@blamejs/pki 0.8.61 → 0.9.1

package/lib/smime.js

@@ -33,6 +33,10 @@
  *   algorithm-agnostic.
  */
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: requiring the guard-intrinsic captures arms the module whole, which counts
+ * 176 live runtime reads here. */
+var _create = Object.create;
 var frameworkError = require("./framework-error.js");
 var mime = require("./mime.js");
 var cms = require("./cms-verify.js");
@@ -265,7 +269,6 @@ function _declaresHp(content) {
 
 function _noneSurface() { return { protectedHeaders: null, headerProtection: { present: false, mode: null, fromMismatch: null, confidential: [], legacy: null } }; }
 
-function _contentTypeCount(headers) { var n = 0; headers.forEach(function (h) { if (h.lname === "content-type") n++; }); return n; }
 
 var RFC5322_SINGLETON = new Set(["date", "from", "sender", "reply-to", "to", "cc", "bcc", "message-id", "in-reply-to", "references", "subject", "return-path"]);
 
@@ -330,7 +333,6 @@ function _legacyHpSurface(canon, outerEnt, mode, enabled) {
     if (partC.contentType.type !== "message/rfc822") return _noneSurface();
     partD = mime.parse(partC.body, SmimeError, "smime/bad-header-protection");
   } catch (_e) { return _noneSurface(); }
-  if (_contentTypeCount(partC.headers) > 1 || _contentTypeCount(partD.headers) > 1) return _noneSurface();
   if (mime.hasParam(partD.contentType.value, "hp")) return _noneSurface();
   if (_isCryptoLayer(partD.contentType.type)) return _noneSurface();
   var ex = _extractProtected(partD.headers);
@@ -549,9 +551,6 @@ function _hpSurface(content, outerEnt, expectedMode, authenticated, legacyEnable
   var canon = mime.canonicalizeText(content);
   if (!_declaresHp(canon)) return _legacyHpSurface(canon, outerEnt, expectedMode, legacyEnabled);
   var inner = mime.parse(canon, SmimeError, "smime/bad-header-protection");
-  var ctCount = _contentTypeCount(inner.headers);
-  if (ctCount > 1) throw _err("smime/bad-header-protection", "a header-protected payload must carry exactly one Content-Type field (found " + ctCount + ")");
-  if (mime.paramNameCount(inner.contentType.value, "hp") > 1) throw _err("smime/bad-header-protection", "a header-protected payload declares the hp parameter more than once");
   var raw = inner.contentType.params.hp;
   if (raw === undefined) throw _err("smime/bad-header-protection", "a header-protected payload declares a bare hp parameter with no value (expected hp=\"clear\" or hp=\"cipher\")");
   var hp = raw.toLowerCase();
@@ -654,7 +653,7 @@ function _base64Body(der) {
  */
 async function sign(content, signers, opts) {
   content = _fixedContent(content);
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, SIGN_OPTS, "sign");
   signers = _snapshotSignersFitForMail(signers);
   var hp = opts.protectHeaders === true;
@@ -767,7 +766,7 @@ function _capped(msg) {
  *   if (res.valid) { res.content; res.signers[0].sid; }
  */
 async function verify(message, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, VERIFY_OPTS, "verify");
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
@@ -877,7 +876,7 @@ function _cmsEncryptOpts(opts) {
  */
 async function encrypt(content, recipients, opts) {
   content = _fixedContent(content);
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, ENCRYPT_OPTS, "encrypt");
   var hp = opts.protectHeaders === true;
   var hpList = hp ? _hpHeaderList(opts.headers) : null;
@@ -934,7 +933,7 @@ async function encrypt(content, recipients, opts) {
  *   res.authenticated;  // true here (an AEAD content cipher); false for an enveloped-only CBC message, which carries no integrity
  */
 async function decrypt(message, keyMaterial, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, DECRYPT_OPTS, "decrypt");
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
@@ -984,7 +983,7 @@ async function decrypt(message, keyMaterial, opts) {
  */
 async function compress(content, opts) {
   content = _fixedContent(content);
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, COMPRESS_OPTS, "compress");
   var entity = _entityBytes(content, opts);
   var cOpts = {};
@@ -1018,7 +1017,7 @@ async function compress(content, opts) {
  *   res.content;   // the recovered inner MIME entity
  */
 async function decompress(message, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, DECOMPRESS_OPTS, "decompress");
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
@@ -1064,7 +1063,7 @@ var CERTS_ONLY_OPTS = Object.assign(Object.create(null), { crls: 1 });
  *   var p7c = pki.smime.buildCertsOnly([leafDer]);
  */
 function buildCertsOnly(certs, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   opts = _knownOpts(opts, CERTS_ONLY_OPTS, "buildCertsOnly");
   var der = _toBuf(cms.certsOnly(certs, { crls: opts.crls }));
   return _capped(Buffer.concat([_pkcs7MimeHead("certs-only", "smime.p7c"), _base64Body(der), mime.CRLF]));

