@blamejs/pki 0.6.40 → 0.6.42

package/lib/pbes2.js

@@ -14,9 +14,9 @@ var b = asn1.build;
 function O(n) { return oid.byName(n); }
 
 var PRF_NODE_BY_NAME = Object.assign(Object.create(null), { hmacWithSHA1: "sha1", hmacWithSHA256: "sha256", hmacWithSHA384: "sha384", hmacWithSHA512: "sha512" });
-var PRF_NODE_BY_OID = {}; Object.keys(PRF_NODE_BY_NAME).forEach(function (n) { PRF_NODE_BY_OID[O(n)] = PRF_NODE_BY_NAME[n]; });
+var PRF_NODE_BY_OID = Object.create(null); Object.keys(PRF_NODE_BY_NAME).forEach(function (n) { PRF_NODE_BY_OID[O(n)] = PRF_NODE_BY_NAME[n]; });
 
-var CONTENT_KEYBITS = {}, CONTENT_MODE = {};
+var CONTENT_KEYBITS = Object.create(null), CONTENT_MODE = Object.create(null);
 [["aes128-CBC", 128, "cbc"], ["aes192-CBC", 192, "cbc"], ["aes256-CBC", 256, "cbc"],
   ["aes128-GCM", 128, "gcm"], ["aes192-GCM", 192, "gcm"], ["aes256-GCM", 256, "gcm"]].forEach(function (r) {
   CONTENT_KEYBITS[O(r[0])] = r[1];

package/lib/pkcs12-build.js

@@ -69,14 +69,14 @@ var DIGEST_NAME = intrinsic.assign(intrinsic.create(null), { sha1: "sha1", sha25
 var _MISSING_PASSWORD = "a password must be a string, Buffer, or Uint8Array -- an omitted password " +
   "is not the empty password; pass \"\" to use the empty one deliberately";
 
-var _INTEGRITY_OPTS = { mode: 1, signer: 1, signers: 1, certificates: 1, sid: 1, signingTime: 1 };
-var _BUILD_SPEC_FULL_KEYS = { safeContents: 1 };
-var _BUILD_SPEC_SHORTHAND_KEYS = { key: 1, cert: 1, ca: 1, friendlyName: 1, localKeyId: 1 };
-var _BUILD_OPTS_FULL = { integrity: 1, mac: 1, password: 1, pem: 1 };
-var _BUILD_OPTS_SHORTHAND = { integrity: 1, mac: 1, password: 1, pem: 1, recipientCerts: 1 };
-var _SAFE_RECIPIENTS_KEYS = { bags: 1, recipients: 1, contentEncryptionAlgorithm: 1 };
-var _SAFE_PASSWORD_KEYS = { bags: 1, encrypt: 1 };
-var _SAFE_PLAINTEXT_KEYS = { bags: 1 };
+var _INTEGRITY_OPTS = intrinsic.assign(intrinsic.create(null), { mode: 1, signer: 1, signers: 1, certificates: 1, sid: 1, signingTime: 1 });
+var _BUILD_SPEC_FULL_KEYS = intrinsic.assign(intrinsic.create(null), { safeContents: 1 });
+var _BUILD_SPEC_SHORTHAND_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1, ca: 1, friendlyName: 1, localKeyId: 1 });
+var _BUILD_OPTS_FULL = intrinsic.assign(intrinsic.create(null), { integrity: 1, mac: 1, password: 1, pem: 1 });
+var _BUILD_OPTS_SHORTHAND = intrinsic.assign(intrinsic.create(null), { integrity: 1, mac: 1, password: 1, pem: 1, recipientCerts: 1 });
+var _SAFE_RECIPIENTS_KEYS = intrinsic.assign(intrinsic.create(null), { bags: 1, recipients: 1, contentEncryptionAlgorithm: 1 });
+var _SAFE_PASSWORD_KEYS = intrinsic.assign(intrinsic.create(null), { bags: 1, encrypt: 1 });
+var _SAFE_PLAINTEXT_KEYS = intrinsic.assign(intrinsic.create(null), { bags: 1 });
 var _BAG_KEYS_BY_TYPE = intrinsic.assign(intrinsic.create(null), {
   key:          { type: 1, friendlyName: 1, localKeyId: 1, key: 1 },
   shroudedKey:  { type: 1, friendlyName: 1, localKeyId: 1, key: 1, encrypt: 1 },
@@ -85,15 +85,15 @@ var _BAG_KEYS_BY_TYPE = intrinsic.assign(intrinsic.create(null), {
   secret:       { type: 1, friendlyName: 1, localKeyId: 1, secretTypeId: 1, secretValue: 1 },
   safeContents: { type: 1, friendlyName: 1, localKeyId: 1, nested: 1 },
 });
-var _ENCRYPT_KEYS = { password: 1, cipher: 1, salt: 1, iterations: 1, prf: 1 };
-var _MAC_KEYS = { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 };
-var _MAC_KEYS_HMAC = { algorithm: 1, hash: 1, salt: 1, iterations: 1, password: 1 };
-var _MAC_KEYS_PBMAC1 = { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 };
-var _OPEN_OPTS = {
+var _ENCRYPT_KEYS = intrinsic.assign(intrinsic.create(null), { password: 1, cipher: 1, salt: 1, iterations: 1, prf: 1 });
+var _MAC_KEYS = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 });
+var _MAC_KEYS_HMAC = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, password: 1 });
+var _MAC_KEYS_PBMAC1 = intrinsic.assign(intrinsic.create(null), { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 });
+var _OPEN_OPTS = intrinsic.assign(intrinsic.create(null), {
   allowUnauthenticated: 1, importAlgorithm: 1, keys: 1, maxIterations: 1, signerCerts: 1,
   recipientKey: 1, recipientCert: 1, recipientIndex: 1,
-};
-var _VERIFY_MAC_OPTS = { maxIterations: 1 };
+});
+var _VERIFY_MAC_OPTS = intrinsic.assign(intrinsic.create(null), { maxIterations: 1 });
 
