anhedral 0.8.5 → 0.9.0

package/assets/security/braces@3.0.3.patch

@@ -0,0 +1,285 @@
+diff --git a/index.js b/index.js
+--- a/index.js
++++ b/index.js
+@@ -1,4 +1,6 @@
+ 'use strict';
++
++const limits = require('./lib/limits');
+ 
+ const stringify = require('./lib/stringify');
+ const compile = require('./lib/compile');
+@@ -23,11 +25,18 @@
+   let output = [];
+ 
+   if (Array.isArray(input)) {
++    if (input.length > limits.MAX_RESULTS) limits.fail();
++    let chars = 0;
+     for (const pattern of input) {
+       const result = braces.create(pattern, options);
+       if (Array.isArray(result)) {
+-        output.push(...result);
++        const size = limits.measure(result);
++        chars += size.chars;
++        if (output.length + size.count > limits.MAX_RESULTS || chars > limits.MAX_CHARS) limits.fail();
++        for (const value of result) output.push(value);
+       } else {
++        chars += String(result).length;
++        if (output.length >= limits.MAX_RESULTS || chars > limits.MAX_CHARS) limits.fail();
+         output.push(result);
+       }
+     }
+diff --git a/lib/compile.js b/lib/compile.js
+--- a/lib/compile.js
++++ b/lib/compile.js
+@@ -1,9 +1,12 @@
+ 'use strict';
++
++const limits = require('./limits');
+ 
+ const fill = require('fill-range');
+ const utils = require('./utils');
+ 
+ const compile = (ast, options = {}) => {
++  limits.ast(ast);
+   const walk = (node, parent = {}) => {
+     const invalidBlock = utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+@@ -38,6 +41,7 @@
+ 
+     if (node.nodes && node.ranges > 0) {
+       const args = utils.reduce(node.nodes);
++      limits.range(args, options, true);
+       const range = fill(...args, { ...options, wrap: false, toRegex: true, strictZeros: true });
+ 
+       if (range.length !== 0) {
+@@ -48,13 +52,14 @@
+     if (node.nodes) {
+       for (const child of node.nodes) {
+         output += walk(child, node);
++        limits.string(output);
+       }
+     }
+ 
+     return output;
+   };
+ 
+-  return walk(ast);
++  return limits.string(walk(ast));
+ };
+ 
+ module.exports = compile;
+diff --git a/lib/expand.js b/lib/expand.js
+--- a/lib/expand.js
++++ b/lib/expand.js
+@@ -1,4 +1,6 @@
+ 'use strict';
++
++const limits = require('./limits');
+ 
+ const fill = require('fill-range');
+ const stringify = require('./stringify');
+@@ -9,6 +11,7 @@
+ 
+   queue = [].concat(queue);
+   stash = [].concat(stash);
++  limits.append(queue, stash, enclose);
+ 
+   if (!stash.length) return queue;
+   if (!queue.length) {
+@@ -31,6 +34,7 @@
+ };
+ 
+ const expand = (ast, options = {}) => {
++  limits.ast(ast);
+   const rangeLimit = options.rangeLimit === undefined ? 1000 : options.rangeLimit;
+ 
+   const walk = (node, parent = {}) => {
+@@ -61,6 +65,7 @@
+         throw new RangeError('expanded array length exceeds range limit. Use options.rangeLimit to increase or disable the limit.');
+       }
+ 
++      limits.range(args, options);
+       let range = fill(...args, options);
+       if (range.length === 0) {
+         range = stringify(node, options);
+@@ -107,7 +112,9 @@
+     return queue;
+   };
+ 
+-  return utils.flatten(walk(ast));
++  const result = utils.flatten(walk(ast));
++  limits.measure(result);
++  return result;
+ };
+ 
+ module.exports = expand;
+diff --git a/lib/limits.js b/lib/limits.js
+new file mode 100644
+--- /dev/null
++++ b/lib/limits.js
+@@ -0,0 +1,102 @@
++'use strict';
++
++// Anhedral's local 3.0.3 security backport. Limits cannot be disabled by options.
++const MAX_DEPTH = 100;
++const MAX_NODES = 20000;
++const MAX_RESULTS = 100000;
++const MAX_CHARS = 10 * 1024 * 1024;
++const fail = () => { throw new RangeError('Brace operation exceeds safe resource limits'); };
++const string = value => {
++  if (String(value).length > MAX_CHARS) fail();
++  return value;
++};
++
++const ast = root => {
++  const work = [[root, 0, false]];
++  const active = new Set();
++  const parentDepths = new Map();
++  let count = 0;
++  let chars = 0;
++  while (work.length) {
++    const [node, depth, leaving] = work.pop();
++    if (leaving) { active.delete(node); continue; }
++    if (!node || (typeof node !== 'object' && typeof node !== 'function')) throw new TypeError('Expected an AST node');
++    if (depth > MAX_DEPTH || ++count > MAX_NODES || active.has(node)) fail();
++    chars += node.value ? String(node.value).length : 0;
++    if (chars > MAX_CHARS) fail();
++    // expand follows parent links independently of the child traversal.
++    const parents = new Set();
++    let parent = node;
++    while (parent && !parentDepths.has(parent)) {
++      if (parents.has(parent) || parents.size > MAX_DEPTH) fail();
++      if (parentDepths.size + parents.size >= MAX_NODES) fail();
