@blamejs/pki 0.6.37 → 0.6.39

package/CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.39 — 2026-09-05
+
+A verdict field is created with the verdict rather than written onto it afterward, so a value left on Object.prototype can no longer answer a question the verification never asked.
+
+### Added
+
+- The pki.ocsp.verify and pki.path.verifyOcspResponse verdicts carry valid, true only when status is good. Every failure these verbs detect already reports status unknown, so the boolean covers exactly the checks they run.
+- The pki.cmc.verify verdict carries valid, true only for the issued outcome. Every other outcome, pending included, reads as false, with outcome, failInfo and pendToken unchanged.
+
+### Changed
+
+- The pki.ocsp.verify and pki.path.verifyOcspResponse verdicts report thisUpdate and nextUpdate as null, not undefined, when no response covered the certificate. Every path now reports both, so a reader gets the same shape whatever the verdict. Code testing them with === undefined should test == null.
+- The container release workflow takes docker/setup-qemu-action v4.3.0.
+
+### Fixed
+
+- A verdict field is now created with the verdict rather than assigned onto it afterward, so a value left on Object.prototype cannot answer a read the verification never wrote. Three verdicts could report an affirmative that had not been established: an OCSP response whose signature does not verify, or that no authorized responder signs, contributed a good status through pki.ocsp.verify, pki.path.verifyOcspResponse and pki.path.ocspChecker, so pki.path.validate accepted a certificate whose revocation status was never determined; pki.cms.verify reported a signer as trusted when it had been given no trust anchors to chain to; and pki.crmf.verifyPop reported verified for a request carrying no proof of possession at all. pki.cmc.verify, pki.smime.verify and the pki.cmp session results carried the same construction and are fixed with them.
+- A verdict also ends the prototype lookup for then, so an accessor installed there cannot rewrite it between the verification and the caller.
+- A pki.cmp session transcript no longer reports a protection result on a request leg. A request records no verdict, and the snapshot read the field without asking whether the entry carried one, so a value left on Object.prototype was copied in and read back as a result the session never reached.
+- The tables that decide how a signature is verified answer from their own entries alone. pki.cms.verify looked its signature scheme up in a table that inherits from Object.prototype, so a message could name an algorithm the toolkit does not implement and have the verification proceed under a descriptor left there. The dispatch tables in pki.cms.verify, pki.path.validate and the composite-signature resolver are fixed.
+
+### Internal
+
+- The test covering the implicit-rejection substitute content key chooses a ciphertext whose outcome it can predict. OpenSSL answers an RSA PKCS#1 v1.5 decode fault with a synthetic key whose length is drawn from the private key and the ciphertext, and a draw equal to the content-key length took the substitute out of the path, so the test failed about once in every few hundred runs.
+
+## v0.6.38 — 2026-09-05
+
+A trust anchor can name the namespace its root is trusted for, and pki.path.validate enforces it as the initial name-constraint state.
+
+### Added
+
+- A trust anchor passed to pki.path.validate or pki.path.build may carry nameConstraints: { permitted, excluded }, each an array of { tag, base } subtrees. They seed the RFC 5280 section 6.1.1(h)(i) initial permitted and excluded state, so a root a program trusts only for a namespace enforces that namespace even though its certificate states no nameConstraints extension. The anchor's subtrees intersect with an intermediate's own extension and with opts.initialPermittedSubtrees; excluded subtrees are a union.
+- The pki.path.validate verdict reports anchorConstraints.nameConstraintsApplied, so a stored verdict distinguishes an anchor that named a namespace from one that did not, alongside the distrustAfterApplied and purposeTrustApplied it already carries.
+
+### Fixed
+
+- pki.path.validate and pki.path.build copy a directoryName subtree base and snapshot an iPAddress one before validating, and read opts.initialPermittedSubtrees and opts.initialExcludedSubtrees once rather than again for each trust anchor or candidate path tried. A caller mutating its own subtree list, entry or base while the path is still verifying signatures no longer changes the namespace the validation enforces; the subtrees that bind are the ones read at entry.
+- A directoryName subtree base whose rdns is an accessor rather than a data property is refused. Its value was read once to check its shape and again to copy it, so an accessor could answer with a restrictive name the first time and an empty one the second, and an empty directoryName constraint matches every name.
+- A subtree list that is a Proxy, that is sparse, or whose entries are accessors is refused, on a trust anchor and on opts.initialPermittedSubtrees and opts.initialExcludedSubtrees alike. Such a list answers its own length and index reads, so it could hold a restrictive subtree while reporting none and leave the namespace unenforced. A directoryName subtree is built from property descriptors alone, so nothing the caller supplies runs while the namespace is read: an accessor, own or inherited, is refused rather than invoked. It is a relative-name sequence of attribute lists and nothing deeper, so an array nested past that, including one that refers to itself, is a typed refusal, as is a hole, an entry the array does not own, an attribute that is not an object, or one lacking its own type and value. Each of those refusals is a configuration error reported wherever the anchor sits among several, rather than a name mismatch a different anchor could mask.
+- A parsed certificate passed as a trust anchor is refused if it carries nameConstraints, the way one carrying purposes or distrustAfter already is. A certificate anchor cannot hold that metadata, so accepting it would have dropped the namespace and validated a leaf the anchor was meant to exclude.
+- An anchor whose nameConstraints names a field other than permitted or excluded is refused rather than read as unconstrained, and its subtrees are checked while the anchor is normalized, so a malformed one is refused wherever that anchor sits among several rather than only once it is reached.
+
 ## v0.6.37 — 2026-09-05
 
 A natively signed C509 certificate is refused when it writes an extension in the generic OID form that the registry can carry as an identifier.

package/lib/cmc-verify.js

@@ -89,12 +89,13 @@ function _assertBound(body, sent) {
     if (Buffer.isBuffer(v) || v instanceof Uint8Array) return v.length > 0;   // allow:byte-source-narrow -- sent.senderNonce / dataReturn are already normalized to a Buffer by _snapshotSent; this is a length test on a settled value, not an input door
     return true;
   }
-  var bound = {
+  var bound = guard.verdict.of({
     transactionId: _carries(sent.transactionId),
     senderNonce: _carries(sent.senderNonce),
     dataReturn: _carries(sent.dataReturn),
     bodyPartIDs: Array.isArray(sent.bodyPartIDs),
-  };
+    boundToRequest: false,
+  });
   if (sent.transactionId != null) {
     var txControl = _findControl(body.controls, OID_TRANSACTION_ID, "Transaction Identifier");
     if (!txControl) {
@@ -197,6 +198,10 @@ function _governingStatus(statuses, outcome) {
  * @defends    cmc-response-replay (CWE-294)
  * @related    pki.schema.cmc.parse, pki.path.validate, pki.cms.verify
  *
+ * The verdict carries `valid`, the toolkit-wide alias the other verify verbs use, true only for the
+ * `issued` outcome. Every other outcome, including `pending`, is `valid: false`, and which one it
+ * was stays in `outcome` alongside `failInfo` and `pendToken`.
+ *
  * Interpret a Full PKI Response into one terminal verdict. `response` is the DER or a PEM `CMS`
  * block; an already-parsed message is interpreted too, but only under `allowUnverified: true`,
  * because both carriers authenticate over BYTES and a parsed object the caller still owns pins
@@ -419,7 +424,8 @@ function _shape(body, sent, signatureVerified, bound) {
   var confirm = _findControl(body.controls, OID_CONFIRM_CERT_ACCEPTANCE, "Confirm Certificate Acceptance");
   var serverNonce = _findControl(body.controls, OID_SENDER_NONCE, "Sender Nonce");
 
