@blamejs/pki 0.8.6 → 0.8.9

package/lib/guard-async.js

@@ -8,6 +8,13 @@ var _reject = _intrinsic.uncurry(_intrinsic.promiseReject);
 var _apply = _intrinsic.apply;
 var _String = _intrinsic.String;
 var _Promise = Promise;
+/** @internal Bound at load, like every other operation this module decides with: a replacement
+ * installed later would otherwise choose when a bound expires, or whether it ever does. */
+var _setTimeout = setTimeout;
+var _clearTimeout = clearTimeout;
+/** @internal The losing side of a race is observed, not acted on: attaching this is what keeps an
+ * outcome nobody wants from becoming an unhandled rejection. */
+function _ignore() { return undefined; }
 // @internal
 // @enforced-by behavioral -- the rule has no rename-proof code shape (it is the ABSENCE of a wrapper
 function deferred(body) {
@@ -40,9 +47,53 @@ function invoked(fn, args, E, code, label) {
   var out;
   try { out = _apply(fn, undefined, args); }
   catch (e) {
-    throw E(code, label + " threw when it was called: " + (e && e.message ? e.message : _String(e)), e);
+    /** @internal The thrown value is the caller's, so describing it is a read of caller data: a
+     * `message` accessor that throws would leave this boundary by the one path it exists to close.
+     * @guard-via guard.text.describeThrown */
+    // allow:inline-require guard-text reaches guard-bytes, which reaches this module, so binding it at load leaves guard-bytes half-built for whichever of the two is required first; this line runs only after a producer has already thrown
+    throw E(code, label + " threw when it was called: " +
+      require("./guard-text").describeThrown(e), e);
   }
   return awaited(out, E, code, label);
 }
 
-module.exports = _intrinsic.freeze({ deferred: deferred, awaited: awaited, invoked: invoked });
+// @internal
+// @enforced-by behavioral -- a RED vector drives a never-settling caller operation through a client
+/** @internal Await a caller-supplied operation under a bound this side controls. A request field
+ * naming a timeout is a request: an operation that does not implement it never settles, and the
+ * verb awaiting it never returns. The timer holds the event loop until it fires or is cleared,
+ * which is what keeps a process from exiting while a bound is still in flight and abandoning the
+ * await in silence. It is cleared on either outcome, so it holds the loop for at most `ms`. The
+ * losing side of the race is not cancelled, because a promise cannot be; the caller stops waiting.
+ *
+ * `ms` at or below zero is already past and refuses without awaiting anything. */
+function bounded(value, ms, E, code, label) {
+  var settled = false;
+  return new _Promise(function (resolve, reject) {
+    if (!(ms > 0)) {
+      /** @internal The operation may already be running: a deadline can expire between the check
+       * that started it and the bound computed for it. Refusing without observing its promise
+       * leaves a rejection nobody handled, which ends the process on the default
+       * `unhandledRejection` behavior, and the caller catching this refusal does not help. */
+      _resolve(_Promise, value).then(_ignore, _ignore);
+      reject(E(code, label + " had no time left to run in"));
+      return;
+    }
+    var timer = _setTimeout(function () {
+      if (settled) return;
+      settled = true;
+      reject(E(code, label + " did not settle within " + ms + "ms"));
+    }, ms);
+    function done(fn) {
+      return function (x) {
+        if (settled) return;
+        settled = true;
+        _clearTimeout(timer);
+        fn(x);
+      };
+    }
+    _resolve(_Promise, value).then(done(resolve), done(reject));
+  });
+}
+
+module.exports = _intrinsic.freeze({ deferred: deferred, awaited: awaited, invoked: invoked, bounded: bounded });

package/lib/guard-encoding.js

@@ -16,6 +16,9 @@ var _charCodeAt = _intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSlice = _intrinsic.uncurry(String.prototype.slice);
 var _toLowerCase = _intrinsic.uncurry(String.prototype.toLowerCase);
 var _isInteger = _intrinsic.isInteger;
+var _charAt = _intrinsic.uncurry(String.prototype.charAt);
+var _fromCharCode = String.fromCharCode;
+var _guardBytes = require("./guard-bytes");
 var _floor = _intrinsic.floor;
 
 var UPPER = "ABCDEFGHIJKLMNOPQRSTUVWXYZ", LOWER = "abcdefghijklmnopqrstuvwxyz", DIGITS = "0123456789";
@@ -76,4 +79,105 @@ function hex(text, maxBytes, E, code, label) {
   return buf;
 }
 
