@blamejs/pki 0.6.40 → 0.6.41

package/lib/schema-cmp.js

@@ -462,15 +462,15 @@ var POLL_REP_CONTENT = schema.seqOf(POLL_REP_ENTRY, {
 var BODY_ARMS = ["ir", "ip", "cr", "cp", "p10cr", "popdecc", "popdecr", "kur", "kup",
   "krr", "krp", "rr", "rp", "ccr", "ccp", "ckuann", "cann", "rann", "crlann",
   "pkiconf", "nested", "genm", "genp", "error", "certConf", "pollReq", "pollRep"];
-var CRMF_ARMS = { 0: true, 2: true, 7: true, 9: true, 13: true };
-var DECODED_ARMS = {
+var CRMF_ARMS = Object.assign(Object.create(null), { 0: true, 2: true, 7: true, 9: true, 13: true });
+var DECODED_ARMS = Object.assign(Object.create(null), {
   1: CERT_REP_MESSAGE, 3: CERT_REP_MESSAGE, 8: CERT_REP_MESSAGE, 14: CERT_REP_MESSAGE,
   10: KEY_REC_REP_CONTENT,
   11: REV_REQ_CONTENT, 12: REV_REP_CONTENT,
   21: GEN_MSG_CONTENT, 22: GEN_MSG_CONTENT,
   23: ERROR_MSG_CONTENT, 24: CERT_CONFIRM_CONTENT,
   25: POLL_REQ_CONTENT, 26: POLL_REP_CONTENT,
-};
+});
 
 var BODY = schema.decode(function (n, ctx) {
   if (n.tagClass !== "context" || !n.children) {

package/lib/schema-cms.js

@@ -84,17 +84,17 @@ var OID_COMPRESSED_DATA = oid.byName("compressedData");
 var OID_DATA = oid.byName("data");
 var OID_ORI_KEM = oid.byName("kem");
 
-var WRAP_KEK_LENGTHS = {};
+var WRAP_KEK_LENGTHS = Object.create(null);
 WRAP_KEK_LENGTHS[oid.byName("aes128-wrap")] = 16;
 WRAP_KEK_LENGTHS[oid.byName("aes192-wrap")] = 24;
 WRAP_KEK_LENGTHS[oid.byName("aes256-wrap")] = 32;
 
-var KEM_CT_LENGTHS = {};
+var KEM_CT_LENGTHS = Object.create(null);
 ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { KEM_CT_LENGTHS[oid.byName(n)] = oid.kemParams(n).ct; });
 
 var AEAD_GCM_ICVLENS = new Set([12, 13, 14, 15, 16]);
 var AEAD_CCM_ICVLENS = new Set([4, 6, 8, 10, 12, 14, 16]);
-var AEAD_ALGS = {};
+var AEAD_ALGS = Object.create(null);
 ["aes128-GCM", "aes192-GCM", "aes256-GCM"].forEach(function (n) { AEAD_ALGS[oid.byName(n)] = "gcm"; });
 ["aes128-CCM", "aes192-CCM", "aes256-CCM"].forEach(function (n) { AEAD_ALGS[oid.byName(n)] = "ccm"; });
 
@@ -107,15 +107,15 @@ var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_SIGNING_TIME = oid.byName("signingTime");
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
 
-var ATTR_FORBIDDEN_IN = {};
+var ATTR_FORBIDDEN_IN = Object.create(null);
 ATTR_FORBIDDEN_IN[OID_CONTENT_TYPE] = { unsigned: true, unauth: true, unprotected: true };
 ATTR_FORBIDDEN_IN[OID_MESSAGE_DIGEST] = { unsigned: true, unauth: true, unprotected: true };
 ATTR_FORBIDDEN_IN[OID_SIGNING_TIME] = { unsigned: true, unauth: true, unprotected: true };
 ATTR_FORBIDDEN_IN[OID_COUNTERSIGNATURE] = { signed: true, auth: true, unauth: true, unprotected: true };
-var ATTR_PLACE_LABELS = {
+var ATTR_PLACE_LABELS = Object.assign(Object.create(null), {
   signed: "a signed attribute", unsigned: "an unsigned attribute", auth: "an authenticated attribute",
   unauth: "an unauthenticated attribute", unprotected: "an unprotected attribute",
-};
+});
 
 function _checkAttrPlacement(attrs, place) {
   for (var i = 0; i < attrs.length; i++) {
@@ -284,8 +284,14 @@ function rawElement(item) {
   return { bytes: item.node.bytes, tagClass: item.node.tagClass, tagNumber: item.node.tagNumber };
 }
 