-  return {
+  return guard.verdict.of({
+    valid: outcome === "issued",
     outcome: outcome,
     statuses: body.statuses,
     failInfo: governing ? governing.failInfoName : null,
@@ -448,7 +454,7 @@ function _shape(body, sent, signatureVerified, bound) {
     controls: body.controls,
     unhandled: body.unhandled,
     cms: body.cms,
-  };
+  });
 }
 
 /**

package/lib/cmp-session.js

@@ -590,24 +590,23 @@ function session(opts) {
 
   function _recordTranscript(entry) {
     var len = Buffer.isBuffer(entry.bytes) ? entry.bytes.length : 0;
-    if (transcriptBytes + len > transcriptCap) {
-      entry.byteLength = len; entry.bytes = null; entry.truncated = true;
-    } else {
-      transcriptBytes += len;
-    }
-    transcript.push(entry);
+    var over = transcriptBytes + len > transcriptCap;
+    if (!over) transcriptBytes += len;
+    transcript.push(over
+      ? guard.verdict.of(entry, { byteLength: len, bytes: null, truncated: true })
+      : guard.verdict.of(entry));
   }
 
   function _transcriptSnapshot() {
     return transcript.map(function (e) {
-      var c = Object.assign({}, e);
+      var c = guard.verdict.of(e);
       if (Buffer.isBuffer(c.bytes)) c.bytes = Buffer.from(c.bytes);
-      if (c.verdict) c.verdict = Object.assign({}, c.verdict);
+      if (guard.verdict.carries(c, "verdict") && c.verdict) c.verdict = guard.verdict.of(c.verdict);
       return c;
     });
   }
   function _terminal(outcome, extra) {
-    return Object.assign({
+    return guard.verdict.of({
       outcome: outcome, certificate: null, chain: [], status: null, trusted: true,
       confirmed: false, implicitConfirm: false, transactionID: Buffer.from(transactionID),
       polls: 0, transcript: _transcriptSnapshot(),

package/lib/cms-verify.js

@@ -51,22 +51,29 @@ var pkix = require("./schema-pkix");
 var CmsError = frameworkError.CmsError;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
 var _Promise = Promise, _promiseResolveRaw = Promise.resolve;
-function _pResolve(v) { return intrinsic.apply(_promiseResolveRaw, _Promise, [v]); }
+/**
+ * @internal Every value resolved here is a signer row, and resolving a promise reads `then` off the
+ * value. Building the row through the verdict guard ends that lookup on the row itself, so an
+ * accessor installed while the signature check is pending cannot rewrite the `ok` the message
+ * verdict is derived from before it is read.
+ */
+function _pResolve(v) { return intrinsic.apply(_promiseResolveRaw, _Promise, [_row(v)]); }
+function _row(o) { return guard.verdict.of(o); }
 
 var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_CONTENT_TYPE = oid.byName("contentType");
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
 
-var DIGEST_HASH = {
+var DIGEST_HASH = intrinsic.assign(intrinsic.create(null), {
   sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512",
   shake128: "SHAKE128", shake256: "SHAKE256",
-};
-var SIG_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
+});
+var SIG_HASH = intrinsic.assign(intrinsic.create(null), { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 function _supportedDigest(name) { return intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 async function _computeDigest(name, content) {
   return intrinsic.bufferFrom(await subtle.digest(DIGEST_HASH[name], content));
 }
-var SIG_SCHEME = {
+var SIG_SCHEME = intrinsic.assign(intrinsic.create(null), {
   rsaEncryption: { kind: "rsa", params: "null" },
   rsassaPss: { kind: "rsapss" },
   ecPublicKey: { kind: "ec", params: "absent" },
@@ -83,13 +90,13 @@ var SIG_SCHEME = {
   ecdsaWithSHA256: { kind: "ec", hash: "SHA-256", params: "absent" },
   ecdsaWithSHA384: { kind: "ec", hash: "SHA-384", params: "absent" },
   ecdsaWithSHA512: { kind: "ec", hash: "SHA-512", params: "absent" },
-};
+});
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
 ].forEach(function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + s.toUpperCase(), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
 function _isDerNull(p) { return Buffer.isBuffer(p) && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
 function _algParamsOk(shape, p) { return shape === "null" ? _isDerNull(p) : (p === null || p === undefined); }
-var EC_CURVE = {};
+var EC_CURVE = intrinsic.create(null);
 EC_CURVE[oid.byName("prime256v1")] = { curve: "P-256", coordLen: 32 };
 EC_CURVE[oid.byName("secp384r1")] = { curve: "P-384", coordLen: 48 };
 EC_CURVE[oid.byName("secp521r1")] = { curve: "P-521", coordLen: 66 };
@@ -122,13 +129,13 @@ async function _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes,
     }
     try {
       var ok = await _verifySignature(scheme, sigHash, sigBytes, c.cert.subjectPublicKeyInfo.bytes, signedBytes, _certCurveOid(c.cert), pssSalt);
-      if (ok === true) return { ok: true, sid: sid, cert: c.der };
+      if (ok === true) return _row({ ok: true, sid: sid, cert: c.der });
     } catch (e) {
       lastErr = (e instanceof CmsError) ? e : _err("cms/verify-error", "the SignerInfo signature could not be evaluated", e);
     }
   }
-  return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
-    : { ok: false, sid: sid, cert: candidates[0].der };
+  return _row(lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+    : { ok: false, sid: sid, cert: candidates[0].der });
 }
 
 function _certSki(cert) {
@@ -262,7 +269,7 @@ async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, dige
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
 
   var signedBytes = await (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType, digestByName));
-  if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+  if (signedBytes && signedBytes.mismatch) return _row({ ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message });
   return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
 }
 
@@ -347,7 +354,7 @@ async function _verifyComposite(si, comp, content, eContentType, parsedCerts, cs
   if (!signers.length) return _pResolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
   var signedBytes = await (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType, digestByName));
-  if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+  if (signedBytes && signedBytes.mismatch) return _row({ ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message });
   return _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si.sid, signers, si.signatureAlgorithm.oid);
 }
 
@@ -360,11 +367,11 @@ async function _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si
       continue;
     }
     var r = await compositeSig.compositeVerify(c.cert.subjectPublicKeyInfo.bytes, sigBytes, signedBytes, comp, CmsError, "cms/unsupported-algorithm", "cms/bad-signature");
-    if (r.ok === true) return { ok: true, sid: sid, cert: c.der };
+    if (r.ok === true) return _row({ ok: true, sid: sid, cert: c.der });
     if (r.code) lastErr = (r.error instanceof CmsError) ? r.error : _err(r.code, r.error && r.error.message ? r.error.message : "the composite signature could not be evaluated");
   }
-  return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
-    : { ok: false, sid: sid, cert: candidates[0].der };
+  return _row(lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+    : { ok: false, sid: sid, cert: candidates[0].der });
 }
 
 function _surfaceUnsignedAttrs(si) {
@@ -394,14 +401,13 @@ async function _verifyCountersignatures(si, parsedCerts) {
 async function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
   var csSi;
   try { csSi = cms.walkCountersignature(asn1.decode(intrinsic.isBuffer(vDer) ? vDer : intrinsic.bufferFrom(vDer))); }
-  catch (e) { return { ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }; }
+  catch (e) { return _row({ ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }); }
   var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig);
   var nested = await _verifyCountersignatures(csSi, parsedCerts);
-  var node = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
-  if (verdict.code) node.code = verdict.code;
-  node.unsignedAttrs = _surfaceUnsignedAttrs(csSi);
-  node.countersignatures = nested;
-  return node;
+  var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
+  return guard.verdict.of(
+    verdict.code ? guard.verdict.of(head, { code: verdict.code }) : head,
+    { unsignedAttrs: _surfaceUnsignedAttrs(csSi), countersignatures: nested });
 }
 
