@blamejs/pki 0.8.61 → 0.9.0

package/lib/est.js

@@ -533,7 +533,7 @@ function _partMediaType(contentType) {
 }
 
 function parseServerKeygenResponse(body, contentType, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   opts = _knownOpts(opts, PARSE_SERVERKEYGEN_OPTS, "parseServerKeygenResponse");
   var parts = splitMultipartMixed(body, contentType);
   if (parts.length !== 2) throw E("est/bad-multipart", "a serverkeygen response must have exactly two parts (RFC 7030 sec. 4.4.2)");
@@ -617,7 +617,7 @@ function classifyResponse(status, headers, body, opts) {
 }
 
 function _classifyResponse(status, headers, body, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   opts = _knownOpts(opts, CLASSIFY_OPTS, "classifyResponse");
   var op = opts.op;
   if (op !== undefined && op !== null && CLASSIFIABLE_OPS.indexOf(op) === -1) throw E("est/unsupported-operation", "unrecognized EST operation " + guard.text.showValue(op));
@@ -689,7 +689,7 @@ function _classifyResponse(status, headers, body, opts) {
  *   // -> "https://ca.example/.well-known/est/cacerts"
  */
 function paths(baseUrl, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   opts = _knownOpts(opts, PATHS_OPTS, "paths");
   var base = String(baseUrl);
   var prefix = base.slice(0, _stripTrailingSlashEnd(base)) + "/.well-known/est";
@@ -957,7 +957,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   function step() {
     var hopBody = (typeof body === "function" && budgets.onAttempt) ? budgets.onAttempt() : body;
     return guard.async.invoked(transport, [{ method: method, url: _urlHref(url), headers: _headersFor(url), body: hopBody, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "est/bad-input", "opts.transport").then(function (res) {
-      res = res || {};
+      res = res || intrinsic.create(null);
       var blen = _bodyLen(res);
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
       var h = intrinsic.assign(intrinsic.create(null), {
@@ -1159,7 +1159,7 @@ function _certsResult(op, res, opts, csrSpki) {
  *   r.retry && r.retryAfterSeconds;   // 60
  */
 function fullcmc(baseUrl, request, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var der, wanted, sent;
   try {
     if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw E("est/bad-input", "pki.est.fullcmc options must be an object");
@@ -1588,7 +1588,7 @@ function _enroll(op, baseUrl, csrInput, opts, proxySnap) {
  *   r.certificates;   // -> [Buffer, ...] raw, unordered
  */
 function cacerts(baseUrl, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, CACERTS_OPTS, "cacerts");
@@ -1654,7 +1654,7 @@ function cacerts(baseUrl, opts) {
  *   bound.retry;   // true
  */
 function simpleenroll(baseUrl, csrInput, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SIMPLEENROLL_OPTS, "simpleenroll");
@@ -1694,7 +1694,7 @@ function simpleenroll(baseUrl, csrInput, opts) {
  *   r.retry;   // true
  */
 function simplereenroll(baseUrl, csrInput, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SIMPLEREENROLL_OPTS, "simplereenroll");
@@ -1751,7 +1751,7 @@ function _assertConfidentialCipher(res) {
 }
 
 function _ciHeaderList(headers, name) {
-  headers = headers || {};
+  headers = headers || intrinsic.create(null);
   /** @internal The header NAME a value is selected under is folded through the captured conversion on
    *  both sides of the comparison: the match decides which header this response is read from. */
   var lname = _toLowerCase(name), keys = guard.identifier.optionNames(headers), parts = [];
@@ -1765,7 +1765,7 @@ function _ciHeaderList(headers, name) {
 }
 
 function _ciHeader(headers, name) {
-  headers = headers || {};
+  headers = headers || intrinsic.create(null);
   var lname = _toLowerCase(name), keys = guard.identifier.optionNames(headers), found = null, n = 0;
   for (var i = 0; i < keys.length; i++) {
     if (_toLowerCase(keys[i]) !== lname) continue;
@@ -1854,7 +1854,7 @@ async function _serverkeygenResult(res, opts, derived) {
  *   r.retry;   // true -- a 202 is surfaced, never slept
  */
 function serverkeygen(baseUrl, csrInput, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SERVERKEYGEN_OPTS, "serverkeygen");
@@ -1916,7 +1916,7 @@ function _csrattrsResult(res, opts) {
  *   r.available;   // false -- a 404 is "no CSR-attributes policy available"
  */
 function csrattrs(baseUrl, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, CSRATTRS_OPTS, "csrattrs");