-var CERT_CHOICE_TAGS = { universal: {}, context: { 0: true, 1: true, 2: true, 3: true } };
-var CRL_CHOICE_TAGS = { universal: {}, context: { 1: true } };
+var CERT_CHOICE_TAGS = Object.assign(Object.create(null), {
+  universal: Object.create(null),
+  context: Object.assign(Object.create(null), { 0: true, 1: true, 2: true, 3: true }),
+});
+var CRL_CHOICE_TAGS = Object.assign(Object.create(null), {
+  universal: Object.create(null),
+  context: Object.assign(Object.create(null), { 1: true }),
+});
 CERT_CHOICE_TAGS.universal[asn1.TAGS.SEQUENCE] = true;
 CRL_CHOICE_TAGS.universal[asn1.TAGS.SEQUENCE] = true;
 function rawChoiceElement(allowed, code, what) {
@@ -510,6 +516,7 @@ function keyIdentifierSchema(keyIdName, assert, code, what) {
   ], {
     assert: assert, code: code, what: what,
     build: function (m) {
+      // allow:registry-table-inherits-object-prototype -- a fixed-shape parse record read as rid / kekid, whose one computed key is the keyIdName argument both callers pass as a string literal
       var out = {};
       out[keyIdName] = m.fields[keyIdName].value;
       out.date = m.fields.date.present ? m.fields.date.value : null;

package/lib/schema-crmf.js

@@ -140,7 +140,7 @@ var POPO_SIGNING_KEY = schema.seq([
   },
 });
 
-var POPOPRIVKEY_METHODS = { 0: "thisMessage", 1: "subsequentMessage", 2: "dhMAC", 3: "agreeMAC", 4: "encryptedKey" };
+var POPOPRIVKEY_METHODS = Object.assign(Object.create(null), { 0: "thisMessage", 1: "subsequentMessage", 2: "dhMAC", 3: "agreeMAC", 4: "encryptedKey" });
 function popoPrivKey(type) {
   return schema.decode(function (n, ctx) {
     if (!n.children || n.children.length !== 1) {

package/lib/schema-csr.js

@@ -52,7 +52,7 @@ var DIRECTORY_STRING_TAGS = [
   asn1.TAGS.UTF8_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.TELETEX_STRING,
   asn1.TAGS.UNIVERSAL_STRING, asn1.TAGS.BMP_STRING,
 ];
-var RECOGNIZED_ATTRIBUTE_VALUE = {};
+var RECOGNIZED_ATTRIBUTE_VALUE = Object.create(null);
 RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("extensionRequest")] = function (node, ctx) {
   try { return { extensions: schema.walk(EXTENSIONS, node, ctx).result }; }
   catch (e) {

package/lib/schema-engine.js

@@ -279,6 +279,7 @@ function _walkSeq(schema, node, ctx) {
   var kids = _assertShape(schema, node, ctx);
   _assertArity(schema, kids, ctx);
 
+  // allow:registry-table-inherits-object-prototype -- the record a schema's own check and build callbacks read as m.fields, whose keys are the field names that schema declared rather than anything the input supplies
   var fields = {};
   var idx = 0;
   for (var f = 0; f < schema.fields.length; f++) {
@@ -322,7 +323,7 @@ function _walkSeq(schema, node, ctx) {
 }
 
 function _consumeTrailing(fld, kids, start, fields, ctx) {
-  var byTag = {};
+  var byTag = Object.create(null);
   for (var m = 0; m < fld.members.length; m++) byTag[fld.members[m].tag] = fld.members[m];
   var last = fld.minTag != null ? fld.minTag - 1 : -1;
   for (var i = start; i < kids.length; i++) {

package/lib/schema-pkcs12.js

@@ -176,7 +176,7 @@ var SAFE_BAG = schema.seq([
     var attributes = [];
     var friendlyName = null;
     var localKeyId = null;
-    var seen = {};
+    var seen = Object.create(null);
     if (m.fields.bagAttributes.present) {
       var items = m.fields.bagAttributes.value.items;
       for (var i = 0; i < items.length; i++) {

package/lib/schema-pkix.js

@@ -676,6 +676,7 @@ function certExtensionDecoders(ns) {
     for (var z = 0; z < bs.bytes.length; z++) { if (bs.bytes[z] !== 0) { anyBit = true; break; } }
     if (!anyBit) throw ns.E(C, "KeyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
     schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw ns.E(C, m); });
+    // allow:registry-table-inherits-object-prototype -- the decoded KeyUsage record, whose keys are the fixed KU_BITS names the schema declares rather than anything the certificate supplies
     var out = {};
     _forEach(KU_BITS, function (nm, bit) {
       var byte = bit >> 3, mask = 0x80 >> (bit & 7);
@@ -821,6 +822,7 @@ function certExtensionDecoders(ns) {
   function authorityKeyIdentifier(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var kids = seqChildren(buf, C, "AuthorityKeyIdentifier");
+    // allow:registry-table-inherits-object-prototype -- the decoded AuthorityKeyIdentifier record, read by the three field names the schema declares rather than by anything the certificate supplies
     var out = { keyIdentifier: null, authorityCertIssuer: null, authorityCertSerialNumber: null };
     var lastTag = -1;
     _forEach(kids, function (k) {
@@ -867,6 +869,7 @@ function certExtensionDecoders(ns) {
       if (dp.tagClass !== "universal" || dp.tagNumber !== _T.SEQUENCE || !dp.children) {
         throw ns.E(C, "DistributionPoint must be a SEQUENCE { distributionPoint?, reasons?, cRLIssuer? }");
       }
+      // allow:registry-table-inherits-object-prototype -- the decoded DistributionPoint record, read by the three field names the schema declares rather than by anything the certificate supplies
       var out = { distributionPoint: null, reasons: null, cRLIssuer: null };
       var lastTag = -1;
       _forEach(dp.children, function (f) {

package/lib/schema-tsp.js

@@ -58,10 +58,10 @@ var OID_SIGNING_CERT_V2 = oid.byName("signingCertificateV2");
 
 var TAGS = asn1.TAGS;
 
