@blamejs/pki 0.8.61 → 0.9.1

package/lib/constants.js

@@ -189,6 +189,9 @@ var LIMITS = Object.assign(Object.create(null), {
   PBKDF2_MAX_SALT: 1024,
   MIME_MAX_BYTES: BYTES.mib(16),
   HEADER_LINE_MAX_OCTETS: 998,
+  MIME_MAX_PARTS: 1024,
+  MIME_MAX_HEADERS: 1024,
+  MIME_MAX_PARAMS: 256,
   COMPRESS_MAX_BYTES: BYTES.mib(16),
   TLS_CERT_MSG_MAX_BYTES: BYTES.mib(16) - 1,
   TLS_CERT_MAX_ENTRIES: 100,

package/lib/crl-sign.js

@@ -240,7 +240,7 @@ function _buildCrlExtensions(spec, ctx) {
   var crlNumberVal = null;
   if (spec.crlNumber != null) { var cn = _boundedInteger(spec.crlNumber, "cRLNumber"); crlNumberVal = cn.value; push("cRLNumber", false, cn.tlv); }
   var ext = spec.extensions;
-  if (ext == null) ext = {};
+  if (ext == null) ext = intrinsic.create(null);
   if (Array.isArray(ext)) {
     var arrBase = null, arrCrlNum = null;
     /** @internal The walk goes through `guard.list.copyMap`, never the caller's own `forEach`. Reached
@@ -391,9 +391,9 @@ function _assertIssuerCanSignCrl(issuerCert) {
 }
 
 function _sign(spec, issuer, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crl/bad-input", "the CRL spec must be an object");
-  issuer = issuer || {};
+  issuer = issuer || intrinsic.create(null);
   var byCert = issuer.cert != null, byName = issuer.name != null;
   guard.identifier.assertKnownKeys(spec, byCert || byName ? KNOWN_SPEC_KEYS_ISSUER_NAMED : KNOWN_SPEC_KEYS,
     _err, "crl/bad-input", function (k) {

package/lib/crmf-sign.js

@@ -1215,7 +1215,7 @@ function _buildCertReqMsg(spec, key, opts) {
 }
 
 function _build(spec, key, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || _isBuffer(spec)) throw _err("crmf/bad-input", "the certificate-request-message spec must be an object");
   var specs;
   if (spec.messages != null) {

package/lib/csr-sign.js

@@ -209,7 +209,7 @@ function sign(spec, key, opts) {
 }
 
 function _sign(spec, key, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("csr/bad-input", "the certification-request spec must be an object");
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "csr/bad-input", "unknown spec field ");
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "csr/bad-input", "pki.csr.sign has an unknown option ");

package/lib/ct.js

@@ -40,6 +40,7 @@
  */
 
 var asn1 = require("./asn1-der.js");
+var _create = require("./guard-intrinsic").create;
 var constants = require("./constants.js");
 var frameworkError = require("./framework-error.js");
 var guard = require("./guard-all.js");
@@ -357,7 +358,7 @@ function _u24Bytes(n) {
 var _X509_ENTRY_KEYS = intrinsic.assign(intrinsic.create(null), { entryType: 1, leafCert: 1 });
 var _PRECERT_ENTRY_KEYS = intrinsic.assign(intrinsic.create(null), { entryType: 1, tbsCertificate: 1, issuerKeyHash: 1 });
 function reconstructSignedData(entry, sct) {
-  entry = entry || {};
+  entry = entry || _create(null);
   if (typeof entry !== "object") throw new CtError("ct/bad-input", "the log entry must be an object { entryType, ... } (RFC 6962 sec. 3.1)");
   var entryType = entry.entryType;
   if (entryType !== 0 && entryType !== 1) {
@@ -493,7 +494,7 @@ async function verifySct(entry, sct, logPublicKey) {
       throw new CtError("ct/log-id-mismatch", "the SCT logId does not match SHA-256 of the provided log key (RFC 6962 sec. 3.2)");
     }
   }
-  var sigInfo = rec.signatureAlgorithm || {};
+  var sigInfo = rec.signatureAlgorithm || _create(null);
   var hashName = CT_HASH[sigInfo.hashName];
   if (!hashName) throw new CtError("ct/unsupported-algorithm", "unsupported SCT hash algorithm " + JSON.stringify(sigInfo.hashName) + " (RFC 6962 sec. 2.1.4 mandates sha256)");
   var alg = _spkiAlg(spki);
@@ -899,7 +900,7 @@ function _classifyLog(sct, logList, entry, opts) {
 }
 