package/lib/framework-error.js

@@ -122,7 +122,7 @@ function defineClass(name, opts) {
   if (typeof name !== "string" || name.length === 0) {
     throw new TypeError("defineClass: name must be a non-empty string");
   }
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var withCause = !!opts.withCause;
   var flagKey = "is" + name;
 

package/lib/guard-bytes.js

@@ -281,7 +281,7 @@ function snapshotSource(input, ErrorClass, code, label) {
  *  the budget rather than the shape of the input. The figure is far above any real caller value: an
  *  options bag or a JWK is tens of nodes, and a certificate chain passed as an anchor list is thousands. */
 function snapshotDeep(value, ErrorClass, code, label, opts) {
-  var o = opts || {};
+  var o = opts || _create(null);
   var cap = o.maxDepth == null ? 64 : o.maxDepth;
   var maxNodes = o.maxNodes == null ? constants.LIMITS.DEEP_COPY_MAX_NODES : o.maxNodes;
   return _deep(value, ErrorClass, code, label, cap, 0, o.collect || null, { n: 0, max: maxNodes });

package/lib/guard-limits.js

@@ -4,6 +4,7 @@
 // @internal
 
 var constants = require("./constants");
+var _create = require("./guard-intrinsic").create;
 var _isInteger = require("./guard-intrinsic").isInteger;
 var _freeze = require("./guard-intrinsic").freeze;
 var _sizeOf = require("./guard-intrinsic").sizeOf;
@@ -15,7 +16,7 @@ function _monotonicNow() { return _Number(_hrtimeBigint() / 1000000n); }
 // @enforced-by behavioral -- a config-time cap validator has no rename-proof code
 function cap(value, key, dflt, opts) {
   if (value === undefined) return dflt;
-  opts = opts || {};
+  opts = opts || _create(null);
   /** @internal Each bound is read ONCE, into the value the integer check and the comparison share.
    *  Read twice, the check saw one bound and the comparison another, so an `opts` answering a valid
    *  small integer to the check and a large one to the comparison configured a cap that admitted a
@@ -141,7 +142,7 @@ function budget(limits) {
  */
 // @enforced-by behavioral -- an elapsed-time comparison has no rename-proof shape that separates a deadline from any other subtraction; the vectors driving a checker to its bound are the guard
 function deadline(totalMs, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var rawNow = opts.now;
   var now = typeof rawNow === "function" ? rawNow : _monotonicNow;
   if (!_isInteger(totalMs) || totalMs < 0) {

package/lib/hpke.js

@@ -923,7 +923,7 @@ function _setupS(ids, pkR, opts) {
    *  the subject being the key rather than the ciphertext. `_suite(ids)` stays above both, by necessity:
    *  which KEM this is decides the width the key is held to. */
   var r = _recipPublic(suite, pkR);
-  opts = _options(opts || {}, _SETUP_S_KEYS, "sender setup");
+  opts = _options(opts || intrinsic.create(null), _SETUP_S_KEYS, "sender setup");
   var mode = opts.mode;
   var kem = suite.kem, k;
   if (mode === MODE_AUTH || mode === MODE_AUTH_PSK) {
@@ -978,7 +978,7 @@ function _setupR(ids, enc, skR, opts) {
    *  size of whatever was supplied: a 64 MiB value handed where a 32-byte encapsulation belongs was
    *  copied in full and only then refused. */
   var sealed = _rawKey(enc, _encWidth(suite.kem));
-  opts = _options(opts || {}, _SETUP_R_KEYS, "recipient setup");
+  opts = _options(opts || intrinsic.create(null), _SETUP_R_KEYS, "recipient setup");
   var mode = opts.mode;
   var r = _recipPrivate(suite, skR);
   var kem = suite.kem, ss;

package/lib/http-retry-after.js

@@ -3,6 +3,9 @@
 "use strict";
 // @internal
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 48 live runtime reads. */
+var _create = Object.create;
 var constants = require("./constants");
 var guard = require("./guard-all");
 
