@blamejs/pki 0.5.28 → 0.5.29

package/CHANGELOG.md

@@ -4,7 +4,29 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.5.28 — 2026-08-23
+## v0.5.29 — 2026-08-24
+
+pki.path.validate refuses a mis-shaped trust anchor instead of returning a verdict against it, and accepts a parsed certificate directly.
+
+### Added
+
+- `pki.path.anchorFromCert(cert)` turns a parsed certificate into the `{ name, publicKey, algorithm }` trust-anchor tuple `pki.path.validate` and `pki.path.build` consume, so a root can be pinned from its certificate without hand-building the tuple. `pki.path.validate` and `pki.path.build` also accept a parsed certificate passed directly as the anchor.
+
+### Changed
+
+- A normalized trust anchor -- what `pki.path.anchorFromCert` returns and what `pki.path.build` reports as `result.trustAnchor` -- carries a defined set of fields: `name`, `publicKey`, `algorithm`, and `parameters`, plus `purposes`, `distrustAfter`, `subjectDer`, `label`, and `mozillaCaPolicy` when the source supplies them (the fields `pki.trust.parseCertdata` emits). These survive normalization, so a pinned trust-store entry round-trips; a field attached outside that set is not carried onto the anchor.
+- A trust anchor's `purposes` and `distrustAfter` constraint maps must be plain own data properties. A map -- or one of its entries -- supplied as a getter, or reached through the object's prototype rather than as an own property, is refused with `path/bad-input` rather than read, so a getter cannot answer a purpose or distrust check inconsistently and a restriction is never silently dropped. The `{ purposes, distrustAfter }` shape `pki.trust.parseCertdata` emits and a hand-built one are the normal, unaffected form.
+- A trust-anchor tuple's nested `algorithm.oid` and `name.rdns` must likewise be plain own data properties. An accessor-backed or prototype-inherited definition is refused with `path/bad-input` rather than read, so a getter on one nested field cannot rewrite the other -- for example, rewriting a wrong declared algorithm OID to the key's real one -- before it is validated. A plain `{ oid }` algorithm and `{ rdns, bytes }` name, and a parsed certificate's own, are the normal, unaffected form.
+- The ACME client's per-request methods refuse an unrecognized option instead of reading it as absent and applying a default: `finalize`, `pollOrder` / `pollAuthorization`, `downloadCertificate`, `revokeCert`, `keyChange`, and `renewalWindow`. A mistyped option name is now an `acme/bad-input` error rather than a silently ignored setting, matching the client constructor and the rest of the toolkit's option-taking verbs.
+
+### Security
+
+- `pki.path.validate` refuses a malformed `opts.trustAnchor` with `path/bad-input` at entry, rather than seeding the path from it and returning a soft verdict. An anchor tuple missing its `algorithm` could previously make the path validate and return `valid: true` -- a self-describing key algorithm filled the gap the absent field left -- so a caller who passed a mis-shaped anchor received a verdict that did not answer the question they asked. The anchor is now normalized and shape-checked at the door, the same way `pki.path.build` already treated its `trustAnchors`.
+- `pki.path.validate` and `pki.path.build` also refuse a trust anchor whose declared `algorithm` does not match the algorithm of its `publicKey`, and take the key's algorithm parameters from that SubjectPublicKeyInfo rather than a declared `parameters` field. An anchor that named a different or unrelated algorithm than the key it carried was previously accepted and validated against the real key; a declared algorithm inconsistent with the key is now a `path/bad-input` refusal at entry. And because the key's own parameters are authoritative, a declared curve that disagreed with the key can no longer be promoted and inherited by an intermediate certificate that omits its own parameters -- which could otherwise validate a chain RFC 5280 parameter inheritance from the real key should reject.
+- A trust anchor passed as a parsed certificate is recognized as a certificate before any tuple field is read, so a value reached through the object's prototype -- such as a polluted `Object.prototype` supplying `name`, `publicKey`, and `algorithm` -- cannot reclassify the certificate as a hand-built tuple and bind a substituted key. The certificate's own key is always the one used.
+- A trust anchor supplied as a `Proxy`, or one whose `purposes` / `distrustAfter` constraint map is a `Proxy`, is refused with `path/bad-input`. A `Proxy`'s traps can answer a field read differently on successive lookups or report a field absent while forwarding the rest, so no field-by-field normalization can trust it to describe itself -- a `Proxy` could report `purposes` absent while carrying the other fields, or a `Proxy` distrust map could report no keys, dropping a `{ serverAuth: false }` restriction or an expired-cutoff date the caller attached and validating a path the anchor forbids. A normal anchor -- a plain tuple, a parsed certificate, or an object inheriting from one, with plain-object constraint maps -- is not a `Proxy` and is unaffected.
+
+## v0.5.28 — 2026-08-22
 
 Importing the toolkit is now silent, and a key's WebCrypto algorithm can no longer change under a signature once the key has been created.
 

package/lib/acme.js

@@ -1955,6 +1955,28 @@ var _CLIENT_OPTS = {
   accountKey: 1, accountJwk: 1, alg: 1, transport: 1, tls: 1, timeout: 1, maxResponseBytes: 1,
   maxRedirects: 1, maxNonceRetries: 1, maxPolls: 1, maxTotalWait: 1, sleep: 1, clock: 1,
 };
+// The per-request options each client method reads. A near-miss spelling in a method's own bag is
+// refused the same way the constructor refuses one, rather than read as undefined and silently
+// defaulted -- a mistyped `requireBinding` or `reason` would otherwise change the request with no error.
+// finalize accepts `identifiers` but NEVER lets it override the order's own set (RFC 8555 sec. 7.4), so
+// it is recognized here though the binding ignores it.
+var _METHOD_OPTS = {
+  finalize: { csr: 1, identifiers: 1 },
+  poll: { maxPolls: 1, maxTotalWait: 1, onRetryAfter: 1 },
+  download: { expectedSpki: 1, identifiers: 1, requireBinding: 1, selectChain: 1, maxAlternates: 1 },
+  revoke: { certAlg: 1, certJwk: 1, certKey: 1, certificate: 1, reason: 1 },
+  keyChange: { newAlg: 1, newJwk: 1, newKey: 1 },
+  renewalWindow: { random: 1, clock: 1, replaced: 1, previous: 1 },
+};
+// Settle a per-method options bag the way the constructor settles its own: guard.identifier.optionsObject
+// snapshots the bag and refuses one a getter rewrites mid-read (a `requireBinding` getter that grows a
+// misspelled key after the check would otherwise slip past assertKnownKeys), THEN reject any unknown key.
+// Returns the settled bag so the method reads the frozen copy, never the live object a getter could rewrite.
+function _gateOpts(bag, whitelist, name) {
+  bag = guard.identifier.optionsObject(bag, E, "acme/bad-input", "pki.acme " + name + " options");
+  guard.identifier.assertKnownKeys(bag, whitelist, E, "acme/bad-input", "unknown " + name + " option ");
+  return bag;
+}
 function client(directoryUrl, opts) {
   opts = guard.identifier.optionsObject(opts, E, "acme/bad-input", "pki.acme.client options");
   guard.identifier.assertKnownKeys(opts, _CLIENT_OPTS, E, "acme/bad-input", "unknown pki.acme.client option ");
@@ -2216,7 +2238,7 @@ function client(directoryUrl, opts) {
 
