@blamejs/pki 0.8.61 → 0.9.1

package/CHANGELOG.md

@@ -4,6 +4,41 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.9.1 — 2026-10-08
+
+Refuse a MIME entity that two conforming readers would read differently, and hold one entity to a bounded number of parts, header lines and parameters.
+
+### Changed
+
+- `pki.smime.verify` and `pki.smime.decrypt` refuse an entity whose `Content-Type` declares one parameter twice, or whose header area declares one field twice. Both readings of such an entity are conforming and they differ, so the signature's own coverage is in question: `boundary` sets where the parts begin, `protocol` and `smime-type` decide whether the entity is accepted, and `micalg` decides which digest is reported back. Previously the verdict followed the order the two occurrences appeared in. `boundary="DECOY"; boundary=<real>` returned `valid: true` while the same two values swapped was refused, and a second `Content-Type: text/plain` placed after the real field returned `valid: true` while the same field placed before it was refused, which left a reader taking the last field seeing `text/plain`, finding no signature part, and reading the message as unsigned. Both orders of both shapes now raise `smime/bad-mime`. An entity naming each parameter and each field once is unaffected, and every occurrence of a field that may legally repeat, such as `Received`, is still readable from `headers`: only resolving a repeated name to a single value is refused.
+- One MIME entity is bounded at 1024 body parts (`pki.constants.LIMITS.MIME_MAX_PARTS`), 1024 header lines (`MIME_MAX_HEADERS`) and 256 `Content-Type` parameters (`MIME_MAX_PARAMS`), and each count is charged as the entity is scanned rather than after it has been taken apart. A 1.4 MiB body declaring 200,000 empty parts previously split into all 200,000, and a 16 MiB header area took 1114 ms and 653 MiB of resident memory to read. A folded field spends one of the 1024 lines per physical line it occupies. `pki.est.splitMultipartMixed` and `pki.est.parseServerKeygenResponse` are held to the same part and header-line bounds, and raise `est/bad-multipart`. From `pki.smime.verify`, an entity over the part bound raises `smime/bad-multipart` and one over the header-line or parameter bound raises `smime/bad-mime`. The 16 MiB entity cap is unchanged and is still applied before any of the bytes are copied.
+- The record `pki.smime.verify` returns, and its `content`, no longer share the buffer the caller passed in. The parsed entity, its header area and its body were views into the caller's own bytes, so a write into that buffer after the verdict returned changed what the caller read back as verified. The entity is copied before it is read, the copy is byte-for-byte the input, and the octets a signature covers are unchanged.
+- The reference at [pkijs.com](https://pkijs.com) reads on a phone. At a 375px viewport the page scrolled 771px wide, and the nineteen navigation groups stood 659px tall even collapsed, so the first screen held navigation and no documentation. The content now starts under a compact header carrying the brand and a menu button, the navigation opens from that button, and tables and code blocks scroll inside their own box instead of widening the page. The menu is a label and a checkbox, so it works with JavaScript off, as the search form does. The layout at 721px and above is unchanged.
+
+## v0.9.0 — 2026-10-08
+
+Import any namespace by name from an ESM caller, and give every record the toolkit builds for an omitted argument no prototype.
+
+### Added
+
+- Every namespace is an ESM named import. `import { x509, cms, path, schema, lint, webcrypto } from "@blamejs/pki"` resolves, as does any of the other 41; `import pki from "@blamejs/pki"` is unchanged and gives the same object `require` does. The package remains CommonJS, runs on Node LTS as shipped, and adds no build step and no transpilation: every value in the export object is a bare identifier bound above it, which is the shape Node's export reader can follow. A `.d.ts` generated from the source comment blocks is still to come.
+
+### Changed
+
+- A record the toolkit defaults for an omitted argument no longer inherits from `Object.prototype`. A caller passing its own object is unaffected: only the record built when the argument is absent changed, and a field read off it that the caller did not supply now reads as absent.
+
+### Fixed
+
+- A revocation deadline is measured against the toolkit's own clock. `pki.path.fetchingChecker` builds its deadline with no options record, so the record it defaulted carried `Object.prototype` and the clock came from an inherited `now`: one reporting a time far ahead made the deadline expired before the first fetch, and the fetch that would have retrieved a CRL or an OCSP response was never made. The same record supplies the bound a decoded size is held to, where an inherited `max` of zero refuses every value.
+- `pki.inspect.asn1`, `pki.inspect.certificate` and the other report verbs are held to the caps their caller passed. With the options argument omitted the record they defaulted carried `Object.prototype`, so an inherited `maxBytes` became the cap the render was held to and a report that renders normally came back refused.
+- A signer signs with the identity its caller named. `pki.x509.sign`, `pki.crl.sign` and `pki.attrcert.sign` default an omitted issuer or extension record, so an inherited `cert`, `key`, `name`, `publicKey`, `basicConstraints` or `keyUsage` was read as if supplied. Reaching the read required getting past the spec's unknown-field door and its copy depth cap, both of which refused it, so the effect was a refused signing call rather than a signature under another identity. The record has no prototype now, which is where the answer belongs.
+- A client believes what a server actually sent. `pki.acme`, `pki.cmp`, `pki.ct`, `pki.est`, `pki.scep` and the revocation fetcher each default an omitted response record, where an inherited `status`, `body` or `headers` stands in for what arrived. The content type a CMP transfer and a CT fetch check, and the declared content length the HTTP transport enforces its response cap against, were each read through a header record defaulted the same way.
+- The records every other verb defaults are the same shape and are converted with them: the options records of `pki.asn1.decode`, `pki.cbor.decode`, the schema engine and the shared PKIX sub-schemas, the signer and countersigner records in `pki.cms.sign`, the MAC and bag encryption records in `pki.pkcs12.build`, the message-imprint records in `pki.tsp.sign`, the header records in `pki.est`, the request and defaults records in the HTTP transport, the setup records in `pki.hpke`, the client option records in `pki.ct`, the certificate-transparency policy `pki.path.validate` passes on, the fallback key in `pki.jose`, the algorithm records the WebAuthn verifiers read a name off, and the algorithm record a signature scheme reads off a key.
+
+### Documentation
+
+- `THREAT-MODEL.md` states the boundary the toolkit's use of captured operations rests on. The operations a check decides through are copied from the runtime while the modules load, which is what makes a later replacement unable to change a verdict, and that also means code running before the first `require` of the package can replace an operation before the copy is taken. Load the package before running untrusted code in the same realm.
+
 ## v0.8.61 — 2026-10-07
 
 Take every cryptographic operation, and every question about which key a key is, through an operation captured when the toolkit loads, so a replacement installed afterwards cannot decide a secret, a tag, a key type or a verdict.

package/MIGRATING.md

@@ -14,6 +14,52 @@ The toolkit has no `deprecate()`-marked surface awaiting removal.
 
 Listed newest-first.
 
+### v0.9.1 — `pki.smime.verify, pki.smime.decrypt, pki.est.splitMultipartMixed, and pki.est.parseServerKeygenResponse`
+
+A MIME entity that names one Content-Type parameter twice, or one header field twice, is refused rather than resolved by position, and one entity is bounded at 1024 body parts, 1024 header lines, and 256 Content-Type parameters.
+
+No API shape changed, so there is nothing to rewrite. What changes is which messages produce a
+verdict.
+
+Two shapes are refused outright, in either order of the two occurrences:
+
+- A `Content-Type` naming one parameter twice, such as `boundary="a"; boundary="b"`, or two
+  `micalg`, `protocol`, or `smime-type` parameters. Raises `smime/bad-mime`.