package/lib/tlog.js

@@ -671,7 +671,7 @@ function parseCheckpoint(input) {
  */
 var _CHECKPOINT_OPTS = _assign(_create(null), { origin: 1 });
 async function verifyCheckpoint(input, keys, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _CHECKPOINT_OPTS, _err,
     "tlog/bad-input", "unknown verifyCheckpoint option ");
   /** @internal ONE read of the caller's input, shared by the decode and the verification below. Reading
@@ -1209,7 +1209,7 @@ async function _tilePath(lo, hi, m, size, unitAt) {
  */
 var _INCLUSION_PROOF_KEYS = _assign(_create(null), { index: 1, size: 1, read: 1 });
 async function inclusionProof(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _INCLUSION_PROOF_KEYS, _err,
     "tlog/bad-input", "unknown inclusionProof option ");
   var size = guard.range.uint64(opts.size, _err, "tlog/bad-input", "size");

package/lib/tls-cert-compress.js

@@ -167,7 +167,7 @@ function _resolveAllowed(opts) {
  *   pki.schema.x509.parse(out.certificate.entries[0].certData).subject;
  */
 function decompressCertificate(bytes, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   /** @internal Viewed, CAPPED, then COPIED, and only then are the options read. A view stays a window
    *  onto the caller's buffer, and `_resolveCap` reads `opts`, which is caller code when it is an
    *  accessor: a `maxOutputBytes` getter that wrote another valid message of the same length over the
@@ -262,7 +262,7 @@ function decompressCertificate(bytes, opts) {
  *   pki.schema.x509.parse(msg.entries[0].certData).subject;
  */
 function parseCertificateMessage(bytes, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var type = opts.certificateType === undefined ? "X509" : opts.certificateType;
   if (type !== "X509" && type !== "RawPublicKey") {
     throw _err("tls/bad-input", "opts.certificateType must be \"X509\" or \"RawPublicKey\"");
@@ -315,7 +315,7 @@ function parseCertificateMessage(bytes, opts) {
  *   wire.length < message.length;                       // true
  */
 function compressCertificate(certificateMessage, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   /** @internal Copied, not viewed. `opts.algorithm` is read below, and reading an option is caller code
    *  when it is an accessor, so over a view it would run between the message being looked at and being
    *  compressed and replace what this verb compresses, after it had accepted the message it was handed.

package/lib/tsp-sign.js

@@ -155,7 +155,7 @@ var _SIGN_OPTS = intrinsic.assign(intrinsic.create(null), {
 });
 
 function _sign(messageImprint, tsa, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (messageImprint && typeof messageImprint === "object" && !Buffer.isBuffer(messageImprint)) {
     guard.identifier.assertKnownKeys(messageImprint, _IMPRINT_KEYS, _err, "tsp/bad-input", function (k) {
       return "unknown messageImprint field " + JSON.stringify(k) + " (the imprint is { hashAlgorithm, hashedMessage })";
@@ -169,7 +169,7 @@ function _sign(messageImprint, tsa, opts) {
         " (the TSA is { cert, key }; a signing option belongs in the third argument)";
     });
   }
-  var mi = messageImprint || {};
+  var mi = messageImprint || intrinsic.create(null);
   if (!mi.hashAlgorithm || !NODE_DIGEST[guard.text.keyOf(mi.hashAlgorithm)]) throw _err("tsp/unsupported-algorithm", "messageImprint.hashAlgorithm must be a supported hash name");
   if (!guard.bytes.isByteSource(mi.hashedMessage)) throw _err("tsp/bad-input", "messageImprint.hashedMessage must be a BufferSource");
   var _signHmLen = guard.bytes.source(mi.hashedMessage, TspError, "tsp/bad-input", "messageImprint.hashedMessage").length;
@@ -292,10 +292,10 @@ function _assertImprint(mi) {
 var _REQUEST_OPTS = intrinsic.assign(intrinsic.create(null), { reqPolicy: 1, nonce: 1, certReq: 1, extensions: 1, pem: 1 });
 
 function request(messageImprint, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.request options must be an object");
   guard.identifier.assertKnownKeys(opts, _REQUEST_OPTS, _err, "tsp/bad-input", "pki.tsp.request has an unknown option ");
-  var mi = messageImprint || {};
+  var mi = messageImprint || intrinsic.create(null);
   if (mi && typeof mi === "object" && !Buffer.isBuffer(mi)) {
     guard.identifier.assertKnownKeys(mi, _IMPRINT_KEYS, _err, "tsp/bad-input", function (k) {
       return "unknown messageImprint field " + JSON.stringify(k) +
@@ -379,7 +379,7 @@ function parseRequest(input) { return schemaTsp.parseRequest(input); }
 var _RESPONSE_OPTS = intrinsic.assign(intrinsic.create(null), { status: 1, statusString: 1, failInfo: 1, pem: 1 });
 
 function response(token, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.response options must be an object");
   guard.identifier.assertKnownKeys(opts, _RESPONSE_OPTS, _err, "tsp/bad-input", "pki.tsp.response has an unknown option ");
   var st = opts.status;
@@ -664,7 +664,7 @@ function _anyCritical(extensions) {
 }
 