   function _finalize(order, o) { return _promised(function () { return _finalizeBody(order, o); }); }
   function _finalizeBody(order, o) {
-    o = o || {};
+    o = _gateOpts(o, _METHOD_OPTS.finalize, "finalize");
     if (!_isObject(order) || !_isString(order.finalize)) throw E("acme/bad-input", "finalize requires the order object with its finalize URL");
     if (!Array.isArray(order.identifiers)) throw E("acme/bad-input", "finalize requires the order's identifiers to enforce the RFC 8555 sec. 7.4 CSR-set match");
     // The sec. 7.4 CSR-vs-order check is ALWAYS bound to the order's OWN authoritative identifiers (the
@@ -2229,12 +2251,12 @@ function client(directoryUrl, opts) {
   // slept via the injectable sleep), bounded by maxPolls + maxTotalWait; each observed pair runs
   // assertTransition. A terminal `invalid` surfaces the object (the caller inspects .status).
   function _poll(kind, url, budget) {
-    budget = budget || {};
     // A per-call poll override is validated through the SAME bounds as the constructor budget, so an
     // Infinity / NaN / over-ceiling value cannot turn a non-terminal resource into an unbounded loop.
     // Surface a bad override (or url) as a REJECTION, not a sync throw, so this async verb is uniform.
     var capPolls, capWait;
     try {
+      budget = _gateOpts(budget, _METHOD_OPTS.poll, "poll");
       capPolls = budget.maxPolls != null ? guard.limits.cap(budget.maxPolls, "maxPolls", maxPolls, { E: E, code: "acme/bad-input", min: 1, max: 1000 }) : maxPolls;
       capWait = budget.maxTotalWait != null ? guard.limits.cap(budget.maxTotalWait, "maxTotalWait", maxTotalWait, { E: E, code: "acme/bad-input", min: 0, max: retryAfter.MAX_RETRY_AFTER_SECONDS }) : maxTotalWait;
       url = _clientUrl(url);
@@ -2346,9 +2368,9 @@ function client(directoryUrl, opts) {
   }
 
   function _downloadCertificate(url, opts) {
-    opts = opts || {};
     // Prelude in a resolved-promise .then so a bad opt / URL is a REJECTION, uniform for a .catch caller.
     return Promise.resolve().then(function () {
+      opts = _gateOpts(opts, _METHOD_OPTS.download, "downloadCertificate");
       var select = opts.selectChain;
       if (select !== undefined && typeof select !== "function") throw E("acme/bad-input", "downloadCertificate opts.selectChain must be a function");
       var maxAlt = guard.limits.cap(opts.maxAlternates, "maxAlternates", DEFAULT_MAX_ALTERNATES, { E: E, code: "acme/bad-input", min: 0, max: 64 });
@@ -2405,26 +2427,29 @@ function client(directoryUrl, opts) {
   }
 
   function _revokeCert(o) {
-    o = o || {};
-    // Surface bad input as a REJECTION (not a sync throw) so this async verb is uniform for a .catch caller.
-    if (!Buffer.isBuffer(o.certificate)) return Promise.reject(E("acme/bad-input", "revokeCert requires a DER certificate Buffer (opts.certificate)"));
-    // Certificate-key mode (RFC 8555 sec. 7.6) needs the COMPLETE triple certKey + certJwk + certAlg: an
-    // incomplete set must NOT fall through to the account-key path (wrong credential), and certAlg must be
-    // explicit -- inheriting the account alg would sign a different-family certificate key under the wrong
-    // JWS algorithm (an ES256 account revoking with an RSA certificate key), which JOSE then rejects.
-    var certKeyMode = o.certKey != null || _isObject(o.certJwk) || o.certAlg != null;
-    if (certKeyMode && !(o.certKey != null && _isObject(o.certJwk) && _isString(o.certAlg))) return Promise.reject(E("acme/bad-input", "revokeCert certificate-key mode requires certKey, certJwk, AND certAlg together, or none (RFC 8555 sec. 7.6)"));
-    var extra = { certificate: o.certificate };
-    if (o.reason !== undefined) extra.reason = o.reason;
-    return _resource("revokeCert").then(function (url) {
-      if (certKeyMode) {
-        // sign with the certificate key (jwk mode) rather than the account (RFC 8555 sec. 7.6), through
-        // the same _postJws so it inherits the badNonce bounded retry the kid path has.
-        return _postJws(url, function (nonce) {
-          return revokeCert(Object.assign({}, extra, { key: o.certKey, alg: o.certAlg, nonce: nonce, url: url, jwk: o.certJwk }));
-        }).then(function () { return true; });
-      }
-      return _post(url, revokeCert, extra, "kid").then(function () { return true; });
+    // Bad input surfaces as a REJECTION -- _promised turns a throw into one -- so this async verb stays
+    // uniform for a .catch caller rather than throwing synchronously.
+    return _promised(function () {
+      o = _gateOpts(o, _METHOD_OPTS.revoke, "revokeCert");
+      if (!Buffer.isBuffer(o.certificate)) throw E("acme/bad-input", "revokeCert requires a DER certificate Buffer (opts.certificate)");
+      // Certificate-key mode (RFC 8555 sec. 7.6) needs the COMPLETE triple certKey + certJwk + certAlg: an
+      // incomplete set must NOT fall through to the account-key path (wrong credential), and certAlg must be
+      // explicit -- inheriting the account alg would sign a different-family certificate key under the wrong
+      // JWS algorithm (an ES256 account revoking with an RSA certificate key), which JOSE then rejects.
+      var certKeyMode = o.certKey != null || _isObject(o.certJwk) || o.certAlg != null;
+      if (certKeyMode && !(o.certKey != null && _isObject(o.certJwk) && _isString(o.certAlg))) throw E("acme/bad-input", "revokeCert certificate-key mode requires certKey, certJwk, AND certAlg together, or none (RFC 8555 sec. 7.6)");
+      var extra = { certificate: o.certificate };
+      if (o.reason !== undefined) extra.reason = o.reason;
+      return _resource("revokeCert").then(function (url) {
+        if (certKeyMode) {
+          // sign with the certificate key (jwk mode) rather than the account (RFC 8555 sec. 7.6), through
+          // the same _postJws so it inherits the badNonce bounded retry the kid path has.
+          return _postJws(url, function (nonce) {
+            return revokeCert(Object.assign({}, extra, { key: o.certKey, alg: o.certAlg, nonce: nonce, url: url, jwk: o.certJwk }));
+          }).then(function () { return true; });
+        }
+        return _post(url, revokeCert, extra, "kid").then(function () { return true; });
+      });
     });
   }
 
