@blamejs/pki 0.6.40 → 0.6.41

package/lib/path-validate.js

@@ -80,7 +80,7 @@ var ANCHOR_SPKI_SCHEMA = pkix.spki(NS);
 
 var subtle = webcrypto.webcrypto.subtle;
 
-var OID = {
+var OID = intrinsic.assign(intrinsic.create(null), {
   basicConstraints: oid.byName("basicConstraints"),
   keyUsage: oid.byName("keyUsage"),
   nameConstraints: oid.byName("nameConstraints"),
@@ -98,9 +98,9 @@ var OID = {
   authorityKeyIdentifier: oid.byName("authorityKeyIdentifier"),
   authorityInfoAccess: oid.byName("authorityInfoAccess"),
   caIssuers: oid.byName("caIssuers"),
-};
+});
 
-var PROCESSED_EXTENSIONS = {};
+var PROCESSED_EXTENSIONS = intrinsic.create(null);
 [OID.basicConstraints, OID.keyUsage, OID.nameConstraints, OID.certificatePolicies,
  OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
  OID.extKeyUsage, OID.cRLDistributionPoints].
@@ -137,7 +137,7 @@ _sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", fal
 
 var OID_RSA_PSS = oid.byName("rsassaPss");
 var OID_MGF1 = oid.byName("mgf1");
-var HASH_BY_OID = {};
+var HASH_BY_OID = intrinsic.create(null);
 HASH_BY_OID[oid.byName("sha256")] = "SHA-256";
 HASH_BY_OID[oid.byName("sha384")] = "SHA-384";
 HASH_BY_OID[oid.byName("sha512")] = "SHA-512";
@@ -244,7 +244,7 @@ function compositeKeyUsageCheck(cert) {
   return { ok: true };
 }
 
-var ML_KEM_OIDS = {};
+var ML_KEM_OIDS = intrinsic.create(null);
 ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { ML_KEM_OIDS[oid.byName(n)] = true; });
 
 function kemKeyUsageCheck(cert) {
@@ -806,7 +806,7 @@ function prepareNext(state, cert, i, checks) {
 function applyPolicyMappings(state, mappings, i) {
   var depth = i;
   if (state.policyMapping > 0) {
-    var mappedFrom = {};
+    var mappedFrom = intrinsic.create(null);
     mappings.forEach(function (m) { guard.list.append(mappedFrom[m.issuerDomainPolicy] = mappedFrom[m.issuerDomainPolicy] || [], m.subjectDomainPolicy); });
     var depthI = leavesAt(state.validPolicyTree, depth);
     var anyNodes = depthI.filter(function (nd) { return nd.validPolicy === OID.anyPolicy; });
@@ -821,7 +821,7 @@ function applyPolicyMappings(state, mappings, i) {
       }
     });
   } else {
-    var mappedSet = {};
+    var mappedSet = intrinsic.create(null);
     mappings.forEach(function (m) { mappedSet[m.issuerDomainPolicy] = true; });
     if (!state.validPolicyTree) return;
     leavesAt(state.validPolicyTree, depth).forEach(function (node) {
@@ -835,7 +835,7 @@ function applyPolicyMappings(state, mappings, i) {
   }
 }
 
-var TARGET_UNPROCESSED_IF_CRITICAL = {};
+var TARGET_UNPROCESSED_IF_CRITICAL = intrinsic.create(null);
 TARGET_UNPROCESSED_IF_CRITICAL[OID.policyMappings] = true;
 Object.freeze(TARGET_UNPROCESSED_IF_CRITICAL);
 
@@ -939,13 +939,13 @@ function validateCriticalExtensionStructure(cert) {
  *   });
  *   res.valid;  // boolean; res.results[0].checks carries the per-check codes
  */
-var _VALIDATE_OPTS = {
+var _VALIDATE_OPTS = intrinsic.assign(intrinsic.create(null), {
   checkPurpose: 1, ctLogList: 1, ctPolicy: 1, historicalMode: 1, initialAnyPolicyInhibit: 1,
   initialExcludedSubtrees: 1, initialExplicitPolicy: 1, initialPermittedSubtrees: 1,
   initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1,
   requiredEku: 1, revocationChecker: 1, softFail: 1, time: 1, trustAnchors: 1,
   userInitialPolicySet: 1, verifier: 1
-};
+});
 
 var OID_SCT_LIST = oid.byName("signedCertificateTimestampList");
 async function ctGateCheck(leaf, certs, anchor, ctLogList, ctPolicy, n, at) {
@@ -1015,7 +1015,7 @@ async function validate(path, opts) {
     var exclRawOnce = opts.initialExcludedSubtrees;
     var singleOpts = function (a) {
       var keys = intrinsic.ownKeys(opts);
-      var o = {};
+      var o = intrinsic.create(null);
       for (var ki = 0; ki < keys.length; ki++) { o[keys[ki]] = opts[keys[ki]]; }
       o.trustAnchors = a;
       if (permRawOnce != null) o.initialPermittedSubtrees = callerPermitted;
@@ -1248,12 +1248,12 @@ function userConstrainedPolicies(state, n) {
   var uips = state.userInitialPolicySet;
   var anyUser = contains(uips, OID.anyPolicy);
   var leaves = leavesAt(state.validPolicyTree, n);
-  var explicit = {}, hasAnyLeaf = false;
+  var explicit = intrinsic.create(null), hasAnyLeaf = false;
   leaves.forEach(function (node) {
     if (node.validPolicy === OID.anyPolicy) hasAnyLeaf = true;
     else explicit[node.validPolicy] = true;
   });
-  var set = {};
+  var set = intrinsic.create(null);
   Object.keys(explicit).forEach(function (p) { if (anyUser || contains(uips, p)) set[p] = true; });
   if (hasAnyLeaf) {
     if (anyUser) set[OID.anyPolicy] = true;
@@ -1941,7 +1941,7 @@ function resolvePurposeOpts(opts) {
 }
 
