@blamejs/pki 0.6.40 → 0.6.41

package/lib/guard-bytes.js

@@ -6,7 +6,7 @@ var async = require("./guard-async");
 var identifier = require("./guard-identifier");
 var time = require("./guard-time");
 var intrinsic = require("./guard-intrinsic");
-var util = { types: intrinsic.types };
+var util = intrinsic.assign(intrinsic.create(null), { types: intrinsic.types });
 var _isArray = intrinsic.isArray;
 var _bufferFrom = intrinsic.bufferFrom;
 var _isView = intrinsic.isView;
@@ -65,7 +65,7 @@ function asyncStreamOf(x) {
   if (isByteSource(x) || x == null || (typeof x !== "object" && typeof x !== "function")) return null;
   var acquire = x[_asyncIterator];
   if (typeof acquire !== "function") return null;
-  var stream = {};
+  var stream = intrinsic.create(null);
   stream[_asyncIterator] = function () { return _apply(acquire, x, _NO_ARGS); };
   return stream;
 }

package/lib/guard-compress.js

@@ -15,17 +15,17 @@ var _sizeOf = _intrinsic.sizeOf;
 var _subarray = _intrinsic.uncurry(Uint8Array.prototype.subarray);
 var _hasOwn = _intrinsic.hasOwn;
 
-var DECOMPRESS = {
+var DECOMPRESS = _intrinsic.assign(_intrinsic.create(null), {
   zlib: zlib.inflateSync,
   brotli: zlib.brotliDecompressSync,
   zstd: zlib.zstdDecompressSync,
-};
+});
 
-var _PROBE_COMPRESS = {
+var _PROBE_COMPRESS = _intrinsic.assign(_intrinsic.create(null), {
   zlib: zlib.deflateSync,
   brotli: zlib.brotliCompressSync,
   zstd: zlib.zstdCompressSync,
-};
+});
 
 function _reportsTruncation(name) {
   var compress = _PROBE_COMPRESS[name];
@@ -47,7 +47,7 @@ function _reportsTruncation(name) {
   return !cutAccepted;
 }
 
-var SAFE = {};
+var SAFE = _intrinsic.create(null);
 _intrinsic.forEach(_objectKeys(DECOMPRESS), function (n) { if (_reportsTruncation(n)) SAFE[n] = true; });
 
 // @enforced-by guard-shape-reinlined

package/lib/guard-identifier.js

@@ -2,7 +2,7 @@
 // Copyright (c) blamejs contributors
 "use strict";
 var intrinsic = require("./guard-intrinsic");
-var util = { types: intrinsic.types };
+var util = intrinsic.assign(intrinsic.create(null), { types: intrinsic.types });
 // @internal
 
 var _isArray = intrinsic.isArray;
@@ -32,6 +32,7 @@ var _Set = intrinsic.Set;
 var _Map = intrinsic.Map;
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSplit = intrinsic.uncurry(String.prototype.split);
+var _fnToString = intrinsic.uncurry(Function.prototype.toString);
 var _hasOwn = intrinsic.hasOwn;
 var _String = intrinsic.String;
 var _Number = intrinsic.Number;
@@ -390,7 +391,50 @@ function _settle(opts, E, code, label) {
   return opts;
 }
 