@@ -2433,7 +2458,7 @@ function client(directoryUrl, opts) {
 
   function _keyChange(o) { return _promised(function () { return _keyChangeBody(o); }); }
   function _keyChangeBody(o) {
-    o = o || {};
+    o = _gateOpts(o, _METHOD_OPTS.keyChange, "keyChange");
     if (!o.newKey || !_isObject(o.newJwk) || !_isString(o.newAlg)) throw E("acme/bad-input", "keyChange requires newKey, newJwk, and newAlg");
     var account = _requireKid();
     return _resource("keyChange").then(function (url) {
@@ -2502,8 +2527,8 @@ function client(directoryUrl, opts) {
   // returns the decision as DATA. It never sleeps or schedules: an auto-renewing daemon is an explicit
   // future opt-in, not a hidden timer inside the thin client.
   function _renewalWindow(certDer, o) {
-    o = o || {};
     return Promise.resolve().then(function () {
+      o = _gateOpts(o, _METHOD_OPTS.renewalWindow, "renewalWindow");
       if (!Buffer.isBuffer(certDer)) throw E("acme/bad-input", "renewalWindow requires a DER certificate Buffer");
       if (o.random !== undefined && typeof o.random !== "function") throw E("acme/bad-input", "renewalWindow opts.random must be a function returning a number in [0, 1]");
       if (o.clock !== undefined && typeof o.clock !== "function") throw E("acme/bad-input", "renewalWindow opts.clock must be a function returning epoch milliseconds");

package/lib/path-validate.js

@@ -84,6 +84,21 @@ function mapsAnyPolicy(mappings) {
 
 var NS = pkix.makeNS("path", PathError, oid);
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+// Validates a trust-anchor tuple's raw publicKey as a COMPLETE SubjectPublicKeyInfo (AlgorithmIdentifier +
+// key BIT STRING), not just a decodable first OID -- a structurally-incomplete SPKI must fail closed at the
+// anchor door, not slip through to a soft valid:false when key import later rejects it.
+var ANCHOR_SPKI_SCHEMA = pkix.spki(NS);
+// A trust anchor carries a CLOSED, producer-derived field set -- the shape pki.trust.parseCertdata documents
+// and path validation + trust dedup consume: name, publicKey, algorithm, parameters, purposes, distrustAfter,
+// subjectDer, label, mozillaCaPolicy. Normalizing a caller tuple reads each of those fields exactly once (by
+// property access, which follows the prototype chain, so an inherited restriction is kept) and builds a fresh
+// object from those reads -- publicKey pinned to a private copy, algorithm/parameters taken from the validated
+// SubjectPublicKeyInfo (never the caller's declared value), the validation-read metadata (name, purposes,
+// distrustAfter) materialized as DATA because validation reads each more than once and a live accessor could
+// answer inconsistently. entry's own shape is NEVER enumerated (no `in` / ownKeys / getOwnPropertyDescriptor)
+// and the prototype chain is never walked, so a Proxy anchor cannot use an enumeration trap to mutate state
+// mid-normalization and a hostile getPrototypeOf cannot be driven into a loop (Buffer.isBuffer invokes
+// getPrototypeOf once). A field the caller attached OUTSIDE the closed set is not carried. See toAnchor.
 
 var subtle = webcrypto.webcrypto.subtle;
 
@@ -332,6 +347,10 @@ function resolveDescriptor(sigAlg) {
 function assertKeyMatchesSigAlg(spkiBytes, sigOid, d) {
   if (!d || !d.sameKeyOid) return;
   var keyOid;
+  // The working-key SPKI is decodable on the shipped path (the anchor's is validated at toAnchor entry and
+  // every chain SPKI is strict-parsed), so this catch is defense-in-depth -- unreachable through
+  // pki.path.validate, kept to keep a typed verdict for any future caller that supplies raw key bytes. The
+  // RFC 9814 sec. 4 algorithm-confusion check below stays reachable and covered.
   try { keyOid = asn1.read.oid(asn1.decode(spkiBytes).children[0].children[0]); }
   catch (e) { throw E("path/algorithm-mismatch", "cannot read the issuer public-key algorithm identifier", e); }
   if (keyOid !== sigOid) {
@@ -791,7 +810,7 @@ function checkedSubtreeSeeds(list, optName) {
   });
 }
 
-function initialize(certs, params, seeds) {
+function initialize(certs, params, seeds, anchor) {
   var n = certs.length;
   return {
     validPolicyTree: rootNode(),
@@ -804,10 +823,10 @@ function initialize(certs, params, seeds) {
     explicitPolicy: params.initialExplicitPolicy ? 0 : n + 1,
     inhibitAnyPolicy: params.initialAnyPolicyInhibit ? 0 : n + 1,
     policyMapping: params.initialPolicyMappingInhibit ? 0 : n + 1,
-    workingPublicKeyAlgorithm: params.trustAnchor.algorithm,
-    workingPublicKey: params.trustAnchor.publicKey,
-    workingPublicKeyParameters: params.trustAnchor.parameters || null,
-    workingIssuerName: params.trustAnchor.name,
+    workingPublicKeyAlgorithm: anchor.algorithm,
+    workingPublicKey: anchor.publicKey,
+    workingPublicKeyParameters: anchor.parameters || null,
+    workingIssuerName: anchor.name,
     maxPathLength: n,
     userInitialPolicySet: params.userInitialPolicySet || [OID.anyPolicy],
     results: [],
@@ -1230,6 +1249,10 @@ async function validate(path, opts) {
   var n = certs.length;
   if (n < 1) throw E("path/empty-path", "validate: the certification path is empty");
   if (!opts.trustAnchor) throw E("path/bad-input", "validate: a trustAnchor is required");
+  // Normalize the anchor at the door: a parsed root CERTIFICATE becomes a { name, publicKey, algorithm }
+  // tuple, and a mis-shaped tuple fails closed with path/bad-input rather than seeding an undefined
+  // working key that a self-describing SPKI could still validate against (a soft-verdict fail-open).
+  var anchor = toAnchor(opts.trustAnchor, "validate");
   // The validity-window check is always on (6.1.3(a)(2)); a missing/invalid
   // check date must fail closed, never silently disable it.
   guard.time.assertValid(opts.time, E, "path/bad-input", "validate: opts.time (the always-on validity-window check date)");
@@ -1262,7 +1285,7 @@ async function validate(path, opts) {
   var requiredEku = purposeOpts.requiredEku;
   var checkPurpose = purposeOpts.checkPurpose;
 
-  var state = initialize(certs, opts, seeds);
+  var state = initialize(certs, opts, seeds, anchor);
   state._n = n;
   state.requiredEku = requiredEku;
   var verifier = opts.verifier || null;
@@ -1287,7 +1310,7 @@ async function validate(path, opts) {
   // `distrustAfter.serverAuth` without being told the validation is about serverAuth -- so without
   // one the caller's stated intent would be discarded silently, and a root distrusted years ago
   // would validate a current leaf. An anchor carrying no such metadata is unaffected.
-  if (!checkPurpose && opts.trustAnchor && _hasPurposeScopedMetadata(opts.trustAnchor)) {
+  if (!checkPurpose && _hasPurposeScopedMetadata(anchor)) {
     throw E("path/bad-input", "validate: the trust anchor carries purpose-scoped metadata (distrustAfter / purposes), which is keyed by key purpose -- supply opts.checkPurpose to say which purpose this validation is for, or the constraint cannot be applied");
   }
 
@@ -1473,7 +1496,7 @@ async function validate(path, opts) {
       // anchor or an absent checkPurpose is byte-identical to today). The anchor's
       // per-purpose distrust-after date and delegator purposes apply to the
       // end-entity leaf it ultimately certifies.
-      var ta = opts.trustAnchor;
+      var ta = anchor;
       // A PRESENT-but-malformed distrustAfter (an Invalid Date: instanceof Date yet a
       // NaN time) would make `notBefore > it` NaN-false and SILENTLY drop the distrust
       // restriction -- the NaN-Date fail-open. Validate a present date fail-closed
@@ -2617,13 +2640,25 @@ function _hasPurposeScopedMetadata(ta) {
   if (!ta || typeof ta !== "object") return false;
   return guard.list.anyMatches(["distrustAfter", "purposes"], function (k) {
     var m = ta[k];
-    return !!m && typeof m === "object" && Object.keys(m).length > 0;
+    // Own names, not Object.keys: a non-enumerable own entry is still a restriction and must count, so it cannot
+    // evade this "the anchor carries purpose-scoped metadata -> require checkPurpose" gate. An inherited map
+    // (Object.create(base) or a polluted Object.prototype) is already refused by toAnchor before an anchor
+    // reaches here, so this read does not resolve an inherited value.
+    return !!m && typeof m === "object" && intrinsic.getOwnPropertyNames(m).length > 0;
   });
 }
 