 function _snapshotConstraintMap(m, E, code, who) {
-  var out = {};
+  var out = intrinsic.create(null);
   var proto = intrinsic.getPrototypeOf(m);
   if (proto !== null && proto !== intrinsic.ObjectProto) throw E(code, who + ": a trustAnchor constraint map must be a plain object (its own entries only), not one with a custom or cross-realm prototype");
   var keys = intrinsic.getOwnPropertyNames(m);
@@ -2468,7 +2468,9 @@ function _aiaParseBody(body, contentType, maxCerts) {
 }
 
 async function _aiaFetchOne(uri, aia) {
-  var res = await aia.transport({ method: "GET", url: uri, tls: aia.tls, timeout: aia.timeout, maxResponseBytes: aia.maxResponseBytes, blockPrivateAddresses: true });
+  var res = await guard.async.invoked(aia.transport,
+    [{ method: "GET", url: uri, tls: aia.tls, timeout: aia.timeout, maxResponseBytes: aia.maxResponseBytes, blockPrivateAddresses: true }],
+    E, "path/bad-input", "opts.transport");
   res = res || {};
   if (res.status !== 200) throw E("path/aia-status", "an AIA fetch returned HTTP " + res.status + " (only 200 is a cert source; no redirect following)");
   var body = guard.bytes.isByteSource(res.body)
@@ -2476,7 +2478,7 @@ async function _aiaFetchOne(uri, aia) {
     : Buffer.from(res.body == null ? "" : String(res.body), "latin1");
   if (body.length === 0) throw E("path/aia-empty", "an AIA fetch returned an empty body");
   if (body.length > aia.maxResponseBytes) throw E("path/aia-too-large", "an AIA response exceeds the " + aia.maxResponseBytes + "-byte cap");
-  var headers = {};
+  var headers = intrinsic.create(null);
   Object.keys(res.headers || {}).forEach(function (k) { headers[k.toLowerCase()] = res.headers[k]; });
   return _aiaParseBody(body, headers["content-type"], aia.maxCertsPerResponse);
 }
@@ -2509,6 +2511,11 @@ async function _fetchAiaIssuers(current, aia) {
     intrinsic.setAdd(aia.fetchedUrls, uris[k]);
     aia.fetches += 1;
     var certs;
+    /** @internal Every failure of a fetch is skipped and the next URL tried, because AIA is a
+     * best-effort source of issuers and one unreachable host must not fail a build that another URL
+     * can complete. A transport that throws where a rejecting one would only reject is the same
+     * failure reported a different way, so the two are treated alike rather than one of them ending
+     * the build. */
     try { certs = await _aiaFetchOne(uris[k], aia); }
     catch (_e2) { continue; }
     for (var c = 0; c < certs.length; c++) {
@@ -2591,11 +2598,11 @@ async function _fetchAiaIssuers(current, aia) {
  *   result.valid;                  // true when a path to a trust anchor was found and validated
  */
 var _BUILD_OPTS = (function () {
-  var o = {
+  var o = intrinsic.assign(intrinsic.create(null), {
     aiaTimeout: 1, candidates: 1, direction: 1, fetchAia: 1, intermediates: 1, maxAiaFetches: 1,
     maxAiaPerCert: 1, maxCandidatesConsidered: 1, maxDepth: 1, maxPathCerts: 1,
     maxResponseBytes: 1, time: 1, tls: 1, transport: 1, trustAnchors: 1, validate: 1
-  };
+  });
   Object.keys(_VALIDATE_OPTS).forEach(function (k) { o[k] = 1; });
   return o;
 })();
@@ -2604,6 +2611,12 @@ async function build(leaf, opts) {
   opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "build: opts");
   guard.identifier.assertKnownKeys(opts, _BUILD_OPTS, E, "path/bad-input",
     "pki.path.build has an unknown option (the anchor option is `trustAnchors`). The unknown option was: ");
+  /** @internal Checked at the door, before any certificate is parsed, and whether or not AIA
+   * fetching is on: supplying a transport that cannot be called is a wiring fault at the moment it
+   * is written. The checked value is the one used below, since reading the option again would ask a
+   * second time and an accessor can answer differently on each read. */
+  var checkedTransport = guard.identifier.assertCallableOption(opts, "transport", E, "path/bad-input",
+    "build: opts.transport", "(request) -> Promise<{ status, headers, body }>");
   var leafCert;
   try { leafCert = coerceCert(leaf); }
   catch (e) { throw E("path/bad-input", "build: the leaf certificate did not parse", e); }
@@ -2652,13 +2665,10 @@ async function build(leaf, opts) {
 
   var aiaCtx = null;
   if (opts.fetchAia === true) {
-    if (opts.transport !== undefined && typeof opts.transport !== "function") {
-      throw E("path/bad-input", "build: opts.transport must be a transport function (request) -> Promise<{ status, headers, body }>");
-    }
     if (opts.aiaTimeout !== undefined) {
       guard.limits.cap(opts.aiaTimeout, "build: opts.aiaTimeout", 1, { E: E, code: "path/bad-input", min: 1, max: httpTransport.MAX_TIMEOUT });
     }
-    var aiaTransport = opts.transport || httpTransport.https({ E: E, errPrefix: "path" });
+    var aiaTransport = checkedTransport || httpTransport.https({ E: E, errPrefix: "path" });
     aiaCtx = {
       transport: aiaTransport,
       transportGuardsAddresses: aiaTransport.blocksPrivateAddresses === true,