-var FAILURE_BITS = {
+var FAILURE_BITS = Object.assign(Object.create(null), {
   0: "badAlg", 2: "badRequest", 5: "badDataFormat", 14: "timeNotAvailable",
   15: "unacceptedPolicy", 16: "unacceptedExtension", 17: "addInfoNotAvailable", 25: "systemFailure",
-};
+});
 
 
 var GEN_TIME = pkix.generalizedTime(NS, { code: "tsp/bad-gentime", message: "genTime must be a GeneralizedTime (RFC 3161 sec. 2.4.2)", allowFractional: true });

package/lib/shbs.js

@@ -48,8 +48,8 @@ function _deriveWinternitz(n, w) {
   return { p: u + v, ls: 16 - v * w };
 }
 
-var LMS_SETS = {};
-var LMOTS_SETS = {};
+var LMS_SETS = Object.create(null);
+var LMOTS_SETS = Object.create(null);
 (function seed() {
   var heights = [5, 10, 15, 20, 25];
   var ws = [1, 2, 4, 8];

package/lib/sign-scheme.js

@@ -26,26 +26,26 @@ var _isU8 = intrinsic.types.isUint8Array;
 
 var HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" });
-var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
-var ECDSA_ALG = { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" };
-var RSA_PKCS1_SIG = { sha256: "sha256WithRSAEncryption", sha384: "sha384WithRSAEncryption", sha512: "sha512WithRSAEncryption" };
-var HASH_NAME_BY_OID = {};
+var PSS_SALT = intrinsic.assign(intrinsic.create(null), { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 });
+var ECDSA_ALG = intrinsic.assign(intrinsic.create(null), { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" });
+var RSA_PKCS1_SIG = intrinsic.assign(intrinsic.create(null), { sha256: "sha256WithRSAEncryption", sha384: "sha384WithRSAEncryption", sha512: "sha512WithRSAEncryption" });
+var HASH_NAME_BY_OID = intrinsic.create(null);
 HASH_NAME_BY_OID[O("sha256")] = "sha256";
 HASH_NAME_BY_OID[O("sha384")] = "sha384";
 HASH_NAME_BY_OID[O("sha512")] = "sha512";
-var EC_BY_CURVE_OID = {};
+var EC_BY_CURVE_OID = intrinsic.create(null);
 EC_BY_CURVE_OID[O("prime256v1")] = { curve: "P-256", coordLen: 32 };
 EC_BY_CURVE_OID[O("secp384r1")] = { curve: "P-384", coordLen: 48 };
 EC_BY_CURVE_OID[O("secp521r1")] = { curve: "P-521", coordLen: 66 };
-var MLDSA_BY_OID = {};
+var MLDSA_BY_OID = intrinsic.create(null);
 MLDSA_BY_OID[O("id-ml-dsa-44")] = "ML-DSA-44";
 MLDSA_BY_OID[O("id-ml-dsa-65")] = "ML-DSA-65";
 MLDSA_BY_OID[O("id-ml-dsa-87")] = "ML-DSA-87";
-var MLDSA_SUITABLE_DIGEST = {
+var MLDSA_SUITABLE_DIGEST = intrinsic.assign(intrinsic.create(null), {
   "ML-DSA-44": { sha256: 1, sha384: 1, sha512: 1, shake256: 1 },
   "ML-DSA-65": { sha384: 1, sha512: 1, shake256: 1 },
   "ML-DSA-87": { sha512: 1, shake256: 1 },
-};
+});
 // @enforced-by behavioral -- an own-property table read has no rename-proof shape distinct from a legitimate lookup, so a RED conformance vector is the guard
 function mldsaDigestSuitable(mlName, md) {
   if (!intrinsic.hasOwn(MLDSA_SUITABLE_DIGEST, mlName)) return false;
@@ -53,7 +53,7 @@ function mldsaDigestSuitable(mlName, md) {
   return !!row && intrinsic.hasOwn(row, md) && !!row[md];
 }
 
-var SLHDSA_BY_OID = {};
+var SLHDSA_BY_OID = intrinsic.create(null);
 [["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
  ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
  ["shake-192s", "shake256"], ["shake-192f", "shake256"], ["shake-256s", "shake256"], ["shake-256f", "shake256"]

package/lib/sigstore.js

@@ -70,14 +70,14 @@ function _stripTrailingEquals(s) {
   return s.slice(0, i);
 }
 