++      parents.add(parent);
++      parent = parent.parent;
++    }
++    let parentDepth = parent ? parentDepths.get(parent) : 0;
++    for (const value of [...parents].reverse()) {
++      if (++parentDepth > MAX_DEPTH + 1) fail();
++      parentDepths.set(value, parentDepth);
++    }
++    if (node.nodes) {
++      if (!Array.isArray(node.nodes)) throw new TypeError('Expected AST children');
++      if (node.nodes.length > MAX_NODES || work.length + node.nodes.length > MAX_NODES * 2) fail();
++      active.add(node);
++      work.push([node, depth, true]);
++      for (let i = node.nodes.length - 1; i >= 0; i--) work.push([node.nodes[i], depth + 1, false]);
++    }
++  }
++};
++
++const measure = value => {
++  const work = [[value, 0, false]];
++  const active = new Set();
++  let count = 0;
++  let chars = 0;
++  let visits = 0;
++  while (work.length) {
++    const [item, depth, leaving] = work.pop();
++    if (leaving) { active.delete(item); continue; }
++    if (depth > MAX_DEPTH || ++visits > MAX_RESULTS + MAX_NODES) fail();
++    if (Array.isArray(item)) {
++      if (active.has(item) || item.length > MAX_RESULTS || work.length + item.length > MAX_RESULTS + MAX_NODES) fail();
++      active.add(item);
++      work.push([item, depth, true]);
++      for (let i = item.length - 1; i >= 0; i--) work.push([item[i], depth + 1, false]);
++    } else if (item !== undefined) {
++      count++;
++      chars += String(item).length;
++      if (count > MAX_RESULTS || chars > MAX_CHARS) fail();
++    }
++  }
++  return { count, chars };
++};
++
++const append = (queue, stash, enclose) => {
++  const left = measure(queue);
++  const right = measure(stash);
++  const count = left.count ? left.count * right.count : right.count;
++  const chars = left.count ? left.chars * right.count + right.chars * left.count : right.chars;
++  if (count > MAX_RESULTS || chars + (enclose ? count * 2 : 0) > MAX_CHARS) fail();
++};
++
++// fill-range enumerates descending ranges too; rangeLimit:false must not bypass the cap.
++const range = (args, options, compiling = false) => {
++  const [start, end] = args;
++  const step = Math.max(Math.abs(Number(args[2] === undefined ? options.step || 1 : args[2])), 1);
++  if (compiling && step === 1) return; // Numeric regex ranges do not allocate each member.
++  let a = Number(start);
++  let b = Number(end);
++  if (!Number.isInteger(a) || !Number.isInteger(b)) {
++    if (String(start).length !== 1 || String(end).length !== 1) return;
++    a = String(start).charCodeAt(0);
++    b = String(end).charCodeAt(0);
++  }
++  if (!Number.isSafeInteger(a) || !Number.isSafeInteger(b)) fail();
++  if (!Number.isFinite(step)) return; // fill-range handles invalid steps.
++  const count = Math.floor(Math.abs(b - a) / step) + 1;
++  const width = Math.max(String(start).length, String(end).length, String(args[2] || '').length, 1);
++  if (count > MAX_RESULTS || count * (width + (compiling ? 2 : 0)) > MAX_CHARS) fail();
++};
++
++module.exports = { MAX_DEPTH, MAX_RESULTS, MAX_CHARS, fail, string, ast, measure, append, range };
+diff --git a/lib/parse.js b/lib/parse.js
+--- a/lib/parse.js
++++ b/lib/parse.js
+@@ -1,4 +1,6 @@
+ 'use strict';
++
++const limits = require('./limits');
+ 
+ const stringify = require('./stringify');
+ 
+@@ -143,6 +145,7 @@
+      */
+ 
+     if (value === CHAR_LEFT_PARENTHESES) {
++      if (stack.length >= limits.MAX_DEPTH) limits.fail();
+       block = push({ type: 'paren', nodes: [] });
+       stack.push(block);
+       push({ type: 'text', value });
+@@ -195,6 +198,7 @@
+      */
+ 
+     if (value === CHAR_LEFT_CURLY_BRACE) {
++      if (stack.length >= limits.MAX_DEPTH) limits.fail();
+       depth++;
+ 
+       const dollar = prev.value && prev.value.slice(-1) === '$' || block.dollar === true;
+@@ -325,6 +329,7 @@
+   } while (stack.length > 0);
+ 
+   push({ type: 'eos' });
++  limits.ast(ast);
+   return ast;
+ };
+ 
+diff --git a/lib/stringify.js b/lib/stringify.js
+--- a/lib/stringify.js
++++ b/lib/stringify.js
+@@ -1,8 +1,11 @@
+ 'use strict';
++
++const limits = require('./limits');
+ 
+ const utils = require('./utils');
+ 
+ module.exports = (ast, options = {}) => {
++  limits.ast(ast);
+   const stringify = (node, parent = {}) => {
+     const invalidBlock = options.escapeInvalid && utils.isInvalidBrace(parent);
+     const invalidNode = node.invalid === true && options.escapeInvalid === true;
+@@ -22,11 +25,12 @@
+     if (node.nodes) {
+       for (const child of node.nodes) {
+         output += stringify(child);
++        limits.string(output);
+       }
+     }
+     return output;
+   };
+ 
+-  return stringify(ast);
++  return limits.string(stringify(ast));
+ };
+ 