 /**
@@ -539,19 +545,23 @@ async function _verify(input, opts) {
   for (var _sp = 0; _sp < parsed.signerInfos.length; _sp++) {
     var siOne = parsed.signerInfos[_sp];
     var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName);
-    verdict.countersignatures = await _verifyCountersignatures(siOne, parsedCerts);
-    verdict.unsignedAttrs = _surfaceUnsignedAttrs(siOne);
-    verdict.signedAttributesPresent = !!siOne.signedAttrsBytes;
-    verdict.signedAttributes = _surfaceSignedAttrs(siOne);
-    verdict.digestAlgorithm = siOne.digestAlgorithm.name;
-    intrinsic.push(signers, verdict);
+    var counters = await _verifyCountersignatures(siOne, parsedCerts);
+    intrinsic.push(signers, guard.verdict.of(verdict, {
+      countersignatures: counters,
+      unsignedAttrs: _surfaceUnsignedAttrs(siOne),
+      signedAttributesPresent: !!siOne.signedAttrsBytes,
+      signedAttributes: _surfaceSignedAttrs(siOne),
+      digestAlgorithm: siOne.digestAlgorithm.name,
+      trusted: false,
+    }));
   }
-  var res = {
+  var res = guard.verdict.of({
     valid: signers.length > 0 && guard.list.allMatch(signers, function (s) { return s.ok === true; }),
     eContentType: parsed.encapContentInfo.eContentType,
     eContent: parsed.encapContentInfo.eContent != null ? parsed.encapContentInfo.eContent : null,
     signers: signers,
-  };
+    trusted: false,
+  });
   await _applyTrust(res, parsedCerts, trustCfg);
   return res;
 }

package/lib/composite-sig.js

@@ -24,7 +24,7 @@ var MLDSA_COMPONENT = {
 };
 var EC_CURVE_OID = { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" };
 var PH_CMS = { "SHA-256": "sha256", "SHA-512": "sha512", "SHAKE256": "shake256" };
-var COMPOSITE_ALGS = {};
+var COMPOSITE_ALGS = Object.create(null);
 function _comp(name, mldsa, ph, label, trad) {
   var sz = MLDSA_COMPONENT[mldsa];
   COMPOSITE_ALGS[oid.byName(name)] = {

package/lib/crmf-sign.js

@@ -478,7 +478,10 @@ function _verifyOne(msg) {
     subjectBound: false,
     publicKey: (t && t.publicKey && t.publicKey.bytes) || null,
   };
-  function settle(extra) { var v = Object.assign({}, base, extra); v.valid = v.verified === true; return Promise.resolve(v); }
+  function settle(extra) {
+    var v = guard.verdict.of(base, extra);
+    return Promise.resolve(guard.verdict.of(v, { valid: v.verified === true }));
+  }
 
   var popo = msg.popo;
   if (popo == null) {
@@ -499,7 +502,7 @@ function _verifyOne(msg) {
   var spki = pin ? pin.publicKey : base.publicKey;
   var bound = !pin;
   return crmfVerify.verifyPopSignature(popo, spki, preimage).then(function (ok) {
-    return Object.assign({}, base, {
+    return guard.verdict.of(base, {
       valid: ok === true, verified: ok === true, method: "signature", cryptographicallyVerified: ok === true,
       subject: bound ? base.subject : null,
       subjectBound: bound,
@@ -558,7 +561,7 @@ function _verifyPop(messages) {
   var parsed = _coerceMessages(messages);
   return Promise.all(parsed.messages.map(_verifyOne)).then(function (out) {
     var allVerified = out.length > 0 && out.every(function (m) { return m.verified === true; });
-    return { valid: allVerified, verified: allVerified, messages: out };
+    return guard.verdict.of({ valid: allVerified, verified: allVerified, messages: out });
   });
 }
 

package/lib/guard-all.js

@@ -20,6 +20,7 @@ var header = require("./guard-header");
 var compress = require("./guard-compress");
 var secret = require("./guard-secret");
 var parsed = require("./guard-parsed");
+var verdict = require("./guard-verdict");
 var async_ = require("./guard-async");
 
 module.exports = _freeze({
@@ -39,5 +40,6 @@ module.exports = _freeze({
   compress: compress,
   secret: secret,
   parsed: parsed,
+  verdict: verdict,
   async:  async_,
 });

package/lib/guard-verdict.js

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+// @internal
+
+var _freeze = require("./guard-intrinsic").freeze;
+var _keys = require("./guard-intrinsic").keys;
+var _defineProperty = require("./guard-intrinsic").defineProperty;
+var _getOwnPropertyDescriptor = require("./guard-intrinsic").getOwnPropertyDescriptor;
+var _hasOwn = require("./guard-intrinsic").hasOwn;
+var _Object = require("./guard-intrinsic").Object;
+
+function _copyOwn(out, src) {
+  var keys = _keys(src);
+  for (var i = 0; i < keys.length; i++) {
+    var d = _getOwnPropertyDescriptor(src, keys[i]);
+    if (!d) continue;
+    var value = _hasOwn(d, "value") ? d.value : src[keys[i]];
+    _defineProperty(out, keys[i], { value: value, enumerable: true, configurable: true, writable: true });
+  }
+}
+
+// @enforced-by behavioral -- the defect is the ABSENCE of this call at a construction site, not a
+function of(src, extras) {
+  var out = {};
+  _copyOwn(out, src);
+  if (extras != null) _copyOwn(out, extras);
+  /** @internal Resolving a promise reads `then` off the value, so an inherited accessor would run
+   * with the verdict as its receiver and could rewrite a field or hand the caller a different
+   * object. An own `then` ends that lookup, and is non-enumerable so keys, JSON, a spread and a
+   * deep-equality comparison do not see it. */
+  _defineProperty(out, "then", { value: undefined, enumerable: false, configurable: true, writable: true });
+  return out;
+}
+
+// @enforced-by behavioral -- Object.hasOwn and hasOwnProperty are replaceable at any time, and a
+function carries(obj, key) {
+  return obj != null && _hasOwn(_Object(obj), key);
+}
+
+module.exports = _freeze({ of: of, carries: carries });

package/lib/ocsp-verify.js

@@ -121,19 +121,33 @@ function makeOcspVerify(deps) {
 
   function isOctetAligned(bitString) { return !!bitString && bitString.unusedBits === 0; }
 