 function _p12PasswordOwned(pw) {
   if (Buffer.isBuffer(pw)) return { bytes: guard.bytes.view(pw, Pkcs12Error, "pkcs12/bad-input", "the password"), owned: false };

package/lib/pki-build.js

@@ -421,7 +421,7 @@ function makeBuilder(ctx) {
   function extSan(entries) { return encodeGeneralNames(entries); }
   function extCertPolicies(names) {
     if (!_isArray(names) || !names.length) throw E("bad-input", "certificatePolicies must list at least one policy OID");
-    var seen = {};
+    var seen = intrinsic.create(null);
     return b.sequence(names.map(function (n) {
       var pOid = _resolveOid(n, "certificate policy");
       if (seen[pOid]) throw E("bad-input", "duplicate certificate policy " + guard.text.showValue(n) + " (RFC 5280 sec. 4.2.1.4)");
@@ -491,7 +491,7 @@ function makeBuilder(ctx) {
     var EXT_DECODERS = ctx.EXT_DECODERS;
     if (_isArray(extSpec)) {
       if (!extSpec.length) throw E("bad-input", "the requested extensions list must carry at least one extension");
-      var seen = {};
+      var seen = intrinsic.create(null);
       return b.sequence(extSpec.map(function (e, i) {
         var der = reqDer(e, "extension");
         assertValidExtension(der, i);

package/lib/scep.js

@@ -308,8 +308,8 @@ async function build(spec) {
     throw e;
   }
 }
-var _REQUEST_KEYS = { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, certificate: 1, serialNumber: 1, signer: 1, transactionId: 1, senderNonce: 1 };
-var _CERTREP_KEYS = { messageType: 1, signer: 1, transactionId: 1, senderNonce: 1, pkiStatus: 1, recipientNonce: 1, certificates: 1, crls: 1, recipient: 1, failInfo: 1, failInfoText: 1 };
+var _REQUEST_KEYS = Object.assign(Object.create(null), { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, certificate: 1, serialNumber: 1, signer: 1, transactionId: 1, senderNonce: 1 });
+var _CERTREP_KEYS = Object.assign(Object.create(null), { messageType: 1, signer: 1, transactionId: 1, senderNonce: 1, pkiStatus: 1, recipientNonce: 1, certificates: 1, crls: 1, recipient: 1, failInfo: 1, failInfoText: 1 });
 
 async function _buildCertRep(spec) {
   if (spec.signer == null || typeof spec.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
@@ -602,7 +602,7 @@ async function parse(bytes, opts) {
   }
   return out;
 }
-var _PARSE_KEYS = { recipientKey: 1, expectedSenderNonce: 1, signerCert: 1 };
+var _PARSE_KEYS = Object.assign(Object.create(null), { recipientKey: 1, expectedSenderNonce: 1, signerCert: 1 });
 
 var DEFAULT_TIMEOUT = C.TIME.seconds(30);
 var MAX_TIMEOUT = C.TIME.seconds(600);
@@ -700,7 +700,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
     var req = { method: curMethod, url: current.href, headers: headers, tls: _hopTls(current), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes };
     if (proxySnap != null) req.proxy = proxySnap;
     if (curBody != null) req.body = curBody;
-    return guard.async.awaited(transport(req), _err, "scep/bad-input", "opts.transport").then(function (res) {
+    return guard.async.invoked(transport, [req], _err, "scep/bad-input", "opts.transport").then(function (res) {
       res = res || {};
       var blen = _responseLen(res.body);
       if (blen > budgets.maxResponseBytes) throw _err("scep/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");
@@ -718,8 +718,21 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   return step(url);
 }
 function _snapshotProxy(p) { return httpTransport.snapshotProxy(p); }
-function _client(method, url, body, headers, opts) {
-  var transport = opts.transport || httpTransport.https({ E: _err, errPrefix: "scep" });
+
+/** @internal Refused at every network verb's door and again where the value is used. The checked
+ * value is RETURNED and it is that one the caller uses: reading the option again would ask a second
+ * time, and an accessor can answer differently on each read. */
+function _assertTransport(opts) {
+  return guard.identifier.assertCallableOption(opts, "transport", _err, "scep/bad-input", "opts.transport",
+    "(request) => Promise<{ status, headers, body }>");
+}
+
+/** @internal `checked` is the transport the verb already took at its door. Taking it again here
+ * would ask the caller's options a second time, and anything read in between could change the
+ * answer, so a verb that holds one passes it and this reads the option only when none was held. */
+function _client(method, url, body, headers, opts, checked) {
+  var resolved = checked !== undefined ? checked : _assertTransport(opts);
+  var transport = resolved || httpTransport.https({ E: _err, errPrefix: "scep" });
   var budgets = {
     timeout: guard.limits.cap(opts.timeout, "timeout", DEFAULT_TIMEOUT, { E: _err, code: "scep/bad-input", min: 1, max: MAX_TIMEOUT }),
     maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.HTTP_MAX_RESPONSE_BYTES, { E: _err, code: "scep/bad-input", min: 1, max: C.LIMITS.HTTP_MAX_RESPONSE_BYTES }),
@@ -740,8 +753,8 @@ function _requireOk(res, expected, what) {
   return _bodyBuf(res.body);
 }
 
