@blamejs/pki 0.8.61 → 0.9.0

package/lib/schema-pkix.js

@@ -330,7 +330,7 @@ function _blockCap(given, ceiling, what, PemError) {
  * label is the only thing separating a CERTIFICATE from a TRUSTED CERTIFICATE or a PRIVATE KEY, and
  * the byte offset it started at, so a fault in a file of hundreds names the one object it is about. */
 function pemDecodeBundle(text, opts, PemError, detect) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var maxBlocks = _blockCap(opts.maxBlocks, constants.LIMITS.PEM_MAX_BLOCKS, "maxBlocks", PemError);
   var maxDecoded = _blockCap(opts.maxDecodedBytes, constants.LIMITS.PEM_MAX_DECODED_BYTES, "maxDecodedBytes", PemError);
   var route = opts.route === true;
@@ -739,7 +739,7 @@ function versionReader(ns, accept) {
 }
 
 function algorithmIdentifier(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   return schema.seq([
     schema.field("algorithm", schema.oidLeaf()),
     schema.optional("parameters", schema.any(), { whenAny: true }),
@@ -761,7 +761,7 @@ function algorithmIdentifier(ns, opts) {
  *  (RFC 5652 sec. 10.2.4). CMS names the type and RFC 9763 sec. 3.1 reuses it inside a CSR attribute,
  *  so the shape is defined once and each caller supplies its own code and name for the refusal. */
 function issuerAndSerialNumber(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   return schema.seq([
     schema.field("issuer", name(ns)),
     schema.field("serialNumber", schema.integerLeaf()),
@@ -952,7 +952,7 @@ function relativeDistinguishedName(ns) {
   return schema.setOf(attributeTypeAndValue(ns), { assert: "set", min: 1, code: ns.prefix + "/bad-rdn", what: "RelativeDistinguishedName" });
 }
 function name(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   function nameBuild(m) {
     var rdns = [], parts = [];
     _forEach(m.items, function (rdnItem) {
@@ -978,7 +978,7 @@ function name(ns, opts) {
 }
 
 function generalizedTime(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-time");
   var message = opts.message || "the time must be a GeneralizedTime";
   var readOpts = opts.allowFractional ? { allowFractional: true } : undefined;
@@ -991,7 +991,7 @@ function generalizedTime(ns, opts) {
 }
 
 function utf8Text(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-freetext");
   var message = opts.message || "the element must be a UTF8String";
   return schema.decode(function (n, ctx) {
@@ -1003,7 +1003,7 @@ function utf8Text(ns, opts) {
 }
 
 function rawNonEmptySequence(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-sequence");
   var message = opts.message || "expected a non-empty universal SEQUENCE";
   return schema.decode(function (n, ctx) {
@@ -1069,7 +1069,7 @@ var GN_IA5 = _assign(_create(null), { 1: 1, 2: 1, 6: 1 });
 var DIRECTORY_STRING_TAGS = [asn1.TAGS.UTF8_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.TELETEX_STRING,
   asn1.TAGS.UNIVERSAL_STRING, asn1.TAGS.BMP_STRING];
 function generalName(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-general-name");
   var decodeValue = opts.decodeValue === true;
   var subtreeBase = opts.subtreeBase === true;
@@ -1165,7 +1165,7 @@ function generalName(ns, opts) {
 }
 
 function generalNames(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var code = opts.code || (ns.prefix + "/bad-general-names");
   var gn = generalName(ns, { code: code, decodeValue: opts.decodeValue === true, subtreeBase: opts.subtreeBase === true });
   function build(m) { return { names: _map(m.items, function (it) { return it.value; }), bytes: m.node.bytes }; }
@@ -2528,7 +2528,7 @@ function extension(ns) {
   });
 }
 function extensions(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var EXT = extension(ns);
   var extOpts = {
     min: 1, code: ns.prefix + "/bad-extensions", what: "Extensions",
@@ -2540,7 +2540,7 @@ function extensions(ns, opts) {
 }
 
 function spki(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   return schema.seq([
     schema.field("algorithm", algorithmIdentifier(ns)),
     schema.field("subjectPublicKey", schema.bitString()),
@@ -2558,7 +2558,7 @@ function spki(ns, opts) {
 }
 
 function attribute(ns, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var minValues = opts.minValues === undefined ? 1 : opts.minValues;
   return schema.seq([
     schema.field("type", schema.oidLeaf()),

package/lib/sign-scheme.js

@@ -124,7 +124,7 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
 }
 
 function _resolveSignScheme(cert, so, noSignedAttrs, E) {
-  so = so || {};
+  so = so || intrinsic.create(null);
   var alg = cert.subjectPublicKeyInfo.algorithm;
   var keyOid = alg.oid;
   var comp = compositeSig.COMPOSITE_ALGS[keyOid];
@@ -180,7 +180,7 @@ function _resolveSignScheme(cert, so, noSignedAttrs, E) {
 }
 