package/lib/pbes2.js

@@ -14,9 +14,9 @@ var b = asn1.build;
 function O(n) { return oid.byName(n); }
 
 var PRF_NODE_BY_NAME = Object.assign(Object.create(null), { hmacWithSHA1: "sha1", hmacWithSHA256: "sha256", hmacWithSHA384: "sha384", hmacWithSHA512: "sha512" });
-var PRF_NODE_BY_OID = {}; Object.keys(PRF_NODE_BY_NAME).forEach(function (n) { PRF_NODE_BY_OID[O(n)] = PRF_NODE_BY_NAME[n]; });
+var PRF_NODE_BY_OID = Object.create(null); Object.keys(PRF_NODE_BY_NAME).forEach(function (n) { PRF_NODE_BY_OID[O(n)] = PRF_NODE_BY_NAME[n]; });
 
-var CONTENT_KEYBITS = {}, CONTENT_MODE = {};
+var CONTENT_KEYBITS = Object.create(null), CONTENT_MODE = Object.create(null);
 [["aes128-CBC", 128, "cbc"], ["aes192-CBC", 192, "cbc"], ["aes256-CBC", 256, "cbc"],
   ["aes128-GCM", 128, "gcm"], ["aes192-GCM", 192, "gcm"], ["aes256-GCM", 256, "gcm"]].forEach(function (r) {
   CONTENT_KEYBITS[O(r[0])] = r[1];

package/lib/pkcs12-build.js

@@ -69,14 +69,14 @@ var DIGEST_NAME = intrinsic.assign(intrinsic.create(null), { sha1: "sha1", sha25
 var _MISSING_PASSWORD = "a password must be a string, Buffer, or Uint8Array -- an omitted password " +
   "is not the empty password; pass \"\" to use the empty one deliberately";
 
-var _INTEGRITY_OPTS = { mode: 1, signer: 1, signers: 1, certificates: 1, sid: 1, signingTime: 1 };
-var _BUILD_SPEC_FULL_KEYS = { safeContents: 1 };
-var _BUILD_SPEC_SHORTHAND_KEYS = { key: 1, cert: 1, ca: 1, friendlyName: 1, localKeyId: 1 };
-var _BUILD_OPTS_FULL = { integrity: 1, mac: 1, password: 1, pem: 1 };
-var _BUILD_OPTS_SHORTHAND = { integrity: 1, mac: 1, password: 1, pem: 1, recipientCerts: 1 };
-var _SAFE_RECIPIENTS_KEYS = { bags: 1, recipients: 1, contentEncryptionAlgorithm: 1 };
-var _SAFE_PASSWORD_KEYS = { bags: 1, encrypt: 1 };
-var _SAFE_PLAINTEXT_KEYS = { bags: 1 };
+var _INTEGRITY_OPTS = intrinsic.assign(intrinsic.create(null), { mode: 1, signer: 1, signers: 1, certificates: 1, sid: 1, signingTime: 1 });
+var _BUILD_SPEC_FULL_KEYS = intrinsic.assign(intrinsic.create(null), { safeContents: 1 });
+var _BUILD_SPEC_SHORTHAND_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1, ca: 1, friendlyName: 1, localKeyId: 1 });
+var _BUILD_OPTS_FULL = intrinsic.assign(intrinsic.create(null), { integrity: 1, mac: 1, password: 1, pem: 1 });
+var _BUILD_OPTS_SHORTHAND = intrinsic.assign(intrinsic.create(null), { integrity: 1, mac: 1, password: 1, pem: 1, recipientCerts: 1 });
+var _SAFE_RECIPIENTS_KEYS = intrinsic.assign(intrinsic.create(null), { bags: 1, recipients: 1, contentEncryptionAlgorithm: 1 });
+var _SAFE_PASSWORD_KEYS = intrinsic.assign(intrinsic.create(null), { bags: 1, encrypt: 1 });
+var _SAFE_PLAINTEXT_KEYS = intrinsic.assign(intrinsic.create(null), { bags: 1 });
 var _BAG_KEYS_BY_TYPE = intrinsic.assign(intrinsic.create(null), {
   key:          { type: 1, friendlyName: 1, localKeyId: 1, key: 1 },
   shroudedKey:  { type: 1, friendlyName: 1, localKeyId: 1, key: 1, encrypt: 1 },
@@ -85,15 +85,15 @@ var _BAG_KEYS_BY_TYPE = intrinsic.assign(intrinsic.create(null), {
   secret:       { type: 1, friendlyName: 1, localKeyId: 1, secretTypeId: 1, secretValue: 1 },
   safeContents: { type: 1, friendlyName: 1, localKeyId: 1, nested: 1 },
 });
-var _ENCRYPT_KEYS = { password: 1, cipher: 1, salt: 1, iterations: 1, prf: 1 };
-var _MAC_KEYS = { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 };
-var _MAC_KEYS_HMAC = { algorithm: 1, hash: 1, salt: 1, iterations: 1, password: 1 };
-var _MAC_KEYS_PBMAC1 = { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 };
-var _OPEN_OPTS = {
+var _ENCRYPT_KEYS = intrinsic.assign(intrinsic.create(null), { password: 1, cipher: 1, salt: 1, iterations: 1, prf: 1 });
+var _MAC_KEYS = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 });
+var _MAC_KEYS_HMAC = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, password: 1 });
+var _MAC_KEYS_PBMAC1 = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 });
+var _OPEN_OPTS = intrinsic.assign(intrinsic.create(null), {
   allowUnauthenticated: 1, importAlgorithm: 1, keys: 1, maxIterations: 1, signerCerts: 1,
   recipientKey: 1, recipientCert: 1, recipientIndex: 1,
-};
-var _VERIFY_MAC_OPTS = { maxIterations: 1 };
+});
+var _VERIFY_MAC_OPTS = intrinsic.assign(intrinsic.create(null), { maxIterations: 1 });
 