 async function verify(token, data, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
     "pki.tsp.verify has an unknown option (the anchor option is `trustAnchors`) ");

package/lib/tuf.js

@@ -804,7 +804,7 @@ function _checkedPublicKey(key, d) {
       guard.text.showValue(importedType) + " public key, so the signature would be checked " +
       "under an algorithm the metadata does not name");
   }
-  var details = guard.crypto.keyDetails(imported) || {};
+  var details = guard.crypto.keyDetails(imported) || _create(null);
   if (d.curve !== null && details.namedCurve !== d.curve) {
     throw _err("tuf/bad-key", "the scheme " + key.scheme + " names the " + d.curve +
       " curve; the key is on " + guard.text.showValue(details.namedCurve));
@@ -889,7 +889,7 @@ function _publicFromPem(pem, label) {
  */
 var _VERIFY_KEYS = intrinsic.assign(_create(null), { metadata: 1, keys: 1, role: 1 });
 async function verifySignatures(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _VERIFY_KEYS, _err, "tuf/bad-input", "unknown verifySignatures option ");
   /** @internal Every caller-owned input is taken ONCE, at the top, and everything below reads the copy.
    *  Validating the caller's object and then reading it again is two reads, and a member reached through an
@@ -1297,7 +1297,7 @@ function _asRoot(input, label) {
  */
 var _UPDATE_KEYS = intrinsic.assign(_create(null), { trustedRoot: 1, candidates: 1, now: 1 });
 async function updateRoot(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _UPDATE_KEYS, _err, "tuf/bad-input", "unknown updateRoot option ");
   /** @internal The instant is CAPTURED here, at the call, into a Date this function owns. A Date is
    *  mutable and the caller keeps theirs, and the freeze-attack check runs at the END, after a signature

package/lib/webauthn-mds.js

@@ -318,7 +318,7 @@ function _verifyMetadataBlob(blob, opts) {
   });
   var leaf = chain[0];
   _assertLeafSigns(leaf);
-  var leafAlg = (leaf.subjectPublicKeyInfo.algorithm || {}).name;
+  var leafAlg = (leaf.subjectPublicKeyInfo.algorithm || intrinsic.create(null)).name;
   var leafSchemes = typeof leafAlg === "string" ? LEAF_SCHEMES_BY_SPKI_ALG[leafAlg] : undefined;
   if (!leafSchemes || !leafSchemes[algRow.scheme]) {
     throw _err("webauthn/unsupported-algorithm", "the metadata BLOB alg " + header.alg + " does not match the x5c leaf key type " + intrinsic.stringify(leafAlg));

package/lib/webauthn.js

@@ -268,7 +268,7 @@ function _certKeyAlgNames(cose) {
   return [];
 }
 function _assertCertKeyAlgorithm(cert, cose, E) {
-  var alg = (cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.algorithm) || {};
+  var alg = (cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.algorithm) || intrinsic.create(null);
   var want = _certKeyAlgNames(cose);
   if (!want.length || intrinsic.indexOf(want, alg.name) < 0) {
     throw E("webauthn/key-mismatch", "the attestation certificate carries a " + intrinsic.stringify(alg.name) +

package/lib/x509-sign.js

@@ -166,7 +166,7 @@ var RESERVED_ALT_EXTS = intrinsic.assign(intrinsic.create(null), (function () {
 })());
 
 function _buildExtensions(extSpec, ctx) {
-  if (extSpec == null) extSpec = {};
+  if (extSpec == null) extSpec = intrinsic.create(null);
   if (_isArray(extSpec)) {
     var seenExt = intrinsic.create(null), arrCa = false, arrKeyCertSign = false, arrPathLen = false, arrNameConstraints = false;
     var oidBc = O("basicConstraints"), oidKu = O("keyUsage"), oidNc = O("nameConstraints"), oidPm = O("policyMappings");
@@ -708,9 +708,9 @@ function sign(spec, issuer, opts) {
 }
 
 function _sign(spec, issuer, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("x509/bad-input", "the certificate spec must be an object");
-  issuer = issuer || {};
+  issuer = issuer || intrinsic.create(null);
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "x509/bad-input", function (k) {
     return "unknown certificate spec field " + JSON.stringify(k) +
       (k === "issuer" ? "; the issuer is the SECOND argument to pki.x509.sign, not a spec field" : "") +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.61",
+  "version": "0.9.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:dc638a09-3eb3-4620-b84b-f3edd3453ec6",
+  "serialNumber": "urn:uuid:c9865553-89a9-487f-aef1-fe53df25b0ea",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-07T23:02:52.146Z",
+    "timestamp": "2026-10-08T04:38:54.565Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.61",
+      "bom-ref": "@blamejs/pki@0.9.1",
       "type": "application",
       "name": "pki",
-      "version": "0.8.61",
+      "version": "0.9.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.61",
+      "purl": "pkg:npm/%40blamejs/pki@0.9.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.61",
+      "ref": "@blamejs/pki@0.9.1",
       "dependsOn": []
     }
   ]