 function _assertKeyMatchesScheme(key, imp, E, what) {
-  var ka = key.algorithm || {};
+  var ka = key.algorithm || intrinsic.create(null);
   var subject = what || "CryptoKey";
   if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) {
     var hint = (_toUpperCase(_String(ka.name)) === "RSA-PSS" && _toUpperCase(_String(imp.name)) === "RSASSA-PKCS1-V1_5")

package/lib/sigstore.js

@@ -1715,7 +1715,7 @@ async function verifyBundle(bundle, opts) {
   if (bundle === null || typeof bundle !== "object" && typeof bundle !== "string" && !_isBuffer(bundle)) {
     throw new TypeError("verifyBundle: bundle must be an object, JSON string, or Buffer");
   }
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _VERIFY_BUNDLE_OPTS, _err, "sigstore/bad-input", "pki.sigstore.verifyBundle has an unknown option ");
   /** @internal parseBundle takes the copy, so every check below runs on plain data that cannot change
    * under it, whichever field it reads and however many times. */

package/lib/smime.js

@@ -33,6 +33,10 @@
  *   algorithm-agnostic.
  */
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: requiring the guard-intrinsic captures arms the module whole, which counts
+ * 176 live runtime reads here. */
+var _create = Object.create;
 var frameworkError = require("./framework-error.js");
 var mime = require("./mime.js");
 var cms = require("./cms-verify.js");
@@ -654,7 +658,7 @@ function _base64Body(der) {
  */
 async function sign(content, signers, opts) {
   content = _fixedContent(content);
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, SIGN_OPTS, "sign");
   signers = _snapshotSignersFitForMail(signers);
   var hp = opts.protectHeaders === true;
@@ -767,7 +771,7 @@ function _capped(msg) {
  *   if (res.valid) { res.content; res.signers[0].sid; }
  */
 async function verify(message, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, VERIFY_OPTS, "verify");
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
@@ -877,7 +881,7 @@ function _cmsEncryptOpts(opts) {
  */
 async function encrypt(content, recipients, opts) {
   content = _fixedContent(content);
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, ENCRYPT_OPTS, "encrypt");
   var hp = opts.protectHeaders === true;
   var hpList = hp ? _hpHeaderList(opts.headers) : null;
@@ -934,7 +938,7 @@ async function encrypt(content, recipients, opts) {
  *   res.authenticated;  // true here (an AEAD content cipher); false for an enveloped-only CBC message, which carries no integrity
  */
 async function decrypt(message, keyMaterial, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, DECRYPT_OPTS, "decrypt");
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
@@ -984,7 +988,7 @@ async function decrypt(message, keyMaterial, opts) {
  */
 async function compress(content, opts) {
   content = _fixedContent(content);
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, COMPRESS_OPTS, "compress");
   var entity = _entityBytes(content, opts);
   var cOpts = {};
@@ -1018,7 +1022,7 @@ async function compress(content, opts) {
  *   res.content;   // the recovered inner MIME entity
  */
 async function decompress(message, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, DECOMPRESS_OPTS, "decompress");
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
@@ -1064,7 +1068,7 @@ var CERTS_ONLY_OPTS = Object.assign(Object.create(null), { crls: 1 });
  *   var p7c = pki.smime.buildCertsOnly([leafDer]);
  */
 function buildCertsOnly(certs, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, CERTS_ONLY_OPTS, "buildCertsOnly");
   var der = _toBuf(cms.certsOnly(certs, { crls: opts.crls }));
   return _capped(Buffer.concat([_pkcs7MimeHead("certs-only", "smime.p7c"), _base64Body(der), mime.CRLF]));

package/lib/tlog.js

@@ -671,7 +671,7 @@ function parseCheckpoint(input) {
  */
 var _CHECKPOINT_OPTS = _assign(_create(null), { origin: 1 });
 async function verifyCheckpoint(input, keys, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _CHECKPOINT_OPTS, _err,
     "tlog/bad-input", "unknown verifyCheckpoint option ");
   /** @internal ONE read of the caller's input, shared by the decode and the verification below. Reading
@@ -1209,7 +1209,7 @@ async function _tilePath(lo, hi, m, size, unitAt) {
  */
 var _INCLUSION_PROOF_KEYS = _assign(_create(null), { index: 1, size: 1, read: 1 });
 async function inclusionProof(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _INCLUSION_PROOF_KEYS, _err,
     "tlog/bad-input", "unknown inclusionProof option ");
   var size = guard.range.uint64(opts.size, _err, "tlog/bad-input", "size");