-var CAP_CANON = { AES: "AES", DES3: "DES3", GETNEXTCACERT: "GetNextCACert", POSTPKIOPERATION: "POSTPKIOperation",
-  RENEWAL: "Renewal", "SHA-1": "SHA-1", "SHA-256": "SHA-256", "SHA-512": "SHA-512", SCEPSTANDARD: "SCEPStandard" };
+var CAP_CANON = Object.assign(Object.create(null), { AES: "AES", DES3: "DES3", GETNEXTCACERT: "GetNextCACert", POSTPKIOPERATION: "POSTPKIOperation",
+  RENEWAL: "Renewal", "SHA-1": "SHA-1", "SHA-256": "SHA-256", "SHA-512": "SHA-512", SCEPSTANDARD: "SCEPStandard" });
 function _splitLines(s) {
   var out = [], start = 0, i, n = s.length;
   for (i = 0; i < n; i++) if (s.charCodeAt(i) === 0x0a) { out.push(s.slice(start, i)); start = i + 1; }
@@ -770,7 +783,7 @@ function _splitLines(s) {
  */
 function parseCapabilities(text) {
   var raw = Buffer.isBuffer(text) ? text.toString("latin1") : String(text == null ? "" : text);
-  var set = {}, lines = _splitLines(raw), i;
+  var set = Object.create(null), lines = _splitLines(raw), i;
   for (i = 0; i < lines.length; i++) {
     var kw = _foldUpper(_trim(lines[i]));
     if (kw !== "" && CAP_CANON[kw]) set[CAP_CANON[kw]] = true;
@@ -810,14 +823,21 @@ function _assertStrongProfile(caps, profile) {
 async function getCACaps(baseUrl, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getCACaps options");
   guard.identifier.assertKnownKeys(opts, _CACAPS_KEYS, _err, "scep/bad-input", "pki.scep.getCACaps has an unknown option: ");
+  var checkedTransport = _assertTransport(opts);
   var profile = { expectSCEPStandard: !!opts.expectSCEPStandard, requireStrongProfile: !!opts.requireStrongProfile };
-  var res = await _client("GET", _scepUrl(baseUrl, "GetCACaps"), null, {}, opts);
+  var res = await _client("GET", _scepUrl(baseUrl, "GetCACaps"), null, {}, opts, checkedTransport);
   if (res.status === 200) {
     var caps = parseCapabilities(_requireOk(res, [CT_PLAIN], "GetCACaps"));
     _assertStrongProfile(caps, profile);
     return caps;
   }
-  if (res.status === 204 || res.status === 400 || res.status === 404 || res.status === 405 || res.status === 501) { _assertStrongProfile({}, profile); return {}; }
+  /** @internal Built the way parseCapabilities builds one, so a CA that advertises nothing yields a
+   * capabilities map of the same shape as one that advertises something. */
+  if (res.status === 204 || res.status === 400 || res.status === 404 || res.status === 405 || res.status === 501) {
+    var none = Object.create(null);
+    _assertStrongProfile(none, profile);
+    return none;
+  }
   throw _err("scep/http-error", "the SCEP GetCACaps returned HTTP " + res.status);
 }
 