+/** @internal An injectable callback option, refused unless it is callable. A value that is present
+ * but not a function reaches the call site otherwise, where the operator gets a bare TypeError
+ * naming no option; and one read as absent sends the caller to whatever default the boundary
+ * installs, which for a transport is a real network client the caller was trying to replace. Take a
+ * value only when it is known to be present; `assertCallableOption` decides presence.
+ *
+ * Callable is all this asks. A class constructor answers "function" to typeof and still throws when
+ * called, but no test here separates one from an ordinary function: freezing a function leaves its
+ * prototype non-writable exactly as a class's is, and reading the source text mistakes a method
+ * named `class` for the keyword. The boundary that calls the value reports that throw as its own
+ * typed error (`guard.async.invoked`), which covers a class however it is disguised, binding it
+ * included, and rejects nothing a caller can legitimately pass. */
+// @enforced-by behavioral -- the shape is a typeof test against a string literal, and the pattern
+// @enforced-by behavioral -- scanner blanks every literal, so "function" cannot be told from
+// @enforced-by behavioral -- "string" or "object"; a lexical rule would flag every type check in
+// @enforced-by behavioral -- lib. The per-verb vectors across est, scep, acme, cmp and ct are the
+// @enforced-by behavioral -- guard: each drives the shipped verb and asserts the typed refusal.
+function assertCallable(value, E, code, label, shape) {
+  var wanted = label + " must be a function" + (shape ? " " + shape : "");
+  if (value === undefined) {
+    throw E(code, wanted + ", got undefined");
+  }
+  if (typeof value !== "function") {
+    throw E(code, wanted + ", got " + (value === null ? "null" : typeof value));
+  }
+  return value;
+}
+
+/** @internal The option form: an option counts as supplied when a name lookup finds the key, so a
+ * merge that produced `{ transport: undefined }` is a value the caller set rather than an option it
+ * left out. Presence is asked the way the boundary asks for the value, which is a plain lookup, so
+ * an inherited option from a defaults bag is checked rather than skipped; testing own keys alone
+ * would let an inherited null pass here and then be read as absent, selecting the default client.
+ * Only a key no lookup finds falls through to that default. */
+// @enforced-by behavioral -- the per-verb vectors across est, scep, acme, cmp, ct and path drive the
+// @enforced-by behavioral -- shipped verb and assert the typed refusal for each unusable value
+function assertCallableOption(opts, key, E, code, label, shape) {
+  if (opts == null || !(key in _Object(opts))) return undefined;
+  return assertCallable(opts[key], E, code, label, shape);
+}
+
 module.exports = intrinsic.freeze({
+  assertCallable: assertCallable,
+  assertCallableOption: assertCallableOption,
   assertCanonicalOid: assertCanonicalOid,
   assertKnownKeys: assertKnownKeys,
   assertPlainRecord: assertPlainRecord,

package/lib/guard-name.js

@@ -152,7 +152,7 @@ function escapeControlBytes(str) {
   return out;
 }
 
-var DN_SPECIAL = { 0x2c: 1, 0x2b: 1, 0x22: 1, 0x5c: 1, 0x3c: 1, 0x3e: 1, 0x3b: 1 };
+var DN_SPECIAL = intrinsic.assign(intrinsic.create(null), { 0x2c: 1, 0x2b: 1, 0x22: 1, 0x5c: 1, 0x3c: 1, 0x3e: 1, 0x3b: 1 });
 // @enforced-by behavioral -- the escaping has no rename-proof code shape distinct
 function escapeDnValue(v) {
   var s = _String(v), out = "";

package/lib/guard-time.js

@@ -3,7 +3,9 @@
 "use strict";
 // @internal
 
-var util = { types: require("./guard-intrinsic").types };
+var _create = require("./guard-intrinsic").create;
+var _assign = require("./guard-intrinsic").assign;
+var util = _assign(_create(null), { types: require("./guard-intrinsic").types });
 var _freeze = require("./guard-intrinsic").freeze;
 var _isNaN = Number.isNaN;
 var _Date = Date;

package/lib/hpke.js

@@ -102,8 +102,8 @@ function _labeledExpand(kdf, suiteId, prk, label, info, len) {
 }
 
 
-var OKP_SPKI = { X25519: "302a300506032b656e032100", X448: "3042300506032b656f033900" };
-var OKP_PKCS8 = { X25519: "302e020100300506032b656e04220420", X448: "3046020100300506032b656f043a0438" };
+var OKP_SPKI = intrinsic.assign(intrinsic.create(null), { X25519: "302a300506032b656e032100", X448: "3042300506032b656f033900" });
+var OKP_PKCS8 = intrinsic.assign(intrinsic.create(null), { X25519: "302e020100300506032b656e04220420", X448: "3046020100300506032b656f043a0438" });
 
 function _importPublic(kem, raw) {
   if (!Buffer.isBuffer(raw) || raw.length !== kem.Npub) {
@@ -318,9 +318,9 @@ function _recipPrivate(suite, sk) {
   }
 }
 
-var _COMMON_KEYS = { mode: 1, info: 1, psk: 1, pskId: 1 };
+var _COMMON_KEYS = intrinsic.assign(intrinsic.create(null), { mode: 1, info: 1, psk: 1, pskId: 1 });
 function _withCommon(extra) {
-  var out = {};
+  var out = intrinsic.create(null);
   Object.keys(_COMMON_KEYS).forEach(function (k) { out[k] = 1; });
   Object.keys(extra).forEach(function (k) { out[k] = 1; });
   return out;
@@ -348,12 +348,12 @@ function _mode(opts, keys, who) {
 }
 