+  /**
+   * @internal Every field the callers decide on is present on every return, so a field an early
+   * return would have left absent is read from the response that was evaluated rather than from
+   * whatever a polluted Object.prototype answers: a rejected response would otherwise be able to
+   * report `sawGood`, and a certificate with no authoritative response would read as good.
+   */
+  function _evaluation(extras) {
+    return guard.verdict.of({
+      applicable: false, matched: false, responderAuthorized: false, signatureValid: false,
+      revoked: null, sawGood: false, sawUnknownStatus: false,
+      thisUpdate: null, nextUpdate: null, reason: "",
+    }, extras);
+  }
+
   async function evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) {
-    if (resp.responseStatus.code !== 0) return { applicable: false, matched: false, reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" };
+    if (resp.responseStatus.code !== 0) return _evaluation({ reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" });
     var br = resp.basicResponse;
-    if (!br) return { applicable: false, matched: false, reason: "successful OCSP response carries no BasicOCSPResponse" };
+    if (!br) return _evaluation({ reason: "successful OCSP response carries no BasicOCSPResponse" });
     var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
-    if (!signerSpki) return { applicable: true, matched: false, responderAuthorized: false, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" };
+    if (!signerSpki) return _evaluation({ applicable: true, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" });
     if (!(await verifyWithSpki(br.signatureAlgorithm, br.signature, signerSpki, br.tbsResponseDataBytes))) {
-      return { applicable: true, matched: false, responderAuthorized: true, signatureValid: false, reason: "the OCSP response signature does not verify over tbsResponseData" };
+      return _evaluation({ applicable: true, responderAuthorized: true, reason: "the OCSP response signature does not verify over tbsResponseData" });
     }
     if (ocspHasCriticalExtension(br.responseExtensions)) {
-      return { applicable: true, matched: false, responderAuthorized: true, signatureValid: true, reason: "the OCSP response carries an unrecognized critical extension" };
+      return _evaluation({ applicable: true, responderAuthorized: true, signatureValid: true, reason: "the OCSP response carries an unrecognized critical extension" });
     }
-    var out = { applicable: true, matched: false, responderAuthorized: true, signatureValid: true, revoked: null, sawGood: false, sawUnknownStatus: false, reason: "no current SingleResponse names this certificate" };
+    var out = _evaluation({ applicable: true, responderAuthorized: true, signatureValid: true, reason: "no current SingleResponse names this certificate" });
     for (var s = 0; s < br.responses.length; s++) {
       var sr = br.responses[s];
       if (!(await ocspCertIdMatches(sr.certID, cert, issuerNameCandidates, issuerKeyBits))) continue;

package/lib/ocsp.js

@@ -374,7 +374,7 @@ function buildErrorResponse(status) {
 
 /**
  * @primitive pki.ocsp.verify
- * @signature pki.ocsp.verify(response, opts) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, nonceMatched?, reason }>
+ * @signature pki.ocsp.verify(response, opts) -> Promise<{ valid, status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, nonceMatched?, reason }>
  * @since 0.2.22
  * @status stable
  * @spec RFC 6960, RFC 9654, RFC 5019
@@ -389,6 +389,11 @@ function buildErrorResponse(status) {
  * unauthorized, stale, or CertID-mismatched response is a `"unknown"` verdict (never a silent
  * accept); a malformed response's parse fault surfaces as the parser's `ocsp/*` / `asn1/*`.
  *
+ * `valid` is the toolkit-wide verdict alias the other verify verbs carry, and it is true only when
+ * `status` is `"good"`. Because every failure this verb detects already collapses to `"unknown"`,
+ * `valid` states exactly what `status === "good"` does and hides no unrun check. A revoked
+ * certificate is `valid: false`; which of the two it was stays in `status`.
+ *
  * The request-nonce check is reported, and downgrades `good` alone. Every verdict carries
  * `nonceMatched` (true / false / null when the client sent no nonce). An unmatched nonce turns a
  * `good` into `"unknown"`, because a response that is not an answer to this request cannot be relied
@@ -437,16 +442,20 @@ function verify(response, opts) {
     time = opts.time == null ? new Date() : _asDate(opts.time);
   } catch (e) { return Promise.reject(e); }
   return pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time, { historicalMode: opts.historicalMode === true }).then(function (verdict) {
-    if (opts.requestNonce == null) return Object.assign({}, verdict, { nonceMatched: null });
-    var respNonce = _responseNonce(parsed);
-    var reqNonce = guard.bytes.isByteSource(opts.requestNonce)
-      ? guard.bytes.snapshotSource(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
-    var matched = respNonce != null && reqNonce != null && guard.crypto.constantTimeEqual(respNonce, reqNonce);
-    var out = Object.assign({}, verdict, { nonceMatched: matched });
-    if (!matched && verdict.status === "good") {
-      return Object.assign(out, { status: "unknown", reason: "the OCSP response nonce does not echo the request nonce (RFC 9654)" });
+    var out;
+    if (opts.requestNonce == null) {
+      out = guard.verdict.of(verdict, { nonceMatched: null });
+    } else {
+      var respNonce = _responseNonce(parsed);
+      var reqNonce = guard.bytes.isByteSource(opts.requestNonce)
+        ? guard.bytes.snapshotSource(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
+      var matched = respNonce != null && reqNonce != null && guard.crypto.constantTimeEqual(respNonce, reqNonce);
+      out = guard.verdict.of(verdict, { nonceMatched: matched });
+      if (!matched && out.status === "good") {
+        out = guard.verdict.of(out, { status: "unknown", reason: "the OCSP response nonce does not echo the request nonce (RFC 9654)" });
+      }
     }
-    return out;
+    return guard.verdict.of(out, { valid: out.status === "good" });
   });
 }
 function _responseNonce(parsed) {
@@ -462,7 +471,7 @@ function _requestFromBytes(request) {
   return ocspSchema.parseRequest(request);
 }
 function _reqVerdict(parsed, extra) {
-  return {
+  return guard.verdict.of({
     valid: extra.signed === true && extra.signatureValid === true,
     signed: extra.signed, signatureValid: extra.signatureValid,
     signerCert: extra.signerCert != null ? extra.signerCert : null,
@@ -472,7 +481,7 @@ function _reqVerdict(parsed, extra) {
     requestorName: parsed.requestorName, requestList: parsed.requestList,
     requestExtensions: parsed.requestExtensions, version: parsed.version,
     reason: extra.reason != null ? extra.reason : null,
-  };
+  });
 }
 async function _findRequestSigners(candidates, strict, parsed, sig, sigBits) {
   var parsedList = [];

package/lib/path-validate.js

@@ -108,7 +108,7 @@ var PROCESSED_EXTENSIONS = {};
 Object.freeze(PROCESSED_EXTENSIONS);
 
 
-var SIG_ALGS = {};
+var SIG_ALGS = intrinsic.create(null);
 function _sig(name, verify, imp, params, ecdsa, sameKeyOid) {
   var entry = { verify: verify, imp: imp, params: params };
   if (ecdsa) entry.ecdsa = true;
@@ -553,19 +553,61 @@ function isSubtreeBaseValid(tag, base) {
 