+- A header area naming one field twice, such as two `Content-Type` lines. Raises
+  `smime/bad-mime`.
+
+RFC 2045 sec. 5.1 gives a parameter one occurrence and RFC 5322 sec. 3.6 gives a singleton field
+one, so an entity naming either twice has two conforming readings that disagree about what the
+entity is: the `boundary` decides which octets a detached signature covers. Before this release
+the verdict followed the order the two occurrences appeared in, so the same two values swapped
+flipped between `valid: true` and a refusal.
+
+A field that may legally repeat, such as `Received`, is unaffected, and every occurrence stays
+readable from `headers`. Only resolving a repeated name to a single value is refused.
+
+Three bounds apply to one entity:
+
+| bound | value | `pki.constants.LIMITS` row |
+| --- | --- | --- |
+| body parts | 1024 | `MIME_MAX_PARTS` |
+| header lines | 1024 | `MIME_MAX_HEADERS` |
+| `Content-Type` parameters | 256 | `MIME_MAX_PARAMS` |
+
+A folded field spends one of the 1024 header lines for each physical line it occupies, so a field
+folded over three lines costs three. From `pki.smime`, an entity over the part bound raises
+`smime/bad-multipart` and one over the header-line or parameter bound raises `smime/bad-mime`;
+the `pki.est` readers raise `est/bad-multipart` for all three. The 16 MiB `MIME_MAX_BYTES` entity
+cap is unchanged.
+
+If a message you must keep reading carries one of the refused shapes, it is ambiguous to every
+other S/MIME implementation as well, and the sender has to emit each parameter and each field
+once. No option restores the previous behavior, because a precedence rule no other reader is
+obliged to share cannot settle which octets a signature covers.
+
+Separately, the entity record and the `content` a verdict is read with no longer share the buffer
+passed in. If you relied on mutating your own input buffer to change what a returned record reads
+back, that no longer works, and the record now holds the bytes the verdict was computed over.
+
 ### v0.6.12 — `pki.crl.verify, pki.pkcs12.verifyMac, and pki.ct.verifySctWithLogList`
 
 Each returned a bare boolean and now returns a verdict object; read `res.valid` where you read the boolean.

package/README.md

@@ -71,6 +71,13 @@ no transpilation.
 var pki = require("@blamejs/pki");
 ```
 
+An ESM caller can import the whole namespace object or any namespace by name:
+
+```js
+import pki from "@blamejs/pki";
+import { x509, cms, path, schema } from "@blamejs/pki";
+```
+
 ## Quickstart
 
 ### Parse an X.509 certificate
@@ -278,7 +285,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.pkcs12` | PKCS#12 (.p12/.pfx) issuance and reading (RFC 7292 / RFC 9579, the latter obsoleted by RFC 9879). `build(spec, opts)` assembles a store from the OpenSSL-style `{ key, cert, ca?, friendlyName?, localKeyId? }` or the full `{ safeContents: [...] }`, where each element is a plaintext or PBES2-encrypted `SafeContents` of key, shroudedKey, cert, crl, secret, or nested `safeContents` bags. Keys and certs are validated before wrapping, a key paired with a certificate (the `{ key, cert }` form, or bags sharing a `localKeyId`) must be the private half of that certificate's public key, and `friendlyName` (BMPString) and `localKeyId` are single-value. Integrity is a classic Appendix B HMAC (the default, for maximum interoperability) or an RFC 9579 PBMAC1 (`opts.mac.algorithm`) over SHA-256/384/512, with shrouded keys and cert safes encrypted under RFC 8018 PBES2 (AES-128/192/256-CBC). Every password is encoded the PKCS#12 way — BMPString+NULL for the classic MAC, UTF-8 for the PBES2 bags and PBMAC1 — which is what OpenSSL and NSS consume, so a file it emits opens in both, cross-checked bidirectionally. The MAC covers the exact AuthenticatedSafe byte range, a DEFAULT-1 `MacData.iterations` is rejected up front, and the store is re-parsed before return. `verifyMac(pfx, password, opts)` recomputes a classic or PBMAC1 MAC over `macedBytes` and constant-time-compares it, throwing on a MAC-less or public-key-integrity store. Public-key integrity (`opts.integrity.mode: "public-key"`) wraps the AuthenticatedSafe in a CMS SignedData instead of a MAC, signed by any `pki.cms.sign` signer and carrying no MacData (§4); privacy stays independent, so `password` still PBES2-encrypts the bags. Public-key privacy wraps a SafeContents as a CMS EnvelopedData (AES-CBC, `id-envelopedData`, never GCM) encrypted to recipient public keys through the `pki.cms.encrypt` recipient model, via per-safe `recipients` or the `opts.recipientCerts` convenience, restricted to certificate recipients (RSA-OAEP, ECDH, X25519, X448, ML-KEM) since a password or KEK recipient could not be reopened by `open`. All four integrity-by-privacy combinations are permitted (§3.1). `open(pfx, password, opts)` reads a store back: it verifies the MAC first, so a wrong password is the MAC verdict rather than a decrypt error, then PBES2-decrypts every privacy safe and shrouded key bag and returns `{ integrityMode, macVerified, signers, keys, certs, crls, secrets }` — keys as re-validated PKCS#8 DER, certs, CRLs and secrets as raw DER, all with `friendlyName` and `localKeyId`, nested safes recursively. A MAC-less store is refused unless `opts.allowUnauthenticated`. A public-key-integrity store is verified through its CMS SignedData signature first (`pkcs12/signature-invalid` on failure), with the signer surfaced in `signers` but never trust-chained, which remains the caller's `pki.path.validate` step. A legacy-PBE store's Appendix C 3DES and RC2 bags are decrypted, RC2 through an in-tree RFC 2268 cipher, so an `openssl pkcs12 -legacy` or NSS store opens; the legacy RC4 schemes are refused. An `id-envelopedData` safe is decrypted with `opts.recipientKey` after the integrity gate (`pkcs12/no-recipient-key` when absent), every recipient-side fault and every post-integrity decrypt failure collapsing to the uniform `pkcs12/decrypt-failed`, and `opts.keys: 'crypto'` imports each key to a `CryptoKey`. It reads what OpenSSL and NSS produce. Returns DER or a PEM `PKCS12`, with a typed `Pkcs12Error` on failure. Parsing stays at `pki.schema.pkcs12.parse` — `build`, `verifyMac`, `open` |
 | `pki.pkcs11` | PKCS #11 URIs (RFC 7512), the syntax an operator names a token and an object on it with instead of a file path. `parseUri(uri)` reads one into `{ path, vendorPath, query, vendorQuery }`, each a prototype-less record: the path carries `token`, `manufacturer`, `serial`, `model`, the three `library-*` and three `slot-*` attributes, `object`, `type` and `id`, and the query carries `pin-source`, `pin-value`, `module-name` and `module-path`, with a vendor attribute in either component kept under its own name. A vendor query attribute carries a list of its values, which §2.4 permits to repeat; a vendor path attribute carries one value. `id` is a `Buffer`, since the attribute names bytes rather than text, and `slot-id` and `library-version` are numbers. `formatUri(record)` writes the record back, percent-encoding each value to what its own component admits unencoded and encoding `id` whole with uppercase hexadecimal, so two URIs naming one identifier compare equal. Parsing follows the §2.3 / §2.4 ABNF rather than a general URI reader and is fail-closed: a character the component admits only percent-encoded, a truncated or non-hexadecimal escape, a value that is not valid UTF-8, an attribute repeated where the RFC admits it once, a `type` outside the five the RFC enumerates, a URI carrying both `pin-source` and `pin-value`, and a relative `module-path` are each refused with their own `pkcs11/*` code. Syntax only: nothing here loads a PKCS #11 module or talks to a token — `parseUri`, `formatUri` |