 // @module @intro; a data registry, not a callable primitive).
-var suites = {
-  KEM: { DHKEM_P256_HKDF_SHA256: 0x0010, DHKEM_P521_HKDF_SHA512: 0x0012, DHKEM_X25519_HKDF_SHA256: 0x0020, DHKEM_X448_HKDF_SHA512: 0x0021 },
-  KDF: { HKDF_SHA256: 0x0001, HKDF_SHA512: 0x0003 },
-  AEAD: { AES_128_GCM: 0x0001, AES_256_GCM: 0x0002, CHACHA20_POLY1305: 0x0003, EXPORT_ONLY: 0xFFFF },
-  MODE: { BASE: MODE_BASE, PSK: MODE_PSK, AUTH: MODE_AUTH, AUTH_PSK: MODE_AUTH_PSK },
-};
+var suites = intrinsic.assign(intrinsic.create(null), {
+  KEM: intrinsic.assign(intrinsic.create(null), { DHKEM_P256_HKDF_SHA256: 0x0010, DHKEM_P521_HKDF_SHA512: 0x0012, DHKEM_X25519_HKDF_SHA256: 0x0020, DHKEM_X448_HKDF_SHA512: 0x0021 }),
+  KDF: intrinsic.assign(intrinsic.create(null), { HKDF_SHA256: 0x0001, HKDF_SHA512: 0x0003 }),
+  AEAD: intrinsic.assign(intrinsic.create(null), { AES_128_GCM: 0x0001, AES_256_GCM: 0x0002, CHACHA20_POLY1305: 0x0003, EXPORT_ONLY: 0xFFFF }),
+  MODE: intrinsic.assign(intrinsic.create(null), { BASE: MODE_BASE, PSK: MODE_PSK, AUTH: MODE_AUTH, AUTH_PSK: MODE_AUTH_PSK }),
+});
 
 
 /**

package/lib/http-digest.js

@@ -17,10 +17,10 @@ var ALGS = intrinsic.assign(intrinsic.create(null), {
   "SHA-256": { hash: "sha256", rank: 2, sess: false }, "SHA-256-SESS": { hash: "sha256", rank: 2, sess: true },
   "MD5": { hash: "md5", rank: 1, sess: false }, "MD5-SESS": { hash: "md5", rank: 1, sess: true },
 });
-var DEFAULT_CODES = {
+var DEFAULT_CODES = intrinsic.assign(intrinsic.create(null), {
   unsupportedAlgorithm: "digest/unsupported-algorithm", weakAlgorithm: "digest/weak-algorithm",
   noQop: "digest/no-qop", badChallenge: "digest/bad-challenge",
-};
+});
 
 function H(hash, s) { return crypto.createHash(hash).update(s, "latin1").digest("hex"); }
 function KD(hash, secret, data) { return H(hash, secret + ":" + data); }

package/lib/http-transport.js

@@ -440,7 +440,7 @@ function httpsTransport(defaults) {
     var bodyIsFn = typeof body === "function";
     if (!bodyIsFn && guard.bytes.isByteSource(body)) body = guard.bytes.source(body, E, C("bad-input"), "the request body");
 
-    var reqHeaders = Object.assign({}, request.headers || {});
+    var reqHeaders = Object.assign(Object.create(null), request.headers || {});
     Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "proxy-authorization" || lk === "proxy-connection") delete reqHeaders[k]; });
     if (bodyIsFn) {
       Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "content-length" || lk === "transfer-encoding" || lk === "expect") delete reqHeaders[k]; });
@@ -553,7 +553,7 @@ function httpsTransport(defaults) {
               if (settled) return;
               settled = true;
               clearTimer();
-              var lower = {};
+              var lower = Object.create(null);
               Object.keys(res.headers || {}).forEach(function (k) { lower[k.toLowerCase()] = res.headers[k]; });
               resolve({
                 status: res.statusCode,
@@ -595,7 +595,7 @@ function httpsTransport(defaults) {
       if (!prep.proxy) { issue(prep.options); return; }
 
       var pinfo = prep.proxy;
-      var pheaders = { Host: pinfo.originAuthority, Connection: "keep-alive" };
+      var pheaders = Object.assign(Object.create(null), { Host: pinfo.originAuthority, Connection: "keep-alive" });
       if (pinfo.auth) pheaders["Proxy-Authorization"] = _basicProxyHeader(pinfo.auth);
       var connectOpts = { host: pinfo.host, port: pinfo.port, method: "CONNECT", path: pinfo.originAuthority, headers: pheaders, agent: false };
       var cr;

package/lib/inspect.js

@@ -95,9 +95,9 @@ function _serial(cert, indent) {
   return "Serial Number:\n" + " ".repeat(indent) + _hexColon(buf, {});
 }
 