package/lib/tls-cert-compress.js

@@ -167,7 +167,7 @@ function _resolveAllowed(opts) {
  *   pki.schema.x509.parse(out.certificate.entries[0].certData).subject;
  */
 function decompressCertificate(bytes, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   /** @internal Viewed, CAPPED, then COPIED, and only then are the options read. A view stays a window
    *  onto the caller's buffer, and `_resolveCap` reads `opts`, which is caller code when it is an
    *  accessor: a `maxOutputBytes` getter that wrote another valid message of the same length over the
@@ -262,7 +262,7 @@ function decompressCertificate(bytes, opts) {
  *   pki.schema.x509.parse(msg.entries[0].certData).subject;
  */
 function parseCertificateMessage(bytes, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var type = opts.certificateType === undefined ? "X509" : opts.certificateType;
   if (type !== "X509" && type !== "RawPublicKey") {
     throw _err("tls/bad-input", "opts.certificateType must be \"X509\" or \"RawPublicKey\"");
@@ -315,7 +315,7 @@ function parseCertificateMessage(bytes, opts) {
  *   wire.length < message.length;                       // true
  */
 function compressCertificate(certificateMessage, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   /** @internal Copied, not viewed. `opts.algorithm` is read below, and reading an option is caller code
    *  when it is an accessor, so over a view it would run between the message being looked at and being
    *  compressed and replace what this verb compresses, after it had accepted the message it was handed.

package/lib/tsp-sign.js

@@ -155,7 +155,7 @@ var _SIGN_OPTS = intrinsic.assign(intrinsic.create(null), {
 });
 
 function _sign(messageImprint, tsa, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (messageImprint && typeof messageImprint === "object" && !Buffer.isBuffer(messageImprint)) {
     guard.identifier.assertKnownKeys(messageImprint, _IMPRINT_KEYS, _err, "tsp/bad-input", function (k) {
       return "unknown messageImprint field " + JSON.stringify(k) + " (the imprint is { hashAlgorithm, hashedMessage })";
@@ -169,7 +169,7 @@ function _sign(messageImprint, tsa, opts) {
         " (the TSA is { cert, key }; a signing option belongs in the third argument)";
     });
   }
-  var mi = messageImprint || {};
+  var mi = messageImprint || intrinsic.create(null);
   if (!mi.hashAlgorithm || !NODE_DIGEST[guard.text.keyOf(mi.hashAlgorithm)]) throw _err("tsp/unsupported-algorithm", "messageImprint.hashAlgorithm must be a supported hash name");
   if (!guard.bytes.isByteSource(mi.hashedMessage)) throw _err("tsp/bad-input", "messageImprint.hashedMessage must be a BufferSource");
   var _signHmLen = guard.bytes.source(mi.hashedMessage, TspError, "tsp/bad-input", "messageImprint.hashedMessage").length;
@@ -292,10 +292,10 @@ function _assertImprint(mi) {
 var _REQUEST_OPTS = intrinsic.assign(intrinsic.create(null), { reqPolicy: 1, nonce: 1, certReq: 1, extensions: 1, pem: 1 });
 
 function request(messageImprint, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.request options must be an object");
   guard.identifier.assertKnownKeys(opts, _REQUEST_OPTS, _err, "tsp/bad-input", "pki.tsp.request has an unknown option ");
-  var mi = messageImprint || {};
+  var mi = messageImprint || intrinsic.create(null);
   if (mi && typeof mi === "object" && !Buffer.isBuffer(mi)) {
     guard.identifier.assertKnownKeys(mi, _IMPRINT_KEYS, _err, "tsp/bad-input", function (k) {
       return "unknown messageImprint field " + JSON.stringify(k) +
@@ -379,7 +379,7 @@ function parseRequest(input) { return schemaTsp.parseRequest(input); }
 var _RESPONSE_OPTS = intrinsic.assign(intrinsic.create(null), { status: 1, statusString: 1, failInfo: 1, pem: 1 });
 
 function response(token, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.response options must be an object");
   guard.identifier.assertKnownKeys(opts, _RESPONSE_OPTS, _err, "tsp/bad-input", "pki.tsp.response has an unknown option ");
   var st = opts.status;
@@ -664,7 +664,7 @@ function _anyCritical(extensions) {
 }
 
 async function verify(token, data, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
     "pki.tsp.verify has an unknown option (the anchor option is `trustAnchors`) ");

