@blamejs/pki 0.8.61 → 0.9.0

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.9.0 — 2026-10-08
+
+Import any namespace by name from an ESM caller, and give every record the toolkit builds for an omitted argument no prototype.
+
+### Added
+
+- Every namespace is an ESM named import. `import { x509, cms, path, schema, lint, webcrypto } from "@blamejs/pki"` resolves, as does any of the other 41; `import pki from "@blamejs/pki"` is unchanged and gives the same object `require` does. The package remains CommonJS, runs on Node LTS as shipped, and adds no build step and no transpilation: every value in the export object is a bare identifier bound above it, which is the shape Node's export reader can follow. A `.d.ts` generated from the source comment blocks is still to come.
+
+### Changed
+
+- A record the toolkit defaults for an omitted argument no longer inherits from `Object.prototype`. A caller passing its own object is unaffected: only the record built when the argument is absent changed, and a field read off it that the caller did not supply now reads as absent.
+
+### Fixed
+
+- A revocation deadline is measured against the toolkit's own clock. `pki.path.fetchingChecker` builds its deadline with no options record, so the record it defaulted carried `Object.prototype` and the clock came from an inherited `now`: one reporting a time far ahead made the deadline expired before the first fetch, and the fetch that would have retrieved a CRL or an OCSP response was never made. The same record supplies the bound a decoded size is held to, where an inherited `max` of zero refuses every value.
+- `pki.inspect.asn1`, `pki.inspect.certificate` and the other report verbs are held to the caps their caller passed. With the options argument omitted the record they defaulted carried `Object.prototype`, so an inherited `maxBytes` became the cap the render was held to and a report that renders normally came back refused.
+- A signer signs with the identity its caller named. `pki.x509.sign`, `pki.crl.sign` and `pki.attrcert.sign` default an omitted issuer or extension record, so an inherited `cert`, `key`, `name`, `publicKey`, `basicConstraints` or `keyUsage` was read as if supplied. Reaching the read required getting past the spec's unknown-field door and its copy depth cap, both of which refused it, so the effect was a refused signing call rather than a signature under another identity. The record has no prototype now, which is where the answer belongs.
+- A client believes what a server actually sent. `pki.acme`, `pki.cmp`, `pki.ct`, `pki.est`, `pki.scep` and the revocation fetcher each default an omitted response record, where an inherited `status`, `body` or `headers` stands in for what arrived. The content type a CMP transfer and a CT fetch check, and the declared content length the HTTP transport enforces its response cap against, were each read through a header record defaulted the same way.
+- The records every other verb defaults are the same shape and are converted with them: the options records of `pki.asn1.decode`, `pki.cbor.decode`, the schema engine and the shared PKIX sub-schemas, the signer and countersigner records in `pki.cms.sign`, the MAC and bag encryption records in `pki.pkcs12.build`, the message-imprint records in `pki.tsp.sign`, the header records in `pki.est`, the request and defaults records in the HTTP transport, the setup records in `pki.hpke`, the client option records in `pki.ct`, the certificate-transparency policy `pki.path.validate` passes on, the fallback key in `pki.jose`, the algorithm records the WebAuthn verifiers read a name off, and the algorithm record a signature scheme reads off a key.
+
+### Documentation
+
+- `THREAT-MODEL.md` states the boundary the toolkit's use of captured operations rests on. The operations a check decides through are copied from the runtime while the modules load, which is what makes a later replacement unable to change a verdict, and that also means code running before the first `require` of the package can replace an operation before the copy is taken. Load the package before running untrusted code in the same realm.
+
 ## v0.8.61 — 2026-10-07
 
 Take every cryptographic operation, and every question about which key a key is, through an operation captured when the toolkit loads, so a replacement installed afterwards cannot decide a secret, a tag, a key type or a verdict.

package/README.md

@@ -71,6 +71,13 @@ no transpilation.