@@ -100,7 +103,7 @@ function httpDateMs(s, refMs) {
 }
 
 function parse(value, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var raStr = String(value).trim();
   var out = { retryAfterSeconds: null, retryAfterDate: null };
   if (_isAllDigits(raStr)) {

package/lib/http-transport.js

@@ -339,7 +339,7 @@ function _blockedAddrErr(hostname, address) {
 }
 function _makeGuardedLookup(lookupFn) {
   return function guardedLookup(hostname, options, callback) {
-    lookupFn(hostname, options || {}, function (err, address, family) {
+    lookupFn(hostname, options || intrinsic.create(null), function (err, address, family) {
       if (err) return callback(err);
       /** @internal Each address is read ONCE, the read is what gets classified, and the SNAPSHOT is
        *  what the socket layer is handed. Forwarding the list the resolver returned let the entry be
@@ -633,7 +633,7 @@ function _proxyErrorClass(e, C) {
  *   res.status;   // 200
  */
 function httpsTransport(defaults) {
-  defaults = defaults || {};
+  defaults = defaults || intrinsic.create(null);
   /** @internal Each of these is read ONCE, into the value both the test and the use see, and the
    *  error factory a refusal is built from is one of them. */
   var rawE = defaults.E;
@@ -789,7 +789,7 @@ function httpsTransport(defaults) {
   }
 
   var _transportFn = function transport(request) {
-    request = request || {};
+    request = request || intrinsic.create(null);
     var prep;
     try { prep = _prepare(request); }
     catch (e) { return _promiseReject(_Promise, e); }
@@ -848,7 +848,7 @@ function httpsTransport(defaults) {
             /** @internal Captured for consistency with the rest of the file, not because this gates
              * anything: an understated `content-length` only skips this EARLY refusal, and the cap is
              * enforced below on the bytes actually counted as they arrive. */
-            var declared = intrinsic.parseInt((res.headers || {})["content-length"], 10);
+            var declared = intrinsic.parseInt((res.headers || intrinsic.create(null))["content-length"], 10);
             if (intrinsic.numberIsFinite(declared) && declared > prep.maxBytes) { fail(C("response-too-large"), "the declared content-length " + declared + " exceeds the " + prep.maxBytes + "-byte cap (RFC 7030 sec. 6)"); return; }
             var buf = _bufferAllocUnsafe(0);
             var len = 0;
@@ -1039,7 +1039,7 @@ function httpsTransport(defaults) {
    * connecting directly while a proxy is configured would reach an origin the caller asked not to
    * reach directly. */
   _transportFn.peerChain = function peerChain(request) {
-    request = request || {};
+    request = request || intrinsic.create(null);
     var prep;
     try { prep = _prepare({
       url: request.url,
@@ -1149,6 +1149,6 @@ function httpsTransport(defaults) {
  *   pki.schema.x509.parse(channel.peerChain[0]).subject.dn;    // the leaf's subject
  *   channel.peerCertificate;                                   // the one certificate the endpoint sent
  */
-function peerChain(request, defaults) { return httpsTransport(defaults || {}).peerChain(request); }
+function peerChain(request, defaults) { return httpsTransport(defaults || intrinsic.create(null)).peerChain(request); }
 
 module.exports = { https: httpsTransport, peerChain: peerChain, isBlockedIp: _isBlockedIp, _makeGuardedLookup: _makeGuardedLookup, MAX_TIMEOUT: MAX_TIMEOUT, snapshotProxy: snapshotProxy };

package/lib/inspect.js

@@ -23,6 +23,11 @@
  * @card Read a certificate like `openssl x509 -text`, in pure JS.
  */
 