 | `pki.cms` | CMS signing, verification, encryption, and compression (RFC 5652). `sign(content, signers, opts)` produces a SignedData (§5), attached or detached, with one or many signers over RSA, RSASSA-PSS, ECDSA, EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA pairing ML-DSA with a traditional RSA, ECDSA, or EdDSA key (accepted only when both components verify, draft-ietf-lamps-cms-composite-sigs). It builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. The content may also be an async iterable of byte chunks, which signs a large detached payload without holding it in memory: the payload is hashed incrementally under every signer's digest algorithm in one pass, and `verify` accepts the same streamed form as its `content` option. A signer may also be key-only — `{ key, spki, keyIdentifier }` with no certificate — which RFC 5272 §3.2 requires when a Full PKI Request's signer is the key of a certification request that request carries: the signer identifier takes the subjectKeyIdentifier form carrying the identifier the request declares, the signature scheme resolves from the request's own public key, and no certificate is embedded. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: with signed attributes present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), and otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate. `valid` and `trusted` are separate claims and neither implies the other: a SignedData carries its own certificates, so `valid` says the signature is sound under one of them and nothing about who signed, while `trusted` says every signer chained to a root named in `opts.trustAnchors`, validated through the same RFC 5280 path engine `pki.path.validate` uses. Without anchors there is nothing to chain to and `trusted` is `false`; anchors that cannot be read throw, rather than reading as untrusted. An unrecognized option is refused rather than ignored. `countersign(cms, signers, opts)` adds a countersignature (§11.4) — a `SignerInfo` over the countersigned SignerInfo's signature value, any signer algorithm, nestable, with the primary bytes preserved so it still verifies — attached as the id-countersignature unsigned attribute; `verify` returns each countersignature's verdict under `signers[i].countersignatures` and every unsigned attribute under `signers[i].unsignedAttrs`, surfaced unauthenticated. The CAdES signature timestamp has verbs of its own: `timestampImprint(der, opts)` returns `{ imprint, signerIndex }`, where `imprint` is the `{ hashAlgorithm, hashedMessage }` argument `pki.tsp.request` takes, the hash of a signer's signature value with neither tag nor length (ETSI EN 319 122-1 clause 5.3), `attachTimestamp(der, token, opts)` splices the returned RFC 3161 token in as the signature-time-stamp unsigned attribute and refuses one whose imprint covers other bytes, and `verify` reports a row per attached token under `signers[i].signatureTimeStamps`, each carrying the generation time, the authority, and what the authority's chain established. A row is refused when its time precedes the signature's own `signing-time` or falls after the signing certificate's `notAfter`. `signers[i].cadesBaseline` reports which CAdES baseline requirements the signature meets. The RFC 6211 `CMSAlgorithmProtection` attribute is emitted on request by `sign`, `countersign` and `authenticate` (`algorithmProtection: true`, or `"registry"` for the IANA arc identifier) and always compared where present: a copy of the digest and signature or MAC algorithm identifiers, placed where the signature or the MAC covers them, with a disagreement refused as `cms/algorithm-protection-mismatch` and the result reporting `algorithmProtection` per signer. It matters most on an `AuthenticatedData`, whose MAC input is the authenticated attributes alone, leaving the outer digest and MAC algorithm fields covered by nothing. `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData, with recipients auto-dispatched off the certificate key to key transport (RSAES-OAEP; v1.5 is never emitted), key agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key wrap, password (PBKDF2 with the PWRI-KEK of RFC 3211, carried forward by RFC 3370), or the post-quantum ML-KEM (and composite ML-KEM, draft-lamps-pq-composite-kem) KEMRecipientInfo (RFC 9629/9936), wrapping one fresh content key for every recipient. The content may also be an async iterable of byte chunks, streamed through the AES-GCM or AES-CBC content cipher so a large plaintext is encrypted without being buffered whole; the ciphertext is assembled before the definite-length encryptedContent is emitted, byte-for-byte the buffered form. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher, EFAIL, and password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. With `opts.stream: true` the recovered `content` is an async iterable of plaintext chunks instead of a single Buffer, for a payload too large to hold whole; the authenticated modes (AuthEnvelopedData, AuthenticatedData, AES-GCM) verify integrity before the iterable yields, so a forged message throws before any plaintext is exposed, while a CBC EnvelopedData or EncryptedData yields the plaintext as the cipher produces it. Every key-establishment secret the toolkit allocates is wiped once used, on the failing path as well as the succeeding one: the KEM shared secret and its derived key-encryption key, the raw ECDH / X25519 / X448 agreement secret, a password-derived key-encryption key, and the content-encryption key itself, cleared once the message is complete since all recipients share it. Caller-supplied key material is never written to (best-effort; NIST SP 800-227 §4.2, RFC 9629 §7). `authenticate(content, recipients, opts)` produces an `id-ct-authData` (§9): cleartext content plus an HMAC-SHA-256/384/512 MAC, authenticated but not encrypted, with the fresh MAC key wrapped for every recipient through the same RecipientInfo model. The MAC covers the authenticated attributes (content-type and message-digest) re-tagged to the EXPLICIT SET OF (§9.2), or the content octets directly; `decrypt` recovers the MAC key, recomputes the MAC and independently the message-digest (§9.3), and releases the content only after both pass, with every secret-dependent failure collapsing to the uniform `cms/decrypt-failed`. `compress(content, opts)` and `decompress(input, opts)` produce and consume a CompressedData (RFC 3274; ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large`. Compression is a size transform with no integrity or confidentiality (RFC 8551 §2.4.5). `certsOnly(certs, opts?)` builds a certs-only certificate-management message (RFC 8551 §3.8): a degenerate SignedData with an empty signerInfos and no eContent that conveys certificates and CRLs without signing anything, `parseCertsOnly(input, opts?)` reads one back to its raw certificate and CRL DER (a CRL-only message is valid here, unlike the cert-required RFC 5272 form that `pki.est.parseCertsOnly` reads), and `isCertsOnly(input)` recognizes one structurally. Fail-closed with typed `cms/*` errors — `sign`, `verify`, `countersign`, `encrypt`, `authenticate`, `decrypt`, `compress`, `decompress`, `certsOnly`, `parseCertsOnly`, `isCertsOnly` |
-| `pki.smime` | S/MIME message assembly, verification, encryption, and compression over the CMS layer (RFC 8551). `sign(content, signers, opts)` wraps a MIME entity in either form: `multipart/signed`, where the content stays readable in any MUA and a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`, or `application/pkcs7-mime; smime-type=signed-data`, where the whole entity is a base64 CMS SignedData. The signed bytes are the entity's §3.1.1 canonical form with CRLF line endings, and `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies while a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one, as `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat). The `smime-type` is derived from the CMS body rather than the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt`, so it is algorithm-agnostic: any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through. As with `cms.verify`, `verify` returns the per-signer verdict plus the recovered content, and `valid` and `trusted` are separate claims: `valid` says the signature is sound under a certificate the message carried, `trusted` says every signer chained to a root named in `opts.trustAnchors`. Anchoring here is validated for email at both ends of the chain — the signer certificate must carry `emailProtection` (RFC 8550 §4.4.4) and the anchor's own trust metadata must permit that purpose, since a root can be distrusted for email while remaining a good TLS root. `sign` refuses a signer certificate a conforming reader would reject: a `keyUsage` extension without `digitalSignature` or `nonRepudiation` (RFC 8550 §4.4.2), or an `extendedKeyUsage` extension without `emailProtection` or `anyExtendedKeyUsage` (§4.4.4); a certificate carrying neither extension signs. Override either with `requiredEku` / `checkPurpose`. `compress(content, opts)` and `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (§3.6, RFC 3274), a size transform with no integrity or confidentiality (§2.4.5), bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Header protection (RFC 9788): `sign` and `encrypt` take `opts.protectHeaders`, which inlines the caller's `opts.headers` on the Cryptographic Payload root (its Content-Type gaining `hp="clear"` when signed or `hp="cipher"` when encrypted) so the CMS signature or encryption covers them, defeating a transport that rewrites or reads Subject, From, and the rest. `verify` and `decrypt` surface the authenticated inner set as `protectedHeaders` plus `headerProtection { present, mode, fromMismatch, confidential, legacy }`, so a tampered outer header cannot alter it and `fromMismatch` flags an outer From that disagrees. Encryption applies a Header Confidentiality Policy: the default `hcp_baseline` obscures the outer Subject to `[...]