 var pki = require("@blamejs/pki");
 ```
 
+An ESM caller can import the whole namespace object or any namespace by name:
+
+```js
+import pki from "@blamejs/pki";
+import { x509, cms, path, schema } from "@blamejs/pki";
+```
+
 ## Quickstart
 
 ### Parse an X.509 certificate

package/index.js

@@ -73,8 +73,53 @@ var inspect    = require("./lib/inspect");
 var lint       = require("./lib/lint");
 var webauthn   = require("./lib/webauthn");
 
+/* Every value in the export object below is a bare identifier, and the ten `var`s here are what make
+ * that true. Node detects a CommonJS module's named exports with `cjs-module-lexer`, which follows
+ * `name: ident` and a shorthand and stops at anything else: a member expression, a nested object
+ * literal, a call. `version: constants.version` was the first entry, so it stopped the lexer before
+ * any namespace was seen and `import { x509 } from "@blamejs/pki"` failed for all 47 of them, with
+ * only `default`, `module.exports` and `version` reaching an ESM caller. Hoisting is the whole fix;
+ * it needs no build step and changes nothing a `require` caller sees. A new namespace added below
+ * must be a bare identifier, which a vector in `esm-named-exports.test.js` holds it to. */
+var _version = constants.version;
+var _identityNs = { match: identity.match };
+var _cmsNs = {
+  verify: cms.verify, sign: cms.sign, countersign: cms.countersign, encrypt: cms.encrypt,
+  authenticate: cms.authenticate, decrypt: cms.decrypt, compress: cms.compress, decompress: cms.decompress,
+  digest: cms.digest, verifyDigest: cms.verifyDigest,
+  certsOnly: cms.certsOnly, parseCertsOnly: cms.parseCertsOnly, isCertsOnly: cms.isCertsOnly,
+  timestampImprint: cms.timestampImprint, attachTimestamp: cms.attachTimestamp,
+};
+var _cmpNs = {
+  build: cmp.build, transfer: cmp.transfer, wellKnownUrl: cmp.wellKnownUrl, verify: cmp.verify,
+  openKeyPackage: cmp.openKeyPackage, session: cmp.session,
+};
+var _keyNs = {
+  encrypt: key.encrypt, decrypt: key.decrypt, export: key.export, import: key.import,
+  generate: key.generate, publicFromPrivate: key.publicFromPrivate,
+};
+var _kemNs = { encapsulate: compositeKem.encapsulate, decapsulate: compositeKem.decapsulate };
+var _scepNs = {
+  build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert,
+  getNextCACert: scep.getNextCACert, enroll: scep.enroll, renew: scep.renew, getCert: scep.getCert,
+  getCrl: scep.getCrl, parseCapabilities: scep.parseCapabilities,
+};
+var _transportNs = { https: transport.https, peerChain: transport.peerChain };
+var _lintNs = {
+  certificate: lint.certificate,
+  csr:         lint.csr,
+  crl:         lint.crl,
+  ocsp:        lint.ocsp,
+  cms:         lint.cms,
+  tsp:         lint.tsp,
+  attrcert:    lint.attrcert,
+  rules:       lint.rules,
+  profiles:    lint.profiles,
+};
+var _webcryptoNs = _webcryptoNamespace();
+
 module.exports = {
-  version:   constants.version,
+  version:   _version,
   // `C` is the terse call-site alias; `constants` the discoverable name.
   C:         constants,
   constants: constants,
@@ -97,7 +142,7 @@ module.exports = {
   // `identity` is RFC 9525 service identity -- pki.identity.match says whether a certificate
   // presents a name the client was trying to reach. A separate answer from path validation,
   // which pki.path.validate gives; sec. 1.2 has an application need both.
-  identity:  { match: identity.match },
+  identity:  _identityNs,
   // `ct` is RFC 6962 Certificate Transparency -- pki.ct.parseSctList decodes the
   // SCT-list extension a certificate / OCSP response carries; the signature is
   // surfaced raw for external verification (pki.ct.reconstructSignedData).
@@ -113,11 +158,7 @@ module.exports = {
   // Curated, the way pki.cmp is: cms-verify also exports `setEngine`, the seam path-validate injects
   // its path builder through. That is plumbing between two internal modules, not an operator verb,
   // and exporting the module wholesale would put it on the public surface.
-  cms:       { verify: cms.verify, sign: cms.sign, countersign: cms.countersign, encrypt: cms.encrypt,
-    authenticate: cms.authenticate, decrypt: cms.decrypt, compress: cms.compress, decompress: cms.decompress,
-    digest: cms.digest, verifyDigest: cms.verifyDigest,
-    certsOnly: cms.certsOnly, parseCertsOnly: cms.parseCertsOnly, isCertsOnly: cms.isCertsOnly,
-    timestampImprint: cms.timestampImprint, attachTimestamp: cms.attachTimestamp },
+  cms:       _cmsNs,
   smime:     smime,
   // `cmc` interprets an RFC 5272 Full PKI Response into one terminal verdict;
   // `pki.schema.cmc` is the decoder underneath it.
@@ -147,8 +188,7 @@ module.exports = {
   // and pki.cmp.verify checks the protection on an incoming one. pki.cmp.openKeyPackage opens a
   // centrally generated private key a CA delivered. Parsing lives at pki.schema.cmp.parse.
   // setEngine is the @internal path-validate seam -- kept off the public surface.