@@ -882,8 +902,9 @@ function _normalizeFingerprint(fp, algName) {
 async function getCACert(baseUrl, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getCACert options");
   guard.identifier.assertKnownKeys(opts, _CACERT_KEYS, _err, "scep/bad-input", "pki.scep.getCACert has an unknown option: ");
+  var checkedTransport = _assertTransport(opts);
   var fp = opts.expectedFingerprint != null ? _normalizeFingerprint(opts.expectedFingerprint, opts.fingerprintAlgorithm) : null;
-  var res = await _client("GET", _scepUrl(baseUrl, "GetCACert"), null, {}, opts);
+  var res = await _client("GET", _scepUrl(baseUrl, "GetCACert"), null, {}, opts, checkedTransport);
   var body = _requireOk(res, [CT_CA_CERT, CT_CA_RA_CERT], "GetCACert");
   var ct = _mediaType(_header(res.headers, "content-type")), certs, single = false;
   if (ct === CT_CA_CERT) {
@@ -937,11 +958,12 @@ async function getCACert(baseUrl, opts) {
 async function getNextCACert(baseUrl, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getNextCACert options");
   guard.identifier.assertKnownKeys(opts, _NEXTCACERT_KEYS, _err, "scep/bad-input", "pki.scep.getNextCACert has an unknown option: ");
+  var checkedTransport = _assertTransport(opts);
   if (opts.caCertificate == null) throw _err("scep/bad-input", "a caCertificate (the current SCEP CA certificate DER) is required to authenticate the GetNextCACert response (RFC 8894 sec. 4.7.1)");
   var currentCa = guard.bytes.snapshotSource(opts.caCertificate, ScepError, "scep/bad-input", "the caCertificate");
   _assertSigningKeyUsage(currentCa, "the caCertificate");
   var url = _scepUrl(baseUrl, "GetNextCACert");
-  var res = await _client("GET", url, null, {}, opts);
+  var res = await _client("GET", url, null, {}, opts, checkedTransport);
   var body = _requireOk(res, [CT_NEXT_CA_CERT], "GetNextCACert");
   var v;
   try { v = await cmsVerify.verify(body, { certs: [currentCa] }); }
@@ -1019,6 +1041,10 @@ async function _pollForIssuance(ctx) {
 async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep." + verbName + " options");
   guard.identifier.assertKnownKeys(opts, _ENROLL_KEYS, _err, "scep/bad-input", "pki.scep." + verbName + " has an unknown option: ");
+  /** @internal Held from the door and forwarded below. The options this verb reads on the way there
+   * are the caller's, and reading the transport again afterwards would let one of them change what
+   * comes back, so the value that was checked is the value that is used. */
+  var checkedTransport = _assertTransport(opts);
   if (opts.csr == null) throw _err("scep/bad-input", "a csr (PKCS#10 DER) is required");
   if (opts.caCert == null) throw _err("scep/bad-input", "a caCert (the SCEP CA certificate DER) is required");
   if (opts.signer == null || typeof opts.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
@@ -1029,7 +1055,6 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var clientOpts = {
-    transport: opts.transport,
     tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls,
     maxRedirects: opts.maxRedirects,
     allowCrossOriginRedirect: opts.allowCrossOriginRedirect,
@@ -1037,6 +1062,9 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
     maxResponseBytes: opts.maxResponseBytes,
     proxy: _snapshotProxy(opts.proxy),
   };
+  /** @internal The value held from the door, carried only when the caller supplied one, so an
+   * omitted transport does not arrive downstream as a key that is present and undefined. */
+  if (checkedTransport !== undefined) clientOpts.transport = checkedTransport;
   var postUrl = _scepUrl(baseUrl, "PKIOperation");
   var httpMethod = _pkiMethod(opts);
   var csrView = guard.bytes.snapshotSource(opts.csr, ScepError, "scep/bad-input", "the csr");
@@ -1168,6 +1196,8 @@ function _resolveQueryTarget(opts) {
 async function _queryOperation(messageType, baseUrl, opts, verbName) {
   opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep." + verbName + " options");
   guard.identifier.assertKnownKeys(opts, _QUERY_KEYS, _err, "scep/bad-input", "pki.scep." + verbName + " has an unknown option: ");
+  /** @internal Held from the door and forwarded below, so a later read cannot answer differently. */
+  var checkedTransport = _assertTransport(opts);
   if (opts.caCert == null) throw _err("scep/bad-input", "a caCert (the SCEP CA certificate DER) is required");
   if (opts.signer == null || typeof opts.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
   if (opts.recipientKey == null || typeof opts.recipientKey !== "object") throw _err("scep/bad-input", "a recipientKey { cert, key } is required to decrypt the CA response");
@@ -1176,7 +1206,8 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var want = _resolveQueryTarget(opts);
-  var clientOpts = { transport: opts.transport, tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
+  var clientOpts = { tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
+  if (checkedTransport !== undefined) clientOpts.transport = checkedTransport;
   var senderNonce = nodeCrypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
   var httpMethod = _pkiMethod(opts);
@@ -1287,7 +1318,7 @@ async function getCrl(baseUrl, opts) {
   return { crl: match, crls: crls, transactionId: q.transactionId };
 }
 
-var _TRANSPORT_KEYS = { transport: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, tls: 1, allowCrossOriginRedirect: 1, proxy: 1 };
+var _TRANSPORT_KEYS = Object.assign(Object.create(null), { transport: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, tls: 1, allowCrossOriginRedirect: 1, proxy: 1 });
 function _withKeys(extra) { var o = {}, k; for (k in _TRANSPORT_KEYS) o[k] = 1; for (k in extra) o[k] = 1; return o; }
 var _CACAPS_KEYS = _withKeys({ expectSCEPStandard: 1, requireStrongProfile: 1 });
 var _CACERT_KEYS = _withKeys({ expectedFingerprint: 1, fingerprintAlgorithm: 1 });

package/lib/schema-all.js

@@ -53,7 +53,7 @@ var frameworkError = require("./framework-error");
 var SchemaError = frameworkError.SchemaError;
 var PemError = frameworkError.PemError;
 
-var ENTRY = { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input", ber: true };
+var ENTRY = Object.assign(Object.create(null), { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input", ber: true });
 
 var FORMATS = [
   {

package/lib/schema-attrcert.js

@@ -280,7 +280,7 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
  *   ac.attributes[0].name;   // "role"
  *   ac.validity.notAfterTime;// Date
  */
-var PARSE_OPTS = { pemLabel: "ATTRIBUTE CERTIFICATE", PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" };
+var PARSE_OPTS = intrinsic.assign(intrinsic.create(null), { pemLabel: "ATTRIBUTE CERTIFICATE", PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" });
 
 function _legacyV1Error() {
   return new AttrCertError("attrcert/legacy-v1-not-supported", "AttributeCertificateV1 (X.509-1997) is obsolete and not parsed by this build (RFC 5755 sec. 1)");
@@ -448,6 +448,7 @@ function _decodeClassList(node, C) {
   var bs;
   try { bs = asn1.read.bitString(node); } catch (e) { throw NS.E(C, "Clearance classList must be a BIT STRING", e); }
   schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw NS.E(C, m); });
+  // allow:registry-table-inherits-object-prototype -- the classList record an operator reads by field name, whose keys are the fixed _CLASSLIST_NAMES; the omitted-classList default at the foot of this file builds the same shape
   var names = [], flags = {}, reserved = [];
   var total = bs.bytes.length * 8 - bs.unusedBits;
   for (var bit = 0; bit < total; bit++) {
@@ -490,7 +491,7 @@ function _clearance(buf) {
   return { policyId: policyId, classList: classList, securityCategories: securityCategories };
 }
 