 function assertAnchorConstraints(ta, checkPurpose) {
-  var d = (checkPurpose && ta && ta.distrustAfter && intrinsic.hasOwn(ta.distrustAfter, checkPurpose))
-    ? ta.distrustAfter[checkPurpose] : null;
+  if (!checkPurpose || !ta) return null;
+  // Read distrustAfter ONCE into a local: reading the anchor field for the presence gate and again for the
+  // value would let an accessor-backed field answer the two reads differently and slip the distrust control.
+  // The normalized anchor already materializes this to plain data; reading once holds the guarantee for any
+  // caller and keeps this from being a live-getter multi-read even if a future path skips normalization. An
+  // inherited distrustAfter (Object.create(base), or a polluted Object.prototype) is already refused by toAnchor
+  // -- _captureConstraintMap / the certificate branch reject a `"distrustAfter" in entry` that is not own -- so
+  // this read never resolves an inherited value on an anchor that reached here.
+  var da = ta.distrustAfter;
+  var d = (da && intrinsic.hasOwn(da, checkPurpose)) ? da[checkPurpose] : null;
   if (d == null) return null;
   return guard.time.assertValid(d, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
 }
@@ -2661,24 +2696,411 @@ function resolvePurposeOpts(opts) {
   return { requiredEku: requiredEku, checkPurpose: checkPurpose };
 }
 