 async function verifySctWithLogList(entry, sct, logList, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var c = _classifyLog(sct, logList, entry, opts);
   if (c.status !== "ok") throw _ctErr(c.code, c.message);
   /** @internal Read before the verify, so the timestamp the verdict states is the one the signature covered.
@@ -1249,7 +1250,7 @@ function _assertTransport(opts) {
  *  `Symbol.split` is part of that operation. The token decides which parser a log's response body is
  *  handed to. */
 function _fetchCtypeToken(headers) {
-  var raw = intrinsic.String((headers || {})["content-type"] || "");
+  var raw = intrinsic.String((headers || _create(null))["content-type"] || "");
   var parts = intrinsic.splitChar(raw, 59);
   return _toLowerCase(_ctTrim(parts.length ? parts[0] : ""));
 }
@@ -1279,7 +1280,7 @@ function _fetchBody(transport, url, req, label) {
     if (req.body !== undefined) request.body = req.body;
     return transport(request);
   }).then(function (res) {
-    res = res || {};
+    res = res || _create(null);
     var h = intrinsic.create(null);
     guard.identifier.optionNames(res.headers).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
     var body = guard.bytes.isByteSource(res.body)
@@ -1581,7 +1582,7 @@ function _uintField(obj, name, code, label) {
 var _STH_KEYS = intrinsic.assign(intrinsic.create(null),
   { timestamp: 1, treeSize: 1, rootHash: 1, signature: 1, raw: 1, then: 1 });
 function sthSignedData(sth) {
-  sth = sth || {};
+  sth = sth || _create(null);
   guard.identifier.assertKnownKeys(sth, _STH_KEYS, _ctErr, "ct/bad-input", "unknown sth field ");
   var ts = guard.range.uint64(sth.timestamp, _ctErr, "ct/bad-input", "sth.timestamp");
   var size = guard.range.uint64(sth.treeSize, _ctErr, "ct/bad-input", "sth.treeSize");
@@ -1627,7 +1628,7 @@ function sthSignedData(sth) {
  *   // -> true
  */
 async function verifySth(sth, logKey) {
-  sth = sth || {};
+  sth = sth || _create(null);
   var signature = _toBuffer(sth.signature, "sth.signature");
   var signedData = sthSignedData({ timestamp: sth.timestamp, treeSize: sth.treeSize, rootHash: sth.rootHash });
   return await _verifyDigitallySigned(signedData, signature, logKey, "the signed tree head");
@@ -1668,7 +1669,7 @@ async function verifySth(sth, logKey) {
  *   sth.treeSize;   // -> 3n
  */
 async function getSth(opts) {
-  var door = _clientDoor(opts || {}, "logKey");
+  var door = _clientDoor(opts || _create(null), "logKey");
   opts = door.o;
   /** @internal ONE read of the option, and the presence check and the copy both decide from it. Reading
    *  it twice let an accessor answer the two separately: a non-null value for the check and an
@@ -1727,7 +1728,7 @@ async function getSth(opts) {
  *   p.verified;   // -> true
  */
 async function getProofByHash(opts) {
-  var door = _clientDoor(opts || {}, null);
+  var door = _clientDoor(opts || _create(null), null);
   opts = door.o;
   var sth = _assertSth(opts.sth, "opts.sth");
   /** @internal Copied for the reason the tree head is: it is sent on the wire and then folded against the
@@ -1783,7 +1784,7 @@ async function getProofByHash(opts) {
  *   c.verified;   // -> true
  */
 async function getSthConsistency(opts) {
-  var door = _clientDoor(opts || {}, null);
+  var door = _clientDoor(opts || _create(null), null);
   opts = door.o;
   var oldSth = _assertSth(opts.oldSth, "opts.oldSth");
   var newSth = _assertSth(opts.newSth, "opts.newSth");
@@ -1841,7 +1842,7 @@ async function getSthConsistency(opts) {
  *   e.entries[0].leafInput;   // -> <Buffer ...>
  */
 async function getEntries(opts) {
-  var door = _clientDoor(opts || {}, null);
+  var door = _clientDoor(opts || _create(null), null);
   opts = door.o;
   var start = guard.range.uint64(opts.start, _ctErr, "ct/bad-input", "opts.start");
   var end = guard.range.uint64(opts.end, _ctErr, "ct/bad-input", "opts.end");
@@ -1899,7 +1900,7 @@ async function getEntries(opts) {
  */
 async function getRoots(opts) {
   /** @internal This message carries no options of its own, so the door's record is all that is used. */
-  var door = _clientDoor(opts || {}, null);
+  var door = _clientDoor(opts || _create(null), null);
   var doc = await _clientJson(door, "get-roots", "roots");
   return guard.verdict.of({ certificates: _b64Array(doc, "certificates", "ct/bad-roots", "roots", undefined, C.LIMITS.CT_MAX_ROOTS) });
 }
@@ -1982,7 +1983,7 @@ async function addPreChain(opts) {
  *  The chain encoding, the response shape, and the refusal when the receipt does not verify are one
  *  rule stated once. */
 async function _addChain(opts, message, entryType) {
-  var door = _clientDoor(opts || {}, "logKey");
+  var door = _clientDoor(opts || _create(null), "logKey");
   opts = door.o;
   /** @internal ONE read of the option, used by the presence check here and by the copy below. Reading it
    *  twice let an accessor answer the two separately, presenting a non-null value to the check and an