-  cmp:       { build: cmp.build, transfer: cmp.transfer, wellKnownUrl: cmp.wellKnownUrl, verify: cmp.verify,
-    openKeyPackage: cmp.openKeyPackage, session: cmp.session },
+  cmp:       _cmpNs,
   // `crl` is the RFC 5280 sec. 5 CRL producing side -- pki.crl.sign builds and signs a CertificateList
   // over any registry algorithm, pki.crl.verify checks a CRL signature through the one path-validation
   // signature engine, and pki.crl.isRevoked looks a serial up. Parsing lives at pki.schema.crl.parse.
@@ -158,8 +198,7 @@ module.exports = {
   // pki.key.generate / publicFromPrivate over every WebCrypto algorithm. Parsing lives at pki.schema.pkcs8.
   // Curated: correspondsTo is the @internal check pki.cmp.session holds a delivered key and its
   // certificate to each other with, and stays off the public surface.
-  key:       { encrypt: key.encrypt, decrypt: key.decrypt, export: key.export, import: key.import,
-    generate: key.generate, publicFromPrivate: key.publicFromPrivate },
+  key:       _keyNs,
   // `pkcs12` is the RFC 7292 / RFC 9579 PKCS#12 (.p12/.pfx) producing side -- pki.pkcs12.build assembles a
   // password-integrity store (key/cert/crl/secret bags in an AuthenticatedSafe, shrouded keys + cert safes
   // under PBES2, a classic HMAC or PBMAC1 MAC), and pki.pkcs12.verifyMac checks a store's MAC. Parsing lives
@@ -193,7 +232,7 @@ module.exports = {
   // `kem` is composite ML-KEM key establishment (draft-ietf-lamps-pq-composite-kem):
   // pki.kem.encapsulate / decapsulate over a post-quantum ML-KEM hybridized with a
   // traditional RSA-OAEP / ECDH / X25519 / X448, mixed through the SHA3-256 combiner.
-  kem:       { encapsulate: compositeKem.encapsulate, decapsulate: compositeKem.decapsulate },
+  kem:       _kemNs,
   // `sigstore` verifies a Sigstore bundle (the npm --provenance artifact): a
   // keyless Fulcio signature over a DSSE-wrapped in-toto SLSA attestation with a
   // Rekor inclusion proof -- offline, zero-dep, against caller-pinned trust.
@@ -204,14 +243,14 @@ module.exports = {
   // splitter, certs-only + serverkeygen validators over CMS, the enroll-attribute
   // builders, the HTTP response classifier). est opens no socket; fail-closed.
   est:       est,
-  scep:      { build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert, getNextCACert: scep.getNextCACert, enroll: scep.enroll, renew: scep.renew, getCert: scep.getCert, getCrl: scep.getCrl, parseCapabilities: scep.parseCapabilities },
+  scep:      _scepNs,
   // `transport` is the shared fail-closed node:https transport the enrollment clients
   // drive -- pki.transport.https(defaults) returns a transport(request) -> {status,
   // headers, body}. The toolkit's sole socket choke point: explicit trust anchors,
   // rejectUnauthorized always on, a TLS floor, a streaming response cap, and a timeout.
   // Curated to the public `https` factory; the module's `isBlockedIp` classifier is an
   // internal helper pki.path.build reuses (require the module), not a public surface.
-  transport: { https: transport.https, peerChain: transport.peerChain },
+  transport: _transportNs,
   // `jose` is the RFC 7515 Flattened JWS + RFC 7638 JWK-thumbprint layer: a strict
   // base64url codec, a bounded duplicate-key-rejecting JSON reader, profiled
   // sign/verify (ACME-outer / EAB-inner / keyChange-inner), and an alg registry
@@ -241,17 +280,7 @@ module.exports = {
   // `lint` is named member by member rather than passed through, because the module also exports the
   // build-time gate the authoring verbs call and the two readers its conformance vectors use. Those
   // are internal plumbing, so they stay off the public namespace.
-  lint: {
-    certificate: lint.certificate,
-    csr:         lint.csr,
-    crl:         lint.crl,
-    ocsp:        lint.ocsp,
-    cms:         lint.cms,
-    tsp:         lint.tsp,
-    attrcert:    lint.attrcert,
-    rules:       lint.rules,
-    profiles:    lint.profiles,
-  },
+  lint: _lintNs,
   // `webauthn` verifies a W3C WebAuthn / passkey attestation -- pki.webauthn.verify
   // checks the attestation-statement signature + each format's structural bindings
   // (packed / tpm / android-key / apple / fido-u2f / none) and surfaces the x5c chain
@@ -263,7 +292,7 @@ module.exports = {
   // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
   // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
   // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.