-function toAnchor(entry) {
-  if (entry && typeof entry === "object" && !Buffer.isBuffer(entry) && entry.name && entry.publicKey && entry.algorithm) {
+// Snapshot a trust-anchor purposes / distrustAfter map (purpose name -> boolean or Date) to a fresh plain
+// object, reading each own entry from its DATA DESCRIPTOR -- never by property access. Reading by value would
+// invoke an accessor entry (a `get serverAuth()`), which is caller code that could mutate the sibling map
+// before it is captured, so an accessor entry is REFUSED instead. A later getter cannot mutate the fresh copy.
+// A distrustAfter entry is a Date: copy it BY VALUE (guard.time.instantOf via the intrinsic) so a later
+// setTime() cannot move the cutoff. Entry enumerability is preserved so the purpose gates see the same shape.
+function _snapshotConstraintMap(m, E, code, who) {
+  var out = {};
+  // getOwnPropertyNames below reads only OWN keys, so a restriction reached through the prototype --
+  // Object.create({ serverAuth: pastDate }) -- would be silently dropped and its cutoff lost. Require the map to
+  // be a plain object of THIS realm: its prototype is Object.prototype (the common case) or null. Anything else
+  // -- a custom prototype, a null-prototype object carrying entries, a Proxy prototype, or a map from another
+  // realm -- is refused, so a prototype-reached restriction is never silently dropped. Only IDENTITY is sound
+  // here: a hostile object can mimic every STRUCTURAL signal of a genuine Object.prototype (a non-enumerable
+  // data entry is indistinguishable from a built-in), so a structural "looks plain" test always leaves a bypass.
+  // A cross-realm map is therefore refused fail-closed -- the operator passes a same-realm plain object (what
+  // pki.trust.parseCertdata emits, or a literal in their own code), which is the norm for this security-critical
+  // input. A name planted on Object.prototype ITSELF is still tolerated (proto === ObjectProto): the map is plain
+  // and consumption reads OWN entries only (the hasOwn gates), so global pollution is ignored, not read. m is
+  // non-Proxy (refused at capture) and this is a reference comparison, so no getPrototypeOf / ownKeys trap runs
+  // even when the prototype is a Proxy.
+  var proto = intrinsic.getPrototypeOf(m);
+  if (proto !== null && proto !== intrinsic.ObjectProto) throw E(code, who + ": a trustAnchor constraint map must be a plain object (its own entries only), not one with a custom or cross-realm prototype");
+  var keys = intrinsic.getOwnPropertyNames(m);
+  // A constraint map is plain STRING-keyed data. A symbol-keyed entry (getOwnPropertyNames omits symbols) or an
+  // own __proto__ data property (skipped below so it can't pollute the fresh map) would be DROPPED from the
+  // snapshot -- and, keyed by neither a checkPurpose OID name, never applied. Refuse the map rather than silently
+  // drop a caller entry, so the snapshot faithfully carries every restriction or the anchor is refused. ownKeys
+  // (Reflect.ownKeys) counts strings + symbols; more than the string-only names means a symbol key is present.
+  if (intrinsic.ownKeys(m).length !== keys.length) throw E(code, who + ": a trustAnchor constraint map must not have symbol-keyed entries");
+  for (var i = 0; i < keys.length; i++) {
+    if (keys[i] === "__proto__") throw E(code, who + ": a trustAnchor constraint map must not have an own __proto__ entry");
+    var d = intrinsic.getOwnPropertyDescriptor(m, keys[i]);
+    if (!d || !intrinsic.hasOwn(d, "value")) throw E(code, who + ": a trustAnchor constraint-map entry must be a data property, not an accessor");
+    var v = d.value;
+    if (intrinsic.types.isDate(v)) v = new intrinsic.Date(guard.time.instantOf(v));
+    // Materialize every entry ENUMERABLE. A constraint map is plain data (purpose -> boolean / Date); a caller
+    // entry defined non-enumerable would otherwise be copied non-enumerable and then be invisible to the
+    // Object.keys-based purpose-scoped-metadata gate, letting a restriction slip the "supply checkPurpose" check.
+    intrinsic.defineProperty(out, keys[i], { value: v, enumerable: true, configurable: true, writable: true });
+  }
+  return out;
+}
+
+// Normalize a captured constraint MAP field for storage. An absent map (null / undefined) carries no
+// restriction and passes through. A present map MUST be a plain object and is snapshotted; a present non-object
+// -- a primitive, a Buffer, or (refused inside the snapshot by the plain-prototype check) an array -- cannot hold
+// a purpose -> boolean/Date restriction, so it is refused rather than passed through as an unusable value that
+// would silently apply no restriction.
+function _normalizeConstraintField(v, E, code, who) {
+  if (v === null || v === undefined) return v;
+  if (typeof v !== "object" || intrinsic.isBuffer(v)) throw E(code, who + ": a trustAnchor constraint map must be a plain object");
+  return _snapshotConstraintMap(v, E, code, who);
+}
+
+// Capture a trust-anchor constraint MAP field (purposes / distrustAfter) WITHOUT invoking a getter: read its
+// OWN DATA descriptor. An accessor-backed map (a `get purposes()`) is caller code that could mutate the sibling
+// map when read, so it is refused; an INHERITED map is refused too (own-only capture), never silently dropped,
+// so a restriction is never lost. A truly absent field is no restriction (undefined).
+function _captureConstraintMap(entry, key, E, code, who) {
+  var d = intrinsic.getOwnPropertyDescriptor(entry, key);
+  if (d === undefined) {
+    if (key in entry) throw E(code, who + ": a trustAnchor " + key + " must be an own data property, not inherited");
+    return undefined;
+  }
+  if (!intrinsic.hasOwn(d, "value")) throw E(code, who + ": a trustAnchor " + key + " must be a data property, not an accessor");
+  // A constraint map that is a Proxy is refused, the same way the top-level anchor is: its ownKeys / descriptor
+  // traps could answer inconsistently -- an empty key list drops a restriction the caller attached, and an
+  // isBuffer-answering trap could skip the snapshot entirely -- so the map cannot be trusted to describe itself.
+  if (intrinsic.types.isProxy(d.value)) throw E(code, who + ": a trustAnchor " + key + " map must not be a Proxy");
+  return d.value;
+}
+
+// Read a field's OWN DATA value from its descriptor, WITHOUT invoking a getter -- an accessor or an inherited
+// field yields undefined. Used for the optional identity metadata (subjectDer / label / mozillaCaPolicy): a
+// getter there, invoked before the key is pinned, could overwrite the key Buffer or mutate the name, so it is
+// never invoked. This metadata does not enter a validation decision, so an accessor / inherited form is simply
+// not carried (unlike a constraint map, which is refused).
+function _captureOwnData(entry, key) {
+  var d = intrinsic.getOwnPropertyDescriptor(entry, key);
+  return (d && intrinsic.hasOwn(d, "value")) ? d.value : undefined;
+}
+
+// A fresh copy of a distinguished-name attribute record { type, value, name }, so the normalized anchor does
+// not share it with the caller. The consumed fields -- type + value drive the RFC 5280 sec. 7.1 dnEqual
+// comparison, name is the optional registry label -- are read by PROPERTY ACCESS, which follows the prototype
+// chain and reads an accessor once. The anchor API deliberately accepts an inherited / accessor name.rdns
+// (Object.create(base), a prototype getter), so an inherited attribute value must be SNAPSHOT here, not
+// dropped; a field the caller did not supply is omitted.
+function _copyAtv(atv) {
+  var out = {};
+  var t = atv.type;
+  if (t !== undefined) intrinsic.defineProperty(out, "type", { value: t, enumerable: true, configurable: true, writable: true });
+  var v = atv.value;
+  if (v !== undefined) intrinsic.defineProperty(out, "value", { value: v, enumerable: true, configurable: true, writable: true });
+  var nm = atv.name;
+  if (nm !== undefined) intrinsic.defineProperty(out, "name", { value: nm, enumerable: true, configurable: true, writable: true });
+  return out;
+}
+
+// DEEP-copy a caller's rdns so the normalized anchor's DN is independent of the caller's object. A single
+// arraySlice copies only the outer RDN sequence, leaving each nested RDN array and attribute record shared, so
+// a caller mutating name.rdns[i][j].value after normalization (or while an async validate awaits signature
+// verification) would change the issuer identity name chaining re-reads. Copy the outer array, each RDN array,
+// and each attribute record (its type/value are strings, so an own-data copy is enough) -- matching the
+// trust-store name copy (lib/trust.js _copyName).
+function _copyRdnsDeep(rdns) {
+  if (!intrinsic.isArray(rdns)) return rdns;
+  // Copy only OWN indexed elements and PRESERVE holes -- never read an inherited Array.prototype[i] slot. A
+  // slice reads inherited indices (HasProperty walks the chain), so on a SPARSE rdns a polluted Array.prototype
+  // slot would be materialized as an own element, filling a hole that guard.name.dnEqual explicitly rejects and
+  // letting a malformed name pass chaining. Keeping the array sparse leaves the hole for the downstream guard.
+  // Read own indices only (hasOwn) and CREATE each copied index with defineProperty, never a plain assignment:
+  // both the read side (a slice walks the chain) and the write side (`out[i] = v` respects an inherited
+  // non-writable data property or accessor -- it can throw, fail silently, or invoke an inherited setter) touch
+  // the prototype, so a polluted Array.prototype could fill a hole or corrupt a dense rdns into a sparse one.
+  // defineProperty is CreateDataProperty: it always makes an own data property regardless of the prototype.
+  var out = [];
+  out.length = rdns.length;
+  for (var i = 0; i < rdns.length; i++) {
+    if (!intrinsic.hasOwn(rdns, i)) continue;   // leave a hole where the source has one
+    var rdn = rdns[i], val;
+    if (intrinsic.isArray(rdn)) {
+      var rdnOut = [];
+      rdnOut.length = rdn.length;
+      for (var j = 0; j < rdn.length; j++) {
+        if (!intrinsic.hasOwn(rdn, j)) continue;   // preserve inner holes for the same reason
+        var atv = (rdn[j] !== null && typeof rdn[j] === "object") ? _copyAtv(rdn[j]) : rdn[j];
+        intrinsic.defineProperty(rdnOut, j, { value: atv, enumerable: true, configurable: true, writable: true });
+      }
+      val = rdnOut;
+    } else { val = rdn; }
+    intrinsic.defineProperty(out, i, { value: val, enumerable: true, configurable: true, writable: true });
+  }
+  return out;
+}
+
+function toAnchor(entry, verb) {
+  var who = verb || "build";
+  // Decide tuple-vs-certificate by the discriminator fields, read under try/catch: a throwing name /
+  // publicKey / algorithm accessor is a malformed anchor and must surface as the documented path/bad-input
+  // entry refusal, not a raw exception leaked past the typed guards. `alg` and the raw publicKey are PINNED
+  // to ONE read here and used throughout, so a stateful accessor that returns a value now and throws (or
+  // returns a different value) on a later read cannot slip past this guard at the shape check or the snapshot.
+  var isTuple = false, alg = null, pubRaw = null, nameRaw = null, pk = null, purposesSnap, distrustSnap;
+  var subjectDerRaw, labelRaw, mozRaw;
+  // A Proxy anchor is refused outright. Every field read below -- whether by property access or from an own
+  // data descriptor -- is answered by the anchor's own reflection, and a Proxy's traps let the same read
+  // return different values on different lookups or report a field absent while forwarding its siblings, so a
+  // Proxy could hide a purposes / distrustAfter restriction the operator attached and validate against a
+  // weaker anchor than the one supplied. A legitimate anchor is a plain tuple, a parsed certificate, or an
+  // Object.create(base) inheriting from one -- none is a Proxy -- so refusing it here costs no real use and
+  // removes the whole class of trap-driven anchor forgery. isProxy is an internal-slot check that runs no
+  // caller code, so it sits outside the accessor try below and its message is not re-wrapped as an accessor throw.
+  if (intrinsic.types.isProxy(entry)) {
+    throw E("path/bad-input", who + ": a trustAnchor must not be a Proxy");
+  }
+  // A Proxy anywhere in the anchor's prototype CHAIN is refused too. entry may legitimately inherit its fields
+  // (an Object.create(base) anchor is supported), and those inherited reads -- the `in` tests and the property
+  // accesses below -- walk the chain, so a Proxy prototype would run its has / get traps: the has trap could
+  // report purposes / distrustAfter absent while the get trap still supplies inherited name / publicKey /
+  // algorithm, dropping the restriction and validating a weaker anchor. Walk the chain refusing any Proxy,
+  // checking isProxy BEFORE reading its prototype so a Proxy never runs a getPrototypeOf trap here. A legitimate
+  // anchor -- a tuple, a certificate, or an Object.create(base) over a plain object -- has a Proxy-free chain.
+  if (entry !== null && typeof entry === "object") {
+    var proto = intrinsic.getPrototypeOf(entry);
+    while (proto !== null) {
+      if (intrinsic.types.isProxy(proto)) throw E("path/bad-input", who + ": a trustAnchor must not inherit from a Proxy");
+      proto = intrinsic.getPrototypeOf(proto);
+    }
+  }
+  try {
+    // Recognize a parsed CERTIFICATE first and route it to coerceCert below -- by PROVENANCE, not by reading
+    // its fields. guard.parsed.isRecorded is a getter-free WeakMap lookup: a certificate from
+    // pki.schema.x509.parse carries a provenance record, a hand-built tuple does not. A certificate does not
+    // carry name / publicKey / algorithm as own properties, but the tuple discriminator reads those by
+    // property access, which FOLLOWS the prototype chain -- so a polluted Object.prototype supplying those
+    // three would otherwise misclassify a real certificate as a tuple and bind the INHERITED (attacker) key
+    // instead of the certificate's own. Recognizing the certificate by its forge-proof provenance mark routes
+    // it to coerceCert and never binds an inherited key. Crucially the check is a WeakMap lookup that invokes
+    // NO caller getter -- so, unlike a structural probe that would read tbsBytes / subject / ... , it cannot run
+    // a tuple-controlled accessor (e.g. a polluted Object.prototype.tbsBytes getter) before publicKey is pinned
+    // below, which would otherwise defeat the key-pinning guarantee.
+    if (entry && typeof entry === "object" && !Buffer.isBuffer(entry) && !guard.parsed.isRecorded(entry)) {
+      // Not a recorded certificate (isRecorded is a getter-free WeakMap lookup), so treat entry as a tuple
+      // candidate. entry is not a Proxy (refused at the door above), so its own reflection is truthful: a
+      // getOwnPropertyDescriptor read reports its real own data, and an absent field is really absent rather
+      // than a trap hiding a forwarded one. The discriminator fields (publicKey / name / algorithm) are read
+      // by PROPERTY ACCESS (follows the prototype chain, so an Object.create(base) inherited anchor is
+      // recognized), each exactly once, so a stateful own accessor answers each at most once. The prototype
+      // chain is never WALKED (Buffer.isBuffer / isRecorded above invoke getPrototypeOf a bounded number of
+      // times only), so a hostile getPrototypeOf cannot be driven into a loop.
+      //
+      // Snapshot the constraint maps FIRST -- before ANY discriminator field (publicKey / name / algorithm) is
+      // read -- so no discriminator getter can flip a denied purpose to allowed or move a distrust cutoff
+      // between the map's capture and validation. A getter for publicKey or name runs when that field is read;
+      // capturing purposes / distrustAfter beforehand puts them out of its reach (the same protection the
+      // ordering already gave against the later algorithm getter, now extended to the earlier ones). The
+      // identity passthrough (subjectDer, label, mozillaCaPolicy -- the closed producer-derived set) is read
+      // once each here too. entry is not a recorded certificate, so these reads do not touch a cert's accessors.
+      var pRaw = _captureConstraintMap(entry, "purposes", E, "path/bad-input", who);
+      purposesSnap = _normalizeConstraintField(pRaw, E, "path/bad-input", who);