package/lib/est.js

@@ -281,8 +281,14 @@ function _matchDelimAt(text, ls, boundary) {
   if (_charCodeAt(text, q) === 0x0d && q + 1 < n && _charCodeAt(text, q + 1) === 0x0a) return { end: q + 2, close: close };
   return null;
 }
+/** @internal The delimiter count is bounded before the list is built, since one mark is appended per
+ *  delimiter found anywhere in the body and the scan does not stop at the terminal one. The bound is
+ *  the part cap plus that terminal delimiter, and it is the same `C.LIMITS` row the MIME reader
+ *  counts parts against, so the two doors hold a multipart body to one number. */
 function _findMultipartMarks(text, boundary) {
   var marks = [], n = text.length, searchStart = 0, p;
+  var counted = guard.limits.counter(constants.LIMITS.MIME_MAX_PARTS, E, "est/bad-multipart",
+    "the multipart body part");
   while (searchStart <= n) {
     var found = null, foundAt = -1;
     for (p = searchStart; p <= n; p++) {
@@ -293,7 +299,15 @@ function _findMultipartMarks(text, boundary) {
       if (lsN !== -1) { var r1 = _matchDelimAt(text, lsN, boundary); if (r1) { found = r1; foundAt = p; break; } }
     }
     if (!found) break;
+    /** @internal The closing delimiter opens no part, so it is not charged and the cap counts the
+     *  parts an operator is told it counts. */
+    if (!found.close) counted.tick();
     guard.list.append(marks, { at: foundAt, bodyStart: found.end, close: found.close });
+    /** @internal RFC 2046 sec. 5.1.1 discards everything after the closing delimiter, and the caller
+     *  reads no mark past the first one that closes, so the scan stops there. Running on charged the
+     *  epilogue against the part budget: a body at the cap was refused for text it never reads, while
+     *  the same body without that epilogue was accepted. */
+    if (found.close) break;
     searchStart = found.end === foundAt ? found.end + 1 : found.end;
   }
   return marks;
@@ -314,18 +328,29 @@ function _stripOneTrailingEol(seg, end) {
   }
   return end;
 }
-function _unfoldHeaders(raw) {
-  var out = "", last = 0, i = 0, n = raw.length;
+/** @internal Every line break in the part's header area is charged as the scan passes it, before the
+ *  unfolded text is split, so the refusal costs the cap rather than the input. Counting the split
+ *  lines afterwards instead read 2,000,000 one-line headers in 425 ms and 172 MiB of resident memory
+ *  before refusing, and never reached two on 1,500,000 continuation lines, which fold into one line. */
+function _unfoldHeaders(raw, counted) {
+  var out = "", last = 0, i = 0, n = raw.length, afterLastBreak = 0;
   while (i < n) {
     var nlLen = 0;
     if (_charCodeAt(raw, i) === 0x0d && i + 1 < n && _charCodeAt(raw, i + 1) === 0x0a) nlLen = 2;
     else if (_charCodeAt(raw, i) === 0x0a) nlLen = 1;
-    if (nlLen > 0) {
-      var after = i + nlLen;
-      if (after < n && (_charCodeAt(raw, after) === 0x20 || _charCodeAt(raw, after) === 0x09)) { out += _strSlice(raw, last, i); last = after; i = after; continue; }
-    }
-    i += 1;
+    if (nlLen === 0) { i += 1; continue; }
+    /** @internal The scan steps PAST the whole break rather than one byte into it, so a CRLF is one
+     *  line and not two: stepping one byte left the LF to be read as a second break on the next pass,
+     *  which charged every CRLF twice and halved the cap a part was actually held to. */
+    counted.tick();
+    var after = i + nlLen;
+    afterLastBreak = after;
+    if (after < n && (_charCodeAt(raw, after) === 0x20 || _charCodeAt(raw, after) === 0x09)) { out += _strSlice(raw, last, i); last = after; i = after; continue; }
+    i = after;
   }
+  /** @internal The run after the last break is a line as well, and a header area that ends at a break
+   *  has no run after it, so the charge is the LINE count the cap is stated in and not one less. */
+  if (afterLastBreak < n) counted.tick();
   return out + _strSlice(raw, last, n);
 }
 function _splitCrlf(s) {