 function _p12PasswordOwned(pw) {
   if (Buffer.isBuffer(pw)) return { bytes: guard.bytes.view(pw, Pkcs12Error, "pkcs12/bad-input", "the password"), owned: false };

package/lib/pki-build.js

@@ -421,7 +421,7 @@ function makeBuilder(ctx) {
   function extSan(entries) { return encodeGeneralNames(entries); }
   function extCertPolicies(names) {
     if (!_isArray(names) || !names.length) throw E("bad-input", "certificatePolicies must list at least one policy OID");
-    var seen = {};
+    var seen = intrinsic.create(null);
     return b.sequence(names.map(function (n) {
       var pOid = _resolveOid(n, "certificate policy");
       if (seen[pOid]) throw E("bad-input", "duplicate certificate policy " + guard.text.showValue(n) + " (RFC 5280 sec. 4.2.1.4)");
@@ -491,7 +491,7 @@ function makeBuilder(ctx) {
     var EXT_DECODERS = ctx.EXT_DECODERS;
     if (_isArray(extSpec)) {
       if (!extSpec.length) throw E("bad-input", "the requested extensions list must carry at least one extension");
-      var seen = {};
+      var seen = intrinsic.create(null);
       return b.sequence(extSpec.map(function (e, i) {
         var der = reqDer(e, "extension");
         assertValidExtension(der, i);

package/lib/scep.js

@@ -308,8 +308,8 @@ async function build(spec) {
     throw e;
   }
 }
-var _REQUEST_KEYS = { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, certificate: 1, serialNumber: 1, signer: 1, transactionId: 1, senderNonce: 1 };
-var _CERTREP_KEYS = { messageType: 1, signer: 1, transactionId: 1, senderNonce: 1, pkiStatus: 1, recipientNonce: 1, certificates: 1, crls: 1, recipient: 1, failInfo: 1, failInfoText: 1 };
+var _REQUEST_KEYS = Object.assign(Object.create(null), { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, certificate: 1, serialNumber: 1, signer: 1, transactionId: 1, senderNonce: 1 });
+var _CERTREP_KEYS = Object.assign(Object.create(null), { messageType: 1, signer: 1, transactionId: 1, senderNonce: 1, pkiStatus: 1, recipientNonce: 1, certificates: 1, crls: 1, recipient: 1, failInfo: 1, failInfoText: 1 });
 
 async function _buildCertRep(spec) {
   if (spec.signer == null || typeof spec.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
@@ -602,7 +602,7 @@ async function parse(bytes, opts) {
   }
   return out;
 }
-var _PARSE_KEYS = { recipientKey: 1, expectedSenderNonce: 1, signerCert: 1 };
+var _PARSE_KEYS = Object.assign(Object.create(null), { recipientKey: 1, expectedSenderNonce: 1, signerCert: 1 });
 
 var DEFAULT_TIMEOUT = C.TIME.seconds(30);
 var MAX_TIMEOUT = C.TIME.seconds(600);
@@ -700,7 +700,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
     var req = { method: curMethod, url: current.href, headers: headers, tls: _hopTls(current), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes };
     if (proxySnap != null) req.proxy = proxySnap;
     if (curBody != null) req.body = curBody;
-    return guard.async.awaited(transport(req), _err, "scep/bad-input", "opts.transport").then(function (res) {
+    return guard.async.invoked(transport, [req], _err, "scep/bad-input", "opts.transport").then(function (res) {
       res = res || {};
       var blen = _responseLen(res.body);
       if (blen > budgets.maxResponseBytes) throw _err("scep/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");
@@ -718,8 +718,21 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   return step(url);
 }
 function _snapshotProxy(p) { return httpTransport.snapshotProxy(p); }
-function _client(method, url, body, headers, opts) {
-  var transport = opts.transport || httpTransport.https({ E: _err, errPrefix: "scep" });
+
+/** @internal Refused at every network verb's door and again where the value is used. The checked
+ * value is RETURNED and it is that one the caller uses: reading the option again would ask a second
+ * time, and an accessor can answer differently on each read. */
+function _assertTransport(opts) {
+  return guard.identifier.assertCallableOption(opts, "transport", _err, "scep/bad-input", "opts.transport",
+    "(request) => Promise<{ status, headers, body }>");
+}
+
+/** @internal `checked` is the transport the verb already took at its door. Taking it again here
+ * would ask the caller's options a second time, and anything read in between could change the
+ * answer, so a verb that holds one passes it and this reads the option only when none was held. */
+function _client(method, url, body, headers, opts, checked) {
+  var resolved = checked !== undefined ? checked : _assertTransport(opts);
+  var transport = resolved || httpTransport.https({ E: _err, errPrefix: "scep" });
   var budgets = {
     timeout: guard.limits.cap(opts.timeout, "timeout", DEFAULT_TIMEOUT, { E: _err, code: "scep/bad-input", min: 1, max: MAX_TIMEOUT }),
     maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.HTTP_MAX_RESPONSE_BYTES, { E: _err, code: "scep/bad-input", min: 1, max: C.LIMITS.HTTP_MAX_RESPONSE_BYTES }),
@@ -740,8 +753,8 @@ function _requireOk(res, expected, what) {
   return _bodyBuf(res.body);
 }
 