 function checkedSubtreeSeeds(list, optName) {
   if (list === undefined || list === null) return [];
-  if (!intrinsic.isArray(list)) throw E("path/bad-input", "validate: opts." + optName + " must be an array of { tag, base } subtree entries");
-  return list.map(function (st) {
-    if (!st || typeof st !== "object" || !Number.isInteger(st.tag) || st.tag < 0 || st.tag > 8) {
-      throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
+  if (!intrinsic.isArray(list) || intrinsic.types.isProxy(list)) throw E("path/bad-input", "validate: opts." + optName + " must be a plain array of { tag, base } subtree entries");
+  for (var li = 0; li < list.length; li++) {
+    var ld = intrinsic.getOwnPropertyDescriptor(list, li);
+    if (ld === undefined) throw E("path/bad-input", "validate: opts." + optName + " must not be a sparse array; index " + li + " is a hole");
+    if (!intrinsic.hasOwn(ld, "value")) throw E("path/bad-input", "validate: opts." + optName + " entry " + li + " must be a data property, not an accessor");
+  }
+  /** @internal Built with a plain loop into a fresh array: Array.prototype.map consults the caller
+   * array's constructor and Symbol.species, which is more caller code running mid-copy. */
+  var seedsOut = [];
+  for (var si = 0; si < list.length; si++) {
+    intrinsic.push(seedsOut, (function (st) {
+    var shapeMsg = "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }";
+    if (!st || typeof st !== "object" || intrinsic.types.isProxy(st)) throw E("path/bad-input", shapeMsg);
+    /** @internal Read tag and base once each, from their own data properties: an accessor could
+     * answer with a restrictive value to a check and a permissive one to the copy. */
+    var tagD = intrinsic.getOwnPropertyDescriptor(st, "tag");
+    var baseD = intrinsic.getOwnPropertyDescriptor(st, "base");
+    if (tagD !== undefined && !intrinsic.hasOwn(tagD, "value")) throw E("path/bad-input", "validate: opts." + optName + " entry tag must be a data property, not an accessor");
+    if (baseD !== undefined && !intrinsic.hasOwn(baseD, "value")) throw E("path/bad-input", "validate: opts." + optName + " entry base must be a data property, not an accessor");
+    var tag = tagD === undefined ? undefined : tagD.value;
+    var base = baseD === undefined ? undefined : baseD.value;
+    if (!Number.isInteger(tag) || tag < 0 || tag > 8) throw E("path/bad-input", shapeMsg);
+    if (tag === 7 && guard.bytes.isByteSource(base)) {
+      base = guard.bytes.snapshotSource(base, PathError, "path/bad-input", "an iPAddress subtree base");
     }
-    var base = (st.tag === 7 && guard.bytes.isByteSource(st.base))
-      ? guard.bytes.snapshotSource(st.base, PathError, "path/bad-input", "an iPAddress subtree base")
-      : st.base;
-    if (!isSubtreeBaseValid(st.tag, base)) {
-      throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
+    if (tag === 4 && base !== null && typeof base === "object") {
+      var seedRdns = _capturedRdns(base, "validate: opts." + optName);
+      if (seedRdns !== undefined) {
+        var dnCopy = {};
+        intrinsic.defineProperty(dnCopy, "rdns", { value: seedRdns, enumerable: true, configurable: true, writable: true });
+        base = dnCopy;
+      }
     }
-    return { tag: st.tag, base: base };
-  });
+    if (!isSubtreeBaseValid(tag, base)) throw E("path/bad-input", shapeMsg);
+    return { tag: tag, base: base };
+    })(intrinsic.getOwnPropertyDescriptor(list, si).value));
+  }
+  return seedsOut;
+}
+
+/**
+ * @internal RFC 5280 sec. 6.1.1(h)(i): the anchor's own permitted/excluded subtrees, the way a root
+ * program restricts a root to a namespace its certificate does not state. Validated through the same
+ * entry-point checker the caller's seeds use, so a mis-shaped subtree is refused rather than dropped.
+ */
+function _anchorSubtreeSeeds(anchor) {
+  var nc = anchor.nameConstraints;
+  if (nc === undefined || nc === null) return { permitted: [], excluded: [] };
+  if (typeof nc !== "object" || intrinsic.isArray(nc)) {
+    throw E("path/bad-input", "validate: a trustAnchor nameConstraints must be a { permitted, excluded } object of { tag, base } subtree entries");
+  }
+  return {
+    permitted: checkedSubtreeSeeds(nc.permitted, "trustAnchors[].nameConstraints.permitted"),
+    excluded: checkedSubtreeSeeds(nc.excluded, "trustAnchors[].nameConstraints.excluded"),
+  };
 }
 
 function initialize(certs, params, seeds, anchor) {
@@ -574,7 +616,7 @@ function initialize(certs, params, seeds, anchor) {
     validPolicyTree: rootNode(),
     policyNodeCount: 1,
     maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
-    permittedGenerations: seeds.permitted.length ? [seeds.permitted] : [],
+    permittedGenerations: intrinsic.filter(seeds.permittedGenerations, function (g) { return g.length > 0; }),
     excludedSubtrees: seeds.excluded,
     explicitPolicy: params.initialExplicitPolicy ? 0 : n + 1,
     inhibitAnyPolicy: params.initialAnyPolicyInhibit ? 0 : n + 1,
@@ -867,10 +909,21 @@ function validateCriticalExtensionStructure(cert) {
  *
  * `anchorConstraints` reports what the anchor's own trust metadata decided:
  * the `checkedPurpose` it was judged under, and whether the `distrustAfter`
- * date and the `purposes` delegator map each applied. That metadata is keyed BY
- * key purpose, so an anchor carrying it while `opts.checkPurpose` is absent is a
- * configuration fault (`path/bad-input`). A silently inert constraint would let
- * a root distrusted years ago quietly validate a current leaf.
+ * date, the `purposes` delegator map and the `nameConstraints` namespace each
+ * applied. The purpose-keyed metadata is keyed BY key purpose, so an anchor
+ * carrying it while `opts.checkPurpose` is absent is a configuration fault
+ * (`path/bad-input`). A silently inert constraint would let a root distrusted
+ * years ago quietly validate a current leaf.
+ *
+ * An anchor may also carry `nameConstraints`, a `{ permitted, excluded }` pair
+ * of `{ tag, base }` subtrees naming the namespace that root is trusted for.
+ * A root program restricts a root this way when the restriction appears in no
+ * `nameConstraints` extension the root certificate carries. The subtrees become
+ * the RFC 5280 sec. 6.1.1(h)(i) initial permitted and excluded state, so an
+ * intermediate's own `nameConstraints` extension intersects with them and a leaf
+ * must satisfy both. They are a separate generation from
+ * `opts.initialPermittedSubtrees`, so those two intersect as well. A mis-shaped
+ * subtree is refused with `path/bad-input` rather than left inert.
  *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -938,17 +991,35 @@ async function validate(path, opts) {
   var certs = path.map(function (c, ci) { return coerceCert(c, "validate: path[" + ci + "]"); });
   var n = certs.length;
   if (n < 1) throw E("path/empty-path", "validate: the certification path is empty");
+  /** @internal Captured before any anchor is normalized: an anchor field may be an accessor, and
+   * that getter runs caller code which could otherwise clear these lists first. */
+  var callerPermitted = checkedSubtreeSeeds(opts.initialPermittedSubtrees, "initialPermittedSubtrees");
+  var callerExcluded = checkedSubtreeSeeds(opts.initialExcludedSubtrees, "initialExcludedSubtrees");
   var rawAnchors = opts.trustAnchors;
   var anchorList = intrinsic.isArray(rawAnchors) ? rawAnchors : [rawAnchors];
   if (rawAnchors == null || anchorList.length === 0) throw E("path/bad-input", "validate: trustAnchors is required (a single anchor or a non-empty array of anchors)");
+  /** @internal Read the caller's list once here, whatever its length, so neither branch below reads
+   * one of its indices twice. */
+  if (intrinsic.isArray(rawAnchors)) anchorList = _ownAnchorEntries(rawAnchors, "validate");
   if (anchorList.length > 1) {
+    var anchorEntries = anchorList;
+    var preNc = _precaptureAnchorNameConstraints(anchorEntries, "validate");
     var tuples = [];
-    for (var ti = 0; ti < anchorList.length; ti++) { tuples[ti] = toAnchor(anchorList[ti], "validate"); }
+    for (var ti = 0; ti < anchorEntries.length; ti++) {
+      tuples[ti] = toAnchor(anchorEntries[ti], "validate");
+      if (preNc[ti] !== undefined) intrinsic.defineProperty(tuples[ti], "nameConstraints", { value: preNc[ti], enumerable: true, configurable: true, writable: true });
+    }
+    /** @internal Each anchor is a separate attempt and the later ones run after an await, so the
+     * caller's own subtree lists are read once here rather than again per attempt. */
+    var permRawOnce = opts.initialPermittedSubtrees;
+    var exclRawOnce = opts.initialExcludedSubtrees;
     var singleOpts = function (a) {
       var keys = intrinsic.ownKeys(opts);
       var o = {};
       for (var ki = 0; ki < keys.length; ki++) { o[keys[ki]] = opts[keys[ki]]; }
       o.trustAnchors = a;
+      if (permRawOnce != null) o.initialPermittedSubtrees = callerPermitted;
+      if (exclRawOnce != null) o.initialExcludedSubtrees = callerExcluded;
       return o;
     };
     var lastMatched = null, anyMatched = false;
@@ -965,10 +1036,12 @@ async function validate(path, opts) {
   guard.time.assertValid(opts.time, E, "path/bad-input", "validate: opts.time (the always-on validity-window check date)");
   guard.limits.cap(opts.maxPolicyNodes, "validate: opts.maxPolicyNodes", undefined, { E: E, code: "path/bad-input", min: 1 });
   _assertUserInitialPolicySet(opts.userInitialPolicySet, "validate");
+  var anchorNc = _anchorSubtreeSeeds(anchor);
   var seeds = {
-    permitted: checkedSubtreeSeeds(opts.initialPermittedSubtrees, "initialPermittedSubtrees"),
-    excluded: checkedSubtreeSeeds(opts.initialExcludedSubtrees, "initialExcludedSubtrees"),
+    permittedGenerations: [callerPermitted, anchorNc.permitted],
+    excluded: intrinsic.concat(callerExcluded, anchorNc.excluded),
   };
+  var anchorNameConstraintsApplied = anchorNc.permitted.length > 0 || anchorNc.excluded.length > 0;
   var purposeOpts = resolvePurposeOpts(opts);
   var requiredEku = purposeOpts.requiredEku;
   var checkPurpose = purposeOpts.checkPurpose;
@@ -1158,6 +1231,7 @@ async function validate(path, opts) {
       checkedPurpose: checkPurpose || null,
       distrustAfterApplied: anchorDistrustApplied,
       purposeTrustApplied: anchorPurposeApplied,
+      nameConstraintsApplied: anchorNameConstraintsApplied,
     },
     path: certs,
     results: state.results,
@@ -1696,7 +1770,7 @@ function ocspChecker(responses) {
 