-var _BUNDLE_MEDIA_TYPES = {
+var _BUNDLE_MEDIA_TYPES = Object.assign(Object.create(null), {
   "application/vnd.dev.sigstore.bundle.v0.1+json": 1,
   "application/vnd.dev.sigstore.bundle.v0.2+json": 1,
   "application/vnd.dev.sigstore.bundle.v0.3+json": 1,
   "application/vnd.dev.sigstore.bundle+json;version=0.1": 1,
   "application/vnd.dev.sigstore.bundle+json;version=0.2": 1,
   "application/vnd.dev.sigstore.bundle+json;version=0.3": 1
-};
+});
 function _isBundleMediaType(mt) {
   return typeof mt === "string" && Object.prototype.hasOwnProperty.call(_BUNDLE_MEDIA_TYPES, mt);
 }
@@ -363,7 +363,7 @@ function _pathToAnchor(leaf, anchor, intBySubject) {
   /** @internal Issuers are collected leaf-first and the path is assembled once, so no element is
    * ever moved to a new index: an indexed setter has nothing to intercept and cannot replace the
    * leaf the preceding signature checks authenticated. */
-  var above = [], cur = leaf, seen = {}, guardN = 0;
+  var above = [], cur = leaf, seen = Object.create(null), guardN = 0;
   function assemble() {
     var path = [];
     for (var k = above.length - 1; k >= 0; k--) guard.list.append(path, above[k]);
@@ -390,7 +390,7 @@ function _pathToAnchor(leaf, anchor, intBySubject) {
 async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
   var roots = _normRoots(fulcioRoots);
   var bundleLinks = chainDers.slice(1).map(function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
-  var intBySubject = {};
+  var intBySubject = Object.create(null);
   function addInt(c) { guard.list.append(intBySubject[_dn(c, "subject")] = intBySubject[_dn(c, "subject")] || [], c); }
   roots.forEach(function (r) { addInt(r.cert); });
   bundleLinks.forEach(addInt);
@@ -421,7 +421,7 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
 var SAN_OID = oid.byName("subjectAltName");
 var FULCIO_PREFIX = oid.byName("otherName").split(".").slice(0, -1).join(".") + ".";
 function _identity(leaf) {
-  var out = { san: null, extensions: {} };
+  var out = { san: null, extensions: Object.create(null) };
   try {
     (leaf.extensions || []).forEach(function (ext) {
       if (ext.oid === SAN_OID) { out.san = _sanValue(ext); return; }
@@ -435,7 +435,7 @@ function _identity(leaf) {
   }
   return out;
 }
-var GN_TYPE = { 1: "rfc822Name", 2: "dNSName", 6: "uri" };
+var GN_TYPE = Object.assign(Object.create(null), { 1: "rfc822Name", 2: "dNSName", 6: "uri" });
 function _sanValue(ext) {
   var seq = asn1.decode(ext.value);
   var names = [];
@@ -467,10 +467,11 @@ function _fulcioExtValue(ext, leafArc) {
 }
 
 var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
-var IDENTITY_KEYS = { san: 1, issuer: 1, sourceRepositoryURI: 1 };
-var _VERIFY_BUNDLE_OPTS = { fulcioRoots: 1, rekorKeys: 1, identity: 1, predicateType: 1, time: 1 };
+var IDENTITY_KEYS = Object.assign(Object.create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
+var _VERIFY_BUNDLE_OPTS = Object.assign(Object.create(null), { fulcioRoots: 1, rekorKeys: 1, identity: 1, predicateType: 1, time: 1 });
 
 function _checkIdentity(id, policy) {
+  // allow:registry-table-inherits-object-prototype -- the identityChecked record an operator reads by field name, whose three keys are the fixed IDENTITY_FIELDS rather than anything the bundle supplies
   var ran = { san: false, issuer: false, sourceRepositoryURI: false };
   if (policy === undefined || policy === null) return ran;
   if (typeof policy !== "object" || Array.isArray(policy)) {

package/lib/smime.js

@@ -48,21 +48,21 @@ var SmimeError = frameworkError.SmimeError;
 
 function _err(code, msg, cause) { return new SmimeError(code, msg, cause); }
 
-var SIGN_OPTS = {
+var SIGN_OPTS = Object.assign(Object.create(null), {
   form: 1, entity: 1, contentType: 1, signingTime: 1, protectHeaders: 1, headers: 1, hcp: 1,
   sid: 1, signedAttributes: 1, additionalSignedAttributes: 1,
-};
-var VERIFY_OPTS = {
+});
+var VERIFY_OPTS = Object.assign(Object.create(null), {
   certs: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1, strictMicalg: 1,
   legacyHeaderProtection: 1, expectedSender: 1,
-};
-var ENCRYPT_OPTS = {
+});
+var ENCRYPT_OPTS = Object.assign(Object.create(null), {
   entity: 1, contentType: 1, protectHeaders: 1, headers: 1, hcp: 1,
   contentEncryptionAlgorithm: 1, oaepHash: 1, keyIdentifier: 1, ukm: 1,
-};
-var DECRYPT_OPTS = { recipientIndex: 1, maxIterations: 1, strictSmimeType: 1, legacyHeaderProtection: 1 };
-var COMPRESS_OPTS = { entity: 1, contentType: 1, level: 1 };
-var DECOMPRESS_OPTS = { maxOutputBytes: 1 };
+});
+var DECRYPT_OPTS = Object.assign(Object.create(null), { recipientIndex: 1, maxIterations: 1, strictSmimeType: 1, legacyHeaderProtection: 1 });
+var COMPRESS_OPTS = Object.assign(Object.create(null), { entity: 1, contentType: 1, level: 1 });
+var DECOMPRESS_OPTS = Object.assign(Object.create(null), { maxOutputBytes: 1 });
 
 function _knownOpts(opts, known, verb) {
   guard.identifier.assertKnownKeys(opts, known, _err, "smime/bad-input", function (k) {
@@ -76,7 +76,7 @@ function _isPkcs7(type, kind) {
   return t === "application/pkcs7-" + kind || t === "application/x-pkcs7-" + kind;
 }
 