package/lib/tuf.js

@@ -804,7 +804,7 @@ function _checkedPublicKey(key, d) {
       guard.text.showValue(importedType) + " public key, so the signature would be checked " +
       "under an algorithm the metadata does not name");
   }
-  var details = guard.crypto.keyDetails(imported) || {};
+  var details = guard.crypto.keyDetails(imported) || _create(null);
   if (d.curve !== null && details.namedCurve !== d.curve) {
     throw _err("tuf/bad-key", "the scheme " + key.scheme + " names the " + d.curve +
       " curve; the key is on " + guard.text.showValue(details.namedCurve));
@@ -889,7 +889,7 @@ function _publicFromPem(pem, label) {
  */
 var _VERIFY_KEYS = intrinsic.assign(_create(null), { metadata: 1, keys: 1, role: 1 });
 async function verifySignatures(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _VERIFY_KEYS, _err, "tuf/bad-input", "unknown verifySignatures option ");
   /** @internal Every caller-owned input is taken ONCE, at the top, and everything below reads the copy.
    *  Validating the caller's object and then reading it again is two reads, and a member reached through an
@@ -1297,7 +1297,7 @@ function _asRoot(input, label) {
  */
 var _UPDATE_KEYS = intrinsic.assign(_create(null), { trustedRoot: 1, candidates: 1, now: 1 });
 async function updateRoot(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _UPDATE_KEYS, _err, "tuf/bad-input", "unknown updateRoot option ");
   /** @internal The instant is CAPTURED here, at the call, into a Date this function owns. A Date is
    *  mutable and the caller keeps theirs, and the freeze-attack check runs at the END, after a signature

package/lib/webauthn-mds.js

@@ -318,7 +318,7 @@ function _verifyMetadataBlob(blob, opts) {
   });
   var leaf = chain[0];
   _assertLeafSigns(leaf);
-  var leafAlg = (leaf.subjectPublicKeyInfo.algorithm || {}).name;
+  var leafAlg = (leaf.subjectPublicKeyInfo.algorithm || intrinsic.create(null)).name;
   var leafSchemes = typeof leafAlg === "string" ? LEAF_SCHEMES_BY_SPKI_ALG[leafAlg] : undefined;
   if (!leafSchemes || !leafSchemes[algRow.scheme]) {
     throw _err("webauthn/unsupported-algorithm", "the metadata BLOB alg " + header.alg + " does not match the x5c leaf key type " + intrinsic.stringify(leafAlg));

package/lib/webauthn.js

@@ -268,7 +268,7 @@ function _certKeyAlgNames(cose) {
   return [];
 }
 function _assertCertKeyAlgorithm(cert, cose, E) {
-  var alg = (cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.algorithm) || {};
+  var alg = (cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.algorithm) || intrinsic.create(null);
   var want = _certKeyAlgNames(cose);
   if (!want.length || intrinsic.indexOf(want, alg.name) < 0) {
     throw E("webauthn/key-mismatch", "the attestation certificate carries a " + intrinsic.stringify(alg.name) +

package/lib/x509-sign.js

@@ -166,7 +166,7 @@ var RESERVED_ALT_EXTS = intrinsic.assign(intrinsic.create(null), (function () {
 })());
 
 function _buildExtensions(extSpec, ctx) {
-  if (extSpec == null) extSpec = {};
+  if (extSpec == null) extSpec = intrinsic.create(null);
   if (_isArray(extSpec)) {
     var seenExt = intrinsic.create(null), arrCa = false, arrKeyCertSign = false, arrPathLen = false, arrNameConstraints = false;
     var oidBc = O("basicConstraints"), oidKu = O("keyUsage"), oidNc = O("nameConstraints"), oidPm = O("policyMappings");
@@ -708,9 +708,9 @@ function sign(spec, issuer, opts) {
 }
 
 function _sign(spec, issuer, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("x509/bad-input", "the certificate spec must be an object");
-  issuer = issuer || {};
+  issuer = issuer || intrinsic.create(null);
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "x509/bad-input", function (k) {
     return "unknown certificate spec field " + JSON.stringify(k) +
       (k === "issuer" ? "; the issuer is the SECOND argument to pki.x509.sign, not a spec field" : "") +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.61",
+  "version": "0.9.0",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:dc638a09-3eb3-4620-b84b-f3edd3453ec6",
+  "serialNumber": "urn:uuid:f52bf92f-41f7-4879-bff9-6077f2cf84f5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-07T23:02:52.146Z",
+    "timestamp": "2026-10-08T01:34:26.318Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.61",
+      "bom-ref": "@blamejs/pki@0.9.0",
       "type": "application",
       "name": "pki",
-      "version": "0.8.61",
+      "version": "0.9.0",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.61",
+      "purl": "pkg:npm/%40blamejs/pki@0.9.0",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.61",
+      "ref": "@blamejs/pki@0.9.0",
       "dependsOn": []
     }
   ]