+      var dRaw = _captureConstraintMap(entry, "distrustAfter", E, "path/bad-input", who);
+      distrustSnap = _normalizeConstraintField(dRaw, E, "path/bad-input", who);
+      // The identity passthrough (subjectDer, label, mozillaCaPolicy) is captured from its OWN DATA descriptor
+      // too, never by property access: an accessor identity field, read before the key is pinned below, could
+      // overwrite the key Buffer or mutate the name, so its getter is never invoked. An accessor / inherited
+      // identity field is not carried (it is non-validation metadata), not refused.
+      subjectDerRaw = _captureOwnData(entry, "subjectDer");
+      labelRaw = _captureOwnData(entry, "label");
+      mozRaw = _captureOwnData(entry, "mozillaCaPolicy");
+      // Every mutable, validation-relevant field above (the constraint maps and the identity metadata) was
+      // captured from a descriptor WITHOUT invoking a getter, so the publicKey read below -- and the name /
+      // algorithm reads after it -- cannot have mutated them. publicKey is read (property access, so an
+      // inherited publicKey is supported) and pinned to a private Buffer IMMEDIATELY, before the name /
+      // algorithm accessors run, so a later getter cannot overwrite the key Buffer after it is read but before
+      // it is captured. A non-tuple leaves pk null / isTuple false and falls through to coerceCert below.
+      pubRaw = entry.publicKey;
+      if (guard.bytes.isByteSource(pubRaw)) {
+        pk = guard.bytes.snapshot(pubRaw, PathError, "path/bad-input", who + ": trustAnchor publicKey");
+      }
+      nameRaw = entry.name;
+      alg = entry.algorithm;
+      isTuple = !!(nameRaw && pubRaw && alg);
+    }
+  } catch (e) {
+    throw E("path/bad-input", who + ": a trustAnchor accessor threw", e);
+  }
+  if (isTuple) {
+    // publicKey was read FIRST and pinned to `pk` in the discriminator above, before the algorithm and name
+    // accessors ran, so no caller getter can have mutated the key Buffer between its read and its capture.
+    // (A non-Buffer publicKey leaves pk null and is refused by the Buffer.isBuffer shape check below.)
     // A ready anchor tuple: validate the shape build + validate consume -- name.rdns
     // (name matching), publicKey bytes and the algorithm OID (the sec. 6.1.4 key
     // hand-off). trustAnchors is a caller option, so a malformed tuple is a config
     // error and fails closed at entry, not a downstream no-path / soft verdict.
-    if (!intrinsic.isArray(entry.name.rdns) || !Buffer.isBuffer(entry.publicKey) || typeof entry.algorithm !== "string") {
-      throw E("path/bad-input", "build: a trustAnchor tuple must be { name: { rdns: [...] }, publicKey: Buffer, algorithm: OID string }");
+    // `algorithm` is the anchor key's own algorithm: an OID string, or the SubjectPublicKeyInfo
+    // `algorithm` object a parsed certificate carries ({ oid, parameters }), which validate has always
+    // accepted. Built-in verification derives the key algorithm from the (valid) publicKey SPKI and never
+    // consults this value, so any algorithm that slips through -- an object with no `oid`, or an oid that
+    // is not a real OID -- would validate the path on the SPKI alone and leave the very fail-open this
+    // check exists to close. A number, an object without an oid, or another non-shape is a malformed tuple
+    // and fails closed; a MISSING algorithm skips this branch and is caught below as not-a-certificate.
+    // Materialize the anchor name to a fresh plain object carrying only its CONSUMED sub-fields: rdns (used
+    // for DN matching -- read through the chain, so an inherited / Object.create(base) rdns is kept, then
+    // DEEP-copied (the outer array, each RDN array, and each attribute record) so a later mutation of the
+    // caller's nested RDN cannot change the issuer DN name chaining re-reads) and bytes (the DN DER a
+    // cert-derived name carries, kept for a lossless round-trip; not consumed in a name-matching decision, so
+    // it is held by reference). Each is read ONCE as DATA; the name object's own shape is never enumerated. path
+    // validation re-reads
+    // workingIssuerName.rdns during name chaining, so a stateful rdns accessor that answered the shape check
+    // with one array must not hand chaining a different issuer DN; the single read stores that one value. A
+    // throwing name / name.rdns accessor is a malformed anchor -> path/bad-input, not a raw throw.
+    // Capture the two NESTED tuple fields -- algorithm.oid and name.rdns / name.bytes -- GETTER-FREE, from their
+    // own data descriptors, never by property access. An ACCESSOR nested field runs caller code that could mutate
+    // the sibling before it is captured: a name.rdns getter rewriting a wrong algorithm.oid to the SPKI's real one
+    // past the mismatch refusal, or an algorithm.oid getter rewriting the anchor DN. Because BOTH directions
+    // cross-mutate, no read ORDER is safe -- so an accessor nested field is refused and no getter ever runs. A
+    // Proxy-hosted algorithm / name object is refused before its traps can answer. A legitimate anchor -- a tuple
+    // with a plain { oid } algorithm and a plain { rdns, bytes } name, or a parsed certificate's own -- carries
+    // plain data and is unaffected.
+    var algStr;
+    try {
+      if (typeof alg === "string") {
+        algStr = alg;
+      } else if (alg !== null && typeof alg === "object") {
+        if (intrinsic.types.isProxy(alg)) throw E("path/bad-input", who + ": a trustAnchor algorithm must not be a Proxy");
+        var algOidD = intrinsic.getOwnPropertyDescriptor(alg, "oid");
+        if (algOidD && !intrinsic.hasOwn(algOidD, "value")) throw E("path/bad-input", who + ": a trustAnchor algorithm.oid must be a data property, not an accessor");
+        var algOid = algOidD ? algOidD.value : undefined;
+        algStr = typeof algOid === "string" ? algOid : null;
+      } else {
+        algStr = null;
+      }
+    } catch (e) { throw E("path/bad-input", who + ": a trustAnchor algorithm.oid accessor threw", e); }
+    var nameOut = {};
+    try {
+      var nsrc = (nameRaw !== null && typeof nameRaw === "object") ? nameRaw : null;
+      if (nsrc !== null && intrinsic.types.isProxy(nsrc)) throw E("path/bad-input", who + ": a trustAnchor name must not be a Proxy");
+      var rdnsD = nsrc ? intrinsic.getOwnPropertyDescriptor(nsrc, "rdns") : undefined;
+      if (rdnsD && !intrinsic.hasOwn(rdnsD, "value")) throw E("path/bad-input", who + ": a trustAnchor name.rdns must be a data property, not an accessor");
+      var rdnsVal = rdnsD ? rdnsD.value : undefined;
+      if (rdnsVal !== undefined) {
+        intrinsic.defineProperty(nameOut, "rdns", { value: _copyRdnsDeep(rdnsVal), enumerable: true, configurable: true, writable: true });
+      }
+      var bytesD = nsrc ? intrinsic.getOwnPropertyDescriptor(nsrc, "bytes") : undefined;
+      if (bytesD && !intrinsic.hasOwn(bytesD, "value")) throw E("path/bad-input", who + ": a trustAnchor name.bytes must be a data property, not an accessor");
+      var nBytes = bytesD ? bytesD.value : undefined;
+      if (nBytes !== undefined) {
+        intrinsic.defineProperty(nameOut, "bytes", { value: nBytes, enumerable: true, configurable: true, writable: true });
+      }
+      // Preserve the parsed Name's dn (the rendered "CN=..., O=..." string a parser emits, used to display /
+      // identify the selected root), so a pki.trust anchor or a cert-derived name round-trips its full shape --
+      // { rdns, dn, bytes } -- through normalization. Only a STRING dn is carried: identity never flows through
+      // this display string (name chaining compares rdns / bytes DER under RFC 5280 sec. 7.1), so an object- or
+      // otherwise non-string-valued dn -- which could run coercion code in a display consumer -- is dropped, not
+      // carried. Captured getter-free like the others (an accessor dn could otherwise mutate a sibling).
+      var dnD = nsrc ? intrinsic.getOwnPropertyDescriptor(nsrc, "dn") : undefined;
+      if (dnD && !intrinsic.hasOwn(dnD, "value")) throw E("path/bad-input", who + ": a trustAnchor name.dn must be a data property, not an accessor");
+      var nDn = dnD ? dnD.value : undefined;
+      if (typeof nDn === "string") {
+        intrinsic.defineProperty(nameOut, "dn", { value: nDn, enumerable: true, configurable: true, writable: true });
+      }
+    } catch (e) { throw E("path/bad-input", who + ": trustAnchor name could not be materialized", e); }
+    // hasOwn-gate the read: nameOut is materialized here, so its rdns is either an OWN data property (set above
+    // from the caller's own rdns) or absent. Testing the OWN property -- not a plain nameOut.rdns, which would
+    // resolve a polluted Object.prototype.rdns on a name that supplied none (and could invoke an inherited
+    // throwing getter) -- means a name with no own rdns is refused, never accepted on an inherited array.
+    var nameHasRdns = intrinsic.hasOwn(nameOut, "rdns") && intrinsic.isArray(nameOut.rdns);
+    if (!nameHasRdns || !Buffer.isBuffer(pubRaw) || algStr === null) {
+      throw E("path/bad-input", who + ": a trustAnchor tuple must be { name: { rdns: [...] }, publicKey: Buffer, algorithm: an OID string or a SubjectPublicKeyInfo algorithm carrying an oid }");
+    }
+    // Hold the stated algorithm to a canonical dotted-decimal OID: a shape-valid but non-canonical value
+    // ("not-an-oid", { oid: "garbage" }) would otherwise pass and never match the SPKI-derived algorithm.
+    guard.identifier.assertCanonicalOid(algStr, E, "path/bad-input", who + ": trustAnchor algorithm " + algStr);
+    // The declared algorithm is redundant with the self-describing publicKey SPKI, and built-in verification
+    // reads the SPKI's own key algorithm, never this field. A canonical but WRONG OID (declaring one key
+    // algorithm for a key that is actually another) would otherwise be accepted and the path validate on the
+    // SPKI alone. Reject a declared OID that does not equal the SubjectPublicKeyInfo's key-algorithm OID.
+    // (publicKey was pinned to `pk` at the top of this branch, before any caller getter could mutate it.)
+    //
+    // Walk the whole SubjectPublicKeyInfo through the shared PKIX schema, not just its first OID: a structure
+    // that carries a decodable AlgorithmIdentifier but no key BIT STRING would otherwise pass this gate and
+    // slip to a soft valid:false at key-import time, bypassing the promised path/bad-input entry refusal.
+    var spkiAlg;
+    try { spkiAlg = schema.walk(ANCHOR_SPKI_SCHEMA, asn1.decode(pk), NS).result.algorithm; }
+    catch (e) { throw E("path/bad-input", who + ": trustAnchor publicKey is not a valid SubjectPublicKeyInfo", e); }
+    if (spkiAlg.oid !== algStr) {
+      throw E("path/bad-input", who + ": trustAnchor algorithm " + algStr + " does not match its publicKey key algorithm " + spkiAlg.oid);
     }
-    return entry;
+    // Return a SELF-CONTAINED anchor: a fresh plain object carrying ONLY the closed, producer-derived anchor
+    // field set -- name, publicKey, algorithm, parameters, purposes, distrustAfter, subjectDer, label,
+    // mozillaCaPolicy -- the shape pki.trust.parseCertdata documents and path validation + trust dedup
+    // consume. Every field was read exactly once above (or is derived from the validated SPKI / pinned key),
+    // so a caller getter or Proxy trap runs at most once per field and no second read can disagree with the
+    // first; the anchor's own shape is NEVER enumerated (no ownKeys / getOwnPropertyDescriptor / `in`) and the
+    // prototype chain is never walked, so a Proxy cannot use an enumeration trap to mutate state and a hostile
+    // getPrototypeOf cannot be driven into a loop (Buffer.isBuffer invokes it at most once). A field the caller
+    // attached OUTSIDE this set is not carried -- an anchor has a DEFINED shape, not an arbitrary passthrough --
+    // and `__proto__` is never assigned, so no caller field reaches Object.prototype's setter.
+    //  - name, purposes, distrustAfter: materialized above from ONE read each as DATA (an inherited
+    //    restriction is kept, since those reads followed the prototype chain). Storing DATA is load-bearing --
+    //    assertAnchorConstraints reads distrustAfter several times (a truthy gate, a hasOwn gate, then the
+    //    value) and _hasPurposeScopedMetadata / the purpose block read purposes at more than one site, so a
+    //    live accessor could answer those reads inconsistently and silently drop a distrust or purpose control.
+    //  - subjectDer, label, mozillaCaPolicy: the trust-store identity fields, read once each in the
+    //    discriminator, so a store's own entry round-trips onto build's result.trustAnchor.
+    //  - publicKey is the pinned copy; algorithm and parameters come from the validated SPKI, never a
+    //    caller-declared field. Seeding the working key from a string OID keeps the sec. 6.1.4 key-algorithm
+    //    comparison working (an object never equals a cert's keyAlg.oid); taking parameters from the key's own
+    //    AlgorithmIdentifier stops a declared value that disagrees with it (e.g. P-384 params on a P-256
+    //    anchor) from being promoted into workingPublicKeyParameters and inherited by a child that omits its
+    //    own, which would validate a chain RFC 5280 inheritance from the real params rejects.
+    var flat = {};
+    intrinsic.defineProperty(flat, "name", { value: nameOut, enumerable: true, configurable: true, writable: true });
+    if (purposesSnap !== undefined) intrinsic.defineProperty(flat, "purposes", { value: purposesSnap, enumerable: true, configurable: true, writable: true });
+    if (distrustSnap !== undefined) intrinsic.defineProperty(flat, "distrustAfter", { value: distrustSnap, enumerable: true, configurable: true, writable: true });
+    if (subjectDerRaw !== undefined) intrinsic.defineProperty(flat, "subjectDer", { value: subjectDerRaw, enumerable: true, configurable: true, writable: true });
+    if (labelRaw !== undefined) intrinsic.defineProperty(flat, "label", { value: labelRaw, enumerable: true, configurable: true, writable: true });
+    if (mozRaw !== undefined) intrinsic.defineProperty(flat, "mozillaCaPolicy", { value: mozRaw, enumerable: true, configurable: true, writable: true });
+    intrinsic.defineProperty(flat, "publicKey", { value: pk, enumerable: true, configurable: true, writable: true });
+    intrinsic.defineProperty(flat, "algorithm", { value: spkiAlg.oid, enumerable: true, configurable: true, writable: true });
+    intrinsic.defineProperty(flat, "parameters", { value: spkiAlg.parameters, enumerable: true, configurable: true, writable: true });
+    return flat;
+  }
+  // A certificate anchor carries no per-purpose constraints: the certificate branch below returns { name,
+  // publicKey, algorithm, ... } only. Per-purpose purposes / distrustAfter come from a trust-anchor TUPLE (what
+  // pki.trust emits), never from properties attached to a parsed certificate -- attaching them there would
+  // silently drop the restriction and validate a path the caller meant to forbid. Refuse rather than drop. The
+  // `in` check catches an OWN or an INHERITED purposes / distrustAfter (a name reached through the prototype, e.g.
+  // a polluted Object.prototype), matching how the tuple branch refuses an inherited constraint field; it invokes
+  // no getter (an existence test), and entry is not a Proxy (refused at the door), so no trap runs. A normal
+  // certificate has neither on its chain, so this only catches the footgun of hanging a constraint on a cert.
+  if (entry && typeof entry === "object" && (("purposes" in entry) || ("distrustAfter" in entry))) {
+    throw E("path/bad-input", who + ": a trustAnchor certificate must not carry purposes / distrustAfter -- put per-purpose constraints on a { name, publicKey, algorithm, purposes, distrustAfter } tuple (or a pki.trust anchor), not on a parsed certificate");
   }
   var cert;
   try { cert = coerceCert(entry); }
-  catch (e) { throw E("path/bad-input", "build: a trustAnchor entry must be a { name, publicKey, algorithm } tuple or a certificate", e); }
+  catch (e) { throw E("path/bad-input", who + ": a trustAnchor entry must be a { name, publicKey, algorithm } tuple or a certificate", e); }
   var spki = cert.subjectPublicKeyInfo;
   return { name: cert.subject, publicKey: spki.bytes, algorithm: spki.algorithm.oid, parameters: spki.algorithm.parameters, subjectDer: cert.subject.bytes };
 }
 