-var CAP_CANON = { AES: "AES", DES3: "DES3", GETNEXTCACERT: "GetNextCACert", POSTPKIOPERATION: "POSTPKIOperation",
-  RENEWAL: "Renewal", "SHA-1": "SHA-1", "SHA-256": "SHA-256", "SHA-512": "SHA-512", SCEPSTANDARD: "SCEPStandard" };
+var CAP_CANON = Object.assign(Object.create(null), { AES: "AES", DES3: "DES3", GETNEXTCACERT: "GetNextCACert", POSTPKIOPERATION: "POSTPKIOperation",
+  RENEWAL: "Renewal", "SHA-1": "SHA-1", "SHA-256": "SHA-256", "SHA-512": "SHA-512", SCEPSTANDARD: "SCEPStandard" });
 function _splitLines(s) {
   var out = [], start = 0, i, n = s.length;
   for (i = 0; i < n; i++) if (s.charCodeAt(i) === 0x0a) { out.push(s.slice(start, i)); start = i + 1; }
@@ -770,7 +783,7 @@ function _splitLines(s) {
  */
 function parseCapabilities(text) {
   var raw = Buffer.isBuffer(text) ? text.toString("latin1") : String(text == null ? "" : text);
-  var set = {}, lines = _splitLines(raw), i;
+  var set = Object.create(null), lines = _splitLines(raw), i;
   for (i = 0; i < lines.length; i++) {
     var kw = _foldUpper(_trim(lines[i]));
     if (kw !== "" && CAP_CANON[kw]) set[CAP_CANON[kw]] = true;
@@ -810,14 +823,21 @@ function _assertStrongProfile(caps, profile) {
 async function getCACaps(baseUrl, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getCACaps options");
   guard.identifier.assertKnownKeys(opts, _CACAPS_KEYS, _err, "scep/bad-input", "pki.scep.getCACaps has an unknown option: ");
+  var checkedTransport = _assertTransport(opts);
   var profile = { expectSCEPStandard: !!opts.expectSCEPStandard, requireStrongProfile: !!opts.requireStrongProfile };
-  var res = await _client("GET", _scepUrl(baseUrl, "GetCACaps"), null, {}, opts);
+  var res = await _client("GET", _scepUrl(baseUrl, "GetCACaps"), null, {}, opts, checkedTransport);
   if (res.status === 200) {
     var caps = parseCapabilities(_requireOk(res, [CT_PLAIN], "GetCACaps"));
     _assertStrongProfile(caps, profile);
     return caps;
   }
-  if (res.status === 204 || res.status === 400 || res.status === 404 || res.status === 405 || res.status === 501) { _assertStrongProfile({}, profile); return {}; }
+  /** @internal Built the way parseCapabilities builds one, so a CA that advertises nothing yields a
+   * capabilities map of the same shape as one that advertises something. */
+  if (res.status === 204 || res.status === 400 || res.status === 404 || res.status === 405 || res.status === 501) {
+    var none = Object.create(null);
+    _assertStrongProfile(none, profile);
+    return none;
+  }
   throw _err("scep/http-error", "the SCEP GetCACaps returned HTTP " + res.status);
 }
 