-var MICALG = { sha1: "sha-1", sha224: "sha-224", sha256: "sha-256", sha384: "sha-384", sha512: "sha-512", md5: "md5", shake128: "shake128", shake256: "shake256" };
+var MICALG = Object.assign(Object.create(null), { sha1: "sha-1", sha224: "sha-224", sha256: "sha-256", sha384: "sha-384", sha512: "sha-512", md5: "md5", shake128: "shake128", shake256: "shake256" });
 
 function _entityBytes(content, opts) {
   var raw = guard.bytes.view(content, SmimeError, "smime/bad-input", "content");
@@ -320,7 +320,7 @@ var SMTP_UTF8_MAILBOX = oid.byName("smtpUtf8Mailbox");
 var EMAIL_ADDRESS_ATTR = oid.byName("emailAddress");
 var _extNs = pkix.makeNS("smime", SmimeError, oid);
 var _extDecoders = pkix.certExtensionDecoders(_extNs);
-var _extCtx = { E: function (c, m, cause) { return new SmimeError(c, m, cause); }, oid: oid };
+var _extCtx = Object.assign(Object.create(null), { E: function (c, m, cause) { return new SmimeError(c, m, cause); }, oid: oid });
 function _signerEmails(certDer) {
   var out = { addresses: [], unreadable: 0 };
   var parsed = null;
@@ -875,7 +875,7 @@ function _decodeCms(ent) {
 
 function _toBuf(v) { return Buffer.isBuffer(v) ? v : Buffer.from(v); }
 
-var CERTS_ONLY_OPTS = { crls: 1 };
+var CERTS_ONLY_OPTS = Object.assign(Object.create(null), { crls: 1 });
 
 /**
  * @primitive  pki.smime.buildCertsOnly

package/lib/tls-cert-compress.js

@@ -62,17 +62,17 @@ var zlib = require("zlib");
 var TlsError = frameworkError.TlsError;
 function _err(code, message, cause) { return new TlsError(code, message, cause); }
 
-var ALG_BY_NUMBER = { 1: "zlib", 2: "brotli", 3: "zstd" };
-var ALG_BY_NAME = {};
+var ALG_BY_NUMBER = intrinsic.assign(intrinsic.create(null), { 1: "zlib", 2: "brotli", 3: "zstd" });
+var ALG_BY_NAME = intrinsic.create(null);
 Object.keys(ALG_BY_NUMBER).forEach(function (n) { ALG_BY_NAME[ALG_BY_NUMBER[n]] = Number(n); });
 
-var COMPRESS = { zlib: zlib.deflateSync, brotli: zlib.brotliCompressSync, zstd: zlib.zstdCompressSync };
+var COMPRESS = intrinsic.assign(intrinsic.create(null), { zlib: zlib.deflateSync, brotli: zlib.brotliCompressSync, zstd: zlib.zstdCompressSync });
 
-var LEVEL_OPT = {
+var LEVEL_OPT = intrinsic.assign(intrinsic.create(null), {
   zlib: function (n) { return { level: n }; },
   brotli: function (n) { var p = {}; p[zlib.constants.BROTLI_PARAM_QUALITY] = n; return { params: p }; },
   zstd: function (n) { var p = {}; p[zlib.constants.ZSTD_c_compressionLevel] = n; return { params: p }; },
-};
+});
 
 var SUPPORTED = guard.compress.algorithms().filter(function (n) {
   return _hasOwn(ALG_BY_NAME, n) && typeof COMPRESS[n] === "function";
@@ -81,7 +81,7 @@ var SUPPORTED = guard.compress.algorithms().filter(function (n) {
 var MIN_CERT_MSG_BYTES = validator.tls.MIN_CERT_MSG_BYTES;
 var MAX_VECTOR_24 = validator.tls.MAX_VECTOR_24;
 
-var FRAMING_CODES = { truncated: "tls/truncated", framing: "tls/bad-framing", trailing: "tls/trailing-data" };
+var FRAMING_CODES = intrinsic.assign(intrinsic.create(null), { truncated: "tls/truncated", framing: "tls/bad-framing", trailing: "tls/trailing-data" });
 
 var HEADER_BYTES = 8;
 

package/lib/trust.js

@@ -327,7 +327,7 @@ function _certEntry(obj) {
 function _trustEntry(obj) {
   var issuer = _requireOctal(obj, "CKA_ISSUER", "trust");
   var serial = _requireOctal(obj, "CKA_SERIAL_NUMBER", "trust");
-  var purposes = { serverAuth: false, emailProtection: false, codeSigning: false };
+  var purposes = intrinsic.assign(intrinsic.create(null), { serverAuth: false, emailProtection: false, codeSigning: false });
   PURPOSE_ATTRS.forEach(function (pair) {
     var a = obj.attrs[pair[0]];
     if (!a) return;
@@ -364,15 +364,15 @@ function _mkAnchor(cert, meta) {
 var _DERIVED_FROM = new WeakMap();
 