` and removes Comments and Keywords, so the real values live only in the ciphertext, and `decrypt` recovers them. Every emitted header routes through a fail-closed injection guard that rejects a CR, LF, or NUL value and a non-ftext name, and a malformed or contradictory `hp` wrap fails closed as `smime/bad-header-protection` rather than silently downgrading. The CMS crypto is unchanged. Inbound legacy RFC 8551 header protection is recognized opt-in: `verify` and `decrypt` with `opts.legacyHeaderProtection` detect a legacy `message/rfc822`-wrapped payload by the RFC 9788 §4.10.1 four-condition identification and surface the inner headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }`, where `headers` is an ordered `[{ name, value }]` array retaining legally repeated fields such as `Received`. Those never appear in `protectedHeaders` and never set `present: true`. Because a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, this is an explicit heuristic (§4.10.2, "no strong end-to-end guarantees"): a caller keying trust off `present` or `protectedHeaders` is never misled, and only one that explicitly reads `headerProtection.legacy.headers` and cross-checks `legacy.fromMismatch` consumes it. It is off by default, and a nested crypto layer, an inner `hp=`, a non-`message/rfc822` payload, or a duplicate Content-Type reports `legacy: null`. Bidirectionally interoperable with `openssl smime` and `openssl cms`. `buildCertsOnly(certs, opts?)` wraps a `pki.cms.certsOnly` certificate-management message in one `application/pkcs7-mime; smime-type=certs-only; name=smime.p7c` entity, read back by OpenSSL's `pkcs7 -print_certs`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress`, `buildCertsOnly` |
+| `pki.smime` | S/MIME message assembly, verification, encryption, and compression over the CMS layer (RFC 8551). `sign(content, signers, opts)` wraps a MIME entity in either form: `multipart/signed`, where the content stays readable in any MUA and a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`, or `application/pkcs7-mime; smime-type=signed-data`, where the whole entity is a base64 CMS SignedData. The signed bytes are the entity's §3.1.1 canonical form with CRLF line endings, and `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies while a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one, as `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat). The `smime-type` is derived from the CMS body rather than the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt`, so it is algorithm-agnostic: any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through. As with `cms.verify`, `verify` returns the per-signer verdict plus the recovered content, and `valid` and `trusted` are separate claims: `valid` says the signature is sound under a certificate the message carried, `trusted` says every signer chained to a root named in `opts.trustAnchors`. Anchoring here is validated for email at both ends of the chain — the signer certificate must carry `emailProtection` (RFC 8550 §4.4.4) and the anchor's own trust metadata must permit that purpose, since a root can be distrusted for email while remaining a good TLS root. `sign` refuses a signer certificate a conforming reader would reject: a `keyUsage` extension without `digitalSignature` or `nonRepudiation` (RFC 8550 §4.4.2), or an `extendedKeyUsage` extension without `emailProtection` or `anyExtendedKeyUsage` (§4.4.4); a certificate carrying neither extension signs. Override either with `requiredEku` / `checkPurpose`. `compress(content, opts)` and `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (§3.6, RFC 3274), a size transform with no integrity or confidentiality (§2.4.5), bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Header protection (RFC 9788): `sign` and `encrypt` take `opts.protectHeaders`, which inlines the caller's `opts.headers` on the Cryptographic Payload root (its Content-Type gaining `hp="clear"` when signed or `hp="cipher"` when encrypted) so the CMS signature or encryption covers them, defeating a transport that rewrites or reads Subject, From, and the rest. `verify` and `decrypt` surface the authenticated inner set as `protectedHeaders` plus `headerProtection { present, mode, fromMismatch, confidential, legacy }`, so a tampered outer header cannot alter it and `fromMismatch` flags an outer From that disagrees. Encryption applies a Header Confidentiality Policy: the default `hcp_baseline` obscures the outer Subject to `[...]` and removes Comments and Keywords, so the real values live only in the ciphertext, and `decrypt` recovers them. Every emitted header routes through a fail-closed injection guard that rejects a CR, LF, or NUL value and a non-ftext name, and a malformed or contradictory `hp` wrap fails closed as `smime/bad-header-protection` rather than silently downgrading. The CMS crypto is unchanged. Inbound legacy RFC 8551 header protection is recognized opt-in: `verify` and `decrypt` with `opts.legacyHeaderProtection` detect a legacy `message/rfc822`-wrapped payload by the RFC 9788 §4.10.1 four-condition identification and surface the inner headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }`, where `headers` is an ordered `[{ name, value }]` array retaining legally repeated fields such as `Received`. Those never appear in `protectedHeaders` and never set `present: true`. Because a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, this is an explicit heuristic (§4.10.2, "no strong end-to-end guarantees"): a caller keying trust off `present` or `protectedHeaders` is never misled, and only one that explicitly reads `headerProtection.legacy.headers` and cross-checks `legacy.fromMismatch` consumes it. It is off by default, and a nested crypto layer, an inner `hp=`, a non-`message/rfc822` payload, or a duplicate Content-Type reports `legacy: null`. Bidirectionally interoperable with `openssl smime` and `openssl cms`. `buildCertsOnly(certs, opts?)` wraps a `pki.cms.certsOnly` certificate-management message in one `application/pkcs7-mime; smime-type=certs-only; name=smime.p7c` entity, read back by OpenSSL's `pkcs7 -print_certs`. An entity whose Content-Type names one parameter twice, or whose header area names one field twice, is refused rather than resolved by position: RFC 2045 §5.1 and RFC 5322 §3.6 each give one occurrence, so the two readings disagree about which octets the signature covers. One entity is bounded at 1024 body parts, 1024 header lines and 256 Content-Type parameters (`MIME_MAX_PARTS`, `MIME_MAX_HEADERS`, `MIME_MAX_PARAMS`), counted as it is scanned, and the record a verdict is read with holds a copy of the entity rather than a view of the caller's buffer. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress`, `buildCertsOnly` |
 | `pki.tsp` | Time-Stamp Protocol (RFC 3161). `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData over `pki.cms.sign` whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` with optional accuracy, nonce, and ordering, plus the §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). The TSA certificate is held to §2.3 before signing (one critical extendedKeyUsage naming timeStamping alone) with the codes `verify` answers, `genTime` keeps its milliseconds as the §2.4.2 fraction of a second, and an accuracy naming no field is refused. `request` and `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq); `response` and `parseResponse` handle the TimeStampResp a TSA returns, either a granted status wrapping a token or a rejection with PKIStatus and failure info, with the §2.4.2 status-to-token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and, with a trust anchor supplied, full certification-path validation of the TSA certificate at the token's `genTime` — judged under the `timeStamping` purpose, so an anchor's own per-purpose trust metadata reaches the decision rather than sitting inert. It returns `{ valid, trusted, genTime, serialNumber, tstInfo, ... }`, where `trusted` is the separate claim that the authority chained to an anchor you named: without one there is nothing to chain to and it is `false`, which is the distinction a timestamp re-read years later turns on — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ocsp` | Online Certificate Status Protocol (RFC 6960), both the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs, with the CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile (obsoleted by RFC 9919) or under SHA-2, plus an optional RFC 9654 nonce (32 to 128 octets, the requester floor that section sets) and an optional requestor signature, under which the signer certificate's subject is the requestorName unless one is stated (RFC 6960 §4.1.2). `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER, from the issuing CA directly or a delegated responder, under any `pki.cms.sign` key including the post-quantum ML-DSA and SLH-DSA sets, with `good`, `revoked` (reason and time), or `unknown` per-certificate status, and per-response `singleExtensions` naming the §4.4.4 archive cutoff and the §4.4.2 CRL reference as fields, each read back by name by the parser. The signer refuses what its own lint would grade an error: a pre-encoded singleExtension that RFC 6960 places in requests or in responseExtensions, a CRL entry extension carried at the wrong criticality, and CRL references or entry extensions on a non-issued response, which itself places the §4.4.8 extended revoked definition in responseExtensions without being asked. `buildErrorResponse(status)` produces the unsigned §2.3 error (`tryLater`, `unauthorized`, and the rest). