   parseTaggedRequest: parseTaggedRequest,
   parse: parse,
@@ -810,4 +810,4 @@ module.exports = {
   parsePkiResponse: parsePkiResponse,
   STATUS_BY_VALUE: STATUS_BY_VALUE,
   FAIL_INFO_BY_VALUE: FAIL_INFO_BY_VALUE,
-};
+});

package/lib/schema-cmp.js

@@ -883,7 +883,7 @@ function _readKem(sch, der, code, what) {
 function readKemBMParameter(p) { return _readKem(KEM_BM_PARAMETER, p, "cmp/bad-kem-data", "KemBMParameter"); }
 function readKemCiphertextInfo(d) { return _readKem(KEM_CIPHERTEXT_INFO, d, "cmp/bad-kem-ciphertext", "KemCiphertextInfo"); }
 
-module.exports = {
+module.exports = Object.freeze({
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
@@ -897,4 +897,4 @@ module.exports = {
   readName: readName,
   readKemBMParameter: readKemBMParameter,
   readKemCiphertextInfo: readKemCiphertextInfo,
-};
+});

package/lib/schema-cms.js

@@ -1465,7 +1465,7 @@ function sameAlgorithmModuloDefaults(a, c) {
   return ak === ck;
 }
 
-module.exports = {
+module.exports = Object.freeze({
   parse: parse,
   parseAlgorithmProtection: parseAlgorithmProtection,
   algorithmProtectionReport: algorithmProtectionReport,   // @internal
@@ -1490,4 +1490,4 @@ module.exports = {
   AEAD_ALGS: AEAD_ALGS,
   AEAD_GCM_ICVLENS: AEAD_GCM_ICVLENS,
   AEAD_CCM_ICVLENS: AEAD_CCM_ICVLENS,
-};
+});

package/lib/schema-crmf.js

@@ -515,7 +515,7 @@ var decodeExtensions = DOOR.decodeExtensions;
  */
 var decodeExtension = DOOR.decodeExtension;
 
-module.exports = {
+module.exports = intrinsic.freeze({
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
@@ -525,4 +525,4 @@ module.exports = {
   walkCertReqMessages: walkCertReqMessages,
   walkCertTemplate: walkCertTemplate,
   certReqMessagesSchema: CERT_REQ_MESSAGES,
-};
+});

package/lib/schema-csr.js

@@ -383,7 +383,7 @@ var decodeExtensions = DOOR.decodeExtensions;
  */
 var decodeExtension = DOOR.decodeExtension;
 
-module.exports = {
+module.exports = intrinsic.freeze({
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
@@ -391,4 +391,4 @@ module.exports = {
   decodeExtensions: decodeExtensions,
   decodeExtension: decodeExtension,
   certificationRequestSchema: CERTIFICATION_REQUEST,
-};
+});

package/lib/schema-pkix.js

@@ -2630,7 +2630,7 @@ function dnsNameProblem(s) {
   if (_hasWhitespace(s)) return "whitespace";
   if (_charAt(s, 0) === "." || _charAt(s, s.length - 1) === ".") return "leading/trailing dot";
   if (_strIndexOf(s, "_") !== -1) return "underscore forbidden in dNSName";
-  var labels = _split(s, ".");
+  var labels = intrinsic.splitChar(s, 46);
   for (var i = 0; i < labels.length; i++) {
     var label = labels[i];
     if (label.length === 0) return "empty label";
@@ -2644,7 +2644,7 @@ function dnsNameProblem(s) {
   return null;
 }
 
-module.exports = {
+module.exports = intrinsic.freeze({
   dnsNameProblem: dnsNameProblem,
   pemDecode: pemDecode,
   pemDecodeAll: pemDecodeAll,
@@ -2720,5 +2720,5 @@ module.exports = {
   attribute: attribute,
   extension: extension,
   extensions: extensions,
-};
+});
 

package/lib/schema-x509.js

@@ -337,7 +337,7 @@ var decodeExtensions = DOOR.decodeExtensions;
  */
 var decodeExtension = DOOR.decodeExtension;
 
-module.exports = {
+module.exports = intrinsic.freeze({
   parse:     parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
@@ -350,4 +350,4 @@ module.exports = {
    *  Not on the curated `pki.schema.x509` surface. */
   tbsCertificateSchema: TBS_CERTIFICATE_ALONE,
   certificateSchema:    CERTIFICATE,
-};
+});

package/lib/sigstore.js

@@ -1501,7 +1501,7 @@ var SAN_OID = oid.byName("subjectAltName");
  * reports for a certificate it cannot read, so the fix adds no new code to the public surface. */
 var _sanDecoder = pkix.certExtensionDecoders(
   pkix.makeNS("x509", frameworkError.CertificateError, oid)).byOid[SAN_OID];
-var FULCIO_PREFIX = _join(_arraySlice(_split(oid.byName("otherName"), "."), 0, -1), ".") + ".";
+var FULCIO_PREFIX = _join(_arraySlice(intrinsic.splitChar(oid.byName("otherName"), 46), 0, -1), ".") + ".";
 function _identity(leaf) {
   var out = { san: null, extensions: _create(null) };
   try {

package/lib/tlog.js

@@ -391,7 +391,7 @@ function parseNote(input) {
   var signedBytes = _subarray(buf, 0, end);
   var rest = _bufToString(_subarray(buf, end + 1), "utf8");
   var signatures = [];
-  var lines = rest.length === 0 ? [] : _split(rest, "\n");
+  var lines = rest.length === 0 ? [] : intrinsic.splitChar(rest, 10);
   /** @internal A note ends with a newline, so the split leaves one empty tail element; anything
    *  else after it is a line the format does not have. The drop goes through the capture: dispatching
    *  through `Array.prototype.pop` let a replacement pop TWICE, taking the last signature line with the
@@ -603,7 +603,7 @@ function parseCheckpoint(input) {
   var note = parseNote(input);
   var text = note.text;
   /** @internal The text ends with a newline, so the split leaves an empty tail that is not a line. */
-  var lines = _split(text, "\n");
+  var lines = intrinsic.splitChar(text, 10);
   if (lines.length > 0 && lines[lines.length - 1] === "") _pop(lines);
   if (lines.length < MIN_CHECKPOINT_LINES) {
     throw _err("tlog/bad-checkpoint", "a checkpoint body is an origin, a tree size and a root hash, got " +
@@ -918,7 +918,7 @@ function _segmentDigits(segment, expectX) {
  */
 function parseTilePath(path) {
   if (typeof path !== "string") throw _err("tlog/bad-input", "a tile path is a string");
-  var parts = _split(path, "/");
+  var parts = intrinsic.splitChar(path, 47);
   if (parts.length < 3 || parts[0] !== "tile") {
     throw _err("tlog/bad-tile", "a tile path begins tile/<level>/<index>");
   }
@@ -1034,7 +1034,10 @@ function parseEntryBundle(bytes) {
     if (p + 2 > buf.length) {
       throw _err("tlog/bad-bundle", "a trailing byte at offset " + p + " is not a whole length prefix");
     }
-    var len = buf.readUInt16BE(p);
+    /** @internal The length prefix comes from the capture. It decides where this entry ends and the
+     *  next begins, so a replaced reader hands the bounds check below a length the bundle does not
+     *  state and the entry that is parsed is a different run of bytes. */
+    var len = intrinsic.readUInt16BE(buf, p);
     p += 2;
     if (p + len > buf.length) {
       throw _err("tlog/bad-bundle", "the entry at offset " + (p - 2) + " declares " + len +