@@ -882,8 +902,9 @@ function _normalizeFingerprint(fp, algName) {
 async function getCACert(baseUrl, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getCACert options");
   guard.identifier.assertKnownKeys(opts, _CACERT_KEYS, _err, "scep/bad-input", "pki.scep.getCACert has an unknown option: ");
+  var checkedTransport = _assertTransport(opts);
   var fp = opts.expectedFingerprint != null ? _normalizeFingerprint(opts.expectedFingerprint, opts.fingerprintAlgorithm) : null;
-  var res = await _client("GET", _scepUrl(baseUrl, "GetCACert"), null, {}, opts);
+  var res = await _client("GET", _scepUrl(baseUrl, "GetCACert"), null, {}, opts, checkedTransport);
   var body = _requireOk(res, [CT_CA_CERT, CT_CA_RA_CERT], "GetCACert");
   var ct = _mediaType(_header(res.headers, "content-type")), certs, single = false;
   if (ct === CT_CA_CERT) {
@@ -937,11 +958,12 @@ async function getCACert(baseUrl, opts) {
 async function getNextCACert(baseUrl, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getNextCACert options");
   guard.identifier.assertKnownKeys(opts, _NEXTCACERT_KEYS, _err, "scep/bad-input", "pki.scep.getNextCACert has an unknown option: ");
+  var checkedTransport = _assertTransport(opts);
   if (opts.caCertificate == null) throw _err("scep/bad-input", "a caCertificate (the current SCEP CA certificate DER) is required to authenticate the GetNextCACert response (RFC 8894 sec. 4.7.1)");
   var currentCa = guard.bytes.snapshotSource(opts.caCertificate, ScepError, "scep/bad-input", "the caCertificate");
   _assertSigningKeyUsage(currentCa, "the caCertificate");
   var url = _scepUrl(baseUrl, "GetNextCACert");
-  var res = await _client("GET", url, null, {}, opts);
+  var res = await _client("GET", url, null, {}, opts, checkedTransport);
   var body = _requireOk(res, [CT_NEXT_CA_CERT], "GetNextCACert");
   var v;
   try { v = await cmsVerify.verify(body, { certs: [currentCa] }); }
@@ -1019,6 +1041,10 @@ async function _pollForIssuance(ctx) {
 async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep." + verbName + " options");
   guard.identifier.assertKnownKeys(opts, _ENROLL_KEYS, _err, "scep/bad-input", "pki.scep." + verbName + " has an unknown option: ");
+  /** @internal Held from the door and forwarded below. The options this verb reads on the way there
+   * are the caller's, and reading the transport again afterwards would let one of them change what
+   * comes back, so the value that was checked is the value that is used. */
+  var checkedTransport = _assertTransport(opts);
   if (opts.csr == null) throw _err("scep/bad-input", "a csr (PKCS#10 DER) is required");
   if (opts.caCert == null) throw _err("scep/bad-input", "a caCert (the SCEP CA certificate DER) is required");
   if (opts.signer == null || typeof opts.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
@@ -1029,7 +1055,6 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var clientOpts = {
-    transport: opts.transport,
     tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls,
     maxRedirects: opts.maxRedirects,
     allowCrossOriginRedirect: opts.allowCrossOriginRedirect,
@@ -1037,6 +1062,9 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
     maxResponseBytes: opts.maxResponseBytes,
     proxy: _snapshotProxy(opts.proxy),
   };
+  /** @internal The value held from the door, carried only when the caller supplied one, so an
+   * omitted transport does not arrive downstream as a key that is present and undefined. */
+  if (checkedTransport !== undefined) clientOpts.transport = checkedTransport;
   var postUrl = _scepUrl(baseUrl, "PKIOperation");
   var httpMethod = _pkiMethod(opts);
   var csrView = guard.bytes.snapshotSource(opts.csr, ScepError, "scep/bad-input", "the csr");
@@ -1168,6 +1196,8 @@ function _resolveQueryTarget(opts) {
 async function _queryOperation(messageType, baseUrl, opts, verbName) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep." + verbName + " options");
   guard.identifier.assertKnownKeys(opts, _QUERY_KEYS, _err, "scep/bad-input", "pki.scep." + verbName + " has an unknown option: ");
+  /** @internal Held from the door and forwarded below, so a later read cannot answer differently. */
+  var checkedTransport = _assertTransport(opts);
   if (opts.caCert == null) throw _err("scep/bad-input", "a caCert (the SCEP CA certificate DER) is required");
   if (opts.signer == null || typeof opts.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
   if (opts.recipientKey == null || typeof opts.recipientKey !== "object") throw _err("scep/bad-input", "a recipientKey { cert, key } is required to decrypt the CA response");
@@ -1176,7 +1206,8 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var want = _resolveQueryTarget(opts);
-  var clientOpts = { transport: opts.transport, tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
+  var clientOpts = { tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
+  if (checkedTransport !== undefined) clientOpts.transport = checkedTransport;
   var senderNonce = nodeCrypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
   var httpMethod = _pkiMethod(opts);
@@ -1287,7 +1318,7 @@ async function getCrl(baseUrl, opts) {
   return { crl: match, crls: crls, transactionId: q.transactionId };
 }
 
-var _TRANSPORT_KEYS = { transport: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, tls: 1, allowCrossOriginRedirect: 1, proxy: 1 };
+var _TRANSPORT_KEYS = Object.assign(Object.create(null), { transport: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, tls: 1, allowCrossOriginRedirect: 1, proxy: 1 });
 function _withKeys(extra) { var o = {}, k; for (k in _TRANSPORT_KEYS) o[k] = 1; for (k in extra) o[k] = 1; return o; }
 var _CACAPS_KEYS = _withKeys({ expectSCEPStandard: 1, requireStrongProfile: 1 });
 var _CACERT_KEYS = _withKeys({ expectedFingerprint: 1, fingerprintAlgorithm: 1 });

package/lib/schema-all.js

@@ -53,7 +53,7 @@ var frameworkError = require("./framework-error");
 var SchemaError = frameworkError.SchemaError;
 var PemError = frameworkError.PemError;
 
-var ENTRY = { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input", ber: true };
+var ENTRY = Object.assign(Object.create(null), { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input", ber: true });
 
 var FORMATS = [
   {

package/lib/schema-attrcert.js

@@ -280,7 +280,7 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
  *   ac.attributes[0].name;   // "role"
  *   ac.validity.notAfterTime;// Date
  */
-var PARSE_OPTS = { pemLabel: "ATTRIBUTE CERTIFICATE", PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" };
+var PARSE_OPTS = intrinsic.assign(intrinsic.create(null), { pemLabel: "ATTRIBUTE CERTIFICATE", PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" });
 
 function _legacyV1Error() {
   return new AttrCertError("attrcert/legacy-v1-not-supported", "AttributeCertificateV1 (X.509-1997) is obsolete and not parsed by this build (RFC 5755 sec. 1)");
@@ -448,6 +448,7 @@ function _decodeClassList(node, C) {
   var bs;
   try { bs = asn1.read.bitString(node); } catch (e) { throw NS.E(C, "Clearance classList must be a BIT STRING", e); }
   schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw NS.E(C, m); });
+  // allow:registry-table-inherits-object-prototype -- the classList record an operator reads by field name, whose keys are the fixed _CLASSLIST_NAMES; the omitted-classList default at the foot of this file builds the same shape
   var names = [], flags = {}, reserved = [];
   var total = bs.bytes.length * 8 - bs.unusedBits;
   for (var bit = 0; bit < total; bit++) {
@@ -490,7 +491,7 @@ function _clearance(buf) {
   return { policyId: policyId, classList: classList, securityCategories: securityCategories };
 }
 