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA, or a CA-issued delegate bearing id-kp-OCSPSigning and id-pkix-ocsp-nocheck and passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency against `thisUpdate` and `nextUpdate`, and the request-nonce echo. It returns `{ status: "good" / "revoked" / "unknown", ... }` and never silently accepts. `verifyRequest(request, opts)` is the responder-side inverse of `buildRequest`: it verifies a client's signed request (RFC 6960 §4.1.1) under the requestor certificate the request carries, trying each embedded certificate since the field is unordered, and reports `signed`, `signatureValid`, every certificate whose key verified the signature and whose subject is the `requestorName` the request states (`signerCerts`, so a key carried under an expired certificate beside its renewal is not hidden behind ordering, while a same-key certificate under another name is not the requestor) with the first one's decoded subject, the full embedded certificate bag (`certs`, including intermediates for path building), and the request's CertIDs; the name check is reported as `requestorNamed` (RFC 6960 §4.1.2) and `valid` requires it, a request no verifying certificate names falls back to listing the verifying ones with `valid: false`, and an unsigned request is reported with `signed: false` rather than refused. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify`, `verifyRequest` |
 | `pki.ct` | Certificate Transparency (RFC 6962). `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries, a TLS-presentation-language payload inside the §3.3 double DER wrap, into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature. `reconstructSignedData` rebuilds the exact `digitally-signed` preimage, and `verifySct` verifies an SCT signature against a log's public key, routing an ECDSA signature through the strict DER-conformance gate and verifying through the crypto engine, resolving true or false and throwing a typed error on a structural fault. On the producing side, `encodeSctList` builds the extension value byte for byte as the exact inverse of `parseSctList`, and `signSct` performs a log's signing step. For trust, `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs, recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2) and decoding the state and temporal-interval constraints; `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable, qualified, and readonly trusted; retired only before retirement; pending and rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. `verifyLogListSignature(json, signature, publicKey)` verifies the detached `log_list.sig` over the raw log-list bytes against a caller-pinned signer key (RSASSA-PKCS1-v1.5/SHA-256 and an EC P-256 arm, with forgeable-key defenses failing closed), cross-checked against `openssl dgst`. `fetchLogList(opts)` turns that chain into a live client: it GETs the `log_list.json` and its detached `log_list.sig` over `pki.transport`, verifies the detached signature over the raw fetched bytes against a caller-pinned distributor key before parsing, so an unverified document is never parsed, read, cached, or surfaced, then ingests the same bytes through `parseLogList` and returns the trusted-log set plus the surfaced `version` and `timestamp`. Above the per-SCT layer, The RFC 6962 sec. 4 log client is shipped: `getSth` fetches a signed tree head and verifies it under the caller-pinned log key, returning nothing when it does not verify, since every later check is measured against that root; `sthSignedData` builds the 50-byte sec. 3.5 preimage and `verifySth` checks a head held offline. `getProofByHash` and `getSthConsistency` fetch the audit and consistency proofs and fold them against tree heads a log signed, taking the query sizes from those heads so a size and a head cannot disagree. `getEntries` and `getRoots` fetch what the specification leaves unsigned and say so, with a short entry answer reported as truncation rather than a fault. `addChain` and `addPreChain` submit a chain and verify the SCT the log returns against the chain it was issued for. `verifySctList` renders a certificate-level verdict over every SCT a certificate carries (§3.3), reporting how many distinct trusted logs verified an SCT (so a duplicated SCT cannot inflate the count) and from how many distinct trusted operators against a caller's CT policy (`minScts` and `minOperators`, both defaulting to the RFC floor of one), where a policy shortfall is a verdict and a per-SCT failure is a recorded row rather than a thrown call; `x509CertEntry` reconstructs the precertificate log entry from a final certificate by removing the SCT-list extension from its TBSCertificate as byte surgery, so its embedded SCTs verify end to end (§3.2). The toolkit bakes in no vendor URL or key, TLS trust is explicit with `rejectUnauthorized` always on, each response is size-capped before the trust chain, and the transport is injectable so the whole path is testable offline — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList`, `verifySctList`, `x509CertEntry`, `verifyLogListSignature`, `fetchLogList` |

package/index.js

@@ -73,8 +73,53 @@ var inspect    = require("./lib/inspect");
 var lint       = require("./lib/lint");
 var webauthn   = require("./lib/webauthn");
 
+/* Every value in the export object below is a bare identifier, and the ten `var`s here are what make
+ * that true. Node detects a CommonJS module's named exports with `cjs-module-lexer`, which follows
+ * `name: ident` and a shorthand and stops at anything else: a member expression, a nested object
+ * literal, a call. `version: constants.version` was the first entry, so it stopped the lexer before
+ * any namespace was seen and `import { x509 } from "@blamejs/pki"` failed for all 47 of them, with
+ * only `default`, `module.exports` and `version` reaching an ESM caller. Hoisting is the whole fix;
+ * it needs no build step and changes nothing a `require` caller sees. A new namespace added below
+ * must be a bare identifier, which a vector in `esm-named-exports.test.js` holds it to. */
+var _version = constants.version;
+var _identityNs = { match: identity.match };
+var _cmsNs = {
+  verify: cms.verify, sign: cms.sign, countersign: cms.countersign, encrypt: cms.encrypt,
+  authenticate: cms.authenticate, decrypt: cms.decrypt, compress: cms.compress, decompress: cms.decompress,
+  digest: cms.digest, verifyDigest: cms.verifyDigest,
+  certsOnly: cms.certsOnly, parseCertsOnly: cms.parseCertsOnly, isCertsOnly: cms.isCertsOnly,
+  timestampImprint: cms.timestampImprint, attachTimestamp: cms.attachTimestamp,
+};
+var _cmpNs = {
+  build: cmp.build, transfer: cmp.transfer, wellKnownUrl: cmp.wellKnownUrl, verify: cmp.verify,
+  openKeyPackage: cmp.openKeyPackage, session: cmp.session,
+};
+var _keyNs = {
+  encrypt: key.encrypt, decrypt: key.decrypt, export: key.export, import: key.import,
+  generate: key.generate, publicFromPrivate: key.publicFromPrivate,
+};
+var _kemNs = { encapsulate: compositeKem.encapsulate, decapsulate: compositeKem.decapsulate };
+var _scepNs = {
+  build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert,
+  getNextCACert: scep.getNextCACert, enroll: scep.enroll, renew: scep.renew, getCert: scep.getCert,
+  getCrl: scep.getCrl, parseCapabilities: scep.parseCapabilities,
+};
+var _transportNs = { https: transport.https, peerChain: transport.peerChain };
+var _lintNs = {
+  certificate: lint.certificate,
+  csr:         lint.csr,
+  crl:         lint.crl,
+  ocsp:        lint.ocsp,
+  cms:         lint.cms,
+  tsp:         lint.tsp,
+  attrcert:    lint.attrcert,
+  rules:       lint.rules,
+  profiles:    lint.profiles,
+};
+var _webcryptoNs = _webcryptoNamespace();
+
 module.exports = {
-  version:   constants.version,
+  version:   _version,
   // `C` is the terse call-site alias; `constants` the discoverable name.