+/**
+ * @primitive  pki.path.anchorFromCert
+ * @signature  pki.path.anchorFromCert(cert) -> { name, publicKey, algorithm, parameters, subjectDer }
+ * @status     stable
+ * @spec       RFC 5280 sec. 6.1.1
+ *
+ * Turn a parsed certificate into the trust-anchor tuple `pki.path.validate` (`opts.trustAnchor`) and
+ * `pki.path.build` (`opts.trustAnchors`) consume, so a root can be pinned directly instead of
+ * hand-building `{ name, publicKey, algorithm }`. The subject becomes the anchor name and its
+ * SubjectPublicKeyInfo the anchor key and algorithm. A value that is neither a parsed certificate nor a
+ * ready anchor tuple is refused with `path/bad-input`. `validate` and `build` already normalize a
+ * certificate passed directly; this exposes the same conversion for a caller that wants the tuple.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var rootDer = await pki.x509.sign({ subject: "Root CA", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date(0), notAfter: new Date("2999-01-01") }, { key: pair.privateKey });
+ *   var anchor = pki.path.anchorFromCert(pki.schema.x509.parse(rootDer));
+ *   // anchor is { name, publicKey, algorithm, ... } -- pass it as opts.trustAnchor to pki.path.validate
+ */
+function anchorFromCert(cert) { return toAnchor(cert, "anchorFromCert"); }
+
 // RFC 4158 sec. 2.4.2 loop key: the (subject DN + subjectAltName + subject
 // public key) tuple, NOT the DN alone. DN-alone keying wrongly prunes a
 // legitimate distinct cross-cert (cross-certs share a DN) and misses a same-key
@@ -2976,7 +3398,7 @@ async function build(leaf, opts) {
   for (var pdk = 0; pdk < pool.length; pdk++) intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
 