package/assets/security/decode-uri-component@0.2.2.patch

@@ -0,0 +1,149 @@
+diff --git a/index.js b/index.js
+index 24e7db0cc55aa22d0f98358b73298067deb33b52..896c03cce865e681bc95ef0d0ed7d64b18488224 100644
+--- a/index.js
++++ b/index.js
+@@ -1,42 +1,122 @@
+ 'use strict';
+-var token = '%[a-f0-9]{2}';
+-var singleMatcher = new RegExp('(' + token + ')|([^%]+?)', 'gi');
+-var multiMatcher = new RegExp('(' + token + ')+', 'gi');
++// Matches one or more consecutive percent-encoded bytes (e.g. `%C3%A5`).
++const token = '%[a-f0-9]{2}';
++const multiMatcher = new RegExp(`(${token})+`, 'gi');
+ 
+-function decodeComponents(components, split) {
+-	try {
+-		// Try to decode the entire string first
+-		return [decodeURIComponent(components.join(''))];
+-	} catch (err) {
+-		// Do nothing
++const hexPair = /^[a-f\d]{2}$/i;
++
++// Read a `%XX` sequence at `position`, returning the byte value and where to continue scanning.
++function parsePercentByte(input, position) {
++	if (input.codePointAt(position) !== 37 || position + 3 > input.length) {
++		return;
+ 	}
+ 
+-	if (components.length === 1) {
+-		return components;
++	const digits = input.slice(position + 1, position + 3);
++
++	if (!hexPair.test(digits)) {
++		return;
+ 	}
+ 
+-	split = split || 1;
++	return {byte: Number.parseInt(digits, 16), next: position + 3};
++}
++
++/**
++ * Return how many bytes a UTF-8 code point needs based on its lead byte.
++ * Returns 0 for continuation bytes and other invalid lead bytes.
++ */
++function utf8SequenceLength(byte) {
++	if (byte <= 0x7F) {
++		return 1;
++	}
+ 
+-	// Split the array in 2 parts
+-	var left = components.slice(0, split);
+-	var right = components.slice(split);
++	// Start at 0xC2 to exclude overlong 2-byte encodings (0xC0/0xC1).
++	if (byte >= 0xC2 && byte <= 0xDF) {
++		return 2;
++	}
+ 
+-	return Array.prototype.concat.call([], decodeComponents(left), decodeComponents(right));
++	if (byte >= 0xE0 && byte <= 0xEF) {
++		return 3;
++	}
++
++	if (byte >= 0xF0 && byte <= 0xF4) {
++		return 4;
++	}
++
++	return 0;
+ }
+ 
++function isContinuationByte(byte) {
++	return byte >= 0x80 && byte <= 0xBF;
++}
++
++/**
++ * Decode as much of `input` as possible without throwing.
++ *Scans left-to-right in O(n), decoding valid UTF-8 runs and leaving the rest literal.
++ */
+ function decode(input) {
+ 	try {
+ 		return decodeURIComponent(input);
+-	} catch (err) {
+-		var tokens = input.match(singleMatcher) || [];
++	} catch {
++		let output = '';
++		let position = 0;
++
++		while (position < input.length) {
++			if (input.codePointAt(position) !== 37) {
++				output += input.charAt(position);
++				position++;
++				continue;
++			}
++
++			const firstByte = parsePercentByte(input, position);
++
++			// `%` not followed by two hex digits (e.g. `%` or `%G`).
++			if (!firstByte) {
++				output += input.charAt(position);
++				position++;
++				continue;
++			}
++
++			const sequenceLength = utf8SequenceLength(firstByte.byte);
++
++			// Continuation byte or invalid lead byte — emit one `%XX` literally.