-  webcrypto: _webcryptoNamespace(),
+  webcrypto: _webcryptoNs,
 };
 
 function _webcryptoNamespace() {

package/lib/acme.js

@@ -1796,7 +1796,7 @@ function _parseLinkValue(raw) {
   return { uri: uri, rel: rel, anchor: anchor, relSeen: relSeen };
 }
 function _parseLinkRelation(headers, base, relName, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var raw = null;
   var hNames = guard.identifier.optionNames(headers);
   for (var hi = 0; hi < hNames.length; hi++) {
@@ -2047,11 +2047,11 @@ function client(directoryUrl, opts) {
 
   function _send(method, url, headers, body) { return _sendFollowing(method, url, headers, body, 0); }
   function _sendFollowing(method, url, headers, body, redirects) {
-    var reqHeaders = Object.assign({ "user-agent": CLIENT_USER_AGENT }, headers || {});
+    var reqHeaders = Object.assign({ "user-agent": CLIENT_USER_AGENT }, headers || intrinsic.create(null));
     return guard.async.deferred(function () {
       return guard.async.invoked(transport, [{ method: method, url: url, headers: reqHeaders, body: body, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "acme/bad-input", "opts.transport");
     }).then(function (res) {
-      res = res || {};
+      res = res || intrinsic.create(null);
       /** @internal The transport is a caller-supplied option, so its response is a caller object: the body
        *  and the status are read ONCE here and every check and the returned value read those locals. Read
        *  per use, the body whose length was capped need not be the body handed back, which is how a
@@ -2145,7 +2145,7 @@ function client(directoryUrl, opts) {
 
   function _newAccount(payloadOpts) {
     return _resource("newAccount").then(function (url) {
-      return _post(url, newAccount, payloadOpts || {}, "jwk", undefined, [200, 201]).then(function (res) {
+      return _post(url, newAccount, payloadOpts || intrinsic.create(null), "jwk", undefined, [200, 201]).then(function (res) {
         var loc = res.headers["location"];
         if (!_isString(loc)) throw E("acme/no-account-url", "newAccount did not return an account URL in a Location header (RFC 8555 sec. 7.3)");
         var account = validate("account", _json(res));
@@ -2156,7 +2156,7 @@ function client(directoryUrl, opts) {
   }
   function _newOrder(payloadOpts) {
     return _resource("newOrder").then(function (url) {
-      return _post(url, newOrder, payloadOpts || {}, "kid", undefined, [201]).then(function (res) {
+      return _post(url, newOrder, payloadOpts || intrinsic.create(null), "kid", undefined, [201]).then(function (res) {
         var loc = res.headers["location"];
         if (!_isString(loc)) throw E("acme/no-order-url", "newOrder did not return an order URL in a Location header (RFC 8555 sec. 7.4)");
         return { order: validate("order", _json(res)), url: _resolveLocation(loc, url) };

package/lib/asn1-der.js

@@ -210,7 +210,7 @@ function _asBuffer(input, who) {
  *   node.tagNumber === pki.asn1.TAGS.SEQUENCE;
  */
 function decode(input, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var buf = _asBuffer(input, "decode");
   var maxBytes = guard.limits.cap(opts.maxBytes, "maxBytes", constants.LIMITS.DER_MAX_BYTES);
   var maxDepth = guard.limits.depthCap(opts.maxDepth, "maxDepth", constants.LIMITS.DER_MAX_DEPTH);

package/lib/attrcert-sign.js

@@ -448,7 +448,7 @@ function _emitNamedExtension(out, seen, k, val, ctx) {
   _push(out,_b.ext(eOid, meta.critical, valueDer));
 }
 function _buildExtensions(extSpec, ctx) {
-  if (extSpec == null) extSpec = {};
+  if (extSpec == null) extSpec = intrinsic.create(null);
   if (Array.isArray(extSpec)) {
     if (!extSpec.length) return null;
     var seenA = intrinsic.create(null);
@@ -567,7 +567,7 @@ function _sign(spec, issuer, opts) {
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "attrcert/bad-input", "unknown pki.attrcert.sign option (accepted: pem, pss, digestAlgorithm): ");
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("attrcert/bad-input", "the attribute-certificate spec must be an object");
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "attrcert/bad-input", "unknown spec field ");
-  issuer = issuer || {};
+  issuer = issuer || intrinsic.create(null);
   if (issuer.key == null) throw _err("attrcert/bad-input", "a signing key (issuer.key, the AA's WebCrypto CryptoKey or PKCS#8 private key DER/PEM) is required");
 
   var issuerDnSpec, aaSpki, aaSki = null;

package/lib/cbor-det.js

@@ -36,6 +36,9 @@
  *   leaf readers over its node tree.