   if (!intrinsic.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
-  var anchors = opts.trustAnchors.map(toAnchor);
+  var anchors = opts.trustAnchors.map(function (a) { return toAnchor(a, "build"); });
 
   guard.time.assertValid(opts.time, E, "path/bad-input", "build: opts.time (the validity-window check date, forwarded to validate)");
   // The chain-length bound is tied to the EFFECTIVE maxPathCerts the interleaved
@@ -3214,6 +3636,7 @@ async function build(leaf, opts) {
 module.exports = {
   validate: validate,
   build: build,
+  anchorFromCert: anchorFromCert,
   crlChecker: crlChecker,
   ocspChecker: ocspChecker,
   verifyOcspResponse: verifyOcspResponse,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.28",
+  "version": "0.5.29",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c0564356-6da6-47da-a75d-a05ee2125d32",
+  "serialNumber": "urn:uuid:6fc4808e-4377-42ae-a5a4-080dbff3e1df",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-23T03:34:40.100Z",
+    "timestamp": "2026-08-24T18:48:42.954Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.28",
+      "bom-ref": "@blamejs/pki@0.5.29",
       "type": "application",
       "name": "pki",
-      "version": "0.5.28",
+      "version": "0.5.29",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.28",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.29",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.28",
+      "ref": "@blamejs/pki@0.5.29",
       "dependsOn": []
     }
   ]