@blamejs/pki 0.6.39 → 0.6.41

package/lib/schema-engine.js

@@ -279,6 +279,7 @@ function _walkSeq(schema, node, ctx) {
   var kids = _assertShape(schema, node, ctx);
   _assertArity(schema, kids, ctx);
 
+  // allow:registry-table-inherits-object-prototype -- the record a schema's own check and build callbacks read as m.fields, whose keys are the field names that schema declared rather than anything the input supplies
   var fields = {};
   var idx = 0;
   for (var f = 0; f < schema.fields.length; f++) {
@@ -322,7 +323,7 @@ function _walkSeq(schema, node, ctx) {
 }
 
 function _consumeTrailing(fld, kids, start, fields, ctx) {
-  var byTag = {};
+  var byTag = Object.create(null);
   for (var m = 0; m < fld.members.length; m++) byTag[fld.members[m].tag] = fld.members[m];
   var last = fld.minTag != null ? fld.minTag - 1 : -1;
   for (var i = start; i < kids.length; i++) {

package/lib/schema-pkcs12.js

@@ -176,7 +176,7 @@ var SAFE_BAG = schema.seq([
     var attributes = [];
     var friendlyName = null;
     var localKeyId = null;
-    var seen = {};
+    var seen = Object.create(null);
     if (m.fields.bagAttributes.present) {
       var items = m.fields.bagAttributes.value.items;
       for (var i = 0; i < items.length; i++) {

package/lib/schema-pkix.js

@@ -676,6 +676,7 @@ function certExtensionDecoders(ns) {
     for (var z = 0; z < bs.bytes.length; z++) { if (bs.bytes[z] !== 0) { anyBit = true; break; } }
     if (!anyBit) throw ns.E(C, "KeyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
     schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw ns.E(C, m); });
+    // allow:registry-table-inherits-object-prototype -- the decoded KeyUsage record, whose keys are the fixed KU_BITS names the schema declares rather than anything the certificate supplies
     var out = {};
     _forEach(KU_BITS, function (nm, bit) {
       var byte = bit >> 3, mask = 0x80 >> (bit & 7);
@@ -821,6 +822,7 @@ function certExtensionDecoders(ns) {
   function authorityKeyIdentifier(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var kids = seqChildren(buf, C, "AuthorityKeyIdentifier");
+    // allow:registry-table-inherits-object-prototype -- the decoded AuthorityKeyIdentifier record, read by the three field names the schema declares rather than by anything the certificate supplies
     var out = { keyIdentifier: null, authorityCertIssuer: null, authorityCertSerialNumber: null };
     var lastTag = -1;
     _forEach(kids, function (k) {
@@ -867,6 +869,7 @@ function certExtensionDecoders(ns) {
       if (dp.tagClass !== "universal" || dp.tagNumber !== _T.SEQUENCE || !dp.children) {
         throw ns.E(C, "DistributionPoint must be a SEQUENCE { distributionPoint?, reasons?, cRLIssuer? }");
       }
+      // allow:registry-table-inherits-object-prototype -- the decoded DistributionPoint record, read by the three field names the schema declares rather than by anything the certificate supplies
       var out = { distributionPoint: null, reasons: null, cRLIssuer: null };
       var lastTag = -1;
       _forEach(dp.children, function (f) {

package/lib/schema-tsp.js

@@ -58,10 +58,10 @@ var OID_SIGNING_CERT_V2 = oid.byName("signingCertificateV2");
 
 var TAGS = asn1.TAGS;
 
-var FAILURE_BITS = {
+var FAILURE_BITS = Object.assign(Object.create(null), {
   0: "badAlg", 2: "badRequest", 5: "badDataFormat", 14: "timeNotAvailable",
   15: "unacceptedPolicy", 16: "unacceptedExtension", 17: "addInfoNotAvailable", 25: "systemFailure",
-};
+});
 
 
 var GEN_TIME = pkix.generalizedTime(NS, { code: "tsp/bad-gentime", message: "genTime must be a GeneralizedTime (RFC 3161 sec. 2.4.2)", allowFractional: true });

package/lib/shbs.js

@@ -48,8 +48,8 @@ function _deriveWinternitz(n, w) {
   return { p: u + v, ls: 16 - v * w };
 }
 
-var LMS_SETS = {};
-var LMOTS_SETS = {};
+var LMS_SETS = Object.create(null);
+var LMOTS_SETS = Object.create(null);
 (function seed() {
   var heights = [5, 10, 15, 20, 25];
   var ws = [1, 2, 4, 8];

package/lib/sign-scheme.js

@@ -26,26 +26,26 @@ var _isU8 = intrinsic.types.isUint8Array;
 