   C:         constants,
   constants: constants,
@@ -97,7 +142,7 @@ module.exports = {
   // `identity` is RFC 9525 service identity -- pki.identity.match says whether a certificate
   // presents a name the client was trying to reach. A separate answer from path validation,
   // which pki.path.validate gives; sec. 1.2 has an application need both.
-  identity:  { match: identity.match },
+  identity:  _identityNs,
   // `ct` is RFC 6962 Certificate Transparency -- pki.ct.parseSctList decodes the
   // SCT-list extension a certificate / OCSP response carries; the signature is
   // surfaced raw for external verification (pki.ct.reconstructSignedData).
@@ -113,11 +158,7 @@ module.exports = {
   // Curated, the way pki.cmp is: cms-verify also exports `setEngine`, the seam path-validate injects
   // its path builder through. That is plumbing between two internal modules, not an operator verb,
   // and exporting the module wholesale would put it on the public surface.
-  cms:       { verify: cms.verify, sign: cms.sign, countersign: cms.countersign, encrypt: cms.encrypt,
-    authenticate: cms.authenticate, decrypt: cms.decrypt, compress: cms.compress, decompress: cms.decompress,
-    digest: cms.digest, verifyDigest: cms.verifyDigest,
-    certsOnly: cms.certsOnly, parseCertsOnly: cms.parseCertsOnly, isCertsOnly: cms.isCertsOnly,
-    timestampImprint: cms.timestampImprint, attachTimestamp: cms.attachTimestamp },
+  cms:       _cmsNs,
   smime:     smime,
   // `cmc` interprets an RFC 5272 Full PKI Response into one terminal verdict;
   // `pki.schema.cmc` is the decoder underneath it.
@@ -147,8 +188,7 @@ module.exports = {
   // and pki.cmp.verify checks the protection on an incoming one. pki.cmp.openKeyPackage opens a
   // centrally generated private key a CA delivered. Parsing lives at pki.schema.cmp.parse.
   // setEngine is the @internal path-validate seam -- kept off the public surface.
-  cmp:       { build: cmp.build, transfer: cmp.transfer, wellKnownUrl: cmp.wellKnownUrl, verify: cmp.verify,
-    openKeyPackage: cmp.openKeyPackage, session: cmp.session },
+  cmp:       _cmpNs,
   // `crl` is the RFC 5280 sec. 5 CRL producing side -- pki.crl.sign builds and signs a CertificateList
   // over any registry algorithm, pki.crl.verify checks a CRL signature through the one path-validation
   // signature engine, and pki.crl.isRevoked looks a serial up. Parsing lives at pki.schema.crl.parse.
@@ -158,8 +198,7 @@ module.exports = {
   // pki.key.generate / publicFromPrivate over every WebCrypto algorithm. Parsing lives at pki.schema.pkcs8.
   // Curated: correspondsTo is the @internal check pki.cmp.session holds a delivered key and its
   // certificate to each other with, and stays off the public surface.
-  key:       { encrypt: key.encrypt, decrypt: key.decrypt, export: key.export, import: key.import,
-    generate: key.generate, publicFromPrivate: key.publicFromPrivate },
+  key:       _keyNs,
   // `pkcs12` is the RFC 7292 / RFC 9579 PKCS#12 (.p12/.pfx) producing side -- pki.pkcs12.build assembles a
   // password-integrity store (key/cert/crl/secret bags in an AuthenticatedSafe, shrouded keys + cert safes
   // under PBES2, a classic HMAC or PBMAC1 MAC), and pki.pkcs12.verifyMac checks a store's MAC. Parsing lives
@@ -193,7 +232,7 @@ module.exports = {
   // `kem` is composite ML-KEM key establishment (draft-ietf-lamps-pq-composite-kem):
   // pki.kem.encapsulate / decapsulate over a post-quantum ML-KEM hybridized with a
   // traditional RSA-OAEP / ECDH / X25519 / X448, mixed through the SHA3-256 combiner.
-  kem:       { encapsulate: compositeKem.encapsulate, decapsulate: compositeKem.decapsulate },
+  kem:       _kemNs,
   // `sigstore` verifies a Sigstore bundle (the npm --provenance artifact): a
   // keyless Fulcio signature over a DSSE-wrapped in-toto SLSA attestation with a
   // Rekor inclusion proof -- offline, zero-dep, against caller-pinned trust.
@@ -204,14 +243,14 @@ module.exports = {
   // splitter, certs-only + serverkeygen validators over CMS, the enroll-attribute
   // builders, the HTTP response classifier). est opens no socket; fail-closed.
   est:       est,
-  scep:      { build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert, getNextCACert: scep.getNextCACert, enroll: scep.enroll, renew: scep.renew, getCert: scep.getCert, getCrl: scep.getCrl, parseCapabilities: scep.parseCapabilities },
+  scep:      _scepNs,
   // `transport` is the shared fail-closed node:https transport the enrollment clients
   // drive -- pki.transport.https(defaults) returns a transport(request) -> {status,
   // headers, body}. The toolkit's sole socket choke point: explicit trust anchors,
   // rejectUnauthorized always on, a TLS floor, a streaming response cap, and a timeout.
   // Curated to the public `https` factory; the module's `isBlockedIp` classifier is an
   // internal helper pki.path.build reuses (require the module), not a public surface.
-  transport: { https: transport.https, peerChain: transport.peerChain },
+  transport: _transportNs,
   // `jose` is the RFC 7515 Flattened JWS + RFC 7638 JWK-thumbprint layer: a strict
   // base64url codec, a bounded duplicate-key-rejecting JSON reader, profiled
   // sign/verify (ACME-outer / EAB-inner / keyChange-inner), and an alg registry
@@ -241,17 +280,7 @@ module.exports = {
   // `lint` is named member by member rather than passed through, because the module also exports the
   // build-time gate the authoring verbs call and the two readers its conformance vectors use. Those
   // are internal plumbing, so they stay off the public namespace.