-var CURVE_BITS = { "P-256": 256, "P-384": 384, "P-521": 521, "prime256v1": 256, "secp384r1": 384, "secp521r1": 521 };
+var CURVE_BITS = Object.assign(Object.create(null), { "P-256": 256, "P-384": 384, "P-521": 521, "prime256v1": 256, "secp384r1": 384, "secp521r1": 521 });
 var NIST_NAME = NAMES.NIST_CURVE;
-var RSA_KEY_ALGS = { rsaEncryption: 1, rsassaPss: 1, rsaesOaep: 1 };
+var RSA_KEY_ALGS = Object.assign(Object.create(null), { rsaEncryption: 1, rsassaPss: 1, rsaesOaep: 1 });
 function _keyBlock(spki, pad) {
   var algName = _algName(spki.algorithm);
   var out = [pad + "Public Key Algorithm: " + algName];
@@ -214,7 +214,7 @@ function _renderCrlDp(decoded, inner) {
 }
 
 
-var EXT_RENDERERS = {
+var EXT_RENDERERS = Object.assign(Object.create(null), {
   keyUsage: function (decoded, inner) {
     return inner + Object.keys(KU_LABEL).filter(function (k) { return decoded[k]; }).map(function (k) { return KU_LABEL[k]; }).join(", ");
   },
@@ -301,7 +301,7 @@ var EXT_RENDERERS = {
   cRLDistributionPoints: _renderCrlDp,
   freshestCRL: _renderCrlDp,
   authorityInfoAccess: function (decoded, inner) {
-    var LABEL = { caIssuers: "CA Issuers", ocsp: "OCSP" };
+    var LABEL = Object.assign(Object.create(null), { caIssuers: "CA Issuers", ocsp: "OCSP" });
     return (decoded || []).map(function (ad) {
       var m = null;
       try { m = oid.name(ad.accessMethod); } catch (_e) { /* allow:swallow-unverified display best-effort: an unregistered accessMethod OID falls back to the raw dotted OID below (inspection is best-effort, never a verdict) */ }
@@ -369,7 +369,7 @@ var EXT_RENDERERS = {
     }
     return akiLines.length ? akiLines.join("\n") : inner + "keyid:(none)";
   },
-};
+});
 EXT_RENDERERS.msApplicationPolicies = EXT_RENDERERS.certificatePolicies;
 
 
@@ -378,7 +378,7 @@ function _renderExtValue(ext, decoded, inner) {
   return fn ? fn(decoded, inner) : null;
 }
 
-var _STRING_TAGS = { 12: 1, 19: 1, 22: 1, 20: 1, 26: 1, 27: 1, 30: 1 };
+var _STRING_TAGS = Object.assign(Object.create(null), { 12: 1, 19: 1, 22: 1, 20: 1, 26: 1, 27: 1, 30: 1 });
 function _printable(buf) {
   return buf.length > 0 && buf.every(function (b) { return b >= 0x20 && b < 0x7f; });
 }
@@ -499,7 +499,7 @@ function _looksParsedCms(o) {
   var shape = _CMS_SHAPE[o.contentType];
   return shape ? shape(o) : false;
 }
-var _INSPECT_ENTRY = { pemLabel: null, PemError: InspectError, ErrorClass: InspectError, prefix: "inspect" };
+var _INSPECT_ENTRY = Object.assign(Object.create(null), { pemLabel: null, PemError: InspectError, ErrorClass: InspectError, prefix: "inspect" });
 function _coerce(input, spec) {
   if (input && typeof input === "object" && !Buffer.isBuffer(input) && !(input instanceof Uint8Array) && input[spec.marker] !== undefined) {
     if (!spec.looksParsed(input)) throw _err("inspect/bad-input", "input has a " + spec.marker + " property but is not a complete " + spec.parsedName + " result");
@@ -657,7 +657,7 @@ function csrReport(input) {
 
 var OID_SIGNED_DATA = oid.byName("signedData");
 function _isObj(x) { return !!x && typeof x === "object"; }
-var _CMS_SHAPE = {};
+var _CMS_SHAPE = Object.create(null);
 _CMS_SHAPE[OID_SIGNED_DATA] = function (o) { return Array.isArray(o.digestAlgorithms) && _isObj(o.encapContentInfo) && Array.isArray(o.signerInfos); };
 _CMS_SHAPE[oid.byName("envelopedData")] = function (o) { return Array.isArray(o.recipientInfos) && _isObj(o.encryptedContentInfo); };
 _CMS_SHAPE[oid.byName("encryptedData")] = function (o) { return _isObj(o.encryptedContentInfo); };
@@ -784,7 +784,7 @@ function cmsReport(input) {
 }
 