 var HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" });
-var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
-var ECDSA_ALG = { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" };
-var RSA_PKCS1_SIG = { sha256: "sha256WithRSAEncryption", sha384: "sha384WithRSAEncryption", sha512: "sha512WithRSAEncryption" };
-var HASH_NAME_BY_OID = {};
+var PSS_SALT = intrinsic.assign(intrinsic.create(null), { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 });
+var ECDSA_ALG = intrinsic.assign(intrinsic.create(null), { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" });
+var RSA_PKCS1_SIG = intrinsic.assign(intrinsic.create(null), { sha256: "sha256WithRSAEncryption", sha384: "sha384WithRSAEncryption", sha512: "sha512WithRSAEncryption" });
+var HASH_NAME_BY_OID = intrinsic.create(null);
 HASH_NAME_BY_OID[O("sha256")] = "sha256";
 HASH_NAME_BY_OID[O("sha384")] = "sha384";
 HASH_NAME_BY_OID[O("sha512")] = "sha512";
-var EC_BY_CURVE_OID = {};
+var EC_BY_CURVE_OID = intrinsic.create(null);
 EC_BY_CURVE_OID[O("prime256v1")] = { curve: "P-256", coordLen: 32 };
 EC_BY_CURVE_OID[O("secp384r1")] = { curve: "P-384", coordLen: 48 };
 EC_BY_CURVE_OID[O("secp521r1")] = { curve: "P-521", coordLen: 66 };
-var MLDSA_BY_OID = {};
+var MLDSA_BY_OID = intrinsic.create(null);
 MLDSA_BY_OID[O("id-ml-dsa-44")] = "ML-DSA-44";
 MLDSA_BY_OID[O("id-ml-dsa-65")] = "ML-DSA-65";
 MLDSA_BY_OID[O("id-ml-dsa-87")] = "ML-DSA-87";
-var MLDSA_SUITABLE_DIGEST = {
+var MLDSA_SUITABLE_DIGEST = intrinsic.assign(intrinsic.create(null), {
   "ML-DSA-44": { sha256: 1, sha384: 1, sha512: 1, shake256: 1 },
   "ML-DSA-65": { sha384: 1, sha512: 1, shake256: 1 },
   "ML-DSA-87": { sha512: 1, shake256: 1 },
-};
+});
 // @enforced-by behavioral -- an own-property table read has no rename-proof shape distinct from a legitimate lookup, so a RED conformance vector is the guard
 function mldsaDigestSuitable(mlName, md) {
   if (!intrinsic.hasOwn(MLDSA_SUITABLE_DIGEST, mlName)) return false;
@@ -53,7 +53,7 @@ function mldsaDigestSuitable(mlName, md) {
   return !!row && intrinsic.hasOwn(row, md) && !!row[md];
 }
 
-var SLHDSA_BY_OID = {};
+var SLHDSA_BY_OID = intrinsic.create(null);
 [["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
  ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
  ["shake-192s", "shake256"], ["shake-192f", "shake256"], ["shake-256s", "shake256"], ["shake-256f", "shake256"]

package/lib/sigstore.js

@@ -70,14 +70,14 @@ function _stripTrailingEquals(s) {
   return s.slice(0, i);
 }
 
-var _BUNDLE_MEDIA_TYPES = {
+var _BUNDLE_MEDIA_TYPES = Object.assign(Object.create(null), {
   "application/vnd.dev.sigstore.bundle.v0.1+json": 1,
   "application/vnd.dev.sigstore.bundle.v0.2+json": 1,
   "application/vnd.dev.sigstore.bundle.v0.3+json": 1,
   "application/vnd.dev.sigstore.bundle+json;version=0.1": 1,
   "application/vnd.dev.sigstore.bundle+json;version=0.2": 1,
   "application/vnd.dev.sigstore.bundle+json;version=0.3": 1
-};
+});
 function _isBundleMediaType(mt) {
   return typeof mt === "string" && Object.prototype.hasOwnProperty.call(_BUNDLE_MEDIA_TYPES, mt);
 }
@@ -360,10 +360,19 @@ function _normRoots(fulcioRoots) {
 