@@ -359,7 +384,9 @@ function splitMultipartMixed(body, contentType) {
     var rawHeaders = _strSlice(seg, 0, sep);
     var partBody = _strSlice(seg, _stripTwoLeadingEol(seg, sep), _stripOneTrailingEol(seg, seg.length));
     var headers = intrinsic.create(null);
-    var lines = _splitCrlf(_unfoldHeaders(rawHeaders));
+    var countedHeaders = guard.limits.counter(constants.LIMITS.MIME_MAX_HEADERS, E, "est/bad-multipart",
+      "the multipart part header line");
+    var lines = _splitCrlf(_unfoldHeaders(rawHeaders, countedHeaders));
     for (var li = 0; li < lines.length; li++) {
       var line = lines[li];
       /** @internal A part's header name and value are cut, trimmed and folded through the captured
@@ -367,7 +394,20 @@ function splitMultipartMixed(body, contentType) {
        *  its body goes to: measured, a part stating `application/pkcs8` was read as
        *  `application/pkcs7-mime` with a `smime-type` of `certs-only`. */
       var col = _estIndexOf(line, ":");
-      if (col > 0) headers[_toLowerCase(_estTrim(_strSlice(line, 0, col)))] = _estTrim(_strSlice(line, col + 1));
+      if (col <= 0) continue;
+      var fname = _toLowerCase(_estTrim(_strSlice(line, 0, col)));
+      /** @internal A repeat is refused rather than overwritten. Storing each value in turn left the
+       *  LAST line deciding the field, and the field this decides is the part's own content type,
+       *  which selects the reader its body goes to: measured, the same two Content-Type lines swapped
+       *  reported `application/pkcs7-mime; smime-type=certs-only` one way and `application/pkcs8` the
+       *  other, which is which part is the private key and which is the certificate. RFC 5322 sec. 3.6
+       *  gives a singleton field one occurrence, and taking the first is as conforming as taking the
+       *  last, so there is no value here to resolve to. */
+      if (intrinsic.hasOwn(headers, fname)) {
+        throw E("est/bad-multipart", "a multipart part declares the " + guard.text.showValue(fname) +
+          " header field more than once, so the value it resolves to is ambiguous (RFC 5322 sec. 3.6)");
+      }
+      headers[fname] = _estTrim(_strSlice(line, col + 1));
     }
     var partCt = headers["content-type"] || "";
     if (_ciStartsWith(partCt, "MULTIPART/")) throw E("est/bad-multipart", "a nested multipart part is not permitted");
@@ -471,36 +511,58 @@ function _recipientMatches(recipientInfos, opts) {
  *  replacement decides which segments a parameter is then looked for in, and one of those parameters
  *  is the multipart boundary a response body is divided on: measured, a `boundary=wire` header
  *  yielded `forged`. */
+/** @internal The first segment is the media type rather than a parameter, so it is not charged, and
+ *  the charge comes BEFORE the segment is stored, so a refusal costs the cap and not the input: with
+ *  no cap here a 3.8 MiB Content-Type carrying 1,000,000 parameters was accepted in 194 ms and 100 MiB
+ *  of resident memory, and a part's media type splits the same value a second time. The bound is the
+ *  `C.LIMITS` row the MIME reader counts parameters against, so both doors hold one media type to one
+ *  number. */
+function _pushCtSegment(segs, seg, counted) {
+  if (segs.length > 0) counted.tick();
+  intrinsic.append(segs, seg);
+}
+
 function _splitContentTypeParams(s) {
   var segs = [], cur = "", inQuote = false;
+  var counted = guard.limits.counter(constants.LIMITS.MIME_MAX_PARAMS, E, "est/bad-multipart",
+    "the Content-Type parameter");
   for (var i = 0; i < s.length; i++) {
     var ch = _estCharAt(s, i);
     if (ch === '"') { inQuote = !inQuote; cur += ch; }
-    else if (ch === ";" && !inQuote) { intrinsic.append(segs, cur); cur = ""; }
+    else if (ch === ";" && !inQuote) { _pushCtSegment(segs, cur, counted); cur = ""; }
     else cur += ch;
   }
-  intrinsic.append(segs, cur);
+  _pushCtSegment(segs, cur, counted);
   return segs;
 }
 