-var _ATTR_VALUE_DECODERS = {};
+var _ATTR_VALUE_DECODERS = intrinsic.create(null);
 _ATTR_VALUE_DECODERS[_Oav("role")] = _role;
 _ATTR_VALUE_DECODERS[_Oav("clearance")] = _clearance;
 _ATTR_VALUE_DECODERS[oid.fromArcs([2, 5, 1, 5, 55])] = _clearance;
@@ -570,7 +571,7 @@ function _aaControls(buf) {
   return out;
 }
 
-var _AC_EXT_DECODERS = {};
+var _AC_EXT_DECODERS = intrinsic.create(null);
 _AC_EXT_DECODERS[_Oav("acAuditIdentity")] = _acAuditIdentity;
 _AC_EXT_DECODERS[_Oav("targetInformation")] = _targetInformation;
 _AC_EXT_DECODERS[_Oav("noRevAvail")] = _noRevAvail;

package/lib/schema-c509.js

@@ -51,17 +51,17 @@ var NO_EXPIRY_SECONDS = 253402300799n;
 
 function _name(n) { var d = oid.byName(n); if (!d) { throw new Error("schema-c509: unregistered OID name " + JSON.stringify(n)); } return n; }
 
-var SIG_ALG_BY_INT = {
+var SIG_ALG_BY_INT = Object.assign(Object.create(null), {
   0: _name("ecdsaWithSHA256"),
   1: _name("ecdsaWithSHA384"),
   2: _name("ecdsaWithSHA512"),
-};
-var PK_ALG_BY_INT = {
+});
+var PK_ALG_BY_INT = Object.assign(Object.create(null), {
   0: { alg: _name("rsaEncryption") },
   1: { alg: _name("ecPublicKey"), curve: _name("prime256v1") },
   2: { alg: _name("ecPublicKey"), curve: _name("secp384r1") },
   3: { alg: _name("ecPublicKey"), curve: _name("secp521r1") },
-};
+});
 var EC_FIELD_BYTES = Object.assign(Object.create(null), { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 });
 /** @internal Curve identity follows the dotted OID; pki.oid.register can rename one at any time. */
 var EC_CURVE_BY_OID = Object.create(null);
@@ -69,7 +69,7 @@ Object.keys(EC_FIELD_BYTES).forEach(function (n) { EC_CURVE_BY_OID[oid.byName(n)
 var SIG_ALG_BY_OID = Object.create(null);
 Object.keys(SIG_ALG_BY_INT).forEach(function (k) { SIG_ALG_BY_OID[oid.byName(SIG_ALG_BY_INT[k])] = SIG_ALG_BY_INT[k]; });
 
-var ATTR_BY_INT = {
+var ATTR_BY_INT = Object.assign(Object.create(null), {
   0: _name("emailAddress"),
   1: _name("commonName"),
   2: _name("surname"),
@@ -81,8 +81,8 @@ var ATTR_BY_INT = {
   8: _name("organizationName"),
   9: _name("organizationalUnitName"),
   10: _name("title"),
-};
-var EXT_BY_INT = {
+});
+var EXT_BY_INT = Object.assign(Object.create(null), {
   1: _name("subjectKeyIdentifier"),
   2: _name("keyUsage"),
   3: _name("subjectAltName"),
@@ -106,7 +106,7 @@ var EXT_BY_INT = {
   35: _name("autonomousSysIdsV2"),
   36: _name("ocspNoCheck"),
   38: _name("tlsFeature"),
-};
+});
 var EXT_COMPACT = Object.assign(Object.create(null), {
   subjectKeyIdentifier: 1, keyUsage: 1, basicConstraints: 1, authorityKeyIdentifier: 1,
   extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
@@ -115,31 +115,31 @@ var EXT_COMPACT = Object.assign(Object.create(null), {
   policyMappings: 1, policyConstraints: 1, subjectDirectoryAttributes: 1,
   ipAddrBlocks: 1, autonomousSysIds: 1, ipAddrBlocksV2: 1, autonomousSysIdsV2: 1,
 });
-var EKU_BY_INT = {
+var EKU_BY_INT = Object.assign(Object.create(null), {
   0: _name("anyExtendedKeyUsage"), 1: _name("serverAuth"), 2: _name("clientAuth"),
   3: _name("codeSigning"), 4: _name("emailProtection"), 8: _name("timeStamping"), 9: _name("ocspSigning"),
   10: _name("pkinitClientAuth"), 11: _name("pkinitKdc"), 12: _name("secureShellClient"), 13: _name("secureShellServer"),
   14: _name("bundleSecurity"), 15: _name("cmcCA"), 16: _name("cmcRA"), 17: _name("cmcArchive"), 18: _name("cmKGA"),
   20: _name("fanDevice"),
-};
-var EKU_TO_INT = {};
+});
+var EKU_TO_INT = Object.create(null);
 Object.keys(EKU_BY_INT).forEach(function (k) { EKU_TO_INT[oid.byName(EKU_BY_INT[k])] = Number(k); });
 
 var NS = pkix.makeNS("c509", C509Error, oid);
 var GN_LEAF = pkix.generalName(NS, { decodeValue: true });
 var GN_LEAF_SUBTREE = pkix.generalName(NS, { decodeValue: true, subtreeBase: true });
 