 
-var _INSPECT_BY_FORMAT = { x509: certificate, crl: crlReport, csr: csrReport, cms: cmsReport };
+var _INSPECT_BY_FORMAT = Object.assign(Object.create(null), { x509: certificate, crl: crlReport, csr: csrReport, cms: cmsReport });
 
 /**
  * @primitive pki.inspect.any

package/lib/jose.js

@@ -129,7 +129,7 @@ function parseJson(input) {
 }
 
 
-var SIG_ALGS = {
+var SIG_ALGS = intrinsic.assign(intrinsic.create(null), {
   ES256: { kty: "EC", crv: "P-256", hash: "SHA-256", subtle: "ECDSA", sigBytes: 64 },
   ES384: { kty: "EC", crv: "P-384", hash: "SHA-384", subtle: "ECDSA", sigBytes: 96 },
   ES512: { kty: "EC", crv: "P-521", hash: "SHA-512", subtle: "ECDSA", sigBytes: 132 },
@@ -139,26 +139,26 @@ var SIG_ALGS = {
   PS256: { kty: "RSA", hash: "SHA-256", subtle: "RSA-PSS", saltLength: 32 },
   PS384: { kty: "RSA", hash: "SHA-384", subtle: "RSA-PSS", saltLength: 48 },
   PS512: { kty: "RSA", hash: "SHA-512", subtle: "RSA-PSS", saltLength: 64 },
-  EdDSA: { kty: "OKP", subtle: "EdDSA", sigBytesByCrv: { Ed25519: 64, Ed448: 114 } },
+  EdDSA: { kty: "OKP", subtle: "EdDSA", sigBytesByCrv: intrinsic.assign(intrinsic.create(null), { Ed25519: 64, Ed448: 114 }) },
   "ML-DSA-44": { kty: "AKP", subtle: "ML-DSA-44", sigBytes: 2420 },
   "ML-DSA-65": { kty: "AKP", subtle: "ML-DSA-65", sigBytes: 3309 },
   "ML-DSA-87": { kty: "AKP", subtle: "ML-DSA-87", sigBytes: 4627 },
-};
+});
 
-var MAC_ALGS = {
+var MAC_ALGS = intrinsic.assign(intrinsic.create(null), {
   HS256: { kty: "oct", hash: "SHA-256", sigBytes: 32 },
   HS384: { kty: "oct", hash: "SHA-384", sigBytes: 48 },
   HS512: { kty: "oct", hash: "SHA-512", sigBytes: 64 },
-};
+});
 
-var UNDERSTOOD_HEADER = { alg: 1, nonce: 1, url: 1, jwk: 1, kid: 1, crit: 1 };
+var UNDERSTOOD_HEADER = intrinsic.assign(intrinsic.create(null), { alg: 1, nonce: 1, url: 1, jwk: 1, kid: 1, crit: 1 });
 
 
-var PROFILES = {
+var PROFILES = intrinsic.assign(intrinsic.create(null), {
   "acme-outer":     { algs: SIG_ALGS, nonce: "required",  keyId: "one-of", requireUrl: true },
   "eab-inner":      { algs: MAC_ALGS, nonce: "forbidden", keyId: "kid",    requireUrl: true },
   "keychange-inner": { algs: SIG_ALGS, nonce: "forbidden", keyId: "jwk",    requireUrl: true },
-};
+});
 