 function _pathToAnchor(leaf, anchor, intBySubject) {
   var anchorSubj = _dn(anchor, "subject");
-  var path = [leaf], cur = leaf, seen = {}, guardN = 0;
+  /** @internal Issuers are collected leaf-first and the path is assembled once, so no element is
+   * ever moved to a new index: an indexed setter has nothing to intercept and cannot replace the
+   * leaf the preceding signature checks authenticated. */
+  var above = [], cur = leaf, seen = Object.create(null), guardN = 0;
+  function assemble() {
+    var path = [];
+    for (var k = above.length - 1; k >= 0; k--) guard.list.append(path, above[k]);
+    guard.list.append(path, leaf);
+    return path;
+  }
   while (guardN++ < 16) {
     var issuerDn = _dn(cur, "issuer");
-    if (issuerDn === anchorSubj) return path;
+    if (issuerDn === anchorSubj) return assemble();
     var cands = intBySubject[issuerDn] || [];
     var next = null;
     for (var j = 0; j < cands.length; j++) {
@@ -372,7 +381,7 @@ function _pathToAnchor(leaf, anchor, intBySubject) {
     }
     if (!next) return null;
     seen[_dn(next, "subject")] = 1;
-    path.unshift(next);
+    guard.list.append(above, next);
     cur = next;
   }
   return null;
@@ -381,8 +390,8 @@ function _pathToAnchor(leaf, anchor, intBySubject) {
 async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
   var roots = _normRoots(fulcioRoots);
   var bundleLinks = chainDers.slice(1).map(function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
-  var intBySubject = {};
-  function addInt(c) { (intBySubject[_dn(c, "subject")] = intBySubject[_dn(c, "subject")] || []).push(c); }
+  var intBySubject = Object.create(null);
+  function addInt(c) { guard.list.append(intBySubject[_dn(c, "subject")] = intBySubject[_dn(c, "subject")] || [], c); }
   roots.forEach(function (r) { addInt(r.cert); });
   bundleLinks.forEach(addInt);
   var candidates = roots.filter(function (r) { return _inWindow(timeMs, r.validFor); });
@@ -412,7 +421,7 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
 var SAN_OID = oid.byName("subjectAltName");
 var FULCIO_PREFIX = oid.byName("otherName").split(".").slice(0, -1).join(".") + ".";
 function _identity(leaf) {
-  var out = { san: null, extensions: {} };
+  var out = { san: null, extensions: Object.create(null) };
   try {
     (leaf.extensions || []).forEach(function (ext) {
       if (ext.oid === SAN_OID) { out.san = _sanValue(ext); return; }
@@ -426,7 +435,7 @@ function _identity(leaf) {
   }
   return out;
 }
-var GN_TYPE = { 1: "rfc822Name", 2: "dNSName", 6: "uri" };
+var GN_TYPE = Object.assign(Object.create(null), { 1: "rfc822Name", 2: "dNSName", 6: "uri" });
 function _sanValue(ext) {
   var seq = asn1.decode(ext.value);
   var names = [];
@@ -446,7 +455,7 @@ function _sanValue(ext) {
       }
       val = { type: "otherName", oid: asn1.read.oid(n.children[0]), value: v };
     }
-    if (val) names.push(val);
+    if (val) guard.list.append(names, val);
   }
   if (names.length > 1) throw _err("sigstore/bad-certificate", "the Fulcio certificate carries multiple SAN identities");
   return names[0] || null;
@@ -458,10 +467,11 @@ function _fulcioExtValue(ext, leafArc) {
 }
 
 var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
-var IDENTITY_KEYS = { san: 1, issuer: 1, sourceRepositoryURI: 1 };
-var _VERIFY_BUNDLE_OPTS = { fulcioRoots: 1, rekorKeys: 1, identity: 1, predicateType: 1, time: 1 };
+var IDENTITY_KEYS = Object.assign(Object.create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
+var _VERIFY_BUNDLE_OPTS = Object.assign(Object.create(null), { fulcioRoots: 1, rekorKeys: 1, identity: 1, predicateType: 1, time: 1 });
 
 function _checkIdentity(id, policy) {
+  // allow:registry-table-inherits-object-prototype -- the identityChecked record an operator reads by field name, whose three keys are the fixed IDENTITY_FIELDS rather than anything the bundle supplies
   var ran = { san: false, issuer: false, sourceRepositoryURI: false };
   if (policy === undefined || policy === null) return ran;
   if (typeof policy !== "object" || Array.isArray(policy)) {
@@ -582,7 +592,7 @@ async function verifyBundle(bundle, opts) {
 
   var st = _statement(payload, env.payloadType, opts.predicateType);
 
-  return {
+  return guard.verdict.of({
     valid: true,
     verified: true,
     payload: payload,
@@ -596,7 +606,7 @@ async function verifyBundle(bundle, opts) {
     integratedTime: integratedTime,
     logIndex: rekor.logIndex,
     logId: rekor.logId,
-  };
+  });
 }
 
 module.exports = {

package/lib/smime.js

@@ -48,21 +48,21 @@ var SmimeError = frameworkError.SmimeError;
 
 function _err(code, msg, cause) { return new SmimeError(code, msg, cause); }
 
-var SIGN_OPTS = {
+var SIGN_OPTS = Object.assign(Object.create(null), {
   form: 1, entity: 1, contentType: 1, signingTime: 1, protectHeaders: 1, headers: 1, hcp: 1,
   sid: 1, signedAttributes: 1, additionalSignedAttributes: 1,
-};
-var VERIFY_OPTS = {
+});
+var VERIFY_OPTS = Object.assign(Object.create(null), {
   certs: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1, strictMicalg: 1,
   legacyHeaderProtection: 1, expectedSender: 1,
-};
-var ENCRYPT_OPTS = {
+});
+var ENCRYPT_OPTS = Object.assign(Object.create(null), {
   entity: 1, contentType: 1, protectHeaders: 1, headers: 1, hcp: 1,
   contentEncryptionAlgorithm: 1, oaepHash: 1, keyIdentifier: 1, ukm: 1,
-};
-var DECRYPT_OPTS = { recipientIndex: 1, maxIterations: 1, strictSmimeType: 1, legacyHeaderProtection: 1 };
-var COMPRESS_OPTS = { entity: 1, contentType: 1, level: 1 };
-var DECOMPRESS_OPTS = { maxOutputBytes: 1 };
+});
+var DECRYPT_OPTS = Object.assign(Object.create(null), { recipientIndex: 1, maxIterations: 1, strictSmimeType: 1, legacyHeaderProtection: 1 });
+var COMPRESS_OPTS = Object.assign(Object.create(null), { entity: 1, contentType: 1, level: 1 });
+var DECOMPRESS_OPTS = Object.assign(Object.create(null), { maxOutputBytes: 1 });
 