-module.exports = _intrinsic.freeze({ base64url: base64url, base64: base64, hex: hex });
+/**
+ * @internal The value of one hexadecimal digit, or -1 when the byte is not one. Every
+ * character-scanning reader of an escape (a DN string, a JSON string, a URI) asks the same
+ * question, and asking it in one place keeps the three ranges from drifting apart.
+ *
+ * @enforced-by guard-shape-reinlined
+ * @guard-shape c >= 0x30 && c <= 0x39\) return c - 0x30
+ */
+function hexNibble(c) {
+  if (c >= 0x30 && c <= 0x39) return c - 0x30;
+  if (c >= 0x41 && c <= 0x46) return c - 0x41 + 10;
+  if (c >= 0x61 && c <= 0x66) return c - 0x61 + 10;
+  return -1;
+}
+
+/**
+ * @internal Whether a byte is an ASCII letter or digit. It is the base of every
+ * character-class a textual syntax defines on top of it, so the three ranges live here
+ * rather than being spelled again per reader.
+ *
+ * @enforced-by behavioral -- the ranges have no rename-proof shape distinct from a legitimate
+ * range test, and each consumer's own acceptance vector is the guard.
+ */
+function isAlphanumericByte(c) {
+  return (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || (c >= 0x30 && c <= 0x39);
+}
+
+var _HEX_UPPER = "0123456789ABCDEF";
+
+/** @internal Whether a byte is in RFC 3986 sec. 2.3's unreserved set: `ALPHA / DIGIT / "-" / "."
+ * / "_" / "~"`. Every other byte is written as a percent-triplet, which is what sec. 2.1 requires
+ * of a character that is not allowed where it sits. The set is deliberately the unreserved one
+ * and not the larger set a path segment also admits, so the output is safe wherever it is
+ * placed and a caller cannot reach a delimiter by choosing a component. */
+function _isUnreservedByte(c) {
+  return (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a) || (c >= 0x30 && c <= 0x39) ||
+    c === 0x2d || c === 0x2e || c === 0x5f || c === 0x7e;
+}
+
+/** @internal Percent-encode bytes to RFC 3986 sec. 2.1, with the unreserved set of sec. 2.3 passed
+ * through and every other byte written as `%` and two upper-case hex digits. sec. 2.1 states that
+ * the hexadecimal digits of a triplet may be either case and that uppercase is the canonical form
+ * a producer emits.
+ *
+ * This is the only escaping in `lib/`. `encodeURIComponent` reads a JavaScript string, so bytes
+ * reach it only after a decode this cannot assume, and it leaves `!`, `*`, `'`, `(` and `)`
+ * unescaped, which are sub-delims in sec. 2.2 and therefore delimiters in some components. */
+// @enforced-by guard-shape-reinlined
+// @guard-shape %[0-9A-F]{2}|toString\(16\)[\s\S]{0,80}?padStart\(\s*2
+// @guard-via guard\.encoding\.(?:percentEncode|uriPathSegment)\(
+function percentEncode(bytes, E, code, label) {
+  var buf = _guardBytes.source(bytes, _rawError(E), code, label || "value to percent-encode");
+  var out = "";
+  for (var i = 0; i < buf.length; i++) {
+    var c = buf[i];
+    if (_isUnreservedByte(c)) { out += _fromCharCode(c); continue; }
+    out += "%" + _charAt(_HEX_UPPER, (c >> 4) & 0x0f) + _charAt(_HEX_UPPER, c & 0x0f);
+  }
+  return out;
+}
+
+/** @internal One path segment of a URI, built from `text` read as its latin1 bytes. Every byte
+ * outside the unreserved set becomes a triplet, so a value carrying `/`, `?`, `#` or a percent of
+ * its own cannot reach past the segment it was placed in. */
+function uriPathSegment(text, E, code, label) {
+  if (typeof text !== "string") {
+    throw _rawError(E)(code, (label || "URI path segment") + " must be a string");
+  }
+  return percentEncode(_bufferFrom(text, "latin1"), E, code, label);
+}
+
+/** @internal The guards take a `(code, message)` factory. A caller that passes an error CLASS is a
+ * configuration fault and not an input one, so it is refused here instead of producing
+ * `undefined is not a constructor` at the first refusal. */
+function _rawError(E) {
+  if (typeof E !== "function") throw new TypeError("guard.encoding: an error factory (code, message) is required");
+  return E;
+}
+
+/** @internal Whether a string is already the form that goes on the wire. RFC 3986 sec. 2 builds a
+ * URI out of US-ASCII alone, so a string carrying anything above it is an IRI (RFC 3987) and the
+ * bytes a transport would send are not the characters counted here. Every length a specification
+ * states about a URL is a byte count, which makes this the check a boundary needs before measuring
+ * one: a code point in U+0080..U+07FF is one character and two UTF-8 bytes, so a rule measured in
+ * characters passes a URL the rule was meant to refuse.
+ *
+ * @enforced-by guard-shape-reinlined
+ * @guard-shape /charCodeAt\s*\(\s*[\w$]+\s*,\s*[\w$]+\s*\)\s*>\s*(?:0x7f|127)\b/ */
+function isAsciiText(s) {
+  if (typeof s !== "string") return false;
+  for (var i = 0; i < s.length; i++) {
+    if (_charCodeAt(s, i) > 0x7f) return false;
+  }
+  return true;
+}
+
+module.exports = _intrinsic.freeze({
+  base64url: base64url, base64: base64, hex: hex,
+  hexNibble: hexNibble, isAlphanumericByte: isAlphanumericByte,
+  isAsciiText: isAsciiText,
+  percentEncode: percentEncode, uriPathSegment: uriPathSegment,
+});