-  lint: {
-    certificate: lint.certificate,
-    csr:         lint.csr,
-    crl:         lint.crl,
-    ocsp:        lint.ocsp,
-    cms:         lint.cms,
-    tsp:         lint.tsp,
-    attrcert:    lint.attrcert,
-    rules:       lint.rules,
-    profiles:    lint.profiles,
-  },
+  lint: _lintNs,
   // `webauthn` verifies a W3C WebAuthn / passkey attestation -- pki.webauthn.verify
   // checks the attestation-statement signature + each format's structural bindings
   // (packed / tpm / android-key / apple / fido-u2f / none) and surfaces the x5c chain
@@ -263,7 +292,7 @@ module.exports = {
   // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
   // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
   // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.
-  webcrypto: _webcryptoNamespace(),
+  webcrypto: _webcryptoNs,
 };
 
 function _webcryptoNamespace() {

package/lib/acme.js

@@ -1796,7 +1796,7 @@ function _parseLinkValue(raw) {
   return { uri: uri, rel: rel, anchor: anchor, relSeen: relSeen };
 }
 function _parseLinkRelation(headers, base, relName, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var raw = null;
   var hNames = guard.identifier.optionNames(headers);
   for (var hi = 0; hi < hNames.length; hi++) {
@@ -2047,11 +2047,11 @@ function client(directoryUrl, opts) {
 
   function _send(method, url, headers, body) { return _sendFollowing(method, url, headers, body, 0); }
   function _sendFollowing(method, url, headers, body, redirects) {
-    var reqHeaders = Object.assign({ "user-agent": CLIENT_USER_AGENT }, headers || {});
+    var reqHeaders = Object.assign({ "user-agent": CLIENT_USER_AGENT }, headers || intrinsic.create(null));
     return guard.async.deferred(function () {
       return guard.async.invoked(transport, [{ method: method, url: url, headers: reqHeaders, body: body, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "acme/bad-input", "opts.transport");
     }).then(function (res) {
-      res = res || {};
+      res = res || intrinsic.create(null);
       /** @internal The transport is a caller-supplied option, so its response is a caller object: the body
        *  and the status are read ONCE here and every check and the returned value read those locals. Read
        *  per use, the body whose length was capped need not be the body handed back, which is how a
@@ -2145,7 +2145,7 @@ function client(directoryUrl, opts) {
 
   function _newAccount(payloadOpts) {
     return _resource("newAccount").then(function (url) {
-      return _post(url, newAccount, payloadOpts || {}, "jwk", undefined, [200, 201]).then(function (res) {
+      return _post(url, newAccount, payloadOpts || intrinsic.create(null), "jwk", undefined, [200, 201]).then(function (res) {
         var loc = res.headers["location"];
         if (!_isString(loc)) throw E("acme/no-account-url", "newAccount did not return an account URL in a Location header (RFC 8555 sec. 7.3)");
         var account = validate("account", _json(res));
@@ -2156,7 +2156,7 @@ function client(directoryUrl, opts) {
   }
   function _newOrder(payloadOpts) {
     return _resource("newOrder").then(function (url) {
-      return _post(url, newOrder, payloadOpts || {}, "kid", undefined, [201]).then(function (res) {
+      return _post(url, newOrder, payloadOpts || intrinsic.create(null), "kid", undefined, [201]).then(function (res) {
         var loc = res.headers["location"];
         if (!_isString(loc)) throw E("acme/no-order-url", "newOrder did not return an order URL in a Location header (RFC 8555 sec. 7.4)");
         return { order: validate("order", _json(res)), url: _resolveLocation(loc, url) };

package/lib/asn1-der.js

@@ -210,7 +210,7 @@ function _asBuffer(input, who) {
  *   node.tagNumber === pki.asn1.TAGS.SEQUENCE;
  */
 function decode(input, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var buf = _asBuffer(input, "decode");
   var maxBytes = guard.limits.cap(opts.maxBytes, "maxBytes", constants.LIMITS.DER_MAX_BYTES);
   var maxDepth = guard.limits.depthCap(opts.maxDepth, "maxDepth", constants.LIMITS.DER_MAX_DEPTH);

package/lib/attrcert-sign.js

@@ -448,7 +448,7 @@ function _emitNamedExtension(out, seen, k, val, ctx) {
   _push(out,_b.ext(eOid, meta.critical, valueDer));
 }
 function _buildExtensions(extSpec, ctx) {
-  if (extSpec == null) extSpec = {};
+  if (extSpec == null) extSpec = intrinsic.create(null);
   if (Array.isArray(extSpec)) {
     if (!extSpec.length) return null;
     var seenA = intrinsic.create(null);
@@ -567,7 +567,7 @@ function _sign(spec, issuer, opts) {
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "attrcert/bad-input", "unknown pki.attrcert.sign option (accepted: pem, pss, digestAlgorithm): ");
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("attrcert/bad-input", "the attribute-certificate spec must be an object");
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "attrcert/bad-input", "unknown spec field ");
-  issuer = issuer || {};
+  issuer = issuer || intrinsic.create(null);
   if (issuer.key == null) throw _err("attrcert/bad-input", "a signing key (issuer.key, the AA's WebCrypto CryptoKey or PKCS#8 private key DER/PEM) is required");
 
   var issuerDnSpec, aaSpki, aaSki = null;

package/lib/cbor-det.js

@@ -36,6 +36,9 @@
  *   leaf readers over its node tree.