++			if (sequenceLength === 0) {
++				output += input.slice(position, position + 3);
++				position += 3;
++				continue;
++			}
+ 
+-		for (var i = 1; i < tokens.length; i++) {
+-			input = decodeComponents(tokens, i).join('');
++			let end = firstByte.next;
++			let validSequence = true;
++
++			for (let index = 1; index < sequenceLength; index++) {
++				const nextByte = parsePercentByte(input, end);
++
++				if (!nextByte || !isContinuationByte(nextByte.byte)) {
++					validSequence = false;
++					break;
++				}
++
++				end = nextByte.next;
++			}
++
++			if (validSequence) {
++				const encodedSequence = input.slice(position, end);
++
++				try {
++					output += decodeURIComponent(encodedSequence);
++					position = end;
++					continue;
++				} catch {
++					// Invalid UTF-8 despite correct structure — emit the first byte literally.
++				}
++			}
+ 
+-			tokens = input.match(singleMatcher) || [];
++			// Missing continuation bytes or decode failure — emit the first byte literally.
++			output += input.slice(position, position + 3);
++			position += 3;
+ 		}
+ 
+-		return input;
++		return output;
+ 	}
+ }
+ 

package/assets/security/decoder-regression.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+
+// Upstream fa479da scanner backport retains the legacy CommonJS/plus API.
+export async function verifyDecoder(packageRoot) {
+  const require = createRequire(join(packageRoot, 'package.json'));
+  const decode = require(join(packageRoot, 'index.js'));
+  assert.equal(typeof decode, 'function', 'Decoder CommonJS export changed');
+  for (const [input, expected] of [
+    ['', ''], ['a+b%2Bc', 'a b+c'], ['%25', '%'], ['%2525', '%25'],
+    ['st%C3%A5le%', 'ståle%'], ['%E4%BD%A0%E5%A5%BD', '你好'],
+    ['%F0%9F%98%80', '😀'], ['%F4%8F%BF%BF', '\u{10FFFF}'],
+    ['%C2', '\uFFFD'], ['%C2%B5%C2', 'µ\uFFFD'],
+    ['%FE%FF', '\uFFFD\uFFFD'], ['%FF%FE', '\uFFFD\uFFFD'],
+    ['%F0%9F%98', '%F0%9F%98'], ['%ED%A0%80', '%ED%A0%80'],
+    ['%C0%AF', '%C0%AF'], ['%F4%90%80%80', '%F4%90%80%80'],
+    ['%C3%5A%A5', '%C3Z%A5'], ['%G0%C3%A5%ab', '%G0å%ab'],
+    ['%84%D7%25%88%90', '%84%D7%%88%90'], ['%20%20%25%80', '  %%80'],
+  ]) assert.equal(decode(input), expected, `Decoder compatibility failure: ${input}`);
+  for (const value of [undefined, null, 1, {}, [], Symbol('x')]) {
+    assert.throws(() => decode(value), TypeError);
+  }
+  // Execute hostile runs in an isolated, hard-bounded process: the old recursive
+  // fallback exhausts its stack or CPU; the scanner leaves invalid bytes literal.
+  const script = `
+    const assert = require('node:assert/strict');
+    const decode = require(${JSON.stringify(join(packageRoot, 'index.js'))});
+    assert.equal(decode('%AB'.repeat(10000)), '%AB'.repeat(10000));
+    assert.equal(decode('%C3%5A%A5'.repeat(10000)), '%C3Z%A5'.repeat(10000));
+    assert.equal(decode('%E0%80%80'.repeat(10000)), '%E0%80%80'.repeat(10000));
+  `;
+  execFileSync(process.execPath, ['--input-type=commonjs', '--eval', script], {
+    timeout: 5000, maxBuffer: 128 * 1024, stdio: 'pipe',
+  });
+}

