From 39f362dcee26664560c65b06a58d1be543ea492d Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:40:11 +0800
Subject: [PATCH] fix(protocols): make admission and certificate success types
 exact

---
 src/apkSignature/apkCertificateFacts.ts            |  2 +-
 src/apkSignature/apkV1Signers.ts                   | 14 ++++----------
 src/browser/history/protobuf/ProtobufSchema.ts     |  1 +
 .../pcap/pcapProviderCrossPlatform.test.ts         |  2 +-
 4 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/src/apkSignature/apkCertificateFacts.ts b/src/apkSignature/apkCertificateFacts.ts
index ffbeb481db..d4cedbc1ac 100644
--- a/src/apkSignature/apkCertificateFacts.ts
+++ b/src/apkSignature/apkCertificateFacts.ts
@@ -24,7 +24,7 @@ const attempt = <T>(read: () => T): T | null => {
 };
 
 /** Identity is the raw-DER fingerprint; parsed X.509 facts are null when unreadable. */
-export const certificateFacts = (der: Uint8Array): Certificate => {
+export const certificateFacts = (der: Uint8Array): NonNullable<Certificate> => {
   const cert = attempt(() => {
     // OpenSSL auto-detects PEM before DER, including PEM embedded in an extension.
     // An explicit envelope makes it decode the selected bytes; raw equality also
diff --git a/src/apkSignature/apkV1Signers.ts b/src/apkSignature/apkV1Signers.ts
index 7620f1b7fd..99ab968f84 100644
--- a/src/apkSignature/apkV1Signers.ts
+++ b/src/apkSignature/apkV1Signers.ts
@@ -186,16 +186,10 @@ export const v1SignerFacts = ({
     // Without verification, a block with several SignerInfos has no one signer.
     certificate:
       infos.length === 1 ? named(infos[0]?.certificateIndex ?? null) : null,
-    certificates: facts.flatMap((fact) =>
-      fact === null
-        ? []
-        : [
-            {
-              sha256_fingerprint: fact.sha256_fingerprint,
-              subject: fact.subject,
-            },
-          ],
-    ),
+    certificates: facts.map(({ sha256_fingerprint, subject }) => ({
+      sha256_fingerprint,
+      subject,
+    })),
     signer_infos: infos.map((info) => ({
       identified_by: info.identifiedBy,
       certificate_sha256:
diff --git a/src/browser/history/protobuf/ProtobufSchema.ts b/src/browser/history/protobuf/ProtobufSchema.ts
index 61bd3f75c3..f75379f1ae 100644
--- a/src/browser/history/protobuf/ProtobufSchema.ts
+++ b/src/browser/history/protobuf/ProtobufSchema.ts
@@ -100,6 +100,7 @@ const admitDescriptorRegistry = async (
         stack.push({ message: nested, prefix: length });
     }
   }
+  return undefined;
 };
 
 const scalarValue = (reader: BinaryReader, scalar: ScalarType): string => {
diff --git a/tests/boundary/pcap/pcapProviderCrossPlatform.test.ts b/tests/boundary/pcap/pcapProviderCrossPlatform.test.ts
index d58f49669d..28d87b1850 100644
--- a/tests/boundary/pcap/pcapProviderCrossPlatform.test.ts
+++ b/tests/boundary/pcap/pcapProviderCrossPlatform.test.ts
@@ -240,7 +240,7 @@ it.each([0, 7])(
     expect(projectAnalysisError(retry.error)).toMatchObject({
       code: "cleanup_incomplete",
       details: {
-        resources: expect.arrayContaining(result.error.cleanupResources),
+        resources: expect.arrayContaining([...result.error.cleanupResources]),
       },
     });
     expect(retry.error.cleanupResources.length).toBeGreaterThan(0);