 function _knownOpts(opts, known, verb) {
   guard.identifier.assertKnownKeys(opts, known, _err, "smime/bad-input", function (k) {
@@ -76,7 +76,7 @@ function _isPkcs7(type, kind) {
   return t === "application/pkcs7-" + kind || t === "application/x-pkcs7-" + kind;
 }
 
-var MICALG = { sha1: "sha-1", sha224: "sha-224", sha256: "sha-256", sha384: "sha-384", sha512: "sha-512", md5: "md5", shake128: "shake128", shake256: "shake256" };
+var MICALG = Object.assign(Object.create(null), { sha1: "sha-1", sha224: "sha-224", sha256: "sha-256", sha384: "sha-384", sha512: "sha-512", md5: "md5", shake128: "shake128", shake256: "shake256" });
 
 function _entityBytes(content, opts) {
   var raw = guard.bytes.view(content, SmimeError, "smime/bad-input", "content");
@@ -320,7 +320,7 @@ var SMTP_UTF8_MAILBOX = oid.byName("smtpUtf8Mailbox");
 var EMAIL_ADDRESS_ATTR = oid.byName("emailAddress");
 var _extNs = pkix.makeNS("smime", SmimeError, oid);
 var _extDecoders = pkix.certExtensionDecoders(_extNs);
-var _extCtx = { E: function (c, m, cause) { return new SmimeError(c, m, cause); }, oid: oid };
+var _extCtx = Object.assign(Object.create(null), { E: function (c, m, cause) { return new SmimeError(c, m, cause); }, oid: oid });
 function _signerEmails(certDer) {
   var out = { addresses: [], unreadable: 0 };
   var parsed = null;
@@ -334,7 +334,7 @@ function _signerEmails(certDer) {
     catch (sanFailed) { out.unreadable++; out.reason = sanFailed.code || "bad-san"; }
     if (dec === null) return;
     (dec.names || []).forEach(function (n) {
-      if (n.tagNumber === 1) { out.addresses.push(String(n.value)); return; }
+      if (n.tagNumber === 1) { guard.list.append(out.addresses, String(n.value)); return; }
       if (n.tagNumber !== 0) return;
       var typeId = n.value && typeof n.value === "object" ? n.value.typeId : undefined;
       if (typeId === undefined) { out.unreadable++; return; }
@@ -346,7 +346,7 @@ function _signerEmails(certDer) {
   (rdns || []).forEach(function (rdn) {
     (rdn || []).forEach(function (attr) {
       if (!attr || attr.type !== EMAIL_ADDRESS_ATTR || typeof attr.value !== "string") return;
-      if (out.addresses.indexOf(attr.value) === -1) out.addresses.push(attr.value);
+      if (out.addresses.indexOf(attr.value) === -1) guard.list.append(out.addresses, attr.value);
     });
   });
   return out;
@@ -362,7 +362,7 @@ function _senderSurface(signers, outerEnt, expectedSender) {
   }
   else {
     var froms = [];
-    outerEnt.headers.forEach(function (h) { if (h.lname === "from") froms.push(h.value.trim()); });
+    outerEnt.headers.forEach(function (h) { if (h.lname === "from") guard.list.append(froms, h.value.trim()); });
     if (froms.length === 1) { expected = _addrSpec(froms[0]); source = expected === null ? null : "from"; }
   }
   var identities = [], undecidable = false, sawIdentity = false;
@@ -371,7 +371,7 @@ function _senderSurface(signers, outerEnt, expectedSender) {
     var e = s.cert ? _signerEmails(s.cert) : null;
     if (e === null) { undecidable = true; return; }
     if (e.unreadable > 0) { undecidable = true; sawIdentity = true; }
-    e.addresses.forEach(function (a) { sawIdentity = true; if (identities.indexOf(a) === -1) identities.push(a); });
+    e.addresses.forEach(function (a) { sawIdentity = true; if (identities.indexOf(a) === -1) guard.list.append(identities, a); });
   });
   if (expected === null) return { checked: false, expected: null, source: null, identities: identities, match: null };
   if (!sawIdentity) return { checked: true, expected: expected, source: source, identities: identities, match: null };
@@ -875,7 +875,7 @@ function _decodeCms(ent) {
 
 function _toBuf(v) { return Buffer.isBuffer(v) ? v : Buffer.from(v); }
 
-var CERTS_ONLY_OPTS = { crls: 1 };
+var CERTS_ONLY_OPTS = Object.assign(Object.create(null), { crls: 1 });
 