+/** @internal The record constructor, captured at load. A default record written as `{}` has
+ * `Object.prototype`, so every field the caller omitted is read off the prototype chain. This module
+ * does not take the guard-intrinsic captures, and requiring them arms it whole: measured, that counts
+ * 662 live runtime reads here, which is a migration of its own rather than a line in this change. */
+var _create = Object.create;
 var frameworkError = require("./framework-error");
 var constants = require("./constants");
 var asn1 = require("./asn1-der");
@@ -56,7 +61,7 @@ var OID_UNOTICE = oid.byName("unotice");
 
 var HEX = "0123456789abcdef";
 function _hexColon(buf, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var hex = [];
   for (var i = 0; i < buf.length; i++) {
     var b = buf[i], s = HEX[(b >> 4) & 0xf] + HEX[b & 0xf];
@@ -346,7 +351,7 @@ var EXT_RENDERERS = Object.assign(Object.create(null), {
     return (decoded || []).map(function (ad) {
       var m = null;
       try { m = oid.name(ad.accessMethod); } catch (_e) { /* allow:swallow-unverified display best-effort: an unregistered accessMethod OID falls back to the raw dotted OID below (inspection is best-effort, never a verdict) */ }
-      var loc = ad.accessLocation || {}, lv;
+      var loc = ad.accessLocation || _create(null), lv;
       if (loc.tag === 6) lv = "URI:" + loc.value;
       else if (loc.tag === 2) lv = "DNS:" + loc.value;
       else if (loc.tag === 1) lv = "email:" + loc.value;
@@ -1368,7 +1373,7 @@ function pkcs12Report(input) {
      *  structure, and the outer MacData fields then describe nothing: read from there, a store with 2048
      *  PBKDF2 iterations reported one iteration, an empty salt, and "pbmac1" as its digest. */
     if (p.mac.pbmac1) {
-      var kdf = p.mac.pbmac1.kdf || {};
+      var kdf = p.mac.pbmac1.kdf || _create(null);
       _optLine(L, "        ", "Digest", p.mac.pbmac1.schemeName || p.mac.pbmac1.schemeOid);
       _optLine(L, "        ", "Key Derivation", kdf.prfName || kdf.prfOid);
       _optLine(L, "        ", "Iterations", kdf.iterationCount);
@@ -2363,7 +2368,7 @@ var KNOWN_DUMP_OPTS = Object.assign(Object.create(null),
  *   // Incomplete: the walk could not read the value at offset 5: content length 3 overruns the 0 bytes that remain.
  */
 function asn1Dump(input, opts) {
-  if (opts === undefined || opts === null) opts = {};
+  if (opts === undefined || opts === null) opts = _create(null);
   if (typeof opts !== "object" || Array.isArray(opts)) {
     throw _err("inspect/bad-input", "pki.inspect.asn1 options must be an object");
   }

package/lib/jose.js

@@ -325,7 +325,7 @@ function assertPublicJwk(jwk) {
  */
 var _VERIFY_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, profile: 1 });
 async function verify(jws, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, _VERIFY_KEYS, E, "jose/bad-input", "unknown pki.jose.verify option ");
   /** @internal opts.key is examined several times: the type gate, the RFC 7638 thumbprint comparison
    *  against the embedded jwk, and the key the signature is verified under. An option reached through
@@ -456,7 +456,7 @@ function _fixedPayload(supplied) {
 }
 
 async function sign(opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, _SIGN_KEYS, E, "jose/bad-input", "unknown pki.jose.sign option ");
   var fixedPayload = _fixedPayload(opts.payload);
   var headerJson;
@@ -496,7 +496,7 @@ async function sign(opts) {
   var protectedB64 = b64uEncode(headerBytes);
   var payloadB64 = payload.length === 0 ? "" : b64uEncode(payload);
   var signingInput = _bufferFrom(protectedB64 + "." + payloadB64, "ascii");
-  var jwk = header.jwk || opts.jwk || {};
+  var jwk = header.jwk || opts.jwk || intrinsic.create(null);
   /** @internal `suppliedKey` is the reading taken at the top, so the key adopted for signing, the key the
    *  hash-to-algorithm check approved and the key the expected signature width is computed from are all
    *  one key. */