  */
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 66 live runtime reads. */
+var _create = Object.create;
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var asn1 = require("./asn1-der");
@@ -241,7 +244,7 @@ function _decodeItem(buf, start, limit, depth, maxD, rules, state) {
  *   pki.cbor.read.uint(node.children[0]); // 1n
  */
 function decode(input, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var buf = _asBuffer(input, "decode");
   var maxBytes = guard.limits.cap(opts.maxBytes, "maxBytes", constants.LIMITS.CBOR_MAX_BYTES);
   var maxDepth = guard.limits.depthCap(opts.maxDepth, "maxDepth", constants.LIMITS.CBOR_MAX_DEPTH);

package/lib/cmc-build.js

@@ -712,7 +712,7 @@ function build(spec, signer, opts) {
 }
 
 async function _build(spec, signer, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Array.isArray(spec) || Buffer.isBuffer(spec)) {
     throw E("cmc/bad-input", "the CMC request spec must be an object");
   }

package/lib/cmp-build.js

@@ -856,7 +856,7 @@ function build(message, opts) {
 }
 
 async function _build(message, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!message || typeof message !== "object" || Buffer.isBuffer(message)) throw _err("cmp/bad-input", "the PKIMessage spec must be an object { header, body }");
   guard.identifier.assertKnownKeys(message, KNOWN_MESSAGE_KEYS, _err, "cmp/bad-input", function (k) {
     return "unknown message field " + JSON.stringify(k) + " (a message carries only header + body)";
@@ -1020,7 +1020,7 @@ function _tlsForTransfer(opts) {
  *  `Symbol.split` is part of that operation. The token decides which parser a response body is
  *  handed to. */
 function _ctypeToken(headers) {
-  var raw = intrinsic.String((headers || {})["content-type"] || "");
+  var raw = intrinsic.String((headers || intrinsic.create(null))["content-type"] || "");
   var parts = intrinsic.splitChar(raw, 59);
   return intrinsic.toLowerCase(_strTrim(parts.length ? parts[0] : ""));
 }
@@ -1067,7 +1067,7 @@ function _assertTransport(opts) {
 }
 
 function _transfer(url, message, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, KNOWN_TRANSFER_OPTS, _err, "cmp/bad-input", "unknown opts field ");
   /** @internal Read once, at the door, and carried from here. Asking again would let an option that
    * answers differently on each read hand back something other than the value that was checked. */
@@ -1095,7 +1095,7 @@ function _transfer(url, message, opts) {
   headers["content-type"] = PKIXCMP;
   var tls = _tlsForTransfer(opts);
   return guard.async.invoked(transport, [{ method: "POST", url: parsedUrl.href, headers: headers, body: der, tls: tls, proxy: proxy, timeout: timeout, maxResponseBytes: maxResponseBytes }], _err, "cmp/bad-input", "opts.transport").then(function (res) {
-    res = res || {};
+    res = res || intrinsic.create(null);
     var h = guard.header.lowerCased(res.headers);
     var body = guard.bytes.isByteSource(res.body)
       ? guard.bytes.source(res.body, CmpError, "cmp/bad-response", "the CMP response body")
@@ -1136,7 +1136,7 @@ function _beforeQueryOrFragment(s) {
 }
 
 function wellKnownUrl(base, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, KNOWN_WELLKNOWN_OPTS, _err, "cmp/bad-input", function (k) {
     return "unknown wellKnownUrl option " + JSON.stringify(k) + " (expected label / operation)";
   });

package/lib/cmp-session.js

@@ -4,6 +4,9 @@
 // @internal
 // lib/cmp-build.js; this file adds the @primitive pki.cmp.session block and re-exports the cmp message
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 174 live runtime reads. */
+var _create = Object.create;
 var cmp = require("./cmp-verify");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
@@ -430,7 +433,7 @@ function _certConfHash(certDer) {
  *   if (answer.outcome === "answered" && answer.present) { var caCerts = answer.value; }
  */
 function session(opts) {
-  if (opts == null) opts = {};
+  if (opts == null) opts = _create(null);
   guard.identifier.assertPlainRecord(opts, _err, "cmp/bad-input", "opts");
   guard.identifier.optionsObject(opts, _err, "cmp/bad-input", "opts");
   guard.identifier.assertKnownKeys(opts, KNOWN_SESSION_OPTS, _err, "cmp/bad-input", "unknown session opts field ");
@@ -668,7 +671,7 @@ function session(opts) {
   }
 