 function _ctParam(contentType, name) {
   var segs = _splitContentTypeParams(_stringOf(contentType || ""));
-  var value = null, count = 0;
+  var value = null, plain = 0, starred = 0;
   /** @internal Each parameter is read through the captured operations. The name decides which
    *  parameter this is, and the value it returns is the one a caller acts on: for the RFC 7030
    *  multipart boundary, it is where a response body is split. */
   for (var i = 1; i < segs.length; i++) {
     var seg = segs[i];
     var eq = _estIndexOf(seg, "=");
-    if (eq === -1) continue;
-    if (_toLowerCase(_estTrim(_strSlice(seg, 0, eq))) !== name) continue;
-    count++;
-    if (count > 1) continue;
+    /** @internal An occurrence counts whether or not it carries a value, which is why a bare
+     *  attribute is counted: skipping it let `boundary; boundary="b"` through while
+     *  `boundary="a"; boundary="b"` was refused. The plain and the starred RFC 2231 spellings are
+     *  counted apart, because what has to be refused is two readings carrying DIFFERENT values.
+     *  `boundary*=us-ascii''DECOY; boundary=REAL` is read here as REAL and by an RFC 2231 reader as
+     *  DECOY, while continuation segments alone leave this reader no boundary at all, which the
+     *  caller already refuses (RFC 2231 sec. 3, sec. 4, sec. 7). */
+    var attr = _toLowerCase(_estTrim(eq === -1 ? seg : _strSlice(seg, 0, eq)));
+    var star = _estIndexOf(attr, "*");
+    if ((star > 0 ? _strSlice(attr, 0, star) : attr) !== name) continue;
+    if (star > 0) { starred++; continue; }
+    plain++;
+    if (eq === -1 || plain > 1) continue;
     var val = _estTrim(_strSlice(seg, eq + 1));
     if (val.length >= 2 && _estCharAt(val, 0) === '"' && _estCharAt(val, val.length - 1) === '"') val = _strSlice(val, 1, -1);
     value = val;
   }
-  return { value: value, duplicated: count > 1 };
+  return { value: value, duplicated: plain > 1 || (plain > 0 && starred > 0) };
 }
 
 var _MT_FIRST = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
@@ -533,7 +595,7 @@ function _partMediaType(contentType) {
 }
 
 function parseServerKeygenResponse(body, contentType, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   opts = _knownOpts(opts, PARSE_SERVERKEYGEN_OPTS, "parseServerKeygenResponse");
   var parts = splitMultipartMixed(body, contentType);
   if (parts.length !== 2) throw E("est/bad-multipart", "a serverkeygen response must have exactly two parts (RFC 7030 sec. 4.4.2)");
@@ -617,7 +679,7 @@ function classifyResponse(status, headers, body, opts) {
 }
 
 function _classifyResponse(status, headers, body, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   opts = _knownOpts(opts, CLASSIFY_OPTS, "classifyResponse");
   var op = opts.op;
   if (op !== undefined && op !== null && CLASSIFIABLE_OPS.indexOf(op) === -1) throw E("est/unsupported-operation", "unrecognized EST operation " + guard.text.showValue(op));
@@ -689,7 +751,7 @@ function _classifyResponse(status, headers, body, opts) {
  *   // -> "https://ca.example/.well-known/est/cacerts"
  */
 function paths(baseUrl, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   opts = _knownOpts(opts, PATHS_OPTS, "paths");
   var base = String(baseUrl);
   var prefix = base.slice(0, _stripTrailingSlashEnd(base)) + "/.well-known/est";
@@ -957,7 +1019,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   function step() {
     var hopBody = (typeof body === "function" && budgets.onAttempt) ? budgets.onAttempt() : body;
     return guard.async.invoked(transport, [{ method: method, url: _urlHref(url), headers: _headersFor(url), body: hopBody, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "est/bad-input", "opts.transport").then(function (res) {
-      res = res || {};
+      res = res || intrinsic.create(null);
       var blen = _bodyLen(res);
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
       var h = intrinsic.assign(intrinsic.create(null), {
@@ -1159,7 +1221,7 @@ function _certsResult(op, res, opts, csrSpki) {
  *   r.retry && r.retryAfterSeconds;   // 60
  */
 function fullcmc(baseUrl, request, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var der, wanted, sent;
   try {
     if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw E("est/bad-input", "pki.est.fullcmc options must be an object");
@@ -1588,7 +1650,7 @@ function _enroll(op, baseUrl, csrInput, opts, proxySnap) {
  *   r.certificates;   // -> [Buffer, ...] raw, unordered
  */
 function cacerts(baseUrl, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, CACERTS_OPTS, "cacerts");
@@ -1654,7 +1716,7 @@ function cacerts(baseUrl, opts) {
  *   bound.retry;   // true
  */
 function simpleenroll(baseUrl, csrInput, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SIMPLEENROLL_OPTS, "simpleenroll");
@@ -1694,7 +1756,7 @@ function simpleenroll(baseUrl, csrInput, opts) {
  *   r.retry;   // true
  */
 function simplereenroll(baseUrl, csrInput, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SIMPLEREENROLL_OPTS, "simplereenroll");
@@ -1751,7 +1813,7 @@ function _assertConfidentialCipher(res) {
 }
 