 /**
  * @primitive  pki.smime.buildCertsOnly

package/lib/tls-cert-compress.js

@@ -62,17 +62,17 @@ var zlib = require("zlib");
 var TlsError = frameworkError.TlsError;
 function _err(code, message, cause) { return new TlsError(code, message, cause); }
 
-var ALG_BY_NUMBER = { 1: "zlib", 2: "brotli", 3: "zstd" };
-var ALG_BY_NAME = {};
+var ALG_BY_NUMBER = intrinsic.assign(intrinsic.create(null), { 1: "zlib", 2: "brotli", 3: "zstd" });
+var ALG_BY_NAME = intrinsic.create(null);
 Object.keys(ALG_BY_NUMBER).forEach(function (n) { ALG_BY_NAME[ALG_BY_NUMBER[n]] = Number(n); });
 
-var COMPRESS = { zlib: zlib.deflateSync, brotli: zlib.brotliCompressSync, zstd: zlib.zstdCompressSync };
+var COMPRESS = intrinsic.assign(intrinsic.create(null), { zlib: zlib.deflateSync, brotli: zlib.brotliCompressSync, zstd: zlib.zstdCompressSync });
 
-var LEVEL_OPT = {
+var LEVEL_OPT = intrinsic.assign(intrinsic.create(null), {
   zlib: function (n) { return { level: n }; },
   brotli: function (n) { var p = {}; p[zlib.constants.BROTLI_PARAM_QUALITY] = n; return { params: p }; },
   zstd: function (n) { var p = {}; p[zlib.constants.ZSTD_c_compressionLevel] = n; return { params: p }; },
-};
+});
 
 var SUPPORTED = guard.compress.algorithms().filter(function (n) {
   return _hasOwn(ALG_BY_NAME, n) && typeof COMPRESS[n] === "function";
@@ -81,7 +81,7 @@ var SUPPORTED = guard.compress.algorithms().filter(function (n) {
 var MIN_CERT_MSG_BYTES = validator.tls.MIN_CERT_MSG_BYTES;
 var MAX_VECTOR_24 = validator.tls.MAX_VECTOR_24;
 
-var FRAMING_CODES = { truncated: "tls/truncated", framing: "tls/bad-framing", trailing: "tls/trailing-data" };
+var FRAMING_CODES = intrinsic.assign(intrinsic.create(null), { truncated: "tls/truncated", framing: "tls/bad-framing", trailing: "tls/trailing-data" });
 
 var HEADER_BYTES = 8;
 

package/lib/trust.js

@@ -327,7 +327,7 @@ function _certEntry(obj) {
 function _trustEntry(obj) {
   var issuer = _requireOctal(obj, "CKA_ISSUER", "trust");
   var serial = _requireOctal(obj, "CKA_SERIAL_NUMBER", "trust");
-  var purposes = { serverAuth: false, emailProtection: false, codeSigning: false };
+  var purposes = intrinsic.assign(intrinsic.create(null), { serverAuth: false, emailProtection: false, codeSigning: false });
   PURPOSE_ATTRS.forEach(function (pair) {
     var a = obj.attrs[pair[0]];
     if (!a) return;
@@ -364,15 +364,15 @@ function _mkAnchor(cert, meta) {
 var _DERIVED_FROM = new WeakMap();
 
 function _copyPurposes(src) {
-  return {
+  return intrinsic.assign(intrinsic.create(null), {
     serverAuth: !!src && src.serverAuth === true,
     emailProtection: !!src && src.emailProtection === true,
     codeSigning: !!src && src.codeSigning === true,
-  };
+  });
 }
 
 function _copyDistrustAfter(src) {
-  var out = {};
+  var out = intrinsic.create(null);
   if (!src || typeof src !== "object") return out;
   Object.keys(src).forEach(function (k) {
     out[k] = guard.time.isDate(src[k]) ? new Date(guard.time.instantOf(src[k])) : src[k];
@@ -521,7 +521,7 @@ function parseCertdata(text) {
     anchors: _dedupAnchors(certs.map(function (c) {
       return _mkAnchor(c.cert, {
         distrustAfter: c.distrustAfter,
-        purposes: c.purposes || { serverAuth: false, emailProtection: false, codeSigning: false },
+        purposes: c.purposes || _copyPurposes(null),
         label: c.label,
         mozillaCaPolicy: c.mozillaCaPolicy,
       });
@@ -579,15 +579,15 @@ function _csvRows(text) {
   return rows;
 }
 