 function _copyPurposes(src) {
-  return {
+  return intrinsic.assign(intrinsic.create(null), {
     serverAuth: !!src && src.serverAuth === true,
     emailProtection: !!src && src.emailProtection === true,
     codeSigning: !!src && src.codeSigning === true,
-  };
+  });
 }
 
 function _copyDistrustAfter(src) {
-  var out = {};
+  var out = intrinsic.create(null);
   if (!src || typeof src !== "object") return out;
   Object.keys(src).forEach(function (k) {
     out[k] = guard.time.isDate(src[k]) ? new Date(guard.time.instantOf(src[k])) : src[k];
@@ -521,7 +521,7 @@ function parseCertdata(text) {
     anchors: _dedupAnchors(certs.map(function (c) {
       return _mkAnchor(c.cert, {
         distrustAfter: c.distrustAfter,
-        purposes: c.purposes || { serverAuth: false, emailProtection: false, codeSigning: false },
+        purposes: c.purposes || _copyPurposes(null),
         label: c.label,
         mozillaCaPolicy: c.mozillaCaPolicy,
       });
@@ -579,15 +579,15 @@ function _csvRows(text) {
   return rows;
 }
 
-var _TRUST_BIT_TOKENS = {
+var _TRUST_BIT_TOKENS = intrinsic.assign(intrinsic.create(null), {
   "websites": "serverAuth", "server authentication": "serverAuth",
   "email": "emailProtection", "secure email": "emailProtection",
   "code": "codeSigning", "code signing": "codeSigning",
   "client authentication": null, "document signing": null,
   "time stamping": null, "ocsp signing": null,
-};
+});
 function _trustBits(cell) {
-  var purposes = { serverAuth: false, emailProtection: false, codeSigning: false };
+  var purposes = intrinsic.assign(intrinsic.create(null), { serverAuth: false, emailProtection: false, codeSigning: false });
   String(cell).split(";").forEach(function (tok) {
     var t = tok.trim();
     if (t === "") return;
@@ -746,7 +746,7 @@ function parseCcadbCsv(text) {
  *   await pki.path.validate([pki.schema.x509.parse(der)],
  *     { time: new Date("2026-06-01T00:00:00Z"), trustAnchors: anchor, checkPurpose: "serverAuth" });
  */
-var _ANCHOR_OPTS = { purpose: 1 };
+var _ANCHOR_OPTS = intrinsic.assign(intrinsic.create(null), { purpose: 1 });
 function anchor(entry, opts) {
   if (!entry || typeof entry !== "object") {
     throw E("trust/bad-input", "anchor expects a trust-store entry ({ name, publicKey, algorithm, ... })");

package/lib/tsp-sign.js

@@ -48,9 +48,9 @@ var _b = pkiBuild.makeBuilder({
 });
 
 var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512" });
-var HASH_LEN = { sha256: 32, sha384: 48, sha512: 64 };
+var HASH_LEN = intrinsic.assign(intrinsic.create(null), { sha256: 32, sha384: 48, sha512: 64 });
 
-var _REVOCATION_RANK = { "false": 0, "undetermined": 1, "waived": 2, "determined": 3 };
+var _REVOCATION_RANK = intrinsic.assign(intrinsic.create(null), { "false": 0, "undetermined": 1, "waived": 2, "determined": 3 });
 function _rankRevocation(v) {
   var r = _REVOCATION_RANK[String(v)];
   return r === undefined ? 0 : r;
@@ -132,12 +132,12 @@ function sign(messageImprint, tsa, opts) {
   ], _sign);
 }
 
-var _TSA_KEYS = { cert: 1, key: 1 };
-var _IMPRINT_KEYS = { hashAlgorithm: 1, hashedMessage: 1 };
-var _SIGN_OPTS = {
+var _TSA_KEYS = intrinsic.assign(intrinsic.create(null), { cert: 1, key: 1 });
+var _IMPRINT_KEYS = intrinsic.assign(intrinsic.create(null), { hashAlgorithm: 1, hashedMessage: 1 });
+var _SIGN_OPTS = intrinsic.assign(intrinsic.create(null), {
   policy: 1, serialNumber: 1, genTime: 1, nonce: 1, accuracy: 1, ordering: 1, sid: 1,
   digestAlgorithm: 1, certHashAlgorithm: 1, additionalSignedAttributes: 1, pss: 1, pem: 1,
-};
+});
 
 function _sign(messageImprint, tsa, opts) {
   opts = opts || {};
@@ -187,7 +187,7 @@ function _sign(messageImprint, tsa, opts) {
   });
 }
 