-var _ATTR_VALUE_DECODERS = {};
+var _ATTR_VALUE_DECODERS = intrinsic.create(null);
 _ATTR_VALUE_DECODERS[_Oav("role")] = _role;
 _ATTR_VALUE_DECODERS[_Oav("clearance")] = _clearance;
 _ATTR_VALUE_DECODERS[oid.fromArcs([2, 5, 1, 5, 55])] = _clearance;
@@ -570,7 +571,7 @@ function _aaControls(buf) {
   return out;
 }
 
-var _AC_EXT_DECODERS = {};
+var _AC_EXT_DECODERS = intrinsic.create(null);
 _AC_EXT_DECODERS[_Oav("acAuditIdentity")] = _acAuditIdentity;
 _AC_EXT_DECODERS[_Oav("targetInformation")] = _targetInformation;
 _AC_EXT_DECODERS[_Oav("noRevAvail")] = _noRevAvail;

package/lib/schema-c509.js

@@ -51,17 +51,17 @@ var NO_EXPIRY_SECONDS = 253402300799n;
 
 function _name(n) { var d = oid.byName(n); if (!d) { throw new Error("schema-c509: unregistered OID name " + JSON.stringify(n)); } return n; }
 
-var SIG_ALG_BY_INT = {
+var SIG_ALG_BY_INT = Object.assign(Object.create(null), {
   0: _name("ecdsaWithSHA256"),
   1: _name("ecdsaWithSHA384"),
   2: _name("ecdsaWithSHA512"),
-};
-var PK_ALG_BY_INT = {
+});
+var PK_ALG_BY_INT = Object.assign(Object.create(null), {
   0: { alg: _name("rsaEncryption") },
   1: { alg: _name("ecPublicKey"), curve: _name("prime256v1") },
   2: { alg: _name("ecPublicKey"), curve: _name("secp384r1") },
   3: { alg: _name("ecPublicKey"), curve: _name("secp521r1") },
-};
+});
 var EC_FIELD_BYTES = Object.assign(Object.create(null), { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 });
 /** @internal Curve identity follows the dotted OID; pki.oid.register can rename one at any time. */
 var EC_CURVE_BY_OID = Object.create(null);
@@ -69,7 +69,7 @@ Object.keys(EC_FIELD_BYTES).forEach(function (n) { EC_CURVE_BY_OID[oid.byName(n)
 var SIG_ALG_BY_OID = Object.create(null);
 Object.keys(SIG_ALG_BY_INT).forEach(function (k) { SIG_ALG_BY_OID[oid.byName(SIG_ALG_BY_INT[k])] = SIG_ALG_BY_INT[k]; });
 
-var ATTR_BY_INT = {
+var ATTR_BY_INT = Object.assign(Object.create(null), {
   0: _name("emailAddress"),
   1: _name("commonName"),
   2: _name("surname"),
@@ -81,8 +81,8 @@ var ATTR_BY_INT = {
   8: _name("organizationName"),
   9: _name("organizationalUnitName"),
   10: _name("title"),
-};
-var EXT_BY_INT = {
+});
+var EXT_BY_INT = Object.assign(Object.create(null), {
   1: _name("subjectKeyIdentifier"),
   2: _name("keyUsage"),
   3: _name("subjectAltName"),
@@ -106,7 +106,7 @@ var EXT_BY_INT = {
   35: _name("autonomousSysIdsV2"),
   36: _name("ocspNoCheck"),
   38: _name("tlsFeature"),
-};
+});
 var EXT_COMPACT = Object.assign(Object.create(null), {
   subjectKeyIdentifier: 1, keyUsage: 1, basicConstraints: 1, authorityKeyIdentifier: 1,
   extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
@@ -115,31 +115,31 @@ var EXT_COMPACT = Object.assign(Object.create(null), {
   policyMappings: 1, policyConstraints: 1, subjectDirectoryAttributes: 1,
   ipAddrBlocks: 1, autonomousSysIds: 1, ipAddrBlocksV2: 1, autonomousSysIdsV2: 1,
 });
-var EKU_BY_INT = {
+var EKU_BY_INT = Object.assign(Object.create(null), {
   0: _name("anyExtendedKeyUsage"), 1: _name("serverAuth"), 2: _name("clientAuth"),
   3: _name("codeSigning"), 4: _name("emailProtection"), 8: _name("timeStamping"), 9: _name("ocspSigning"),
   10: _name("pkinitClientAuth"), 11: _name("pkinitKdc"), 12: _name("secureShellClient"), 13: _name("secureShellServer"),
   14: _name("bundleSecurity"), 15: _name("cmcCA"), 16: _name("cmcRA"), 17: _name("cmcArchive"), 18: _name("cmKGA"),
   20: _name("fanDevice"),
-};
-var EKU_TO_INT = {};
+});
+var EKU_TO_INT = Object.create(null);
 Object.keys(EKU_BY_INT).forEach(function (k) { EKU_TO_INT[oid.byName(EKU_BY_INT[k])] = Number(k); });
 
 var NS = pkix.makeNS("c509", C509Error, oid);
 var GN_LEAF = pkix.generalName(NS, { decodeValue: true });
 var GN_LEAF_SUBTREE = pkix.generalName(NS, { decodeValue: true, subtreeBase: true });
 