package/assets/security/forge-regression.mjs

@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict';
+import { Buffer } from 'node:buffer';
+import { createHash, generateKeyPairSync, privateEncrypt, constants } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+
+// PR1152 validates nested DigestAlgorithm children; Anhedral also enforces empty
+// DER NULL parameters. Fixture keys never leave memory.
+export async function verifyForge(packageRoot) {
+  const require = createRequire(join(packageRoot, 'package.json'));
+  const forge = require(join(packageRoot, 'lib/index.js'));
+  const { publicKey, privateKey } = generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicExponent: 65537,
+  });
+  const key = forge.pki.publicKeyFromPem(publicKey.export({ type: 'spki', format: 'pem' }));
+  const digest = createHash('sha256').update('Anhedral RSA validation fixture').digest();
+  const asn1 = forge.asn1;
+  const node = (type, value, constructed = false) =>
+    asn1.create(asn1.Class.UNIVERSAL, type, constructed, value);
+  const oid = () => node(asn1.Type.OID, asn1.oidToDer(forge.oids.sha256).getBytes());
+  const nil = (value = '') => node(asn1.Type.NULL, value);
+  const garbage = () => node(asn1.Type.OCTETSTRING, 'unconsumed');
+  const verify = (algorithm, extraOuter = []) => {
+    const info = node(asn1.Type.SEQUENCE, [
+      node(asn1.Type.SEQUENCE, algorithm, true),
+      node(asn1.Type.OCTETSTRING, digest.toString('binary')),
+      ...extraOuter,
+    ], true);
+    const der = Buffer.from(asn1.toDer(info).getBytes(), 'binary');
+    // Use normal PKCS#1 padding, never Forge's internal padding bypass options.
+    const encoded = Buffer.concat([
+      Buffer.from([0, 1]), Buffer.alloc(256 - der.length - 3, 255), Buffer.from([0]), der,
+    ]);
+    const signature = privateEncrypt({ key: privateKey, padding: constants.RSA_NO_PADDING }, encoded);
+    return key.verify(digest.toString('binary'), signature.toString('binary'));
+  };
+  assert.equal(verify([oid(), nil()]), true, 'Valid RSA SHA-256 with NULL parameters rejected');
+  assert.equal(verify([oid()]), true, 'Valid RSA SHA-256 without parameters rejected');
+  for (const algorithm of [[oid(), nil(), garbage()], [oid(), garbage()], [oid(), nil('garbage')], [oid(), nil('\x00')]]) {
+    assert.throws(() => verify(algorithm), /valid RSASSA-PKCS1-v1_5 DigestInfo/,
+      'RSA verification accepted malformed DigestAlgorithm parameters');
+  }
+  assert.throws(() => verify([oid(), nil()], [garbage()]), /valid RSASSA-PKCS1-v1_5 DigestInfo/,
+    'RSA verification accepted an extra outer DigestInfo element');
+}

