fix(cbor): stop leaking inherited keys into encoded objects

[tomas-zijdemans]

encodeObject() writes the CBOR map header from Object.keys(input).length but iterates entries with for-in, which also visits inherited enumerable keys. When the two disagree, the declared pair count no longer matches the pairs written. The header lies.

Concrete failure:

const obj = Object.assign(Object.create({ inherited: "boom" }), { own: 1 });
encodeCbor(obj);

On main this returns 21 bytes: a valid 6-byte map declaring one pair, then "inherited": "boom" appended as trailing garbage. The inherited value leaks into the wire bytes, and strict decoders reject the trailing data. Same story if something pollutes Object.prototype with an enumerable property: every encoded object grows a stowaway pair.

The fix makes calcObjectEncodingSize() and encodeObject() iterate the same Object.keys() array the header count comes from, so count, buffer size, and written pairs can't drift apart.

Review focus: the two loops in cbor/_common_encode.ts. Output for plain objects without inherited enumerables is byte-for-byte unchanged.

Tested with the existing cbor suite (83 pass) plus the repro above, which returns the correct 6 bytes on this branch. Happy to add it as a regression test in encode_cbor_test.ts if wanted.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.00%. Comparing base (ad7c87b) to head (5292a9e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7250   +/-   ##
=======================================
  Coverage   95.00%   95.00%           
=======================================
  Files         617      617           
  Lines       51674    51674           
  Branches     9326     9326           
=======================================
+ Hits        49093    49094    +1     
  Misses       2038     2038           
+ Partials      543      542    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.