@blamejs/pki 0.8.58 → 0.8.60

package/lib/guard-list.js

@@ -8,6 +8,7 @@ var _defineProperty = require("./guard-intrinsic").defineProperty;
 var _isArray = require("./guard-intrinsic").isArray;
 var _arrSort = require("./guard-intrinsic").sort;
 var _isSafeInteger = require("./guard-intrinsic").isSafeInteger;
+var _hasOwn = require("./guard-intrinsic").hasOwn;
 
 var MAX_ARRAY_LENGTH = 4294967295;
 
@@ -76,6 +77,67 @@ function allMatch(list, predicate) {
   return true;
 }
 
+/** @internal The first element a predicate selects, or null. Written as `list.filter(p)[0]`, the
+ * selection is a fresh array that is empty when nothing matched, and reading index 0 of an empty
+ * array answers from the array prototype: an accessor there becomes the selected element in a
+ * selection that selected nothing, which reads at every call site as "found one". `filter` also
+ * builds its result through the receiver's `Symbol.species`, so the array indexed is not necessarily
+ * one this toolkit made. This walks the own indexes and returns null when nothing matched, so a
+ * caller's `if (!found)` test answers for the list rather than for the prototype.
+ *
+ * @enforced-by behavioral -- `filter(...)[0]` has no rename-proof shape of its own beyond the method
+ * name, which the captured-operation budget already counts; the RED vectors are the empty-selection
+ * ones each consumer carries (a signedAttrs with no message-digest attribute, a certificate with no
+ * subject key identifier).
+ */
+function firstMatch(list, predicate) {
+  if (!list) return null;
+  for (var i = 0, n = _count(list, "firstMatch"); i < n; i++) {
+    if (!_hasOwn(list, i)) continue;
+    /** @internal One read of the element, tested and returned. Read again after the predicate, an
+     * own accessor at the index answers the test with one value and the caller with another, and a
+     * getter that deletes its own slot leaves the second read falling through to the prototype. */
+    var element = list[i];
+    if (predicate(element, i)) return element;
+  }
+  return null;
+}
+
+/** @internal Remove the element at `index`, shifting the ones after it down by defining each slot
+ * and then truncating through the array's own `length`. `splice` is the ordinary way to write this
+ * and it is not usable here: it returns the removed elements, so it builds that result through
+ * `ArraySpeciesCreate`, which reads the receiver's `constructor` and then its `Symbol.species`. A
+ * getter installed on `Array.prototype.constructor` receives the real array as its `this`, which
+ * hands caller code a reference to the list being edited and to every record in it, in the middle of
+ * the edit. Nothing is returned here, so nothing is constructed.
+ *
+ * @enforced-by behavioral -- `splice(i, 1)` has no rename-proof shape beyond the method name, which
+ * the captured-operation budget counts; the RED vector is the policy-node removal driven with a
+ * `constructor` getter installed.
+ */
+function removeAt(list, index) {
+  if (!_isArray(list)) throw new TypeError("guard.list.removeAt: the receiver must be an array");
+  var n = _count(list, "removeAt");
+  if (!_isSafeInteger(index) || index < 0 || index >= n) {
+    throw new RangeError("guard.list.removeAt: the index must be a position the array holds");
+  }
+  /** @internal A hole stays a hole, and is never read through. `splice` leaves an absent element
+   * absent, so a shift that defined every slot would turn one into an own `undefined`; and reading
+   * `list[i + 1]` at a hole answers from the prototype, which is the value this family exists to
+   * keep out. Each source slot is tested for own-ness once and read once. */
+  for (var i = index; i < n - 1; i++) {
+    if (_hasOwn(list, i + 1)) {
+      _defineProperty(list, i, { value: list[i + 1], writable: true, enumerable: true, configurable: true });
+    } else if (_hasOwn(list, i)) {
+      delete list[i];
+    }
+  }
+  /** @internal `length` is an array's own writable property, so assigning it consults no prototype
+   * and the assignment deletes the tail slot the shift left behind. */
+  list.length = n - 1;
+  return list;
+}
+
 // @enforced-by caller-array-copied-live
 function snapshot(list) {
   if (!_isArray(list)) throw new TypeError("guard.list.snapshot: the receiver must be an array");
@@ -132,6 +194,8 @@ module.exports = _freeze({
   containsAll: containsAll,
   anyMatches: anyMatches,
   allMatch: allMatch,
+  firstMatch: firstMatch,
+  removeAt: removeAt,
   snapshot: snapshot,
   copyMap: copyMap,
 });