   function _classify(verdict) {
-    var body = verdict.body || {};
+    var body = verdict.body || _create(null);
     var arm = body.arm;
     if (arm === expectedRespArm && txnKind === "revoke") return _classifyRevRep(body);
     if (arm === expectedRespArm && txnKind === "info") return _classifyGenRep(body);
@@ -734,7 +737,7 @@ function session(opts) {
   }
 
   function _classifyRevRep(body) {
-    var d = body.decoded || {};
+    var d = body.decoded || _create(null);
     var list = d.status || [];
     if (list.length !== 1) {
       return { state: "unexpected", reason: "an rp answering a revocation must carry exactly one status (RFC 9483 sec. 4.2); got " + list.length };

package/lib/cmp-verify.js

@@ -811,7 +811,7 @@ function _fixTime(v) {
   return new _Date(guard.time.instantOf(v));
 }
 function _fixVerifyOptions(opts, made) {
-  if (opts == null) opts = {};
+  if (opts == null) opts = _create(null);
   opts = guard.identifier.optionsObject(opts, _err, "cmp/bad-input", "pki.cmp.verify options");
   guard.identifier.assertKnownKeys(opts, KNOWN_VERIFY_OPTS, _err, "cmp/bad-input", "unknown opts field ");
   var f = {

package/lib/cms-compress.js

@@ -4,6 +4,9 @@
 // @internal
 // @module pki.cms + the @primitive blocks live in cms-verify.js, which re-exports these (the
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 5 live runtime reads. */
+var _create = Object.create;
 var zlib = require("zlib");
 var oid = require("./oid");
 var schemaCms = require("./schema-cms");
@@ -21,7 +24,7 @@ var OID_ZLIB = O("id-alg-zlibCompress");
 var NULL_PARAMS_DER = Buffer.from([0x05, 0x00]);
 
 async function compress(content, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var raw = guard.bytes.source(content, CmsError, "cms/bad-input", "content");
   var level = opts.level;
   if (level !== undefined && (typeof level !== "number" || !isFinite(level) || Math.floor(level) !== level)) throw _err("cms/bad-input", "opts.level must be an integer");
@@ -41,7 +44,7 @@ async function compress(content, opts) {
 }
 
 async function decompress(input, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var cap = C.LIMITS.COMPRESS_MAX_BYTES;
   if (opts.maxOutputBytes !== undefined) {
     var mo = opts.maxOutputBytes;

package/lib/cms-decrypt.js

@@ -34,7 +34,7 @@ var CONTENT_KEYBITS = pbes2.CONTENT_KEYBITS;
 var CONTENT_MODE = pbes2.CONTENT_MODE;
 
 async function decrypt(input, keyMaterial, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (keyMaterial == null || typeof keyMaterial !== "object") throw _err("cms/bad-input", "decrypt requires a key-material object");
   /** @internal Read on every route, not only the one that applies it, and read before the message
    * is derived: deriving one runs accessors on a parsed input, which is the caller's own code and
@@ -66,7 +66,7 @@ function _originFields(res, authenticatedBy, originatorInfo) {
 }
 
 async function decryptEnvelopedData(parsed, keyMaterial, opts, contentTypeName) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (keyMaterial == null || typeof keyMaterial !== "object") throw _err("cms/bad-input", "decrypt requires a key-material object");
   var ct = contentTypeName || "envelopedData";
   var recips = parsed.recipientInfos || [];

package/lib/cms-encrypt.js

@@ -426,7 +426,7 @@ function encrypt(content, recipients, opts) {
 }
 
 async function _encryptImpl(content, recipients, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var algName = opts.contentEncryptionAlgorithm || "aes-256-gcm";
   var ca = CONTENT_ALGS[guard.text.keyOf(algName)];
   if (!ca) throw _err("cms/bad-input", "unsupported contentEncryptionAlgorithm " + guard.text.showValue(algName));
@@ -648,7 +648,7 @@ function authenticate(content, recipients, opts) {
 }
 
 async function _authenticateImpl(content, recipients, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var withAttrs = opts.authenticatedAttributes !== false;
   guard.identifier.assertKnownKeys(opts, withAttrs ? _AUTHENTICATE_OPTS_ATTRS : _AUTHENTICATE_OPTS_BARE,
     _err, "cms/bad-input", function (k) {

package/lib/cms-sign.js

@@ -203,7 +203,7 @@ function _assertAlgorithmProtectionPairs(pairs, digestAlgId, armAlgId, armTag) {
 }
 
 function _resolveSignerContext(signer, opts) {
-  var so = signer || {};