package/lib/guard-identifier.js

@@ -401,7 +401,62 @@ function _settle(opts, E, code, label) {
     throw E(code, label + " changes which options it carries while they are read, so no set of " +
       "them can be checked; pass an object whose properties are plain values");
   }
-  return opts;
+  return _withoutPlantedFields(opts, before);
+}
+
+/** @internal A language prototype, as opposed to one the caller built. A defaults object the
+ * caller put under their bag is theirs and sits below these in the chain. */
+function _isLanguageProto(o) {
+  return o === intrinsic.ObjectProto || o === intrinsic.ArrayProto ||
+    o === intrinsic.BufferProto || o === intrinsic.FunctionProto;
+}
+
+function _holderOf(obj, k) {
+  var visited = new _Set();
+  for (var o = obj; o !== null && o !== undefined && !_setHas(visited, o); o = _getPrototypeOf(o)) {
+    _setAdd(visited, o);
+    if (_getOwnPropertyDescriptor(o, k)) return o;
+  }
+  return null;
+}
+
+/** @internal An option is something the caller supplied, and a name whose descriptor sits on a
+ * language prototype was supplied by whoever wrote to that prototype. The verb reads its options
+ * with `opts.name`, which walks the chain, so such a name answers as though it had been passed:
+ * `historicalMode` treats a revocation as not yet in force and `softFail` waives an undetermined
+ * one, each turning a revoked certificate into a valid path. The unknown-key check catches a
+ * planted name that is not an option at all; one spelled like a real option passes it.
+ *
+ * What comes back reads `undefined` for those names and is otherwise the object that was passed:
+ * the same prototype chain, the same own fields, and one own `undefined` masking each planted
+ * name. So the caller's own field still wins, a defaults object under their bag still supplies its
+ * options whatever their type, the reported set of names does not change, and a verb in a polluted
+ * process still runs instead of failing on every call. With nothing planted the object is handed
+ * back untouched, which is every call outside a process that has been written to.
+ *
+ * The own fields are carried as OWN fields rather than left to be inherited from the object that
+ * was passed. A verb that forwards its options builds the forwarded set by copying own keys, and a
+ * bag whose fields had all become inherited arrives at the inner call carrying none of them. */
+function _withoutPlantedFields(obj, names) {
+  var planted = null;
+  for (var i = 0; i < names.length; i++) {
+    if (!_isLanguageProto(_holderOf(obj, names[i]))) continue;
+    if (planted === null) planted = [];
+    _append(planted, names[i]);
+  }
+  if (planted === null) return obj;
+  var shadow = _create(_getPrototypeOf(obj));
+  var own = _ownKeys(obj);
+  for (var k = 0; k < own.length; k++) {
+    var d = _getOwnPropertyDescriptor(obj, own[k]);
+    if (!d) continue;
+    _defineProperty(shadow, own[k], d);
+  }
+  for (var j = 0; j < planted.length; j++) {
+    if (_getOwnPropertyDescriptor(obj, planted[j])) continue;
+    _defineProperty(shadow, planted[j], { value: undefined, writable: true, enumerable: false, configurable: true });
+  }
+  return shadow;
 }
 