package/lib/guard-name.js

@@ -177,7 +177,7 @@ function _reduceDpn(d, E, code, label) {
   for (var i = 0; i < len; i++) {
     var n = ownValue(names, i);
     if (!_isBuffer(n)) throw refuse("every fullName GeneralName must be its encoded bytes");
-    taken[i] = n;
+    _append(taken, n);
   }
   return { kind: kind, names: taken };
 }

package/lib/hpke.js

@@ -47,7 +47,10 @@ var oid = require("./oid");
 var _hasOwn = intrinsic.hasOwn;
 var _isBuffer = intrinsic.isBuffer, _bufferFrom = intrinsic.bufferFrom, _bufferAlloc = intrinsic.bufferAlloc;
 var _bufferConcat = intrinsic.bufferConcat, _bufferEquals = intrinsic.bufferEquals, _compare = intrinsic.compare;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. The lists here become the byte
+ *  strings a KEM's key schedule is computed over. `append` defines the index. */
+var _push = intrinsic.append;
 var _subarray = intrinsic.subarray;
 
 var HpkeError = frameworkError.HpkeError;
@@ -76,7 +79,10 @@ function _pushPrefixed(parts, b, what) {
     throw _err("hpke/input-length", what + " is " + b.length + " bytes; a single-stage KDF accepts at " +
       "most " + MAX_PREFIXED + " (draft-ietf-hpke-hpke-05 sec. 7.2.1)");
   }
-  _push(parts, i2osp(b.length, 2), b);
+  /** @internal Two appends, because `append` takes one value where `push` took many: the length
+   *  prefix and the value it measures are both part of the byte string a KDF reads. */
+  _push(parts, i2osp(b.length, 2));
+  _push(parts, b);
   return parts;
 }
 /** @internal Through the capture, which is the whole point of this helper existing: every
@@ -346,7 +352,8 @@ function _derive(xof, input, outLen) {
 function _labeledDerive(xof, suiteId, ikm, label, context, outLen) {
   var lab = _bufferFrom(label, "latin1");
   var parts = _pushPrefixed([ikm, HPKE_V1, suiteId], lab, "a derive label");
-  _push(parts, i2osp(outLen, 2), context);
+  _push(parts, i2osp(outLen, 2));
+  _push(parts, context);
   var labeledIkm = concat(parts);
   try { return _derive(xof, labeledIkm, outLen); }
   finally { guard.secret.zeroize(labeledIkm, HpkeError, "hpke/bad-input", "the labeled derive input"); }

package/lib/http-transport.js

@@ -128,7 +128,10 @@ var _toLowerCase = intrinsic.toLowerCase;
 var _fromCharCode = intrinsic.fromCharCode;
 var _isArray = intrinsic.isArray;
 var _arrIndexOf = intrinsic.indexOf;
-var _arrPush = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended, and this list is the peer chain a
+ *  caller reads. `append` defines the index. */
+var _arrPush = intrinsic.append;
 var _arrForEach = intrinsic.forEach;
 var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
@@ -348,7 +351,10 @@ function _makeGuardedLookup(lookupFn) {
           var entry = address[i];
           var one = { address: entry && entry.address, family: entry && entry.family };
           if (_isBlockedIp(one.address)) return callback(_blockedAddrErr(hostname, one.address));
-          checked[i] = one;
+          /** @internal Appended by defining the index. Stored at, the store walks the prototype chain
+           *  for a setter, so an accessor there took the checked entry and node read the address it
+           *  connects to back from the getter instead: an address this check never saw. */
+          _arrPush(checked, one);
         }
         return callback(null, checked);
       }
@@ -448,7 +454,10 @@ function snapshotProxy(p) {
       var a = p.tls.anchors;
       if (_copyableArray(a)) {
         var copied = [];
-        for (var i = 0; i < a.length; i++) copied[i] = _copyAnchor(a[i]);
+        /** @internal Appended by defining the index, for the reason the address list above is: these
+         *  are the trust anchors the handshake runs under, and a store consults a setter inherited at
+         *  the index. */
+        for (var i = 0; i < a.length; i++) _arrPush(copied, _copyAnchor(a[i]));
         out.tls.anchors = copied;
       } else if (typeof a === "string") out.tls.anchors = a;
       else if (a !== null && typeof a === "object" && !nodeUtil.types.isProxy(a) && _isBuffer(a)) out.tls.anchors = _bufferFrom(a);

package/lib/inspect.js

@@ -1158,7 +1158,11 @@ function _joinAnd(list) {
  *  door can validate to arbitrary depth, so a report must not fault on any shape it is handed. */
 function _list(v) { return Array.isArray(v) ? v : []; }
 /** @internal The same for a member a loop body dereferences. */
-function _obj(v) { return (v !== null && typeof v === "object") ? v : {}; }
+/** @internal The stand-in for a value that is not a record has NO PROTOTYPE. Written as `{}`, it
+ *  inherits `Object.prototype`, so a field read off it answers with whatever a name planted there
+ *  holds and a report prints a value its subject does not carry. */
+var _EMPTY_RECORD = Object.create(null);
+function _obj(v) { return (v !== null && typeof v === "object") ? v : _EMPTY_RECORD; }
 