-var _ACCURACY_KEYS = { seconds: 1, millis: 1, micros: 1 };
+var _ACCURACY_KEYS = intrinsic.assign(intrinsic.create(null), { seconds: 1, millis: 1, micros: 1 });
 
 function _accuracy(a) {
   guard.identifier.assertKnownKeys(a, _ACCURACY_KEYS, _err, "tsp/bad-input", function (k) {
@@ -260,7 +260,7 @@ function _assertImprint(mi) {
  *   var sha256Digest = Buffer.from(await pki.webcrypto.subtle.digest("SHA-256", Buffer.from("hello")));
  *   var req = pki.tsp.request({ hashAlgorithm: "sha256", hashedMessage: sha256Digest }, { nonce: 0x0102030405060708n, certReq: true });
  */
-var _REQUEST_OPTS = { reqPolicy: 1, nonce: 1, certReq: 1, extensions: 1, pem: 1 };
+var _REQUEST_OPTS = intrinsic.assign(intrinsic.create(null), { reqPolicy: 1, nonce: 1, certReq: 1, extensions: 1, pem: 1 });
 
 function request(messageImprint, opts) {
   opts = opts || {};
@@ -282,7 +282,7 @@ function request(messageImprint, opts) {
   if (opts.certReq === true) guard.list.append(fields,b.boolean(true));
   if (opts.extensions != null) {
     if (!Array.isArray(opts.extensions) || !guard.list.allMatch(opts.extensions, function (e) { return guard.bytes.isByteSource(e); })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
-    var seenExt = {};
+    var seenExt = intrinsic.create(null);
     var encoded = opts.extensions.map(function (e, i) {
       var der = guard.bytes.source(e, TspError, "tsp/bad-input", "an extension");
       _b.assertValidExtension(der, i);
@@ -347,7 +347,7 @@ function parseRequest(input) { return schemaTsp.parseRequest(input); }
  *   var resp = pki.tsp.response(token, {});                                  // granted
  *   var rej  = pki.tsp.response(null, { status: 2, failInfo: ["badAlg"] });  // rejection
  */
-var _RESPONSE_OPTS = { status: 1, statusString: 1, failInfo: 1, pem: 1 };
+var _RESPONSE_OPTS = intrinsic.assign(intrinsic.create(null), { status: 1, statusString: 1, failInfo: 1, pem: 1 });
 
 function response(token, opts) {
   opts = opts || {};
@@ -585,7 +585,7 @@ function _buildTsaChains(leaf, pool) {
  *   res.valid;     // boolean; pass opts.trustAnchors to also chain the TSA cert to a root
  *   res.genTime;   // Date, read from the verified eContent
  */
-var _VERIFY_OPTS = { certs: 1, trustAnchors: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 };
+var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, trustAnchors: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 });
 
 function _anyCritical(extensions) {
   return guard.list.anyMatches(extensions, function (e) { return !!e && !!e.critical; });

package/lib/validator-attcert.js

@@ -25,7 +25,7 @@ function assertNotCa(cert, exts, E, code) {
 function packedCert(cert, exts, E, code) {
   requireV3(cert, E, code);
   assertNotCa(cert, exts, E, code);
-  var have = {};
+  var have = Object.create(null);
   (cert.subject.rdns || []).forEach(function (rdn) { rdn.forEach(function (a) { have[a.type] = a.value; }); });
   if (have[oid.byName("countryName")] == null || have[oid.byName("organizationName")] == null || have[oid.byName("commonName")] == null) {
     throw new E(code, "the packed attestation certificate subject MUST set C, O, OU, and CN (WebAuthn 8.2.1)");
@@ -46,7 +46,7 @@ function aikCert(cert, exts, E, code) {
   }
   var san = exts.decode(cert, "subjectAltName");
   var dirName = san && san.value && san.value.names && san.value.names.filter(function (n) { return n.tagNumber === 4; })[0];
-  var types = {};
+  var types = Object.create(null);
   if (dirName && dirName.value && dirName.value.rdns) {
     dirName.value.rdns.forEach(function (rdn) { rdn.forEach(function (a) { types[a.type] = true; }); });
   }

package/lib/validator-cose.js

@@ -9,20 +9,20 @@ var oid = require("./oid");
 var edwardsPoint = require("./edwards-point");
 var nodeCrypto = require("crypto");
 
-var EC2_CRV_LEN = { 1: 32, 2: 48, 3: 66 };
-var EC2_CRV_OID = { 1: "prime256v1", 2: "secp384r1", 3: "secp521r1" };
-var OKP_CRV = { 6: { oid: "Ed25519", len: 32 }, 7: { oid: "Ed448", len: 57 } };
+var EC2_CRV_LEN = Object.assign(Object.create(null), { 1: 32, 2: 48, 3: 66 });
+var EC2_CRV_OID = Object.assign(Object.create(null), { 1: "prime256v1", 2: "secp384r1", 3: "secp521r1" });
+var OKP_CRV = Object.assign(Object.create(null), { 6: { oid: "Ed25519", len: 32 }, 7: { oid: "Ed448", len: 57 } });
 var RSA_MIN_MODULUS_BITS = 2048;
 var RSA_MAX_EXPONENT_BYTES = 8;
 function _modulusBits(n) { return (n.length - 1) * 8 + (32 - Math.clz32(n[0])); }
 