+  var so = signer || intrinsic.create(null);
   var keyOnly = so.cert == null && so.spki != null;
   var soKey = so.key;
   var soSpki = keyOnly ? guard.bytes.snapshotSource(so.spki, CmsError, "cms/bad-input", "a key-only signer's spki") : null;
@@ -533,7 +533,7 @@ function _resolveSignerIndices(spec, n) {
 }
 
 function _buildCountersignature(targetSigOctets, countersigner, opts) {
-  var so = countersigner || {};
+  var so = countersigner || intrinsic.create(null);
   var certDer = _normCertDer(so.cert);
   var cert = x509.parse(certDer);
   var scheme = signScheme.resolveSignScheme(cert, so, opts.signedAttributes === false, _signE);

package/lib/crl-sign.js

@@ -240,7 +240,7 @@ function _buildCrlExtensions(spec, ctx) {
   var crlNumberVal = null;
   if (spec.crlNumber != null) { var cn = _boundedInteger(spec.crlNumber, "cRLNumber"); crlNumberVal = cn.value; push("cRLNumber", false, cn.tlv); }
   var ext = spec.extensions;
-  if (ext == null) ext = {};
+  if (ext == null) ext = intrinsic.create(null);
   if (Array.isArray(ext)) {
     var arrBase = null, arrCrlNum = null;
     /** @internal The walk goes through `guard.list.copyMap`, never the caller's own `forEach`. Reached
@@ -391,9 +391,9 @@ function _assertIssuerCanSignCrl(issuerCert) {
 }
 
 function _sign(spec, issuer, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crl/bad-input", "the CRL spec must be an object");
-  issuer = issuer || {};
+  issuer = issuer || intrinsic.create(null);
   var byCert = issuer.cert != null, byName = issuer.name != null;
   guard.identifier.assertKnownKeys(spec, byCert || byName ? KNOWN_SPEC_KEYS_ISSUER_NAMED : KNOWN_SPEC_KEYS,
     _err, "crl/bad-input", function (k) {

package/lib/crmf-sign.js

@@ -1215,7 +1215,7 @@ function _buildCertReqMsg(spec, key, opts) {
 }
 
 function _build(spec, key, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || _isBuffer(spec)) throw _err("crmf/bad-input", "the certificate-request-message spec must be an object");
   var specs;
   if (spec.messages != null) {

package/lib/csr-sign.js

@@ -209,7 +209,7 @@ function sign(spec, key, opts) {
 }
 
 function _sign(spec, key, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("csr/bad-input", "the certification-request spec must be an object");
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "csr/bad-input", "unknown spec field ");
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "csr/bad-input", "pki.csr.sign has an unknown option ");

package/lib/ct.js

@@ -40,6 +40,7 @@
  */
 
 var asn1 = require("./asn1-der.js");
+var _create = require("./guard-intrinsic").create;
 var constants = require("./constants.js");
 var frameworkError = require("./framework-error.js");
 var guard = require("./guard-all.js");
@@ -357,7 +358,7 @@ function _u24Bytes(n) {
 var _X509_ENTRY_KEYS = intrinsic.assign(intrinsic.create(null), { entryType: 1, leafCert: 1 });
 var _PRECERT_ENTRY_KEYS = intrinsic.assign(intrinsic.create(null), { entryType: 1, tbsCertificate: 1, issuerKeyHash: 1 });
 function reconstructSignedData(entry, sct) {
-  entry = entry || {};
+  entry = entry || _create(null);
   if (typeof entry !== "object") throw new CtError("ct/bad-input", "the log entry must be an object { entryType, ... } (RFC 6962 sec. 3.1)");
   var entryType = entry.entryType;
   if (entryType !== 0 && entryType !== 1) {
@@ -493,7 +494,7 @@ async function verifySct(entry, sct, logPublicKey) {
       throw new CtError("ct/log-id-mismatch", "the SCT logId does not match SHA-256 of the provided log key (RFC 6962 sec. 3.2)");
     }
   }
-  var sigInfo = rec.signatureAlgorithm || {};
+  var sigInfo = rec.signatureAlgorithm || _create(null);
   var hashName = CT_HASH[sigInfo.hashName];
   if (!hashName) throw new CtError("ct/unsupported-algorithm", "unsupported SCT hash algorithm " + JSON.stringify(sigInfo.hashName) + " (RFC 6962 sec. 2.1.4 mandates sha256)");
   var alg = _spkiAlg(spki);
@@ -899,7 +900,7 @@ function _classifyLog(sct, logList, entry, opts) {
 }
 
 async function verifySctWithLogList(entry, sct, logList, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var c = _classifyLog(sct, logList, entry, opts);
   if (c.status !== "ok") throw _ctErr(c.code, c.message);
   /** @internal Read before the verify, so the timestamp the verdict states is the one the signature covered.