package/lib/merkle.js

@@ -274,7 +274,7 @@ function emptyRootHash() {
  */
 var _INCLUSION_KEYS = _assign(_create(null), { leafIndex: 1, treeSize: 1, leafHash: 1, rootHash: 1, proof: 1 });
 function verifyInclusion(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _INCLUSION_KEYS, function (c, m) { return new MerkleError(c, m); },
     "merkle/bad-input", "unknown verifyInclusion option ");
   var leafIndex = _coerceCoord(opts.leafIndex, "leafIndex");
@@ -346,7 +346,7 @@ function verifyInclusion(opts) {
  */
 var _CONSISTENCY_KEYS = _assign(_create(null), { oldSize: 1, newSize: 1, oldRoot: 1, newRoot: 1, proof: 1 });
 function verifyConsistency(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _CONSISTENCY_KEYS, function (c, m) { return new MerkleError(c, m); },
     "merkle/bad-input", "unknown verifyConsistency option ");
   var oldSize = _coerceCoord(opts.oldSize, "oldSize");
@@ -456,7 +456,7 @@ function root(leafHashes) {
  */
 var _INCLUSION_PROOF_KEYS = _assign(_create(null), { leafHashes: 1, leafIndex: 1 });
 function inclusionProof(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _INCLUSION_PROOF_KEYS, _merkleErr,
     "merkle/bad-input", "unknown inclusionProof option ");
   var leaves = _leafArray(opts.leafHashes, "leafHashes");
@@ -498,7 +498,7 @@ function inclusionProof(opts) {
  */
 var _CONSISTENCY_PROOF_KEYS = _assign(_create(null), { leafHashes: 1, oldSize: 1 });
 function consistencyProof(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _CONSISTENCY_PROOF_KEYS, _merkleErr,
     "merkle/bad-input", "unknown consistencyProof option ");
   var leaves = _leafArray(opts.leafHashes, "leafHashes");

package/lib/ocsp.js

@@ -350,7 +350,7 @@ function _sign(responseData, responder, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.sign options");
   guard.identifier.assertKnownKeys(opts, _SIGN_OPTS, _err, "ocsp/bad-input",
     "pki.ocsp.sign has an unknown option (the nonce to echo back is `nonce`): ");
-  responseData = responseData || {};
+  responseData = responseData || _ocspIntrinsic.create(null);
   if (typeof responseData !== "object") throw _err("ocsp/bad-input", "the responseData must be an object { responderID, responses, producedAt? }");
   guard.identifier.assertKnownKeys(responseData, _RESPONSE_DATA_KEYS, _err, "ocsp/bad-input", "unknown responseData field (accepted: responderID, responses, producedAt): ");
   if (!responder || typeof responder !== "object") throw _err("ocsp/bad-input", "a responder must be { cert, key }");
@@ -449,7 +449,7 @@ function _responderID(rid, respCert) {
   throw _err("ocsp/bad-input", "responderID must be \"byName\" or \"byKey\"");
 }
 function _buildSingleResponse(r, opts) {
-  r = r || {};
+  r = r || _ocspIntrinsic.create(null);
   var certIdP;
   if (typeof r !== "object") return _promiseReject(_Promise, _err("ocsp/bad-input", "each response entry must be an object"));
   try { guard.identifier.assertKnownKeys(r, _SINGLE_RESPONSE_KEYS, _err, "ocsp/bad-input", "unknown response entry field (accepted: cert, issuer, certID, hashAlgorithm, status, thisUpdate, nextUpdate, singleExtensions): "); }

package/lib/path-validate.js

@@ -1867,7 +1867,7 @@ async function _validate(path, opts, run, scope) {
   }
 
   if (opts.ctLogList != null) {
-    var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || {}, n, opts.time);
+    var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || intrinsic.create(null), n, opts.time);
     var target = null;
     for (var tr = 0; tr < state.results.length; tr++) { if (state.results[tr].index === n - 1) { target = state.results[tr]; break; } }
     if (target) guard.list.append(target.checks, ctCheck);
@@ -2599,7 +2599,7 @@ function _ocspFromBytes(response) {
 }
 