 function _ciHeaderList(headers, name) {
-  headers = headers || {};
+  headers = headers || intrinsic.create(null);
   /** @internal The header NAME a value is selected under is folded through the captured conversion on
    *  both sides of the comparison: the match decides which header this response is read from. */
   var lname = _toLowerCase(name), keys = guard.identifier.optionNames(headers), parts = [];
@@ -1765,7 +1827,7 @@ function _ciHeaderList(headers, name) {
 }
 
 function _ciHeader(headers, name) {
-  headers = headers || {};
+  headers = headers || intrinsic.create(null);
   var lname = _toLowerCase(name), keys = guard.identifier.optionNames(headers), found = null, n = 0;
   for (var i = 0; i < keys.length; i++) {
     if (_toLowerCase(keys[i]) !== lname) continue;
@@ -1777,6 +1839,16 @@ function _ciHeader(headers, name) {
       "the response carries more than one " + lname + " header field, so what the body is cannot be told " +
       "from it (RFC 9110 sec. 5.1: field names are case-insensitive)");
   }
+  /** @internal One key can still hold SEVERAL values, which is how `node:http` reports a field that
+   *  arrived more than once, and these three fields each carry one value. Counting keys alone left a
+   *  two-element array to be read as one string: measured, the two orders of the same pair gave
+   *  `est/bad-content-type` one way and an accepted classification the other, because the joined text
+   *  parsed as a media type in one order and not in the other. */
+  if (intrinsic.isArray(found) && found.length > 1) {
+    throw E("est/bad-content-type",
+      "the response carries " + found.length + " values for " + lname + ", so what the body is cannot be " +
+      "told from it (RFC 9110 sec. 5.1)");
+  }
   return n === 0 ? null : found;
 }
 
@@ -1854,7 +1926,7 @@ async function _serverkeygenResult(res, opts, derived) {
  *   r.retry;   // true -- a 202 is surfaced, never slept
  */
 function serverkeygen(baseUrl, csrInput, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SERVERKEYGEN_OPTS, "serverkeygen");
@@ -1916,7 +1988,7 @@ function _csrattrsResult(res, opts) {
  *   r.available;   // false -- a 404 is "no CSR-attributes policy available"
  */
 function csrattrs(baseUrl, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, CSRATTRS_OPTS, "csrattrs");

package/lib/framework-error.js

@@ -122,7 +122,7 @@ function defineClass(name, opts) {
   if (typeof name !== "string" || name.length === 0) {
     throw new TypeError("defineClass: name must be a non-empty string");
   }
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var withCause = !!opts.withCause;
   var flagKey = "is" + name;
 

package/lib/guard-bytes.js

@@ -281,7 +281,7 @@ function snapshotSource(input, ErrorClass, code, label) {
  *  the budget rather than the shape of the input. The figure is far above any real caller value: an
  *  options bag or a JWK is tens of nodes, and a certificate chain passed as an anchor list is thousands. */
 function snapshotDeep(value, ErrorClass, code, label, opts) {
-  var o = opts || {};
+  var o = opts || _create(null);
   var cap = o.maxDepth == null ? 64 : o.maxDepth;
   var maxNodes = o.maxNodes == null ? constants.LIMITS.DEEP_COPY_MAX_NODES : o.maxNodes;
   return _deep(value, ErrorClass, code, label, cap, 0, o.collect || null, { n: 0, max: maxNodes });