 function _checkHeader(header, profileName) {
   var profile = PROFILES[profileName];
@@ -192,7 +192,7 @@ function _checkHeader(header, profileName) {
   if (_hasOwn(header, "crit")) {
     var crit = header.crit;
     if (!_isArray(crit) || crit.length === 0) throw E("jose/bad-crit", "crit must be a non-empty array");
-    var seen = {};
+    var seen = intrinsic.create(null);
     for (var c = 0; c < crit.length; c++) {
       var name = crit[c];
       if (typeof name !== "string") throw E("jose/bad-crit", "crit entries must be strings");
@@ -315,7 +315,7 @@ function assertPublicJwk(jwk) {
  *   var v = await pki.jose.verify(jws, { profile: "acme-outer", key: accountJwk });
  *   v.header.alg;   // -> "ES256"
  */
-var _VERIFY_KEYS = { key: 1, profile: 1 };
+var _VERIFY_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, profile: 1 });
 async function verify(jws, opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _VERIFY_KEYS, E, "jose/bad-input", "unknown pki.jose.verify option ");
@@ -395,8 +395,8 @@ async function verify(jws, opts) {
  *     nonce: "oFvnlFP1wIhRlYS2jTaXbA", url: "https://ca.example/acme/new-acct" };
  *   var jws = await pki.jose.sign({ protected: hdr, payload: Buffer.from("{}"), key: priv });
  */
-var _SIGN_KEYS = { protected: 1, payload: 1, key: 1, jwk: 1, profile: 1 };
-var _SIGN_KEYS_EMBEDDED_JWK = { protected: 1, payload: 1, key: 1, profile: 1 };
+var _SIGN_KEYS = intrinsic.assign(intrinsic.create(null), { protected: 1, payload: 1, key: 1, jwk: 1, profile: 1 });
+var _SIGN_KEYS_EMBEDDED_JWK = intrinsic.assign(intrinsic.create(null), { protected: 1, payload: 1, key: 1, profile: 1 });
 async function sign(opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _SIGN_KEYS, E, "jose/bad-input", "unknown pki.jose.sign option ");
@@ -442,13 +442,13 @@ async function sign(opts) {
 }
 
 
-var THUMBPRINT_MEMBERS = {
+var THUMBPRINT_MEMBERS = intrinsic.assign(intrinsic.create(null), {
   EC: ["crv", "kty", "x", "y"],
   RSA: ["e", "kty", "n"],
   oct: ["k", "kty"],
   OKP: ["crv", "kty", "x"],
   AKP: ["alg", "kty", "pub"],
-};
+});
 
 /**
  * @primitive  pki.jose.thumbprint

package/lib/key.js

@@ -38,7 +38,7 @@ function _err(code, msg, cause) { return new KeyError(code, msg, cause); }
 
 var CIPHER_NAME = Object.assign(Object.create(null), { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" });
 
-var INFER_ALG = {};
+var INFER_ALG = Object.create(null);
 ["Ed25519", "Ed448", "X25519", "X448"].forEach(function (n) { INFER_ALG[O(n)] = { name: n }; });
 [["id-ml-dsa-44", "ML-DSA-44"], ["id-ml-dsa-65", "ML-DSA-65"], ["id-ml-dsa-87", "ML-DSA-87"],
  ["id-ml-kem-512", "ML-KEM-512"], ["id-ml-kem-768", "ML-KEM-768"], ["id-ml-kem-1024", "ML-KEM-1024"]
@@ -88,7 +88,7 @@ async function _toPrivateKeyDer(input) {
  *   var enc = await pki.key.encrypt(der, "s3cr3t", { pem: true });
  *   var back = await pki.key.decrypt(enc, "s3cr3t");
  */
-var _ENCRYPT_OPTS = { cipher: 1, iterations: 1, pem: 1, prf: 1, salt: 1 };
+var _ENCRYPT_OPTS = Object.assign(Object.create(null), { cipher: 1, iterations: 1, pem: 1, prf: 1, salt: 1 });
 
 async function encrypt(privateKey, password, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.encrypt options");
@@ -147,7 +147,7 @@ async function encrypt(privateKey, password, opts) {
  *   var enc = await pki.key.encrypt(await pki.key.export(pair.privateKey), "s3cr3t", { pem: true });
  *   var der = await pki.key.decrypt(enc, "s3cr3t");
  */
-var _DECRYPT_OPTS = { maxIterations: 1, pem: 1 };
+var _DECRYPT_OPTS = Object.assign(Object.create(null), { maxIterations: 1, pem: 1 });
 
 async function decrypt(encrypted, password, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.decrypt options");
@@ -203,7 +203,7 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
  *   var pair = await pki.key.generate("Ed25519");
  *   var spkiPem = await pki.key.export(pair.publicKey, { format: "pem" });
  */
-var _EXPORT_OPTS = { format: 1, label: 1 };
+var _EXPORT_OPTS = Object.assign(Object.create(null), { format: 1, label: 1 });
 
 async function export_(key, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.export options");
@@ -246,7 +246,7 @@ async function export_(key, opts) {
  *   var spki = await pki.key.export(pair.publicKey);
  *   var pub = await pki.key.import(spki);                       // Ed25519 -- algorithm inferred
  */
-var _IMPORT_OPTS = { algorithm: 1, extractable: 1, password: 1, usages: 1 };
+var _IMPORT_OPTS = Object.assign(Object.create(null), { algorithm: 1, extractable: 1, password: 1, usages: 1 });
 