 /**
  * @primitive  pki.path.verifyOcspResponse
- * @signature  pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, reason }>
+ * @signature  pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ valid, status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, reason }>
  * @since       0.2.22
  * @status      stable
  * @spec        RFC 6960
@@ -1752,14 +1826,16 @@ function ocspChecker(responses) {
  *   var v = await pki.path.verifyOcspResponse(der, cert, issuerCert, new Date());
  *   v.status;   // "good" | "revoked" | "unknown"
  */
-function verifyOcspResponse(response, cert, issuerCert, time, opts) {
+async function verifyOcspResponse(response, cert, issuerCert, time, opts) {
   var parsedResponse, subject, issuer;
   try {
     parsedResponse = _ocspFromBytes(response);
     subject = coerceCert(cert, "the certificate");
     issuer = coerceCert(issuerCert, "the issuer certificate");
   } catch (e) { return Promise.reject(e); }
-  return _verifyOcspParsed(parsedResponse, subject, issuer, time, opts);
+  var v = await _verifyOcspParsed(parsedResponse, subject, issuer, time, opts);
+  var out = guard.verdict.of(v);
+  return guard.verdict.of(out, { valid: out.status === "good" });
 }
 
 var _OCSP_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
@@ -1778,7 +1854,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   if (!guard.time.isDate(time) || isNaN(guard.time.instantOf(time))) {
     return Promise.reject(E("path/bad-input", "verifyOcspResponse: time must be a valid Date (the currency + responder-validity check date)"));
   }
-  function unbound(reason) { return { status: "unknown", responderAuthorized: false, signatureValid: false, matched: false, reason: reason }; }
+  function unbound(reason) { return guard.verdict.of({ status: "unknown", responderAuthorized: false, signatureValid: false, matched: false, thisUpdate: null, nextUpdate: null, reason: reason }); }
   var boundName;
   try { boundName = dnEqual(cert.issuer.rdns, issuerCert.subject.rdns); }
   catch (e) { return Promise.reject(e); }
@@ -1795,9 +1871,9 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
     catch (_e) { return unbound("the issuer public key could not be read to recompute the OCSP CertID"); }
     return ocspCore.evaluateResponse(parsedResponse, cert, issuerCtx, issuerKeyBits, issuerNameCandidates, time, opts.historicalMode === true).then(function (v) {
-      if (v.revoked) return { status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason };
-      if (v.sawGood) return { status: "good", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: "good" };
-      return { status: "unknown", responderAuthorized: v.responderAuthorized === true, signatureValid: v.signatureValid === true, matched: v.matched === true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: v.reason };
+      if (v.revoked) return guard.verdict.of({ status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason });
+      if (v.sawGood) return guard.verdict.of({ status: "good", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: "good" });
+      return guard.verdict.of({ status: "unknown", responderAuthorized: v.responderAuthorized === true, signatureValid: v.signatureValid === true, matched: v.matched === true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: v.reason });
     });
   });
 }
@@ -1903,6 +1979,198 @@ function _captureOwnData(entry, key) {
   return (d && intrinsic.hasOwn(d, "value")) ? d.value : undefined;
 }
 