package/assets/security/manifest.json

@@ -0,0 +1,53 @@
+{
+  "schemaVersion": 1,
+  "packages": [
+    {
+      "name": "node-forge",
+      "version": "1.4.0",
+      "advisoryIds": [
+        "GHSA-86w9-cpqp-85rv"
+      ],
+      "patch": "node-forge@1.4.0.patch",
+      "patchSha256": "1b5e41ae73d70d18d2541c50e67d5b408eda4cdd52a426c3d085ec17b8f9b2a9",
+      "installedTreeSha256": "bb76d231d6aba9cad2da5f1ec1dee54b64c6720c5fb0b0c6aa0119b661d541c0",
+      "provenanceUrls": [
+        "https://github.com/digitalbazaar/forge/pull/1152",
+        "https://github.com/digitalbazaar/forge/commit/ceba34402e329f0365134f23fe19898756527d65",
+        "https://github.com/advisories/GHSA-86w9-cpqp-85rv"
+      ],
+      "origin": "Upstream PR1152 cardinality backport plus Anhedral strict DER NULL payload validation"
+    },
+    {
+      "name": "braces",
+      "version": "3.0.3",
+      "advisoryIds": [
+        "GHSA-vfj7-8cjw-p6xm"
+      ],
+      "patch": "braces@3.0.3.patch",
+      "patchSha256": "7274fa48b0167311b25a1ef8cf34f4bfe45f6ef58a0cc2813712fb7bb26e2e6a",
+      "installedTreeSha256": "c3d6d7c5bc0b6a578effc6d0e4bf6b384cbf04c6a81cfd2c8af10c185acdb0fb",
+      "provenanceUrls": [
+        "https://github.com/advisories/GHSA-vfj7-8cjw-p6xm",
+        "https://github.com/micromatch/braces/commit/74b2db2938fad48a2ea54a9c8bf27a37a62c350d",
+        "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz"
+      ],
+      "origin": "Anhedral local guarded backport; upstream advisory still lists no patched release"
+    },
+    {
+      "name": "decode-uri-component",
+      "version": "0.2.2",
+      "advisoryIds": [
+        "GHSA-vcc3-ghjq-m6fr"
+      ],
+      "patch": "decode-uri-component@0.2.2.patch",
+      "patchSha256": "f6a891bfb1a3d59b5b72602d4f6e5de5b6f5ee64467a9a24a1e182a3b07f8c54",
+      "installedTreeSha256": "821832e5d3622308a9159706eebb0b9ac702576b39e0cd4ea4fcb15cb9d7cbfb",
+      "provenanceUrls": [
+        "https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005",
+        "https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0",
+        "https://github.com/advisories/GHSA-vcc3-ghjq-m6fr"
+      ],
+      "origin": "Official 0.5.0 security scanner backported to 0.2.2 while preserving its CommonJS API and plus-to-space behavior"
+    }
+  ]
+}

package/assets/security/node-forge@1.4.0.patch

@@ -0,0 +1,26 @@
+diff --git a/lib/rsa.js b/lib/rsa.js
+index a4264822b..430905451 100644
+--- a/lib/rsa.js
++++ b/lib/rsa.js
+@@ -1168,11 +1168,19 @@ pki.setRsaPublicKey = pki.rsa.setPublicKey = function(n, e) {
+             parseAllBytes: options._parseAllDigestBytes
+           });
+ 
+-          // validate DigestInfo structure and element count
++          // validate DigestInfo structure and element counts (outer DigestInfo
++          // and nested DigestAlgorithm). asn1.validate ignores extra children,
++          // so length must be checked explicitly at each nesting level to
++          // prevent low-exponent PKCS#1 v1.5 signature forgery (CVE-2026-85393).
++          // Anhedral additionally rejects nonempty primitive NULL parameters:
++          // DER NULL has zero content octets; child counts do not check this.
+           var capture = {};
+           var errors = [];
+           if(!asn1.validate(obj, digestInfoValidator, capture, errors) ||
+-            obj.value.length !== 2) {
++            obj.value.length !== 2 ||
++            obj.value[0].value.length !==
++              (('parameters' in capture) ? 2 : 1) ||
++            (('parameters' in capture) && capture.parameters !== '')) {
+             var error = new Error(
+               'ASN.1 object does not contain a valid RSASSA-PKCS1-v1_5 ' +
+               'DigestInfo value.');

package/dist/access.d.ts

@@ -0,0 +1,10 @@
+import { type ApplicationProject } from './project-state.js';
+import { type CloudflareRequest } from './cloudflare.js';
+export interface AccessReceipt {
+    target: string;
+    workerId: string;
+    applicationId: string;
+}
+export declare function validatePrivateAudience(project: ApplicationProject, root: string): void;
+/** Protect the entire Worker, including every route and preview, before product code is deployed. */
+export declare function reconcileAccess(root: string, project: ApplicationProject, request: CloudflareRequest, create: boolean): Promise<AccessReceipt[]>;