 /** @internal An injectable callback option, refused unless it is callable. A value that is present
@@ -445,8 +500,26 @@ function assertCallableOption(opts, key, E, code, label, shape) {
   return assertCallable(opts[key], E, code, label, shape);
 }
 
+/** @internal Whether a caller's object says something about itself, as opposed to inheriting the
+ * answer. A declaration is a promise the author of that object made, so it has to sit on the object
+ * they wrote: reading the flag through the object finds a value on `Function.prototype` that every
+ * function in the process carries, and a boundary reading it that way treats every caller as having
+ * promised whatever was planted there. The value is read from the descriptor rather than through
+ * the object, so an accessor further up the chain cannot answer either.
+ *
+ * @enforced-by guard-shape-reinlined
+ * @guard-shape /\.\s*blocksPrivateAddresses\s*===\s*true/ */
+function declaresOwn(obj, name) {
+  if (obj === null || obj === undefined) return false;
+  var d;
+  try { d = _getOwnPropertyDescriptor(_Object(obj), name); }
+  catch (_e) { return false; }
+  return !!d && !d.get && !d.set && d.value === true;
+}
+
 module.exports = intrinsic.freeze({
   assertCallable: assertCallable,
+  declaresOwn: declaresOwn,
   assertCallableOption: assertCallableOption,
   assertCanonicalOid: assertCanonicalOid,
   assertKnownKeys: assertKnownKeys,

package/lib/guard-intrinsic.js

@@ -96,6 +96,7 @@ var _ObjectFn = Object;
 var _ObjectProto = Object.prototype;
 var _BufferProto = Buffer.prototype;
 var _ArrayProto = Array.prototype;
+var _FunctionProto = Function.prototype;
 var _Set = Set;
 var _Map = Map;
 var _WeakMap = WeakMap;
@@ -216,6 +217,7 @@ module.exports = Object.freeze({
   ObjectProto: _ObjectProto,
   BufferProto: _BufferProto,
   ArrayProto: _ArrayProto,
+  FunctionProto: _FunctionProto,
   setAdd: _setAdd,
   setHas: _setHas,
   mapGet: _mapGet,

package/lib/guard-json.js

@@ -15,12 +15,7 @@ var _stringify = require("./guard-intrinsic").stringify;
 var _append = require("./guard-list").append;
 var limits = require("./guard-limits");
 
-function _hexVal(c) {
-  if (c >= 0x30 && c <= 0x39) return c - 0x30;
-  if (c >= 0x61 && c <= 0x66) return c - 0x61 + 10;
-  if (c >= 0x41 && c <= 0x46) return c - 0x41 + 10;
-  return -1;
-}
+var _hexVal = require("./guard-encoding").hexNibble;
 
 // @enforced-by json-parse-not-via-guard
 function parse(input, ErrorClass, spec) {

package/lib/guard-limits.js

@@ -7,6 +7,10 @@ var constants = require("./constants");
 var _isInteger = require("./guard-intrinsic").isInteger;
 var _freeze = require("./guard-intrinsic").freeze;
 var _sizeOf = require("./guard-intrinsic").sizeOf;
+var _isFinite = require("./guard-intrinsic").isFinite;
+var _Number = require("./guard-intrinsic").Number;
+var _hrtimeBigint = process.hrtime.bigint;
+function _monotonicNow() { return _Number(_hrtimeBigint() / 1000000n); }
 
 // @enforced-by behavioral -- a config-time cap validator has no rename-proof code
 function cap(value, key, dflt, opts) {
@@ -109,7 +113,42 @@ function budget(limits) {
   return _freeze(self);
 }
 