package/lib/guard-limits.js

@@ -4,6 +4,7 @@
 // @internal
 
 var constants = require("./constants");
+var _create = require("./guard-intrinsic").create;
 var _isInteger = require("./guard-intrinsic").isInteger;
 var _freeze = require("./guard-intrinsic").freeze;
 var _sizeOf = require("./guard-intrinsic").sizeOf;
@@ -15,7 +16,7 @@ function _monotonicNow() { return _Number(_hrtimeBigint() / 1000000n); }
 // @enforced-by behavioral -- a config-time cap validator has no rename-proof code
 function cap(value, key, dflt, opts) {
   if (value === undefined) return dflt;
-  opts = opts || {};
+  opts = opts || _create(null);
   /** @internal Each bound is read ONCE, into the value the integer check and the comparison share.
    *  Read twice, the check saw one bound and the comparison another, so an `opts` answering a valid
    *  small integer to the check and a large one to the comparison configured a cap that admitted a
@@ -141,7 +142,7 @@ function budget(limits) {
  */
 // @enforced-by behavioral -- an elapsed-time comparison has no rename-proof shape that separates a deadline from any other subtraction; the vectors driving a checker to its bound are the guard
 function deadline(totalMs, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var rawNow = opts.now;
   var now = typeof rawNow === "function" ? rawNow : _monotonicNow;
   if (!_isInteger(totalMs) || totalMs < 0) {

package/lib/hpke.js

@@ -923,7 +923,7 @@ function _setupS(ids, pkR, opts) {
    *  the subject being the key rather than the ciphertext. `_suite(ids)` stays above both, by necessity:
    *  which KEM this is decides the width the key is held to. */
   var r = _recipPublic(suite, pkR);
-  opts = _options(opts || {}, _SETUP_S_KEYS, "sender setup");
+  opts = _options(opts || intrinsic.create(null), _SETUP_S_KEYS, "sender setup");
   var mode = opts.mode;
   var kem = suite.kem, k;
   if (mode === MODE_AUTH || mode === MODE_AUTH_PSK) {
@@ -978,7 +978,7 @@ function _setupR(ids, enc, skR, opts) {
    *  size of whatever was supplied: a 64 MiB value handed where a 32-byte encapsulation belongs was
    *  copied in full and only then refused. */
   var sealed = _rawKey(enc, _encWidth(suite.kem));
-  opts = _options(opts || {}, _SETUP_R_KEYS, "recipient setup");
+  opts = _options(opts || intrinsic.create(null), _SETUP_R_KEYS, "recipient setup");
   var mode = opts.mode;
   var r = _recipPrivate(suite, skR);
   var kem = suite.kem, ss;

package/lib/http-retry-after.js

@@ -3,6 +3,9 @@
 "use strict";
 // @internal
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 48 live runtime reads. */
+var _create = Object.create;
 var constants = require("./constants");
 var guard = require("./guard-all");
 
@@ -100,7 +103,7 @@ function httpDateMs(s, refMs) {
 }
 
 function parse(value, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var raStr = String(value).trim();
   var out = { retryAfterSeconds: null, retryAfterDate: null };
   if (_isAllDigits(raStr)) {

package/lib/http-transport.js

@@ -339,7 +339,7 @@ function _blockedAddrErr(hostname, address) {
 }
 function _makeGuardedLookup(lookupFn) {
   return function guardedLookup(hostname, options, callback) {
-    lookupFn(hostname, options || {}, function (err, address, family) {
+    lookupFn(hostname, options || intrinsic.create(null), function (err, address, family) {
       if (err) return callback(err);
       /** @internal Each address is read ONCE, the read is what gets classified, and the SNAPSHOT is
        *  what the socket layer is handed. Forwarding the list the resolver returned let the entry be
@@ -633,7 +633,7 @@ function _proxyErrorClass(e, C) {
  *   res.status;   // 200
  */
 function httpsTransport(defaults) {
-  defaults = defaults || {};
+  defaults = defaults || intrinsic.create(null);
   /** @internal Each of these is read ONCE, into the value both the test and the use see, and the
    *  error factory a refusal is built from is one of them. */
   var rawE = defaults.E;
@@ -789,7 +789,7 @@ function httpsTransport(defaults) {
   }
 