-var ON_NAME_BY_INT = { "-1": _name("hardwareModuleName"), "-2": _name("smtpUtf8Mailbox"), "-3": _name("macAddress") };
-var ON_INT_BY_OID = {};
+var ON_NAME_BY_INT = Object.assign(Object.create(null), { "-1": _name("hardwareModuleName"), "-2": _name("smtpUtf8Mailbox"), "-3": _name("macAddress") });
+var ON_INT_BY_OID = Object.create(null);
 Object.keys(ON_NAME_BY_INT).forEach(function (k) { ON_INT_BY_OID[oid.byName(ON_NAME_BY_INT[k])] = Number(k); });
-var IA_BY_INT = {
+var IA_BY_INT = Object.assign(Object.create(null), {
   1: _name("ocsp"), 2: _name("caIssuers"), 3: _name("id-ad-timeStamping"), 5: _name("id-ad-caRepository"),
   10: _name("id-ad-rpkiManifest"), 11: _name("id-ad-signedObject"), 13: _name("id-ad-rpkiNotify"),
-};
-var IA_TO_INT = {};
+});
+var IA_TO_INT = Object.create(null);
 Object.keys(IA_BY_INT).forEach(function (k) { IA_TO_INT[oid.byName(IA_BY_INT[k])] = Number(k); });
 
-var CP_BY_INT = {
+var CP_BY_INT = Object.assign(Object.create(null), {
   0: _name("anyPolicy"), 1: _name("domain-validated"), 2: _name("organization-validated"),
   3: _name("individual-validated"), 4: _name("ev-guidelines"),
   7: _name("id-cp-ipAddr-asNumber"), 8: _name("id-cp-ipAddr-asNumber-v2"),
@@ -150,11 +150,11 @@ var CP_BY_INT = {
   33: _name("id-rspRole-dp-pb-v2"), 34: _name("id-rspRole-dp-pb"),
   35: _name("id-rspRole-ds-tls-v2"), 36: _name("id-rspRole-ds-tls"),
   37: _name("id-rspRole-ds-auth-v2"), 38: _name("id-rspRole-ds-auth"),
-};
-var CP_TO_INT = {};
+});
+var CP_TO_INT = Object.create(null);
 Object.keys(CP_BY_INT).forEach(function (k) { CP_TO_INT[oid.byName(CP_BY_INT[k])] = Number(k); });
-var PQ_BY_INT = { 1: _name("cps"), 2: _name("unotice") };
-var PQ_TO_INT = {};
+var PQ_BY_INT = Object.assign(Object.create(null), { 1: _name("cps"), 2: _name("unotice") });
+var PQ_TO_INT = Object.create(null);
 Object.keys(PQ_BY_INT).forEach(function (k) { PQ_TO_INT[oid.byName(PQ_BY_INT[k])] = Number(k); });
 
 
@@ -543,7 +543,7 @@ function _ipIntToSeq(n) {
   out[0] -= 1;
   return Buffer.from(out);
 }
-var _IP_WIDTH = { 1: 4, 2: 16 };
+var _IP_WIDTH = Object.assign(Object.create(null), { 1: 4, 2: 16 });
 
 function _ipLow(seq, width) {
   var v = Buffer.alloc(width);
@@ -1013,7 +1013,7 @@ function _extValueToDer(name, node, isNative) {
       if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a certificatePolicies value must be a CBOR array");
       var cpKids = node.children;
       if (cpKids.length === 0 || cpKids.length % 2 !== 0) throw _err("c509/bad-extensions", "a certificatePolicies array must be non-empty (policyIdentifier, qualifiers) pairs (sec. 3.3)");
-      var polInfos = [], seenPolicy = {};
+      var polInfos = [], seenPolicy = Object.create(null);
       for (var cpi = 0; cpi + 1 < cpKids.length; cpi += 2) {
         var quals = cpKids[cpi + 1];
         if (quals.majorType !== 4 || !quals.children) throw _err("c509/bad-extensions", "a certificatePolicies qualifiers slot must be a CBOR array");

package/lib/schema-cmc.js

@@ -62,21 +62,21 @@ var OID_RA_IDENTITY_WITNESS = O("id-cmc-raIdentityWitness");
 
 var BODY_PART_MAX = 4294967295n;
 
-var STATUS_BY_VALUE = {
+var STATUS_BY_VALUE = Object.assign(Object.create(null), {
   0: "success", 2: "failed", 3: "pending", 4: "noSupport",
   5: "confirmRequired", 6: "popRequired", 7: "partial",
-};
+});
 
-var FAIL_INFO_BY_VALUE = {
+var FAIL_INFO_BY_VALUE = Object.assign(Object.create(null), {
   0: "badAlg", 1: "badMessageCheck", 2: "badRequest", 3: "badTime", 4: "badCertId",
   5: "unsupportedExt", 6: "mustArchiveKeys", 7: "badIdentity", 8: "popRequired",
   9: "popFailed", 10: "noKeyReuse", 11: "internalCAError", 12: "tryLater",
   13: "authDataFail",
-};
+});
 
-var CMC_CARRIERS = { signedData: 1, authData: 1 };
+var CMC_CARRIERS = Object.assign(Object.create(null), { signedData: 1, authData: 1 });
 