+/** @internal A wall-clock bound shared across several operations, where a per-operation timeout
+ * bounds each one and nothing bounds their sum. `now` is the clock, which a caller supplies so a
+ * test drives the bound without waiting; it defaults to the monotonic one, because a wall clock
+ * that steps backward would extend the deadline it was meant to enforce.
+ *
+ * `expired()` answers the question and `remaining()` gives the budget a per-operation timeout
+ * should be narrowed to, never below zero, so a caller that hands `remaining()` to a timeout
+ * cannot ask for one that outlives the deadline.
+ */
+// @enforced-by behavioral -- an elapsed-time comparison has no rename-proof shape that separates a deadline from any other subtraction; the vectors driving a checker to its bound are the guard
+function deadline(totalMs, opts) {
+  opts = opts || {};
+  var now = typeof opts.now === "function" ? opts.now : _monotonicNow;
+  if (!_isInteger(totalMs) || totalMs < 0) {
+    throw new TypeError("guard.limits.deadline: the total must be a non-negative integer of milliseconds");
+  }
+  var started = now();
+  if (typeof started !== "number" || !_isFinite(started)) {
+    throw new TypeError("guard.limits.deadline: the clock must return a finite number of milliseconds");
+  }
+  var self = {
+    elapsed: function () {
+      var at = now();
+      return typeof at === "number" && _isFinite(at) && at > started ? at - started : 0;
+    },
+    remaining: function () {
+      var left = totalMs - self.elapsed();
+      return left > 0 ? left : 0;
+    },
+    expired: function () { return self.remaining() === 0; },
+    total: function () { return totalMs; },
+  };
+  return _freeze(self);
+}
+
 module.exports = _freeze({
   cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap,
-  budget: budget, isBudgetExceeded: isBudgetExceeded,
+  budget: budget, isBudgetExceeded: isBudgetExceeded, deadline: deadline,
 });

package/lib/guard-list.js

@@ -48,10 +48,35 @@ function allMatch(list, predicate) {
   return true;
 }
 
+// @enforced-by caller-array-copied-live
+function snapshot(list) {
+  if (!_isArray(list)) throw new TypeError("guard.list.snapshot: the receiver must be an array");
+  var n = list.length;
+  var out = [];
+  for (var i = 0; i < n; i++) {
+    _defineProperty(out, i, { value: list[i], writable: true, enumerable: true, configurable: true });
+  }
+  return out;
+}
+
+// @enforced-by caller-array-copied-live
+function copyMap(list, fn) {
+  if (!_isArray(list)) throw new TypeError("guard.list.copyMap: the receiver must be an array");
+  if (typeof fn !== "function") throw new TypeError("guard.list.copyMap: the second argument must be a function");
+  var n = list.length;
+  var out = [];
+  for (var i = 0; i < n; i++) {
+    _defineProperty(out, i, { value: fn(list[i], i), writable: true, enumerable: true, configurable: true });
+  }
+  return out;
+}
+
 module.exports = _freeze({
   append: append,
   contains: contains,
   containsAll: containsAll,
   anyMatches: anyMatches,
   allMatch: allMatch,
+  snapshot: snapshot,
+  copyMap: copyMap,
 });

package/lib/guard-name.js

@@ -164,12 +164,7 @@ function escapeControlBytes(str) {
 
 var DN_SPECIAL = intrinsic.assign(intrinsic.create(null), { 0x2c: 1, 0x2b: 1, 0x22: 1, 0x5c: 1, 0x3c: 1, 0x3e: 1, 0x3b: 1 });
 
-function _hexNibble(c) {
-  if (c >= 0x30 && c <= 0x39) return c - 0x30;
-  if (c >= 0x41 && c <= 0x46) return c - 0x41 + 10;
-  if (c >= 0x61 && c <= 0x66) return c - 0x61 + 10;
-  return -1;
-}
+var _hexNibble = require("./guard-encoding").hexNibble;
 function _isAttrTypeStart(c) { return (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a); }
 function _isAttrTypeChar(c) { return _isAttrTypeStart(c) || (c >= 0x30 && c <= 0x39) || c === 0x2d; }
 function _isDigit(c) { return c >= 0x30 && c <= 0x39; }
@@ -330,7 +325,6 @@ function _charTable(chars) {
   for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true;
   return t;
 }
-var _FQDN_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-");
 var _DIGDOT_TABLE = _charTable("0123456789.");
 function _allCharsIn(s, table) {
   if (s.length === 0) return false;
@@ -349,12 +343,18 @@ function uriSchemeIs(s, scheme) {
   return lowerAscii(_strSlice(s, 0, scheme.length)) === scheme;
 }
 