-var ALG_PROFILE = {
+var ALG_PROFILE = Object.assign(Object.create(null), {
   "-7": { kty: 2, crv: 1 }, "-35": { kty: 2, crv: 2 }, "-36": { kty: 2, crv: 3 },
   "-9": { kty: 2, crv: 1 }, "-51": { kty: 2, crv: 2 }, "-52": { kty: 2, crv: 3 },
   "-8": { kty: 1, crv: 6 }, "-19": { kty: 1, crv: 6 }, "-53": { kty: 1, crv: 7 },
   "-257": { kty: 3 }, "-258": { kty: 3 }, "-259": { kty: 3 },
   "-37": { kty: 3 }, "-38": { kty: 3 }, "-39": { kty: 3 }, "-65535": { kty: 3 },
-};
+});
 
 // @enforced-by validator-shape-reinlined
 // @validator-shape kty\s*===\s*2n

package/lib/validator-sig.js

@@ -15,12 +15,12 @@ function rawToEcdsaDer(raw, coordLen) {
   return asn1.build.sequence([asn1.build.integer(r), asn1.build.integer(s)]);
 }
 
-var CURVE_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
-var CURVE_ORDER = {
+var CURVE_FIELD_BYTES = Object.assign(Object.create(null), { "P-256": 32, "P-384": 48, "P-521": 66 });
+var CURVE_ORDER = Object.assign(Object.create(null), {
   "P-256": BigInt("0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"),
   "P-384": BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"),
   "P-521": BigInt("0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409"),
-};
+});
 
 // @enforced-by behavioral -- a DER ECDSA-Sig-Value decode has no rename-proof code shape distinct
 function ecdsaDerToP1363(der, curve, E, code) {

package/lib/validator-tpm.js

@@ -8,9 +8,9 @@ var guard = require("./guard-all");
 
 var TPM_GENERATED_VALUE = 0xff544347;
 var TPM_ST_ATTEST_CERTIFY = 0x8017;
-var TPM_ALG = { RSA: 0x0001, SHA1: 0x0004, SHA256: 0x000b, SHA384: 0x000c, SHA512: 0x000d, NULL: 0x0010, ECC: 0x0023 };
-var TPM_ALG_HASH = {}; TPM_ALG_HASH[TPM_ALG.SHA1] = "sha1"; TPM_ALG_HASH[TPM_ALG.SHA256] = "sha256"; TPM_ALG_HASH[TPM_ALG.SHA384] = "sha384"; TPM_ALG_HASH[TPM_ALG.SHA512] = "sha512";
-var TPM_CURVE_TO_COSE = {}; TPM_CURVE_TO_COSE[0x0003] = 1; TPM_CURVE_TO_COSE[0x0004] = 2; TPM_CURVE_TO_COSE[0x0005] = 3;
+var TPM_ALG = Object.assign(Object.create(null), { RSA: 0x0001, SHA1: 0x0004, SHA256: 0x000b, SHA384: 0x000c, SHA512: 0x000d, NULL: 0x0010, ECC: 0x0023 });
+var TPM_ALG_HASH = Object.create(null); TPM_ALG_HASH[TPM_ALG.SHA1] = "sha1"; TPM_ALG_HASH[TPM_ALG.SHA256] = "sha256"; TPM_ALG_HASH[TPM_ALG.SHA384] = "sha384"; TPM_ALG_HASH[TPM_ALG.SHA512] = "sha512";
+var TPM_CURVE_TO_COSE = Object.create(null); TPM_CURVE_TO_COSE[0x0003] = 1; TPM_CURVE_TO_COSE[0x0004] = 2; TPM_CURVE_TO_COSE[0x0005] = 3;
 
 function _ucmp(a, b) {
   function strip(x) { var i = 0; while (i < x.length - 1 && x[i] === 0) i++; return x.subarray(i); }
@@ -32,6 +32,7 @@ var TPMA_OBJECT_RESERVED = 0xfff0f009;
 
 // @enforced-by behavioral -- a bit-position table lookup has no rename-proof code shape; the RED
 function _decodeAttributes(oa) {
+  // allow:registry-table-inherits-object-prototype -- the attributes record an operator reads as result.tpm.attributes by field name, whose keys are the fixed TPMA_OBJECT_BITS list rather than anything the attestation supplies
   var out = {};
   Object.keys(TPMA_OBJECT_BITS).forEach(function (n) { out[n] = ((oa >>> TPMA_OBJECT_BITS[n]) & 1) === 1; });
   return out;
@@ -112,7 +113,7 @@ function normalizeObjectAttributePolicy(policy, E, code) {
   if (policy === undefined) return null;
   if (!policy || typeof policy !== "object" || Array.isArray(policy)) throw new E(code, "opts.tpmPolicy must be an object");
   guard.identifier.assertKnownKeys(policy, _TPM_POLICY_KEYS, function (c, m) { return new E(c, m); }, code, "opts.tpmPolicy has an unknown key ");
-  var want = {};
+  var want = Object.create(null);
   if (policy.profile !== undefined) {
     var preset = TPM_POLICY_PROFILES[guard.text.keyOf(policy.profile)];
     if (!preset) throw new E(code, "opts.tpmPolicy.profile " + guard.text.showValue(policy.profile) + " is not a defined profile");