-var CONTROL_PLACEMENT = {};
+var CONTROL_PLACEMENT = Object.create(null);
 CONTROL_PLACEMENT[OID_RESPONSE_BODY] = "pkiResponse";
 CONTROL_PLACEMENT[OID_RA_IDENTITY_WITNESS] = "pkiData";
 

package/lib/schema-cmp.js

@@ -462,15 +462,15 @@ var POLL_REP_CONTENT = schema.seqOf(POLL_REP_ENTRY, {
 var BODY_ARMS = ["ir", "ip", "cr", "cp", "p10cr", "popdecc", "popdecr", "kur", "kup",
   "krr", "krp", "rr", "rp", "ccr", "ccp", "ckuann", "cann", "rann", "crlann",
   "pkiconf", "nested", "genm", "genp", "error", "certConf", "pollReq", "pollRep"];
-var CRMF_ARMS = { 0: true, 2: true, 7: true, 9: true, 13: true };
-var DECODED_ARMS = {
+var CRMF_ARMS = Object.assign(Object.create(null), { 0: true, 2: true, 7: true, 9: true, 13: true });
+var DECODED_ARMS = Object.assign(Object.create(null), {
   1: CERT_REP_MESSAGE, 3: CERT_REP_MESSAGE, 8: CERT_REP_MESSAGE, 14: CERT_REP_MESSAGE,
   10: KEY_REC_REP_CONTENT,
   11: REV_REQ_CONTENT, 12: REV_REP_CONTENT,
   21: GEN_MSG_CONTENT, 22: GEN_MSG_CONTENT,
   23: ERROR_MSG_CONTENT, 24: CERT_CONFIRM_CONTENT,
   25: POLL_REQ_CONTENT, 26: POLL_REP_CONTENT,
-};
+});
 
 var BODY = schema.decode(function (n, ctx) {
   if (n.tagClass !== "context" || !n.children) {

package/lib/schema-cms.js

@@ -84,17 +84,17 @@ var OID_COMPRESSED_DATA = oid.byName("compressedData");
 var OID_DATA = oid.byName("data");
 var OID_ORI_KEM = oid.byName("kem");
 
-var WRAP_KEK_LENGTHS = {};
+var WRAP_KEK_LENGTHS = Object.create(null);
 WRAP_KEK_LENGTHS[oid.byName("aes128-wrap")] = 16;
 WRAP_KEK_LENGTHS[oid.byName("aes192-wrap")] = 24;
 WRAP_KEK_LENGTHS[oid.byName("aes256-wrap")] = 32;
 
-var KEM_CT_LENGTHS = {};
+var KEM_CT_LENGTHS = Object.create(null);
 ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { KEM_CT_LENGTHS[oid.byName(n)] = oid.kemParams(n).ct; });
 
 var AEAD_GCM_ICVLENS = new Set([12, 13, 14, 15, 16]);
 var AEAD_CCM_ICVLENS = new Set([4, 6, 8, 10, 12, 14, 16]);
-var AEAD_ALGS = {};
+var AEAD_ALGS = Object.create(null);
 ["aes128-GCM", "aes192-GCM", "aes256-GCM"].forEach(function (n) { AEAD_ALGS[oid.byName(n)] = "gcm"; });
 ["aes128-CCM", "aes192-CCM", "aes256-CCM"].forEach(function (n) { AEAD_ALGS[oid.byName(n)] = "ccm"; });
 
@@ -107,15 +107,15 @@ var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_SIGNING_TIME = oid.byName("signingTime");
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
 
-var ATTR_FORBIDDEN_IN = {};
+var ATTR_FORBIDDEN_IN = Object.create(null);
 ATTR_FORBIDDEN_IN[OID_CONTENT_TYPE] = { unsigned: true, unauth: true, unprotected: true };
 ATTR_FORBIDDEN_IN[OID_MESSAGE_DIGEST] = { unsigned: true, unauth: true, unprotected: true };
 ATTR_FORBIDDEN_IN[OID_SIGNING_TIME] = { unsigned: true, unauth: true, unprotected: true };
 ATTR_FORBIDDEN_IN[OID_COUNTERSIGNATURE] = { signed: true, auth: true, unauth: true, unprotected: true };
-var ATTR_PLACE_LABELS = {
+var ATTR_PLACE_LABELS = Object.assign(Object.create(null), {
   signed: "a signed attribute", unsigned: "an unsigned attribute", auth: "an authenticated attribute",
   unauth: "an unauthenticated attribute", unprotected: "an unprotected attribute",
-};
+});
 
 function _checkAttrPlacement(attrs, place) {
   for (var i = 0; i < attrs.length; i++) {
@@ -284,8 +284,14 @@ function rawElement(item) {
   return { bytes: item.node.bytes, tagClass: item.node.tagClass, tagNumber: item.node.tagNumber };
 }
 
-var CERT_CHOICE_TAGS = { universal: {}, context: { 0: true, 1: true, 2: true, 3: true } };
-var CRL_CHOICE_TAGS = { universal: {}, context: { 1: true } };
+var CERT_CHOICE_TAGS = Object.assign(Object.create(null), {
+  universal: Object.create(null),
+  context: Object.assign(Object.create(null), { 0: true, 1: true, 2: true, 3: true }),
+});
+var CRL_CHOICE_TAGS = Object.assign(Object.create(null), {
+  universal: Object.create(null),
+  context: Object.assign(Object.create(null), { 1: true }),
+});
 CERT_CHOICE_TAGS.universal[asn1.TAGS.SEQUENCE] = true;
 CRL_CHOICE_TAGS.universal[asn1.TAGS.SEQUENCE] = true;
 function rawChoiceElement(allowed, code, what) {
@@ -510,6 +516,7 @@ function keyIdentifierSchema(keyIdName, assert, code, what) {
   ], {
     assert: assert, code: code, what: what,
     build: function (m) {
+      // allow:registry-table-inherits-object-prototype -- a fixed-shape parse record read as rid / kekid, whose one computed key is the keyIdName argument both callers pass as a string literal
       var out = {};
       out[keyIdName] = m.fields[keyIdName].value;
       out.date = m.fields.date.present ? m.fields.date.value : null;

package/lib/schema-crmf.js

@@ -140,7 +140,7 @@ var POPO_SIGNING_KEY = schema.seq([
   },
 });
 