  */
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 66 live runtime reads. */
+var _create = Object.create;
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var asn1 = require("./asn1-der");
@@ -241,7 +244,7 @@ function _decodeItem(buf, start, limit, depth, maxD, rules, state) {
  *   pki.cbor.read.uint(node.children[0]); // 1n
  */
 function decode(input, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var buf = _asBuffer(input, "decode");
   var maxBytes = guard.limits.cap(opts.maxBytes, "maxBytes", constants.LIMITS.CBOR_MAX_BYTES);
   var maxDepth = guard.limits.depthCap(opts.maxDepth, "maxDepth", constants.LIMITS.CBOR_MAX_DEPTH);

package/lib/cmc-build.js

@@ -712,7 +712,7 @@ function build(spec, signer, opts) {
 }
 
 async function _build(spec, signer, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Array.isArray(spec) || Buffer.isBuffer(spec)) {
     throw E("cmc/bad-input", "the CMC request spec must be an object");
   }

package/lib/cmp-build.js

@@ -856,7 +856,7 @@ function build(message, opts) {
 }
 
 async function _build(message, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!message || typeof message !== "object" || Buffer.isBuffer(message)) throw _err("cmp/bad-input", "the PKIMessage spec must be an object { header, body }");
   guard.identifier.assertKnownKeys(message, KNOWN_MESSAGE_KEYS, _err, "cmp/bad-input", function (k) {
     return "unknown message field " + JSON.stringify(k) + " (a message carries only header + body)";
@@ -1020,7 +1020,7 @@ function _tlsForTransfer(opts) {
  *  `Symbol.split` is part of that operation. The token decides which parser a response body is
  *  handed to. */
 function _ctypeToken(headers) {
-  var raw = intrinsic.String((headers || {})["content-type"] || "");
+  var raw = intrinsic.String((headers || intrinsic.create(null))["content-type"] || "");
   var parts = intrinsic.splitChar(raw, 59);
   return intrinsic.toLowerCase(_strTrim(parts.length ? parts[0] : ""));
 }
@@ -1067,7 +1067,7 @@ function _assertTransport(opts) {
 }
 
 function _transfer(url, message, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, KNOWN_TRANSFER_OPTS, _err, "cmp/bad-input", "unknown opts field ");
   /** @internal Read once, at the door, and carried from here. Asking again would let an option that
    * answers differently on each read hand back something other than the value that was checked. */
@@ -1095,7 +1095,7 @@ function _transfer(url, message, opts) {
   headers["content-type"] = PKIXCMP;
   var tls = _tlsForTransfer(opts);
   return guard.async.invoked(transport, [{ method: "POST", url: parsedUrl.href, headers: headers, body: der, tls: tls, proxy: proxy, timeout: timeout, maxResponseBytes: maxResponseBytes }], _err, "cmp/bad-input", "opts.transport").then(function (res) {
-    res = res || {};
+    res = res || intrinsic.create(null);
     var h = guard.header.lowerCased(res.headers);
     var body = guard.bytes.isByteSource(res.body)
       ? guard.bytes.source(res.body, CmpError, "cmp/bad-response", "the CMP response body")
@@ -1136,7 +1136,7 @@ function _beforeQueryOrFragment(s) {
 }
 
 function wellKnownUrl(base, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, KNOWN_WELLKNOWN_OPTS, _err, "cmp/bad-input", function (k) {
     return "unknown wellKnownUrl option " + JSON.stringify(k) + " (expected label / operation)";
   });

package/lib/cmp-session.js

@@ -4,6 +4,9 @@
 // @internal
 // lib/cmp-build.js; this file adds the @primitive pki.cmp.session block and re-exports the cmp message
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 174 live runtime reads. */
+var _create = Object.create;
 var cmp = require("./cmp-verify");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
@@ -430,7 +433,7 @@ function _certConfHash(certDer) {
  *   if (answer.outcome === "answered" && answer.present) { var caCerts = answer.value; }
  */
 function session(opts) {
-  if (opts == null) opts = {};
+  if (opts == null) opts = _create(null);
   guard.identifier.assertPlainRecord(opts, _err, "cmp/bad-input", "opts");
   guard.identifier.optionsObject(opts, _err, "cmp/bad-input", "opts");
   guard.identifier.assertKnownKeys(opts, KNOWN_SESSION_OPTS, _err, "cmp/bad-input", "unknown session opts field ");
@@ -668,7 +671,7 @@ function session(opts) {
   }
 
   function _classify(verdict) {
-    var body = verdict.body || {};
+    var body = verdict.body || _create(null);
     var arm = body.arm;
     if (arm === expectedRespArm && txnKind === "revoke") return _classifyRevRep(body);
     if (arm === expectedRespArm && txnKind === "info") return _classifyGenRep(body);
@@ -734,7 +737,7 @@ function session(opts) {
   }
 
   function _classifyRevRep(body) {
-    var d = body.decoded || {};
+    var d = body.decoded || _create(null);
     var list = d.status || [];
     if (list.length !== 1) {
       return { state: "unexpected", reason: "an rp answering a revocation must carry exactly one status (RFC 9483 sec. 4.2); got " + list.length };

package/lib/cmp-verify.js

@@ -811,7 +811,7 @@ function _fixTime(v) {
   return new _Date(guard.time.instantOf(v));
 }
 function _fixVerifyOptions(opts, made) {
-  if (opts == null) opts = {};
+  if (opts == null) opts = _create(null);
   opts = guard.identifier.optionsObject(opts, _err, "cmp/bad-input", "pki.cmp.verify options");
   guard.identifier.assertKnownKeys(opts, KNOWN_VERIFY_OPTS, _err, "cmp/bad-input", "unknown opts field ");
   var f = {

package/lib/cms-compress.js

@@ -4,6 +4,9 @@
 // @internal
 // @module pki.cms + the @primitive blocks live in cms-verify.js, which re-exports these (the
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 5 live runtime reads. */
+var _create = Object.create;
 var zlib = require("zlib");
 var oid = require("./oid");
 var schemaCms = require("./schema-cms");
@@ -21,7 +24,7 @@ var OID_ZLIB = O("id-alg-zlibCompress");
 var NULL_PARAMS_DER = Buffer.from([0x05, 0x00]);
 
 async function compress(content, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var raw = guard.bytes.source(content, CmsError, "cms/bad-input", "content");
   var level = opts.level;
   if (level !== undefined && (typeof level !== "number" || !isFinite(level) || Math.floor(level) !== level)) throw _err("cms/bad-input", "opts.level must be an integer");
@@ -41,7 +44,7 @@ async function compress(content, opts) {
 }
 
 async function decompress(input, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var cap = C.LIMITS.COMPRESS_MAX_BYTES;
   if (opts.maxOutputBytes !== undefined) {
     var mo = opts.maxOutputBytes;

package/lib/cms-decrypt.js

@@ -34,7 +34,7 @@ var CONTENT_KEYBITS = pbes2.CONTENT_KEYBITS;
 var CONTENT_MODE = pbes2.CONTENT_MODE;
 
 async function decrypt(input, keyMaterial, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (keyMaterial == null || typeof keyMaterial !== "object") throw _err("cms/bad-input", "decrypt requires a key-material object");
   /** @internal Read on every route, not only the one that applies it, and read before the message
    * is derived: deriving one runs accessors on a parsed input, which is the caller's own code and
@@ -66,7 +66,7 @@ function _originFields(res, authenticatedBy, originatorInfo) {
 }
 
 async function decryptEnvelopedData(parsed, keyMaterial, opts, contentTypeName) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (keyMaterial == null || typeof keyMaterial !== "object") throw _err("cms/bad-input", "decrypt requires a key-material object");
   var ct = contentTypeName || "envelopedData";
   var recips = parsed.recipientInfos || [];

package/lib/cms-encrypt.js

@@ -426,7 +426,7 @@ function encrypt(content, recipients, opts) {
 }
 
 async function _encryptImpl(content, recipients, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var algName = opts.contentEncryptionAlgorithm || "aes-256-gcm";
   var ca = CONTENT_ALGS[guard.text.keyOf(algName)];
   if (!ca) throw _err("cms/bad-input", "unsupported contentEncryptionAlgorithm " + guard.text.showValue(algName));
@@ -648,7 +648,7 @@ function authenticate(content, recipients, opts) {
 }
 
 async function _authenticateImpl(content, recipients, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var withAttrs = opts.authenticatedAttributes !== false;
   guard.identifier.assertKnownKeys(opts, withAttrs ? _AUTHENTICATE_OPTS_ATTRS : _AUTHENTICATE_OPTS_BARE,
     _err, "cms/bad-input", function (k) {

package/lib/cms-sign.js

@@ -203,7 +203,7 @@ function _assertAlgorithmProtectionPairs(pairs, digestAlgId, armAlgId, armTag) {
 }
 
 function _resolveSignerContext(signer, opts) {
-  var so = signer || {};
+  var so = signer || intrinsic.create(null);
   var keyOnly = so.cert == null && so.spki != null;
   var soKey = so.key;
   var soSpki = keyOnly ? guard.bytes.snapshotSource(so.spki, CmsError, "cms/bad-input", "a key-only signer's spki") : null;
@@ -533,7 +533,7 @@ function _resolveSignerIndices(spec, n) {
 }
 
 function _buildCountersignature(targetSigOctets, countersigner, opts) {
-  var so = countersigner || {};
+  var so = countersigner || intrinsic.create(null);
   var certDer = _normCertDer(so.cert);
   var cert = x509.parse(certDer);
   var scheme = signScheme.resolveSignScheme(cert, so, opts.signedAttributes === false, _signE);