 async function import_(input, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.import options");
@@ -290,7 +290,7 @@ async function import_(input, opts) {
  *   var pair = await pki.key.generate("Ed25519");
  *   var pkcs8 = await pki.key.export(pair.privateKey);
  */
-var _GENERATE_OPTS = { extractable: 1, usages: 1 };
+var _GENERATE_OPTS = Object.assign(Object.create(null), { extractable: 1, usages: 1 });
 
 async function generate(algorithm, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.generate options");
@@ -325,7 +325,7 @@ async function generate(algorithm, opts) {
  *   var pair = await pki.key.generate("Ed25519");
  *   var spki = await pki.key.publicFromPrivate(await pki.key.export(pair.privateKey));
  */
-var _PUBLIC_FROM_PRIVATE_OPTS = { pem: 1 };
+var _PUBLIC_FROM_PRIVATE_OPTS = Object.assign(Object.create(null), { pem: 1 });
 
 async function publicFromPrivate(privateKey, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.publicFromPrivate options");

package/lib/lint.js

@@ -129,7 +129,8 @@ function _effective(rule, cert) {
 }
 
 function _runLints(rules, cert, ctx) {
-  var findings = [], counts = { fatal: 0, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }, ran = [];
+  var findings = [], ran = [];
+  var counts = Object.assign(Object.create(null), { fatal: 0, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 });
   rules.forEach(function (rule) {
     if (rule.appliesTo && !rule.appliesTo(cert, ctx)) { counts.na++; return; }
     if (!_effective(rule, cert)) { counts.ne++; return; }
@@ -172,7 +173,7 @@ function _subjectCNs(cert) {
   return out;
 }
 
-var _CRITICAL_LEGIT = {};
+var _CRITICAL_LEGIT = Object.create(null);
 _CRITICAL_LEGIT[oid.byName("precertificatePoison")] = true;
 function _isUnknownExtension(extOid) {
   if (path.PROCESSED_EXTENSIONS[extOid] !== true) return _CRITICAL_LEGIT[extOid] !== true;
@@ -560,7 +561,7 @@ function _applyThreshold(report, severity) {
  *   report.worst;                              // "notice" | "error" | ...
  *   report.findings.map(function (f) { return f.id; });
  */
-var _CERTIFICATE_OPTS = { profile: 1, severity: 1 };
+var _CERTIFICATE_OPTS = Object.assign(Object.create(null), { profile: 1, severity: 1 });
 
 function certificate(input, opts) {
   opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
@@ -573,7 +574,8 @@ function certificate(input, opts) {
   var ingested = _ingest(input);
   var report;
   if (ingested.fatal) {
-    report = { findings: [ingested.fatal], counts: { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }, ran: [] };
+    report = { findings: [ingested.fatal], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
   } else {
     var ctx = _makeCtx(ingested.cert, opts.profile);
     report = _runLints(rules, ingested.cert, ctx);

package/lib/merkle.js

@@ -180,7 +180,7 @@ function emptyRootHash() {
  *   var lh = pki.merkle.leafHash(Buffer.from([0]));
  *   pki.merkle.verifyInclusion({ leafIndex: 0, treeSize: 1, leafHash: lh, proof: [], rootHash: lh }); // -> true
  */
-var _INCLUSION_KEYS = { leafIndex: 1, treeSize: 1, leafHash: 1, rootHash: 1, proof: 1 };
+var _INCLUSION_KEYS = Object.assign(Object.create(null), { leafIndex: 1, treeSize: 1, leafHash: 1, rootHash: 1, proof: 1 });
 function verifyInclusion(opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _INCLUSION_KEYS, function (c, m) { return new MerkleError(c, m); },
@@ -252,7 +252,7 @@ function verifyInclusion(opts) {
  *   var r = pki.merkle.leafHash(Buffer.from([0]));
  *   pki.merkle.verifyConsistency({ oldSize: 1, newSize: 1, oldRoot: r, newRoot: r, proof: [] }); // -> true
  */
-var _CONSISTENCY_KEYS = { oldSize: 1, newSize: 1, oldRoot: 1, newRoot: 1, proof: 1 };
+var _CONSISTENCY_KEYS = Object.assign(Object.create(null), { oldSize: 1, newSize: 1, oldRoot: 1, newRoot: 1, proof: 1 });
 function verifyConsistency(opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _CONSISTENCY_KEYS, function (c, m) { return new MerkleError(c, m); },