-var _TRUST_BIT_TOKENS = {
+var _TRUST_BIT_TOKENS = intrinsic.assign(intrinsic.create(null), {
   "websites": "serverAuth", "server authentication": "serverAuth",
   "email": "emailProtection", "secure email": "emailProtection",
   "code": "codeSigning", "code signing": "codeSigning",
   "client authentication": null, "document signing": null,
   "time stamping": null, "ocsp signing": null,
-};
+});
 function _trustBits(cell) {
-  var purposes = { serverAuth: false, emailProtection: false, codeSigning: false };
+  var purposes = intrinsic.assign(intrinsic.create(null), { serverAuth: false, emailProtection: false, codeSigning: false });
   String(cell).split(";").forEach(function (tok) {
     var t = tok.trim();
     if (t === "") return;
@@ -746,7 +746,7 @@ function parseCcadbCsv(text) {
  *   await pki.path.validate([pki.schema.x509.parse(der)],
  *     { time: new Date("2026-06-01T00:00:00Z"), trustAnchors: anchor, checkPurpose: "serverAuth" });
  */
-var _ANCHOR_OPTS = { purpose: 1 };
+var _ANCHOR_OPTS = intrinsic.assign(intrinsic.create(null), { purpose: 1 });
 function anchor(entry, opts) {
   if (!entry || typeof entry !== "object") {
     throw E("trust/bad-input", "anchor expects a trust-store entry ({ name, publicKey, algorithm, ... })");

package/lib/tsp-sign.js

@@ -48,9 +48,9 @@ var _b = pkiBuild.makeBuilder({
 });
 
 var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512" });
-var HASH_LEN = { sha256: 32, sha384: 48, sha512: 64 };
+var HASH_LEN = intrinsic.assign(intrinsic.create(null), { sha256: 32, sha384: 48, sha512: 64 });
 
-var _REVOCATION_RANK = { "false": 0, "undetermined": 1, "waived": 2, "determined": 3 };
+var _REVOCATION_RANK = intrinsic.assign(intrinsic.create(null), { "false": 0, "undetermined": 1, "waived": 2, "determined": 3 });
 function _rankRevocation(v) {
   var r = _REVOCATION_RANK[String(v)];
   return r === undefined ? 0 : r;
@@ -132,12 +132,12 @@ function sign(messageImprint, tsa, opts) {
   ], _sign);
 }
 
-var _TSA_KEYS = { cert: 1, key: 1 };
-var _IMPRINT_KEYS = { hashAlgorithm: 1, hashedMessage: 1 };
-var _SIGN_OPTS = {
+var _TSA_KEYS = intrinsic.assign(intrinsic.create(null), { cert: 1, key: 1 });
+var _IMPRINT_KEYS = intrinsic.assign(intrinsic.create(null), { hashAlgorithm: 1, hashedMessage: 1 });
+var _SIGN_OPTS = intrinsic.assign(intrinsic.create(null), {
   policy: 1, serialNumber: 1, genTime: 1, nonce: 1, accuracy: 1, ordering: 1, sid: 1,
   digestAlgorithm: 1, certHashAlgorithm: 1, additionalSignedAttributes: 1, pss: 1, pem: 1,
-};
+});
 
 function _sign(messageImprint, tsa, opts) {
   opts = opts || {};
@@ -171,9 +171,9 @@ function _sign(messageImprint, tsa, opts) {
   var genTime = guard.time.isDate(opts.genTime) ? opts.genTime : new Date();
   var serial = guard.range.authoredInteger(opts.serialNumber, _err, "tsp/bad-input", "serialNumber");
   var fields = [b.integer(1n), _policy(opts.policy), imprint, b.integer(serial), b.generalizedTime(genTime)];
-  if (opts.accuracy) fields.push(_accuracy(opts.accuracy));
-  if (opts.ordering === true) fields.push(b.boolean(true));
-  if (opts.nonce != null) fields.push(b.integer(guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "nonce")));
+  if (opts.accuracy) guard.list.append(fields,_accuracy(opts.accuracy));
+  if (opts.ordering === true) guard.list.append(fields,b.boolean(true));
+  if (opts.nonce != null) guard.list.append(fields,b.integer(guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "nonce")));
   var tstInfo = b.sequence(fields);
 
   var signCert = { type: "signingCertificateV2", values: [_signingCertV2(certDer, certHashAlg)] };
@@ -187,7 +187,7 @@ function _sign(messageImprint, tsa, opts) {
   });
 }
 
-var _ACCURACY_KEYS = { seconds: 1, millis: 1, micros: 1 };
+var _ACCURACY_KEYS = intrinsic.assign(intrinsic.create(null), { seconds: 1, millis: 1, micros: 1 });
 