-var ON_NAME_BY_INT = { "-1": _name("hardwareModuleName"), "-2": _name("smtpUtf8Mailbox"), "-3": _name("macAddress") };
-var ON_INT_BY_OID = {};
+var ON_NAME_BY_INT = Object.assign(Object.create(null), { "-1": _name("hardwareModuleName"), "-2": _name("smtpUtf8Mailbox"), "-3": _name("macAddress") });
+var ON_INT_BY_OID = Object.create(null);
 Object.keys(ON_NAME_BY_INT).forEach(function (k) { ON_INT_BY_OID[oid.byName(ON_NAME_BY_INT[k])] = Number(k); });
-var IA_BY_INT = {
+var IA_BY_INT = Object.assign(Object.create(null), {
   1: _name("ocsp"), 2: _name("caIssuers"), 3: _name("id-ad-timeStamping"), 5: _name("id-ad-caRepository"),
   10: _name("id-ad-rpkiManifest"), 11: _name("id-ad-signedObject"), 13: _name("id-ad-rpkiNotify"),
-};
-var IA_TO_INT = {};
+});
+var IA_TO_INT = Object.create(null);
 Object.keys(IA_BY_INT).forEach(function (k) { IA_TO_INT[oid.byName(IA_BY_INT[k])] = Number(k); });
 
-var CP_BY_INT = {
+var CP_BY_INT = Object.assign(Object.create(null), {
   0: _name("anyPolicy"), 1: _name("domain-validated"), 2: _name("organization-validated"),
   3: _name("individual-validated"), 4: _name("ev-guidelines"),
   7: _name("id-cp-ipAddr-asNumber"), 8: _name("id-cp-ipAddr-asNumber-v2"),
@@ -150,11 +150,11 @@ var CP_BY_INT = {
   33: _name("id-rspRole-dp-pb-v2"), 34: _name("id-rspRole-dp-pb"),
   35: _name("id-rspRole-ds-tls-v2"), 36: _name("id-rspRole-ds-tls"),
   37: _name("id-rspRole-ds-auth-v2"), 38: _name("id-rspRole-ds-auth"),
-};
-var CP_TO_INT = {};
+});
+var CP_TO_INT = Object.create(null);
 Object.keys(CP_BY_INT).forEach(function (k) { CP_TO_INT[oid.byName(CP_BY_INT[k])] = Number(k); });
-var PQ_BY_INT = { 1: _name("cps"), 2: _name("unotice") };
-var PQ_TO_INT = {};
+var PQ_BY_INT = Object.assign(Object.create(null), { 1: _name("cps"), 2: _name("unotice") });
+var PQ_TO_INT = Object.create(null);
 Object.keys(PQ_BY_INT).forEach(function (k) { PQ_TO_INT[oid.byName(PQ_BY_INT[k])] = Number(k); });
 
 
@@ -543,7 +543,7 @@ function _ipIntToSeq(n) {
   out[0] -= 1;
   return Buffer.from(out);
 }
-var _IP_WIDTH = { 1: 4, 2: 16 };
+var _IP_WIDTH = Object.assign(Object.create(null), { 1: 4, 2: 16 });
 
 function _ipLow(seq, width) {
   var v = Buffer.alloc(width);
@@ -1013,7 +1013,7 @@ function _extValueToDer(name, node, isNative) {
       if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a certificatePolicies value must be a CBOR array");
       var cpKids = node.children;
       if (cpKids.length === 0 || cpKids.length % 2 !== 0) throw _err("c509/bad-extensions", "a certificatePolicies array must be non-empty (policyIdentifier, qualifiers) pairs (sec. 3.3)");
-      var polInfos = [], seenPolicy = {};
+      var polInfos = [], seenPolicy = Object.create(null);
       for (var cpi = 0; cpi + 1 < cpKids.length; cpi += 2) {
         var quals = cpKids[cpi + 1];
         if (quals.majorType !== 4 || !quals.children) throw _err("c509/bad-extensions", "a certificatePolicies qualifiers slot must be a CBOR array");

package/lib/schema-cmc.js

@@ -62,21 +62,21 @@ var OID_RA_IDENTITY_WITNESS = O("id-cmc-raIdentityWitness");
 
 var BODY_PART_MAX = 4294967295n;
 
-var STATUS_BY_VALUE = {
+var STATUS_BY_VALUE = Object.assign(Object.create(null), {
   0: "success", 2: "failed", 3: "pending", 4: "noSupport",
   5: "confirmRequired", 6: "popRequired", 7: "partial",
-};
+});
 
-var FAIL_INFO_BY_VALUE = {
+var FAIL_INFO_BY_VALUE = Object.assign(Object.create(null), {
   0: "badAlg", 1: "badMessageCheck", 2: "badRequest", 3: "badTime", 4: "badCertId",
   5: "unsupportedExt", 6: "mustArchiveKeys", 7: "badIdentity", 8: "popRequired",
   9: "popFailed", 10: "noKeyReuse", 11: "internalCAError", 12: "tryLater",
   13: "authDataFail",
-};
+});
 
-var CMC_CARRIERS = { signedData: 1, authData: 1 };
+var CMC_CARRIERS = Object.assign(Object.create(null), { signedData: 1, authData: 1 });
 
-var CONTROL_PLACEMENT = {};
+var CONTROL_PLACEMENT = Object.create(null);
 CONTROL_PLACEMENT[OID_RESPONSE_BODY] = "pkiResponse";
 CONTROL_PLACEMENT[OID_RA_IDENTITY_WITNESS] = "pkiData";