package/lib/mime.js

@@ -68,7 +68,7 @@ function _unfoldHeaders(headerText) {
 function _parseStructured(headerValue) {
   var parts = _splitSemicolons(headerValue);
   var type = _stripComments(parts[0]).trim().toLowerCase();
-  var params = {};
+  var params = Object.create(null);
   for (var i = 1; i < parts.length; i++) {
     var p = _stripComments(parts[i]);
     var eq = p.indexOf("=");
@@ -131,7 +131,7 @@ function parse(input, E, code) {
   var cte = (header("content-transfer-encoding") || "").trim().toLowerCase() || "7bit";
   return {
     headers: headers, header: header,
-    contentType: ctv != null ? _parseStructured(ctv) : { value: "text/plain", type: "text/plain", params: {} },
+    contentType: ctv != null ? _parseStructured(ctv) : { value: "text/plain", type: "text/plain", params: Object.create(null) },
     cte: cte,
     headerBytes: headerBytes, bodyBytes: bodyBytes, body: bodyBytes, bytes: bytes,
   };

package/lib/ocsp-verify.js

@@ -12,7 +12,7 @@ var compositeSig = require("./composite-sig");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 
-var OCSP_CERTID_HASHES = {};
+var OCSP_CERTID_HASHES = intrinsic.create(null);
 OCSP_CERTID_HASHES[oid.byName("sha1")] = "SHA-1";
 OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
 OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";

package/lib/ocsp.js

@@ -139,9 +139,9 @@ function buildRequest(query, opts) {
   ], _buildRequest);
 }
 
-var _BUILD_REQUEST_OPTS = {
+var _BUILD_REQUEST_OPTS = Object.assign(Object.create(null), {
   hashAlgorithm: 1, nonce: 1, pem: 1, profile: 1, requestorName: 1, signer: 1
-};
+});
 
 function _buildRequest(query, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.buildRequest options");
@@ -250,7 +250,7 @@ function sign(responseData, responder, opts) {
   ], _sign);
 }
 
-var _SIGN_OPTS = { embedCert: 1, extendedRevoke: 1, nonce: 1, pem: 1 };
+var _SIGN_OPTS = Object.assign(Object.create(null), { embedCert: 1, extendedRevoke: 1, nonce: 1, pem: 1 });
 
 function _sign(responseData, responder, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.sign options");
@@ -425,7 +425,7 @@ function buildErrorResponse(status) {
  *   var res = await pki.ocsp.verify(responseDer, { cert: leafDer, issuer: caDer });
  *   res.status;   // "good" | "revoked" | "unknown"
  */
-var _VERIFY_OPTS = { cert: 1, historicalMode: 1, issuer: 1, requestNonce: 1, time: 1 };
+var _VERIFY_OPTS = Object.assign(Object.create(null), { cert: 1, historicalMode: 1, issuer: 1, requestNonce: 1, time: 1 });
 
 function verify(response, opts) {
   try {
@@ -465,7 +465,7 @@ function _responseNonce(parsed) {
   return null;
 }
 
-var _VERIFY_REQUEST_OPTS = { certs: 1 };
+var _VERIFY_REQUEST_OPTS = Object.assign(Object.create(null), { certs: 1 });
 function _requestFromBytes(request) {
   if (guard.bytes.isByteSource(request)) request = guard.bytes.snapshotSource(request, OcspError, "ocsp/bad-input", "the OCSP request");
   return ocspSchema.parseRequest(request);

package/lib/oid.js

@@ -42,7 +42,7 @@ var OidError = frameworkError.OidError;
 
 function _oidError(c, m) { return new OidError(c, m); }
 
-var FAMILIES = {
+var FAMILIES = Object.assign(Object.create(null), {
   attributeType: { base: [2, 5, 4], of: {
     commonName: 3, surname: 4, serialNumber: 5, countryName: 6,
     localityName: 7, stateOrProvinceName: 8, streetAddress: 9,
@@ -335,7 +335,7 @@ var FAMILIES = {
     scepMessageType: 2, scepPkiStatus: 3, scepFailInfo: 4,
     scepSenderNonce: 5, scepRecipientNonce: 6, scepTransactionId: 7 } },
   scep: { base: [1, 3, 6, 1, 5, 5, 7, 24], of: { scepFailInfoText: 1 } },
-};
+});
 
 var _byOid = new Map();
 var _byName = new Map();
@@ -483,7 +483,7 @@ function registerFamily(base, members) {
 }
 
 function all() {
-  var out = {};
+  var out = Object.create(null);
   _byOid.forEach(function (v, k) { out[k] = v; });
   return out;
 }