-var POPOPRIVKEY_METHODS = { 0: "thisMessage", 1: "subsequentMessage", 2: "dhMAC", 3: "agreeMAC", 4: "encryptedKey" };
+var POPOPRIVKEY_METHODS = Object.assign(Object.create(null), { 0: "thisMessage", 1: "subsequentMessage", 2: "dhMAC", 3: "agreeMAC", 4: "encryptedKey" });
 function popoPrivKey(type) {
   return schema.decode(function (n, ctx) {
     if (!n.children || n.children.length !== 1) {

package/lib/schema-csr.js

@@ -52,7 +52,7 @@ var DIRECTORY_STRING_TAGS = [
   asn1.TAGS.UTF8_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.TELETEX_STRING,
   asn1.TAGS.UNIVERSAL_STRING, asn1.TAGS.BMP_STRING,
 ];
-var RECOGNIZED_ATTRIBUTE_VALUE = {};
+var RECOGNIZED_ATTRIBUTE_VALUE = Object.create(null);
 RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("extensionRequest")] = function (node, ctx) {
   try { return { extensions: schema.walk(EXTENSIONS, node, ctx).result }; }
   catch (e) {

package/lib/schema-engine.js

@@ -279,6 +279,7 @@ function _walkSeq(schema, node, ctx) {
   var kids = _assertShape(schema, node, ctx);
   _assertArity(schema, kids, ctx);
 
+  // allow:registry-table-inherits-object-prototype -- the record a schema's own check and build callbacks read as m.fields, whose keys are the field names that schema declared rather than anything the input supplies
   var fields = {};
   var idx = 0;
   for (var f = 0; f < schema.fields.length; f++) {
@@ -322,7 +323,7 @@ function _walkSeq(schema, node, ctx) {
 }
 
 function _consumeTrailing(fld, kids, start, fields, ctx) {
-  var byTag = {};
+  var byTag = Object.create(null);
   for (var m = 0; m < fld.members.length; m++) byTag[fld.members[m].tag] = fld.members[m];
   var last = fld.minTag != null ? fld.minTag - 1 : -1;
   for (var i = start; i < kids.length; i++) {

package/lib/schema-pkcs12.js

@@ -176,7 +176,7 @@ var SAFE_BAG = schema.seq([
     var attributes = [];
     var friendlyName = null;
     var localKeyId = null;
-    var seen = {};
+    var seen = Object.create(null);
     if (m.fields.bagAttributes.present) {
       var items = m.fields.bagAttributes.value.items;
       for (var i = 0; i < items.length; i++) {

package/lib/schema-pkix.js

@@ -676,6 +676,7 @@ function certExtensionDecoders(ns) {
     for (var z = 0; z < bs.bytes.length; z++) { if (bs.bytes[z] !== 0) { anyBit = true; break; } }
     if (!anyBit) throw ns.E(C, "KeyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
     schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw ns.E(C, m); });
+    // allow:registry-table-inherits-object-prototype -- the decoded KeyUsage record, whose keys are the fixed KU_BITS names the schema declares rather than anything the certificate supplies
     var out = {};
     _forEach(KU_BITS, function (nm, bit) {
       var byte = bit >> 3, mask = 0x80 >> (bit & 7);
@@ -821,6 +822,7 @@ function certExtensionDecoders(ns) {
   function authorityKeyIdentifier(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var kids = seqChildren(buf, C, "AuthorityKeyIdentifier");
+    // allow:registry-table-inherits-object-prototype -- the decoded AuthorityKeyIdentifier record, read by the three field names the schema declares rather than by anything the certificate supplies
     var out = { keyIdentifier: null, authorityCertIssuer: null, authorityCertSerialNumber: null };
     var lastTag = -1;
     _forEach(kids, function (k) {
@@ -867,6 +869,7 @@ function certExtensionDecoders(ns) {
       if (dp.tagClass !== "universal" || dp.tagNumber !== _T.SEQUENCE || !dp.children) {
         throw ns.E(C, "DistributionPoint must be a SEQUENCE { distributionPoint?, reasons?, cRLIssuer? }");
       }
+      // allow:registry-table-inherits-object-prototype -- the decoded DistributionPoint record, read by the three field names the schema declares rather than by anything the certificate supplies
       var out = { distributionPoint: null, reasons: null, cRLIssuer: null };
       var lastTag = -1;
       _forEach(dp.children, function (f) {

package/lib/schema-tsp.js

@@ -58,10 +58,10 @@ var OID_SIGNING_CERT_V2 = oid.byName("signingCertificateV2");
 
 var TAGS = asn1.TAGS;
 
-var FAILURE_BITS = {
+var FAILURE_BITS = Object.assign(Object.create(null), {
   0: "badAlg", 2: "badRequest", 5: "badDataFormat", 14: "timeNotAvailable",
   15: "unacceptedPolicy", 16: "unacceptedExtension", 17: "addInfoNotAvailable", 25: "systemFailure",
-};
+});
 
 
 var GEN_TIME = pkix.generalizedTime(NS, { code: "tsp/bad-gentime", message: "genTime must be a GeneralizedTime (RFC 3161 sec. 2.4.2)", allowFractional: true });