-/** @internal A host name of two or more labels that is not an address, which is the form a URI
- * name constraint is compared by (RFC 5280 sec. 4.2.1.10). */
+/** @internal A host name that is not an address, which is the form a URI name constraint is
+ * compared by (RFC 5280 sec. 4.2.1.10). The clause holds a URI constraint to "a fully qualified
+ * domain name" and names in the same sentence what that excludes: a URI with no authority
+ * component, and one whose authority names an IP address. It states no label count, so a single
+ * label is a host like any other and `com` constrains a top-level domain. The host is read by its
+ * labels rather than by which characters it holds: a character test admits an empty label and a
+ * hyphen at a label edge, and the suffix comparison below would then match a base against a name
+ * that is not a name. */
 function isFqdnHost(host) {
+  if (typeof host !== "string") return false;
   var h = stripTrailingDot(host);
-  if (h === "" || _indexOf(h, ".") === -1) return false;
-  if (!_allCharsIn(h, _FQDN_TABLE)) return false;
+  if (!_isHostName(h)) return false;
   if (_allCharsIn(h, _DIGDOT_TABLE)) return false;
   return true;
 }
@@ -391,6 +391,112 @@ function _isHostName(s) {
   return true;
 }
 
+/** @internal A host name written as labels separated by dots (RFC 1034 sec. 3.5, RFC 1123 sec. 2.1),
+ * with no trailing dot: the caller strips the one dot a comparison strips, so a second one is an
+ * empty label and is refused. */
+// @enforced-by behavioral -- an LDH label walk has no rename-proof shape that separates it from any other per-character scan; the vectors refusing an empty label, a hyphen at a label edge and a name past 253 octets are the guard
+function isHostName(s) { return typeof s === "string" && _isHostName(s); }
+
+/** @internal The labels of `s`, in order, with no trailing-dot handling of its own: the caller
+ * normalizes the dot through `stripTrailingDot` so both sides of a comparison are normalized by
+ * one symbol. A name carrying an empty label yields an empty string at that position, which a
+ * label test then refuses, rather than being dropped. */
+// @enforced-by behavioral -- splitting on a dot has no rename-proof shape; the vectors counting the labels of a name carrying an empty one are the guard
+function hostLabels(s) {
+  var out = [], start = 0;
+  for (var i = 0; i <= s.length; i++) {
+    if (i === s.length || _charCodeAt(s, i) === 0x2e) {
+      _append(out, _strSlice(s, start, i));
+      start = i + 1;
+    }
+  }
+  return out;
+}
+
+function _isAlnumLower(c) { return (c >= 0x61 && c <= 0x7a) || (c >= 0x30 && c <= 0x39); }
+
+/** @internal Whether `l` is a well-formed A-label (RFC 5890 sec. 2.3.2.1): the `xn--` prefix
+ * followed by groups of lower-case alphanumerics separated by single hyphens, each group non-empty.
+ * The label is not decoded, because RFC 5891 sec. 3.1 rule 2 compares a pair of A-labels as
+ * case-insensitive ASCII without validating either. */
+// @enforced-by behavioral -- an `xn--` prefix scan has no rename-proof shape; the vectors refusing `xn--`, a trailing hyphen and an empty group are the guard
+function isXnLabel(l) {
+  if (typeof l !== "string") return false;
+  var n = l.length;
+  if (!(n >= 4 && _charCodeAt(l, 0) === 0x78 && _charCodeAt(l, 1) === 0x6e &&
+        _charCodeAt(l, 2) === 0x2d && _charCodeAt(l, 3) === 0x2d)) return false;
+  var i = 4, g = 0;
+  while (i < n && _isAlnumLower(_charCodeAt(l, i))) { i++; g++; }
+  if (g < 1) return false;
