@vizamodo/aws-sts-core 0.4.20 → 0.4.22

package/dist/sts/issue.js

@@ -74,12 +74,6 @@ export async function issueAwsCredentials(input) {
     const normalizedCert = normalizeCert(certBase64);
     // No isolate cache — stale cached values caused wrong-serial bugs.
     const certSerialDec = parseCertSerialDec(normalizedCert);
-    console.debug("[cert-serial-debug]", {
-        certLen: normalizedCert.length,
-        certPreview: normalizedCert.slice(0, 40),
-        certSerialDec,
-        certSerialHex: BigInt(certSerialDec).toString(16),
-    });
     const cacheKey = `${region}|${roleArn}|${profileArn}|${trustAnchorArn}|${certSerialDec}`;
     // BUG 1 KEPT: signing happens before getCachedOrFetch — runs on every
     // request even when L1/L2 cache would have returned a hit.
@@ -176,40 +170,40 @@ function normalizeCert(raw) {
 function parseCertSerialDec(normalizedCertBase64) {
     try {
         const der = base64ToBytes(normalizedCertBase64);
-        let offset = 0;
-        function readLen() {
-            if (offset >= der.length)
+        // Use array pointer instead of closure-captured variable to avoid
+        // bundler (esbuild/wrangler) variable-rename bugs.
+        const p = [0];
+        function readLen(p) {
+            if (p[0] >= der.length)
                 throw new Error("DER overflow");
-            const b = der[offset++];
+            const b = der[p[0]++];
             if ((b & 0x80) === 0)
                 return b;
             const n = b & 0x7f;
             let len = 0;
-            if (offset + n > der.length)
+            if (p[0] + n > der.length)
                 throw new Error("DER overflow");
             for (let i = 0; i < n; i++)
-                len = (len << 8) | der[offset++];
+                len = (len << 8) | der[p[0]++];
             return len;
         }
-        if (der[offset++] !== 0x30)
+        if (der[p[0]++] !== 0x30)
             throw new Error("bad cert");
-        readLen();
-        if (der[offset++] !== 0x30)
+        readLen(p);
+        if (der[p[0]++] !== 0x30)
             throw new Error("bad tbs");
-        readLen();
-        const beforeVersionOffset = offset;
-        if (der[offset] === 0xa0) {
-            offset++;
-            offset += readLen();
+        readLen(p);
+        // Skip optional [0] EXPLICIT version field.
+        if (der[p[0]] === 0xa0) {
+            p[0]++;
+            p[0] += readLen(p);
         }
-        const afterVersionOffset = offset;
-        if (der[offset++] !== 0x02)
+        if (der[p[0]++] !== 0x02)
             throw new Error("bad serial tag");
-        const serialLen = readLen();
-        console.debug("[der-debug]", { beforeVersionOffset, afterVersionOffset, serialLen, serialByte0: der[offset]?.toString(16) });
-        if (offset + serialLen > der.length)
+        const serialLen = readLen(p);
+        if (p[0] + serialLen > der.length)
             throw new Error("DER overflow");
-        let serial = der.slice(offset, offset + serialLen);
+        let serial = der.slice(p[0], p[0] + serialLen);
         if (serial.length > 1 && serial[0] === 0x00)
             serial = serial.slice(1);
         let serialBig = 0n;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/aws-sts-core",
-  "version": "0.4.20",
+  "version": "0.4.22",
   "description": "Pure AWS STS + SigV4 (X509 Roles Anywhere) core logic",
   "type": "module",
   "main": "dist/index.js",