@@ -1249,7 +1250,7 @@ function _assertTransport(opts) {
  *  `Symbol.split` is part of that operation. The token decides which parser a log's response body is
  *  handed to. */
 function _fetchCtypeToken(headers) {
-  var raw = intrinsic.String((headers || {})["content-type"] || "");
+  var raw = intrinsic.String((headers || _create(null))["content-type"] || "");
   var parts = intrinsic.splitChar(raw, 59);
   return _toLowerCase(_ctTrim(parts.length ? parts[0] : ""));
 }
@@ -1279,7 +1280,7 @@ function _fetchBody(transport, url, req, label) {
     if (req.body !== undefined) request.body = req.body;
     return transport(request);
   }).then(function (res) {
-    res = res || {};
+    res = res || _create(null);
     var h = intrinsic.create(null);
     guard.identifier.optionNames(res.headers).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
     var body = guard.bytes.isByteSource(res.body)
@@ -1581,7 +1582,7 @@ function _uintField(obj, name, code, label) {
 var _STH_KEYS = intrinsic.assign(intrinsic.create(null),
   { timestamp: 1, treeSize: 1, rootHash: 1, signature: 1, raw: 1, then: 1 });
 function sthSignedData(sth) {
-  sth = sth || {};
+  sth = sth || _create(null);
   guard.identifier.assertKnownKeys(sth, _STH_KEYS, _ctErr, "ct/bad-input", "unknown sth field ");
   var ts = guard.range.uint64(sth.timestamp, _ctErr, "ct/bad-input", "sth.timestamp");
   var size = guard.range.uint64(sth.treeSize, _ctErr, "ct/bad-input", "sth.treeSize");
@@ -1627,7 +1628,7 @@ function sthSignedData(sth) {
  *   // -> true
  */
 async function verifySth(sth, logKey) {
-  sth = sth || {};
+  sth = sth || _create(null);
   var signature = _toBuffer(sth.signature, "sth.signature");
   var signedData = sthSignedData({ timestamp: sth.timestamp, treeSize: sth.treeSize, rootHash: sth.rootHash });
   return await _verifyDigitallySigned(signedData, signature, logKey, "the signed tree head");
@@ -1668,7 +1669,7 @@ async function verifySth(sth, logKey) {
  *   sth.treeSize;   // -> 3n
  */
 async function getSth(opts) {
-  var door = _clientDoor(opts || {}, "logKey");
+  var door = _clientDoor(opts || _create(null), "logKey");
   opts = door.o;
   /** @internal ONE read of the option, and the presence check and the copy both decide from it. Reading
    *  it twice let an accessor answer the two separately: a non-null value for the check and an
@@ -1727,7 +1728,7 @@ async function getSth(opts) {
  *   p.verified;   // -> true
  */
 async function getProofByHash(opts) {
-  var door = _clientDoor(opts || {}, null);
+  var door = _clientDoor(opts || _create(null), null);
   opts = door.o;
   var sth = _assertSth(opts.sth, "opts.sth");
   /** @internal Copied for the reason the tree head is: it is sent on the wire and then folded against the
@@ -1783,7 +1784,7 @@ async function getProofByHash(opts) {
  *   c.verified;   // -> true
  */
 async function getSthConsistency(opts) {
-  var door = _clientDoor(opts || {}, null);
+  var door = _clientDoor(opts || _create(null), null);
   opts = door.o;
   var oldSth = _assertSth(opts.oldSth, "opts.oldSth");
   var newSth = _assertSth(opts.newSth, "opts.newSth");
@@ -1841,7 +1842,7 @@ async function getSthConsistency(opts) {
  *   e.entries[0].leafInput;   // -> <Buffer ...>
  */
 async function getEntries(opts) {
-  var door = _clientDoor(opts || {}, null);
+  var door = _clientDoor(opts || _create(null), null);
   opts = door.o;
   var start = guard.range.uint64(opts.start, _ctErr, "ct/bad-input", "opts.start");
   var end = guard.range.uint64(opts.end, _ctErr, "ct/bad-input", "opts.end");
@@ -1899,7 +1900,7 @@ async function getEntries(opts) {
  */
 async function getRoots(opts) {
   /** @internal This message carries no options of its own, so the door's record is all that is used. */
-  var door = _clientDoor(opts || {}, null);
+  var door = _clientDoor(opts || _create(null), null);
   var doc = await _clientJson(door, "get-roots", "roots");
   return guard.verdict.of({ certificates: _b64Array(doc, "certificates", "ct/bad-roots", "roots", undefined, C.LIMITS.CT_MAX_ROOTS) });
 }
@@ -1982,7 +1983,7 @@ async function addPreChain(opts) {
  *  The chain encoding, the response shape, and the refusal when the receipt does not verify are one
  *  rule stated once. */
 async function _addChain(opts, message, entryType) {
-  var door = _clientDoor(opts || {}, "logKey");
+  var door = _clientDoor(opts || _create(null), "logKey");
   opts = door.o;
   /** @internal ONE read of the option, used by the presence check here and by the copy below. Reading it
    *  twice let an accessor answer the two separately, presenting a non-null value to the check and an