+/**
+ * @internal Copy the anchor's subtree lists getter-free, so a caller mutating the entry afterwards
+ * cannot widen the namespace the validation already resolved.
+ */
+/**
+ * @internal Read a directoryName base's `rdns` once, from its own data property. Reading it twice,
+ * to test its shape and then to copy it, lets an accessor answer differently each time and hand the
+ * validation an empty DN, which matches every name.
+ */
+var _ATV_KEYS = ["type", "value", "name"];
+/**
+ * @internal Build the directoryName's own copy from property descriptors alone, so no caller code
+ * runs while the namespace is read: a getter, own or inherited, could clear another part of the
+ * namespace before it is captured. A directoryName is a relative-name sequence of attribute lists
+ * and nothing deeper, so exactly those levels are walked and a self-referencing array is refused
+ * rather than followed.
+ */
+function _copyDnRdns(rdns, who) {
+  _assertPlainDnRdns(rdns, who);
+  var out = [];
+  for (var i = 0; i < rdns.length; i++) {
+    var rd = intrinsic.getOwnPropertyDescriptor(rdns, i);
+    if (rd === undefined) throw E("path/bad-input", who + " index " + i + " is a hole or is inherited; every entry must be its own");
+    var rdn = rd.value;
+    if (!intrinsic.isArray(rdn)) throw E("path/bad-input", who + "[" + i + "] must be an array of attributes");
+    var rdnOut = [];
+    for (var j = 0; j < rdn.length; j++) {
+      var ad = intrinsic.getOwnPropertyDescriptor(rdn, j);
+      if (ad === undefined) throw E("path/bad-input", who + "[" + i + "] index " + j + " is a hole or is inherited; every entry must be its own");
+      var atv = ad.value;
+      if (atv === null || typeof atv !== "object") throw E("path/bad-input", who + "[" + i + "][" + j + "] must be an attribute object carrying a type and a value");
+      var atvOut = {};
+      for (var k = 0; k < _ATV_KEYS.length; k++) {
+        var fd = intrinsic.getOwnPropertyDescriptor(atv, _ATV_KEYS[k]);
+        if (fd === undefined) continue;
+        intrinsic.defineProperty(atvOut, _ATV_KEYS[k], { value: fd.value, enumerable: true, configurable: true, writable: true });
+      }
+      if (!intrinsic.hasOwn(atvOut, "type") || !intrinsic.hasOwn(atvOut, "value")) {
+        throw E("path/bad-input", who + "[" + i + "][" + j + "] must carry its type and value as own data properties");
+      }
+      intrinsic.push(rdnOut, atvOut);
+    }
+    intrinsic.push(out, rdnOut);
+  }
+  return out;
+}
+/**
+ * @internal The shape check the copy above relies on: a Proxy answers its own reads and an accessor
+ * runs caller code, so either one at any level of the directoryName is refused before it is copied.
+ */
+function _assertPlainDnRdns(rdns, who) {
+  if (intrinsic.types.isProxy(rdns)) throw E("path/bad-input", who + " must be a plain array, not a Proxy");
+  for (var i = 0; i < rdns.length; i++) {
+    var rd = intrinsic.getOwnPropertyDescriptor(rdns, i);
+    if (rd === undefined) continue;
+    if (!intrinsic.hasOwn(rd, "value")) throw E("path/bad-input", who + " entry " + i + " must be a data property, not an accessor");
+    var rdn = rd.value;
+    if (!intrinsic.isArray(rdn)) continue;
+    if (intrinsic.types.isProxy(rdn)) throw E("path/bad-input", who + "[" + i + "] must be a plain array, not a Proxy");
+    for (var j = 0; j < rdn.length; j++) {
+      var ad = intrinsic.getOwnPropertyDescriptor(rdn, j);
+      if (ad === undefined) continue;
+      if (!intrinsic.hasOwn(ad, "value")) throw E("path/bad-input", who + "[" + i + "] entry " + j + " must be a data property, not an accessor");
+      var atv = ad.value;
+      if (atv === null || typeof atv !== "object") continue;
+      if (intrinsic.types.isProxy(atv)) throw E("path/bad-input", who + "[" + i + "][" + j + "] must not be a Proxy");
+      if (intrinsic.isArray(atv)) throw E("path/bad-input", who + "[" + i + "][" + j + "] must be an attribute object, not an array");
+      for (var k = 0; k < _ATV_KEYS.length; k++) {
+        var fd = intrinsic.getOwnPropertyDescriptor(atv, _ATV_KEYS[k]);
+        if (fd !== undefined && !intrinsic.hasOwn(fd, "value")) {
+          throw E("path/bad-input", who + "[" + i + "][" + j + "]." + _ATV_KEYS[k] + " must be a data property, not an accessor");
+        }
+      }
+    }
+  }
+}
+function _capturedRdns(base, who) {
+  if (intrinsic.types.isProxy(base)) throw E("path/bad-input", who + ": a trustAnchor nameConstraints directoryName base must not be a Proxy");
+  /** @internal An inherited Proxy answers `in` through its has trap, which is caller code running
+   * inside what is meant to be a getter-free read. */
+  var baseProto = intrinsic.getPrototypeOf(base);
+  while (baseProto !== null) {
+    if (intrinsic.types.isProxy(baseProto)) throw E("path/bad-input", who + ": a trustAnchor nameConstraints directoryName base must not inherit from a Proxy");
+    baseProto = intrinsic.getPrototypeOf(baseProto);
+  }
+  var d = intrinsic.getOwnPropertyDescriptor(base, "rdns");
+  if (d === undefined) {
+    if ("rdns" in base) throw E("path/bad-input", who + ": a trustAnchor nameConstraints directoryName rdns must be an own data property, not inherited");
+    return undefined;
+  }
+  if (!intrinsic.hasOwn(d, "value")) throw E("path/bad-input", who + ": a trustAnchor nameConstraints directoryName rdns must be a data property, not an accessor");
+  if (!intrinsic.isArray(d.value)) return undefined;
+  return _copyDnRdns(d.value, who + ": a trustAnchor nameConstraints directoryName rdns");
+}
+var _NC_SUBTREE_KEYS = ["tag", "base"];
+var _NC_LIST_KEYS = ["permitted", "excluded"];
+function _copyAnchorSubtreeList(list, key, who) {
+  if (list === undefined || list === null) return undefined;
+  if (!intrinsic.isArray(list) || intrinsic.types.isProxy(list)) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " must be a plain array of { tag, base } subtree entries");
+  var copied = [];
+  var len = list.length;
+  for (var i = 0; i < len; i++) {
+    var entryD = intrinsic.getOwnPropertyDescriptor(list, i);
+    if (entryD === undefined) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " must not be a sparse array; index " + i + " is a hole");
+    if (!intrinsic.hasOwn(entryD, "value")) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " entry " + i + " must be a data property, not an accessor");
+    var st = entryD.value;
+    if (st === null || typeof st !== "object" || intrinsic.types.isProxy(st)) {
+      throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " entry must be a plain { tag, base } object");
+    }
+    var out = {};
+    for (var k = 0; k < _NC_SUBTREE_KEYS.length; k++) {
+      var field = _NC_SUBTREE_KEYS[k];
+      var fd = intrinsic.getOwnPropertyDescriptor(st, field);
+      if (fd === undefined) continue;
+      if (!intrinsic.hasOwn(fd, "value")) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " " + field + " must be a data property, not an accessor");
+      var fv = fd.value;
+      if (field === "base" && fv !== null && typeof fv === "object") {
+        var rdnsOwn = _capturedRdns(fv, who);
+        if (rdnsOwn !== undefined) {
+          var dnBase = {};
+          intrinsic.defineProperty(dnBase, "rdns", { value: rdnsOwn, enumerable: true, configurable: true, writable: true });
+          fv = dnBase;
+        } else if (guard.bytes.isByteSource(fv)) {
+          fv = guard.bytes.snapshotSource(fv, PathError, "path/bad-input", who + ": a trustAnchor nameConstraints iPAddress subtree base");
+        }
+      }
+      intrinsic.defineProperty(out, field, { value: fv, enumerable: true, configurable: true, writable: true });
+    }
+    intrinsic.push(copied, out);
+  }
+  return copied;
+}
+/**
+ * @internal Anchors are normalized one at a time, and each may expose fields through getters that
+ * run caller code. Capture every anchor's namespace first, so an earlier anchor's getter cannot
+ * clear a later anchor's restriction before that anchor is reached.
+ */
+/**
+ * @internal Read a caller's anchor list once, from its own indices, into a fresh array. The list is
+ * walked twice, to capture namespaces and then to normalize, and an accessor index could answer
+ * differently each time.
+ */
+function _ownAnchorEntries(list, who) {
+  if (intrinsic.types.isProxy(list)) throw E("path/bad-input", who + ": trustAnchors must be a plain array, not a Proxy");
+  var out = [];
+  for (var i = 0; i < list.length; i++) {
+    var d = intrinsic.getOwnPropertyDescriptor(list, i);
+    if (d === undefined) throw E("path/bad-input", who + ": trustAnchors index " + i + " is a hole or is inherited; every entry must be its own");
+    if (!intrinsic.hasOwn(d, "value")) throw E("path/bad-input", who + ": trustAnchors entry " + i + " must be a data property, not an accessor");
+    intrinsic.push(out, d.value);
+  }
+  return out;
+}
+function _precaptureAnchorNameConstraints(list, who) {
+  var out = [];
+  for (var i = 0; i < list.length; i++) {
+    var entry = list[i];
+    var captured;
+    if (entry && typeof entry === "object" && !intrinsic.isBuffer(entry) && !guard.parsed.isRecorded(entry) && !intrinsic.types.isProxy(entry)) {
+      var raw = _captureConstraintMap(entry, "nameConstraints", E, "path/bad-input", who);
+      captured = raw == null ? undefined : _copyAnchorNameConstraints(raw, who);
+    }
+    intrinsic.push(out, captured);
+  }
+  return out;
+}
+function _copyAnchorNameConstraints(nc, who) {
+  if (nc === null || typeof nc !== "object" || intrinsic.isArray(nc)) {
+    throw E("path/bad-input", who + ": a trustAnchor nameConstraints must be a { permitted, excluded } object of { tag, base } subtree entries");
+  }
+  guard.identifier.assertPlainRecord(nc, E, "path/bad-input", who + ": a trustAnchor nameConstraints");
+  guard.identifier.assertKnownKeys(nc, { permitted: 1, excluded: 1 }, E, "path/bad-input",
+    who + ": a trustAnchor nameConstraints names its subtree lists `permitted` and `excluded`. The unknown key was: ");
+  var out = {};
+  for (var i = 0; i < _NC_LIST_KEYS.length; i++) {
+    var key = _NC_LIST_KEYS[i];
+    var d = intrinsic.getOwnPropertyDescriptor(nc, key);
+    if (d === undefined) {
+      if (key in nc) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " must be an own data property, not inherited");
+      continue;
+    }
+    if (!intrinsic.hasOwn(d, "value")) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " must be a data property, not an accessor");
+    var copiedList = _copyAnchorSubtreeList(d.value, key, who);
+    if (copiedList === undefined) continue;
+    /** @internal Validated while the anchor is normalized, so a malformed subtree is refused
+     * wherever the anchor sits in the list rather than only once that anchor is reached. */
+    var checkedList = checkedSubtreeSeeds(copiedList, "trustAnchors[].nameConstraints." + key);
+    intrinsic.defineProperty(out, key, { value: checkedList, enumerable: true, configurable: true, writable: true });
+  }
+  return out;
+}
+
 function _copyAtv(atv) {
   var out = {};
   var t = atv.type;
@@ -1939,7 +2207,7 @@ function _copyRdnsDeep(rdns) {
 function toAnchor(entry, verb) {
   var who = verb || "build";
   var isTuple = false, alg = null, pubRaw, nameRaw = null, pk = null, purposesSnap, distrustSnap;
-  var subjectDerRaw, labelRaw, mozRaw;
+  var subjectDerRaw, labelRaw, mozRaw, ncSnap;
   if (intrinsic.types.isProxy(entry)) {
     throw E("path/bad-input", who + ": a trustAnchor must not be a Proxy");
   }
@@ -1956,6 +2224,8 @@ function toAnchor(entry, verb) {
       purposesSnap = _normalizeConstraintField(pRaw, E, "path/bad-input", who);
       var dRaw = _captureConstraintMap(entry, "distrustAfter", E, "path/bad-input", who);
       distrustSnap = _normalizeConstraintField(dRaw, E, "path/bad-input", who);
+      var ncRaw = _captureConstraintMap(entry, "nameConstraints", E, "path/bad-input", who);
+      ncSnap = ncRaw == null ? undefined : _copyAnchorNameConstraints(ncRaw, who);
       subjectDerRaw = _captureOwnData(entry, "subjectDer");
       labelRaw = _captureOwnData(entry, "label");
       mozRaw = _captureOwnData(entry, "mozillaCaPolicy");
@@ -2023,6 +2293,7 @@ function toAnchor(entry, verb) {
     intrinsic.defineProperty(flat, "name", { value: nameOut, enumerable: true, configurable: true, writable: true });
     if (purposesSnap !== undefined) intrinsic.defineProperty(flat, "purposes", { value: purposesSnap, enumerable: true, configurable: true, writable: true });
     if (distrustSnap !== undefined) intrinsic.defineProperty(flat, "distrustAfter", { value: distrustSnap, enumerable: true, configurable: true, writable: true });
+    if (ncSnap !== undefined) intrinsic.defineProperty(flat, "nameConstraints", { value: ncSnap, enumerable: true, configurable: true, writable: true });
     if (subjectDerRaw !== undefined) intrinsic.defineProperty(flat, "subjectDer", { value: subjectDerRaw, enumerable: true, configurable: true, writable: true });
     if (labelRaw !== undefined) intrinsic.defineProperty(flat, "label", { value: labelRaw, enumerable: true, configurable: true, writable: true });
     if (mozRaw !== undefined) intrinsic.defineProperty(flat, "mozillaCaPolicy", { value: mozRaw, enumerable: true, configurable: true, writable: true });
@@ -2031,8 +2302,8 @@ function toAnchor(entry, verb) {
     intrinsic.defineProperty(flat, "parameters", { value: spkiAlg.parameters, enumerable: true, configurable: true, writable: true });
     return flat;
   }
-  if (entry && typeof entry === "object" && (("purposes" in entry) || ("distrustAfter" in entry))) {
-    throw E("path/bad-input", who + ": a trustAnchor certificate must not carry purposes / distrustAfter -- put per-purpose constraints on a { name, publicKey, algorithm, purposes, distrustAfter } tuple (or a pki.trust anchor), not on a parsed certificate");
+  if (entry && typeof entry === "object" && (("purposes" in entry) || ("distrustAfter" in entry) || ("nameConstraints" in entry))) {
+    throw E("path/bad-input", who + ": a trustAnchor certificate must not carry purposes / distrustAfter / nameConstraints -- put anchor constraints on a { name, publicKey, algorithm, purposes, distrustAfter, nameConstraints } tuple (or a pki.trust anchor), not on a parsed certificate");
   }
   var cert;
   try { cert = coerceCert(entry); }
@@ -2349,7 +2620,20 @@ async function build(leaf, opts) {
   for (var pdk = 0; pdk < pool.length; pdk++) intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
 