 function _accuracy(a) {
   guard.identifier.assertKnownKeys(a, _ACCURACY_KEYS, _err, "tsp/bad-input", function (k) {
@@ -199,10 +199,10 @@ function _accuracy(a) {
     if (typeof sec !== "number" && typeof sec !== "bigint") throw _err("tsp/bad-input", "Accuracy seconds must be a non-negative integer, got " + guard.text.showValue(sec));
     var s = intrinsic.Number(sec);
     if (!Number.isInteger(s) || s < 0 || s > 0x7fffffff) throw _err("tsp/bad-input", "Accuracy seconds must be a non-negative integer");
-    f.push(b.integer(BigInt(s)));
+    guard.list.append(f,b.integer(BigInt(s)));
   }
-  if (mil != null) f.push(b.contextPrimitive(0, _subMilliBytes(mil, "millis")));
-  if (mic != null) f.push(b.contextPrimitive(1, _subMilliBytes(mic, "micros")));
+  if (mil != null) guard.list.append(f,b.contextPrimitive(0, _subMilliBytes(mil, "millis")));
+  if (mic != null) guard.list.append(f,b.contextPrimitive(1, _subMilliBytes(mic, "micros")));
   return b.sequence(f);
 }
 function _subMilliBytes(n, label) {
@@ -260,7 +260,7 @@ function _assertImprint(mi) {
  *   var sha256Digest = Buffer.from(await pki.webcrypto.subtle.digest("SHA-256", Buffer.from("hello")));
  *   var req = pki.tsp.request({ hashAlgorithm: "sha256", hashedMessage: sha256Digest }, { nonce: 0x0102030405060708n, certReq: true });
  */
-var _REQUEST_OPTS = { reqPolicy: 1, nonce: 1, certReq: 1, extensions: 1, pem: 1 };
+var _REQUEST_OPTS = intrinsic.assign(intrinsic.create(null), { reqPolicy: 1, nonce: 1, certReq: 1, extensions: 1, pem: 1 });
 
 function request(messageImprint, opts) {
   opts = opts || {};
@@ -276,13 +276,13 @@ function request(messageImprint, opts) {
   _assertImprint(mi);
   var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(guard.bytes.source(mi.hashedMessage, TspError, "tsp/bad-input", "messageImprint.hashedMessage"))]);
   var fields = [b.integer(1n), imprint];
-  if (opts.reqPolicy != null) fields.push(_policy(opts.reqPolicy));
-  if (opts.nonce != null) fields.push(b.integer(guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "nonce")));
+  if (opts.reqPolicy != null) guard.list.append(fields,_policy(opts.reqPolicy));
+  if (opts.nonce != null) guard.list.append(fields,b.integer(guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "nonce")));
   if (opts.certReq != null && typeof opts.certReq !== "boolean") throw _err("tsp/bad-input", "certReq must be a boolean");
-  if (opts.certReq === true) fields.push(b.boolean(true));
+  if (opts.certReq === true) guard.list.append(fields,b.boolean(true));
   if (opts.extensions != null) {
     if (!Array.isArray(opts.extensions) || !guard.list.allMatch(opts.extensions, function (e) { return guard.bytes.isByteSource(e); })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
-    var seenExt = {};
+    var seenExt = intrinsic.create(null);
     var encoded = opts.extensions.map(function (e, i) {
       var der = guard.bytes.source(e, TspError, "tsp/bad-input", "an extension");
       _b.assertValidExtension(der, i);
@@ -291,7 +291,7 @@ function request(messageImprint, opts) {
       seenExt[extnId] = true;
       return der;
     });
-    if (encoded.length) fields.push(b.contextConstructed(0, Buffer.concat(encoded)));
+    if (encoded.length) guard.list.append(fields,b.contextConstructed(0, Buffer.concat(encoded)));
   }
   var der = b.sequence(fields);
   return opts.pem ? schemaTsp.pemEncode(der, "TIMESTAMP REQUEST") : der;
@@ -347,7 +347,7 @@ function parseRequest(input) { return schemaTsp.parseRequest(input); }
  *   var resp = pki.tsp.response(token, {});                                  // granted
  *   var rej  = pki.tsp.response(null, { status: 2, failInfo: ["badAlg"] });  // rejection
  */
-var _RESPONSE_OPTS = { status: 1, statusString: 1, failInfo: 1, pem: 1 };
+var _RESPONSE_OPTS = intrinsic.assign(intrinsic.create(null), { status: 1, statusString: 1, failInfo: 1, pem: 1 });
 
 function response(token, opts) {
   opts = opts || {};
@@ -364,14 +364,14 @@ function response(token, opts) {
   if (opts.statusString != null) {
     var texts = Array.isArray(opts.statusString) ? opts.statusString : [opts.statusString];
     if (!texts.length) throw _err("tsp/bad-input", "statusString must carry at least one PKIFreeText element (RFC 4210 SEQUENCE SIZE 1..MAX)");
-    siFields.push(b.sequence(texts.map(function (t) { return b.utf8(String(t)); })));
+    guard.list.append(siFields,b.sequence(texts.map(function (t) { return b.utf8(String(t)); })));
   }
   if (opts.failInfo != null) {
     if (status !== 2) throw _err("tsp/unexpected-failinfo", "failInfo is present only when the status is rejection(2) (RFC 3161 sec. 2.4.2)");
-    siFields.push(_failInfoBits(opts.failInfo));
+    guard.list.append(siFields,_failInfoBits(opts.failInfo));
   }
   var respFields = [b.sequence(siFields)];
-  if (token != null) respFields.push(b.raw(_tokenDer(token)));
+  if (token != null) guard.list.append(respFields, b.raw(_tokenDer(token)));
   var der = b.sequence(respFields);
   return opts.pem ? schemaTsp.pemEncode(der, "TIMESTAMP RESPONSE") : der;
 }
@@ -508,12 +508,12 @@ function _buildTsaChains(leaf, pool) {
   var chains = [];
   function dfs(current, acc, used) {
     if (chains.length >= MAX_TSA_CHAINS) return;
-    chains.push(acc.slice());
+    guard.list.append(chains, acc.slice());
     for (var i = 0; i < pool.length && chains.length < MAX_TSA_CHAINS; i++) {
       if (used[i]) continue;
       if (pool[i].serialNumberHex === current.serialNumberHex && guard.name.dnEqual(pool[i].issuer.rdns, current.issuer.rdns, _err, "tsp/bad-tsa-certificate", "the TSA certificate issuer")) continue;
       if (guard.name.dnEqual(pool[i].subject.rdns, current.issuer.rdns, _err, "tsp/bad-tsa-certificate", "the TSA certificate subject")) {
-        used[i] = true; acc.push(pool[i]);
+        used[i] = true; guard.list.append(acc, pool[i]);
         dfs(pool[i], acc, used);
         acc.pop(); used[i] = false;
       }
@@ -585,7 +585,7 @@ function _buildTsaChains(leaf, pool) {
  *   res.valid;     // boolean; pass opts.trustAnchors to also chain the TSA cert to a root
  *   res.genTime;   // Date, read from the verified eContent
  */
-var _VERIFY_OPTS = { certs: 1, trustAnchors: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 };
+var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, trustAnchors: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 });
 