 /** @internal A serial reads the same wherever a report carries one, through the certificate report's own
  *  presentation: small values as decimal with the hex beside them, long ones as wrapped colon-hex. Printed
@@ -1327,7 +1331,11 @@ function _someSignerUnmatched(signed) {
 }
 function _certMatchesSid(cert, sid) {
   if (Buffer.isBuffer(sid.subjectKeyIdentifier)) {
-    var ski = _list(cert.extensions).filter(function (e) { return _obj(e).oid === OID_SUBJECT_KEY_ID; })[0];
+    /** @internal The selection returns the first matching row or null. `filter(...)[0]` indexes a
+     *  result that is EMPTY when the certificate carries no key identifier, and index 0 of an empty
+     *  array answers from the array prototype, which would report a signer match for a certificate
+     *  that carries nothing to match on. */
+    var ski = guard.list.firstMatch(_list(cert.extensions), function (e) { return _obj(e).oid === OID_SUBJECT_KEY_ID; });
     if (!ski) return false;
     // allow:swallow-unverified drop-silent display fallback: an unreadable key id matches nothing
     try { return asn1.read.octetString(asn1.decode(_obj(ski).value)).equals(sid.subjectKeyIdentifier); }

package/lib/jose.js

@@ -54,7 +54,9 @@ var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
 var _stringify = intrinsic.stringify;
 var _ObjectProto = intrinsic.ObjectProto;
-var _push = intrinsic.uncurry(Array.prototype.push);
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 var _join = intrinsic.join;
 var _map = intrinsic.map;
 var _bufToString = intrinsic.uncurry(Buffer.prototype.toString);

package/lib/key.js

@@ -48,6 +48,10 @@ var _floor = intrinsic.floor;
 var _isFinite = intrinsic.isFinite;
 var _String = intrinsic.String;
 var _toUpperCase = intrinsic.toUpperCase;
+/** @internal The walk over an array LITERAL is captured too. The receiver is the literal rather than
+ *  a caller's value, but the method is still read off the live prototype at the moment it runs, and a
+ *  replacement decides which rows of a registry this module builds. */
+var _forEach = intrinsic.forEach;
 var _strIndexOf = intrinsic.stringIndexOf;
 
 var b = asn1.build;
@@ -60,13 +64,13 @@ function _err(code, msg, cause) { return new KeyError(code, msg, cause); }
 var CIPHER_NAME = _assign(_create(null), { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" });
 
 var INFER_ALG = _create(null);
-["Ed25519", "Ed448", "X25519", "X448"].forEach(function (n) { INFER_ALG[O(n)] = { name: n }; });
-[["id-ml-dsa-44", "ML-DSA-44"], ["id-ml-dsa-65", "ML-DSA-65"], ["id-ml-dsa-87", "ML-DSA-87"],
- ["id-ml-kem-512", "ML-KEM-512"], ["id-ml-kem-768", "ML-KEM-768"], ["id-ml-kem-1024", "ML-KEM-1024"]
-].forEach(function (r) { INFER_ALG[O(r[0])] = { name: r[1] }; });
-["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
- "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (s) { INFER_ALG[O("id-slh-dsa-" + s)] = { name: _toUpperCase("SLH-DSA-" + s) }; });
+_forEach(["Ed25519", "Ed448", "X25519", "X448"], function (n) { INFER_ALG[O(n)] = { name: n }; });
+_forEach([["id-ml-dsa-44", "ML-DSA-44"], ["id-ml-dsa-65", "ML-DSA-65"], ["id-ml-dsa-87", "ML-DSA-87"],
+  ["id-ml-kem-512", "ML-KEM-512"], ["id-ml-kem-768", "ML-KEM-768"], ["id-ml-kem-1024", "ML-KEM-1024"]
+], function (r) { INFER_ALG[O(r[0])] = { name: r[1] }; });
+_forEach(["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+], function (s) { INFER_ALG[O("id-slh-dsa-" + s)] = { name: _toUpperCase("SLH-DSA-" + s) }; });
 
 function _isCryptoKey(x) { return webcrypto.isCryptoKeyLike(x); }
 function _algName(a) { return typeof a === "string" ? a : (a && a.name); }