 function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   /** @internal The captured finite test rather than a live `isNaN`: a valid Date's instant is always
    * finite and an invalid one's is not, so the two answer the same question, and the instant is read
    * ONCE into the value the test decides on. */
@@ -3356,7 +3356,7 @@ async function _aiaFetchOne(uri, aia) {
   var res = await guard.async.invoked(aia.transport,
     [{ method: "GET", url: uri, tls: aia.tls, timeout: aia.timeout, maxResponseBytes: aia.maxResponseBytes, blockPrivateAddresses: true }],
     E, "path/bad-input", "opts.transport");
-  res = res || {};
+  res = res || intrinsic.create(null);
   if (res.status !== 200) throw E("path/aia-status", "an AIA fetch returned HTTP " + res.status + " (only 200 is a cert source; no redirect following)");
   var body = guard.bytes.isByteSource(res.body)
     ? guard.bytes.source(res.body, PathError, "path/aia-bad-body", "the AIA response body")

package/lib/pbes2.js

@@ -4,6 +4,9 @@
 // @internal
 
 var asn1 = require("./asn1-der");
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 25 live runtime reads. */
+var _create = Object.create;
 var oid = require("./oid");
 var webcrypto = require("./webcrypto");
 var guard = require("./guard-all");
@@ -110,7 +113,7 @@ function cbcDecrypt(key, iv, ct, keyBits, E, code) {
 }
 
 function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var cipherName = opts.cipher || "aes256-CBC";
   var keyBits = CONTENT_KEYBITS[O(cipherName)];
   if (!keyBits || cipherName.indexOf("CBC") === -1) throw E(prefix + "/bad-input", "unsupported PBES2 cipher " + cipherName + " (AES-CBC only)");
@@ -168,9 +171,10 @@ function pbmac1AlgId(desc) {
 
 function pbmac1(pwBytes, salt, iterationCount, keyLength, prfHash, macHash, message) {
   var subtle = webcrypto.webcrypto.subtle;
-  /** @internal Every step is continued through the capture, and the wipe is attached on BOTH outcomes
-   * rather than through `finally`, which calls the receiver's own `then`. These steps derive the key
-   * a PBMAC1 integrity tag is computed under, so a replacement settling one hands back a tag computed
+  /** @internal Every step is continued through the capture, and the wipe is attached on the success
+   * outcome and the failure outcome separately, not through `finally`, which calls the receiver's own
+   * `then`. These steps derive the key a PBMAC1 integrity tag is computed under, so a replacement
+   * settling one hands back a tag computed
    * under bytes nobody derived, and skips the wipe that keeps the derived key from outliving it. */
   var base = guard.async.chain(subtle.importKey("raw", pwBytes, { name: "PBKDF2" }, false, ["deriveBits"]),
     function (baseKey) {

package/lib/pkcs12-build.js

@@ -237,7 +237,7 @@ function _buildBag(bag, opts, depth) {
     case "shroudedKey": {
       var kDer = _coerceDer(bag.key, "shroudedKey key");
       try { pkcs8.parse(kDer); } catch (e2) { throw _err("pkcs12/bad-input", "shroudedKey key is not a well-formed PKCS#8 PrivateKeyInfo", e2); }
-      var enc = bag.encrypt || {};
+      var enc = bag.encrypt || intrinsic.create(null);
       var bagPbe = _pbeOpts(enc);
       var pw = _pbePasswordOwned(enc.password != null ? enc.password : opts.password);
       var r;
@@ -552,7 +552,7 @@ function build(spec, opts) {
 }
 
 async function _build(spec, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var form = _specForm(spec);
   if (form.isObject) {
     guard.identifier.assertKnownKeys(spec, form.full ? _BUILD_SPEC_FULL_KEYS : _BUILD_SPEC_SHORTHAND_KEYS,
@@ -621,7 +621,7 @@ async function _build(spec, opts) {
             : "");
       });
     }
-    if (opts.mac !== false) _push(pfxChildren,await _buildMacData(opts.mac || {}, opts.password, authSafeDer));
+    if (opts.mac !== false) _push(pfxChildren,await _buildMacData(opts.mac || intrinsic.create(null), opts.password, authSafeDer));
     pfx = b.sequence(pfxChildren);
   }
 