 function _anyCritical(extensions) {
   return guard.list.anyMatches(extensions, function (e) { return !!e && !!e.critical; });
@@ -605,7 +605,7 @@ async function verify(token, data, opts) {
   var revocationChecked = false;
   var anchorConstraints = null;
   function fail(code, reason) {
-    return { valid: false, trusted: false, revocationChecked: revocationChecked, anchorConstraints: anchorConstraints, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, policyName: tst.policyName, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null };
+    return guard.verdict.of({ valid: false, trusted: false, revocationChecked: revocationChecked, anchorConstraints: anchorConstraints, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, policyName: tst.policyName, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null });
   }
   var cmsRes = await cmsVerify.verify(tokenDer, { certs: opts.certs });
   var signer = cmsRes.signers[0];
@@ -642,7 +642,7 @@ async function verify(token, data, opts) {
     var ceilT = (tst.genTimeFraction != null && _hasNonZeroDigit(tst.genTimeFraction.slice(3))) ? new Date(guard.time.instantOf(floorT) + 1) : floorT;
     try {
       var pool = (parsed.certificates || []).filter(function (c) { return c.tagClass === "universal"; }).map(function (c) { return pkiX509.parse(c.bytes); });
-      (opts.certs || []).forEach(function (c) { pool.push(pkiX509.parse(c)); });
+      (opts.certs || []).forEach(function (c) { guard.list.append(pool, pkiX509.parse(c)); });
       async function validateAt(chain, when) {
         var res = await pathValidate.validate(chain, {
           time: when, trustAnchors: opts.trustAnchors, requiredEku: ["timeStamping"], checkPurpose: "timeStamping", revocationChecker: opts.revocationChecker,
@@ -662,13 +662,13 @@ async function verify(token, data, opts) {
     anchorConstraints = pathRes.anchorConstraints;
     trusted = true;
   }
-  return {
+  return guard.verdict.of({
     valid: true, trusted: trusted, revocationChecked: revocationChecked, anchorConstraints: anchorConstraints,
     genTime: tst.genTime, accuracy: tst.accuracy,
     serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex,
     policy: tst.policy, policyName: tst.policyName, nonce: tst.nonce, tsa: tst.tsa,
     tstInfo: tst, signer: { cert: tsaCertDer, sid: signer.sid },
-  };
+  });
 }
 
 module.exports = { sign: sign, request: request, parseRequest: parseRequest, response: response, parseResponse: parseResponse, verify: verify };

package/lib/validator-attcert.js

@@ -25,7 +25,7 @@ function assertNotCa(cert, exts, E, code) {
 function packedCert(cert, exts, E, code) {
   requireV3(cert, E, code);
   assertNotCa(cert, exts, E, code);
-  var have = {};
+  var have = Object.create(null);
   (cert.subject.rdns || []).forEach(function (rdn) { rdn.forEach(function (a) { have[a.type] = a.value; }); });
   if (have[oid.byName("countryName")] == null || have[oid.byName("organizationName")] == null || have[oid.byName("commonName")] == null) {
     throw new E(code, "the packed attestation certificate subject MUST set C, O, OU, and CN (WebAuthn 8.2.1)");
@@ -46,7 +46,7 @@ function aikCert(cert, exts, E, code) {
   }
   var san = exts.decode(cert, "subjectAltName");
   var dirName = san && san.value && san.value.names && san.value.names.filter(function (n) { return n.tagNumber === 4; })[0];
-  var types = {};
+  var types = Object.create(null);
   if (dirName && dirName.value && dirName.value.rdns) {
     dirName.value.rdns.forEach(function (rdn) { rdn.forEach(function (a) { types[a.type] = true; }); });
   }