+  while (i < n) {
+    if (_charCodeAt(l, i) !== 0x2d) return false;
+    i++;
+    var g2 = 0;
+    while (i < n && _isAlnumLower(_charCodeAt(l, i))) { i++; g2++; }
+    if (g2 < 1) return false;
+  }
+  return true;
+}
+
+var _SCHEME_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+.-");
+
+/** @internal The scheme and the host of a URI, read to RFC 3986 sec. 3: the scheme up to its colon,
+ * and, when `//` follows that colon, the authority up to the first `/`, `?` or `#`, with userinfo
+ * and port removed and an IPv6 literal's brackets stripped. `hasAuthority` is false for a URI
+ * written without `//`, which RFC 3986 sec. 3.3 permits and which therefore has no host; a caller
+ * that needs a host decides what to do with that rather than being handed a guess. `host` is null
+ * when the authority carries none, and `bracketed` says the host arrived inside `[]`, which is the
+ * only place an IPv6 literal may appear. Percent-escapes are left as written, so a caller comparing
+ * the host decides whether to accept one. */
+// @enforced-by behavioral -- a URI walk has no rename-proof shape that separates it from any other character scan; the vectors reading a scheme, refusing two userinfo separators and stripping a port are the guard
+function uriParts(uri) {
+  if (typeof uri !== "string") return null;
+  var n = uri.length;
+  if (n === 0) return null;
+  var c0 = _charCodeAt(uri, 0);
+  if (!((c0 >= 0x41 && c0 <= 0x5a) || (c0 >= 0x61 && c0 <= 0x7a))) return null;
+  var p = 1;
+  while (p < n && _SCHEME_TABLE[_charCodeAt(uri, p)]) p += 1;
+  if (_charCodeAt(uri, p) !== 0x3a) return null;
+  var scheme = _strSlice(uri, 0, p);
+  if (_charCodeAt(uri, p + 1) !== 0x2f || _charCodeAt(uri, p + 2) !== 0x2f) {
+    return { scheme: scheme, hasAuthority: false, host: null, bracketed: false };
+  }
+  p += 3;
+  var authStart = p;
+  while (p < n) {
+    var d = _charCodeAt(uri, p);
+    if (d === 0x2f || d === 0x3f || d === 0x23) break;
+    p += 1;
+  }
+  var authority = _strSlice(uri, authStart, p);
+  var firstAt = _indexOf(authority, "@");
+  if (firstAt !== _lastIndexOf(authority, "@")) return null;
+  if (firstAt !== -1) authority = _strSlice(authority, firstAt + 1);
+  var host = _strSlice(authority, 0, _portStripIndex(authority));
+  if (host === "") return { scheme: scheme, hasAuthority: true, host: null, bracketed: false };
+  var hn = host.length;
+  if (hn >= 2 && _charCodeAt(host, 0) === 0x5b && _charCodeAt(host, hn - 1) === 0x5d) {
+    return { scheme: scheme, hasAuthority: true, host: _strSlice(host, 1, hn - 1), bracketed: true };
+  }
+  return { scheme: scheme, hasAuthority: true, host: host, bracketed: false };
+}
+
+/** @internal Where a `:port` suffix starts, or the length when there is none. RFC 3986 sec. 3.2.3
+ * writes `port = *DIGIT`, so a colon with nothing after it is a port too, and leaving that colon on
+ * the host would make the authority compare as a name carrying a character no name carries. A
+ * bracketed IPv6 literal has colons of its own, so the scan reads digits back from the end and
+ * requires the colon immediately before them; the closing bracket is what stops it. */
+function _portStripIndex(s) {
+  var i = s.length;
+  while (i > 0) {
+    var c = _charCodeAt(s, i - 1);
+    if (c >= 0x30 && c <= 0x39) i -= 1;
+    else break;
+  }
+  return (i > 0 && _charCodeAt(s, i - 1) === 0x3a) ? i - 1 : s.length;
+}
+
 var _ATEXT_TABLE = _charTable("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$%&'*+-/=?^_`{|}~");
 