@@ -676,7 +676,7 @@ async function verifyMac(pfx, password, opts) {
 }
 
 async function _verifyMacOfStore(m, password, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (m.integrityMode !== "password" || !m.mac) throw _err("pkcs12/bad-input", "the store carries no password MAC (integrityMode " + m.integrityMode + ")");
   var expected = m.mac.macValue;
   var computed;
@@ -767,7 +767,7 @@ function _capWork(iterations, salt, opts, keyLength, hardCap) {
  *   var keyDer = store.keys[0].pkcs8, certDer = store.certs[0].cert;
  */
 async function open(pfx, password, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, _OPEN_OPTS, _err, "pkcs12/bad-input", "pki.pkcs12.open has an unknown option ");
   /** @internal Every option is taken once, here, and everything below reads the snapshot. A store
    * is opened in many passes, the MAC and then each bag, so an option left on the caller's object is

package/lib/scep.js

@@ -745,7 +745,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
     if (proxySnap != null) req.proxy = proxySnap;
     if (curBody != null) req.body = curBody;
     return guard.async.invoked(transport, [req], _err, "scep/bad-input", "opts.transport").then(function (res) {
-      res = res || {};
+      res = res || intrinsic.create(null);
       var blen = _responseLen(res.body);
       if (blen > budgets.maxResponseBytes) throw _err("scep/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");
       var status = res.status;

package/lib/schema-engine.js

@@ -169,7 +169,7 @@ function time(ns) {
 
 function field(name, schema)          { return { fkind: "required", name: name, schema: schema }; }
 function optional(name, schema, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var match = opts.whenAny
     ? function () { return true; }
     : opts.whenUniversal
@@ -182,51 +182,51 @@ function optional(name, schema, opts) {
            defaultCode: opts.defaultCode };
 }
 function trailing(members, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { fkind: "trailing", members: members, minTag: opts.minTag, maxTag: opts.maxTag,
            unexpectedCode: opts.unexpectedCode, orderCode: opts.orderCode };
 }
 
 
 function seq(fields, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "seq", fields: fields, assert: opts.assert || "sequence", implicitTag: opts.implicitTag, arity: opts.arity,
            code: opts.code, what: opts.what, build: opts.build, checks: opts.checks || [] };
 }
 
 function explicit(tag, schema, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "explicit", tag: tag, schema: schema, emptyCode: opts.emptyCode, code: opts.code, what: opts.what };
 }
 
 function choice(alts, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "choice", alts: alts, code: opts.code, what: opts.what };
 }
 
 function seqOf(item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: opts.assert || "sequence", code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOf(item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: opts.assert || "set", derSetOrder: true, code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function setOfUnique(item, keyFn, opts) {
-  return setOf(item, Object.assign({ unique: keyFn }, opts || {}));
+  return setOf(item, Object.assign({ unique: keyFn }, opts || intrinsic.create(null)));
 }
 function implicitSetOf(tag, item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, derSetOrder: true, code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
 function implicitSeqOf(tag, item, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, code: opts.code, what: opts.what,
            min: opts.min, max: opts.max, maxCode: opts.maxCode,
            unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
@@ -471,7 +471,7 @@ function _wrapConstructed(schema, parts) {
 function _present(v) { return v !== undefined && v !== null; }
 
 function _encodeSeq(schema, value, ctx) {
-  value = value || {};
+  value = value || intrinsic.create(null);
   var parts = [];
   for (var f = 0; f < schema.fields.length; f++) {
     var fld = schema.fields[f];
@@ -578,7 +578,7 @@ function _encodeChoice(schema, value, ctx) {
  *     { code: "app/bad-der", what: "the embedded structure" });
  */
 function embeddedDer(schema, bytes, ctx, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (opts.budget) {
     if (!(opts.budget.remaining > 0)) {
       throw ctx.E(opts.budgetCode || opts.code, (opts.what || "embedded DER") +