   var _transportFn = function transport(request) {
-    request = request || {};
+    request = request || intrinsic.create(null);
     var prep;
     try { prep = _prepare(request); }
     catch (e) { return _promiseReject(_Promise, e); }
@@ -848,7 +848,7 @@ function httpsTransport(defaults) {
             /** @internal Captured for consistency with the rest of the file, not because this gates
              * anything: an understated `content-length` only skips this EARLY refusal, and the cap is
              * enforced below on the bytes actually counted as they arrive. */
-            var declared = intrinsic.parseInt((res.headers || {})["content-length"], 10);
+            var declared = intrinsic.parseInt((res.headers || intrinsic.create(null))["content-length"], 10);
             if (intrinsic.numberIsFinite(declared) && declared > prep.maxBytes) { fail(C("response-too-large"), "the declared content-length " + declared + " exceeds the " + prep.maxBytes + "-byte cap (RFC 7030 sec. 6)"); return; }
             var buf = _bufferAllocUnsafe(0);
             var len = 0;
@@ -1039,7 +1039,7 @@ function httpsTransport(defaults) {
    * connecting directly while a proxy is configured would reach an origin the caller asked not to
    * reach directly. */
   _transportFn.peerChain = function peerChain(request) {
-    request = request || {};
+    request = request || intrinsic.create(null);
     var prep;
     try { prep = _prepare({
       url: request.url,
@@ -1149,6 +1149,6 @@ function httpsTransport(defaults) {
  *   pki.schema.x509.parse(channel.peerChain[0]).subject.dn;    // the leaf's subject
  *   channel.peerCertificate;                                   // the one certificate the endpoint sent
  */
-function peerChain(request, defaults) { return httpsTransport(defaults || {}).peerChain(request); }
+function peerChain(request, defaults) { return httpsTransport(defaults || intrinsic.create(null)).peerChain(request); }
 
 module.exports = { https: httpsTransport, peerChain: peerChain, isBlockedIp: _isBlockedIp, _makeGuardedLookup: _makeGuardedLookup, MAX_TIMEOUT: MAX_TIMEOUT, snapshotProxy: snapshotProxy };

package/lib/inspect.js

@@ -23,6 +23,11 @@
  * @card Read a certificate like `openssl x509 -text`, in pure JS.
  */
 
+/** @internal The record constructor, captured at load. A default record written as `{}` has
+ * `Object.prototype`, so every field the caller omitted is read off the prototype chain. This module
+ * does not take the guard-intrinsic captures, and requiring them arms it whole: measured, that counts
+ * 662 live runtime reads here, which is a migration of its own rather than a line in this change. */
+var _create = Object.create;
 var frameworkError = require("./framework-error");
 var constants = require("./constants");
 var asn1 = require("./asn1-der");
@@ -56,7 +61,7 @@ var OID_UNOTICE = oid.byName("unotice");
 
 var HEX = "0123456789abcdef";
 function _hexColon(buf, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var hex = [];
   for (var i = 0; i < buf.length; i++) {
     var b = buf[i], s = HEX[(b >> 4) & 0xf] + HEX[b & 0xf];
@@ -346,7 +351,7 @@ var EXT_RENDERERS = Object.assign(Object.create(null), {
     return (decoded || []).map(function (ad) {
       var m = null;
       try { m = oid.name(ad.accessMethod); } catch (_e) { /* allow:swallow-unverified display best-effort: an unregistered accessMethod OID falls back to the raw dotted OID below (inspection is best-effort, never a verdict) */ }
-      var loc = ad.accessLocation || {}, lv;
+      var loc = ad.accessLocation || _create(null), lv;
       if (loc.tag === 6) lv = "URI:" + loc.value;
       else if (loc.tag === 2) lv = "DNS:" + loc.value;
       else if (loc.tag === 1) lv = "email:" + loc.value;
@@ -1368,7 +1373,7 @@ function pkcs12Report(input) {
      *  structure, and the outer MacData fields then describe nothing: read from there, a store with 2048
      *  PBKDF2 iterations reported one iteration, an empty salt, and "pbmac1" as its digest. */
     if (p.mac.pbmac1) {
-      var kdf = p.mac.pbmac1.kdf || {};
+      var kdf = p.mac.pbmac1.kdf || _create(null);
       _optLine(L, "        ", "Digest", p.mac.pbmac1.schemeName || p.mac.pbmac1.schemeOid);
       _optLine(L, "        ", "Key Derivation", kdf.prfName || kdf.prfOid);
       _optLine(L, "        ", "Iterations", kdf.iterationCount);
@@ -2363,7 +2368,7 @@ var KNOWN_DUMP_OPTS = Object.assign(Object.create(null),
  *   // Incomplete: the walk could not read the value at offset 5: content length 3 overruns the 0 bytes that remain.
  */
 function asn1Dump(input, opts) {
-  if (opts === undefined || opts === null) opts = {};
+  if (opts === undefined || opts === null) opts = _create(null);
   if (typeof opts !== "object" || Array.isArray(opts)) {
     throw _err("inspect/bad-input", "pki.inspect.asn1 options must be an object");
   }