 /** @internal A quoted local part (RFC 5321 sec. 4.1.2 Quoted-string): printable ASCII between
@@ -539,18 +645,23 @@ function constraintBaseRefusal(tag, base) {
       : "must be a host name, optionally written as a subtree with a leading dot";
   }
   /** @internal RFC 5280 sec. 4.2.1.10 says of a URI constraint: "The constraint MUST be specified as
-   * a fully qualified domain name and MAY specify a host or a domain. Examples would be
-   * host.example.com and .example.com." Its dNSName paragraph states no such requirement, so a single
-   * label is a valid dNSName base and is not a valid URI base. A caller meets this rule at the door,
-   * whether through `pki.trust.anchor` or through the validator's subtree seeds. A base a certificate
-   * carries in its own extension never reaches a door, and `uriMatch` is what holds it to the rule
-   * there, answering `path/name-constraint-unsupported` for a host it cannot read as fully qualified.
-   * `constraintBaseUnreadable` does not judge label count and does not stand in for that check. */
+   * a fully qualified domain name and MAY specify a host or a domain", and the same sentence names
+   * what that excludes: a URI with no authority component, and one whose authority names an IP
+   * address. Its dNSName paragraph states no such requirement, so an address is a valid dNSName base
+   * and is not a valid URI base. Neither paragraph states a label count. A caller meets this rule at
+   * the door, whether through `pki.trust.anchor` or through the validator's subtree seeds. A base a
+   * certificate carries in its own extension never reaches a door, and `uriMatch` holds it to the
+   * same `isFqdnHost` this calls, so the door and the comparison cannot answer differently. */
   if (tag === 6) {
-    var h = _hostConstraintBody(_toLowerCase(base));
-    var dotted = _isHostName(h) && _indexOf(h, ".") !== -1 && !_allCharsIn(h, _DIGDOT_TABLE);
-    return dotted ? null
-      : "must be a fully qualified domain name, which RFC 5280 sec. 4.2.1.10 requires of a URI constraint and not of a dNSName one";
+    /** @internal Only the leading dot comes off here. `isFqdnHost` takes a host as a URI carries
+     * it and strips the one trailing dot that makes a name absolute, so stripping it here too
+     * would let a base ending in two dots through as one ending in none. */
+    var uriBody = _toLowerCase(base);
+    if (_charAt(uriBody, 0) === ".") uriBody = _strSlice(uriBody, 1);
+    if (isFqdnHost(uriBody)) return null;
+    return _allCharsIn(stripTrailingDot(uriBody), _DIGDOT_TABLE)
+      ? "must be a domain name rather than an address, RFC 5280 sec. 4.2.1.10 naming an address in a URI's authority as what a URI constraint cannot be compared against"
+      : "must be a domain name, which RFC 5280 sec. 4.2.1.10 requires of a URI constraint, optionally written as a subtree with a leading dot";
   }
   return null;
 }
@@ -661,6 +772,7 @@ module.exports = intrinsic.freeze({
   isAttributeDescriptor: isAttributeDescriptor,
   lowerAscii: lowerAscii, uriSchemeIs: uriSchemeIs,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,
+  isHostName: isHostName, hostLabels: hostLabels, isXnLabel: isXnLabel, uriParts: uriParts,
   constraintBaseRefusal: constraintBaseRefusal,
   constraintBaseUnreadable: constraintBaseUnreadable,
 });

package/lib/guard-text.js

@@ -50,4 +50,36 @@ function keyOf(v) {
   return typeof v === "string" || typeof v === "number" ? v : undefined;
 }
 
-module.exports = intrinsic.freeze({ decode: decode, showValue: showValue, keyOf: keyOf });
+/** @internal What a caught value says about itself, as a string, for a boundary that reports a
+ * fault it did not cause. The value came from caller code, so every step of reading it is a step
+ * the caller chose the behavior of: `message` may be an accessor that throws, a Symbol that
+ * refuses string conversion, or an object whose `toString` throws, and the value itself may be a
+ * Proxy that refuses every read. A boundary whose whole contract is to turn a fault into a verdict
+ * cannot afford any of those to leave it, which is what happens when the description is built by
+ * reading `e.message` in the open.
+ *
+ * Every read is attempted and none is required. A value that answers nothing readable is described
+ * by its type, which is what `showValue` would have said about it anyway.
+ *
+ * @enforced-by guard-shape-reinlined
+ * @guard-shape /([\w$]+)\s*&&\s*\1\.message\s*\?\s*\1\.message\s*:|([\w$]+)\.message\s*\|\|\s*\2\b/ */
+function describeThrown(e) {
+  var m;
+  try { m = e === null || e === undefined ? undefined : e.message; }
+  catch (_readFailed) { return _thrownFallback(e); }
+  if (typeof m === "string" && m.length > 0) return m;
+  if (m === undefined || m === null) return _thrownFallback(e);
+  try {
+    if (typeof m === "symbol") return intrinsic.String(m);
+    return "" + m;
+  } catch (_convertFailed) { return _thrownFallback(e); }
+}
+
+function _thrownFallback(e) {
+  try { return showValue(e); }
+  catch (_showFailed) { return "a value that reports nothing readable"; }
+}
+
+module.exports = intrinsic.freeze({
+  decode: decode, showValue: showValue, keyOf: keyOf, describeThrown: describeThrown,
+});