   if (!intrinsic.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
-  var anchors = opts.trustAnchors.map(function (a) { return toAnchor(a, "build"); });
+  /** @internal Captured before any anchor is normalized: an anchor field may be an accessor whose
+   * getter runs caller code, and every candidate is validated in its own pass after an await. */
+  var buildPermRaw = opts.initialPermittedSubtrees;
+  var buildExclRaw = opts.initialExcludedSubtrees;
+  var buildPermSeeds = checkedSubtreeSeeds(buildPermRaw, "initialPermittedSubtrees");
+  var buildExclSeeds = checkedSubtreeSeeds(buildExclRaw, "initialExcludedSubtrees");
+  var buildEntries = _ownAnchorEntries(opts.trustAnchors, "build");
+  var buildPreNc = _precaptureAnchorNameConstraints(buildEntries, "build");
+  var anchors = [];
+  for (var bai = 0; bai < buildEntries.length; bai++) {
+    var bAnchor = toAnchor(buildEntries[bai], "build");
+    if (buildPreNc[bai] !== undefined) intrinsic.defineProperty(bAnchor, "nameConstraints", { value: buildPreNc[bai], enumerable: true, configurable: true, writable: true });
+    intrinsic.push(anchors, bAnchor);
+  }
 
   guard.time.assertValid(opts.time, E, "path/bad-input", "build: opts.time (the validity-window check date, forwarded to validate)");
   var effectiveMaxCerts = guard.limits.cap(opts.maxPathCerts, "build: opts.maxPathCerts", constants.LIMITS.PATH_MAX_CERTS, { E: E, code: "path/bad-input", min: 1 });
@@ -2396,6 +2680,8 @@ async function build(leaf, opts) {
     if (intrinsic.hasOwn(BUILD_ONLY_OPT, k)) return;
     if (k in opts) forwarded[k] = opts[k];
   });
+  if (buildPermRaw != null) forwarded.initialPermittedSubtrees = buildPermSeeds;
+  if (buildExclRaw != null) forwarded.initialExcludedSubtrees = buildExclSeeds;
   function validateOpts(anchor) {
     var vo = Object.create(null);
     Object.keys(forwarded).forEach(function (f) { vo[f] = forwarded[f]; });

package/lib/smime.js

@@ -630,7 +630,7 @@ async function verify(message, opts) {
     var inner;
     try { inner = _toBuf(schemaCms.parse(p7m).encapContentInfo.eContent); }
     catch (e) { throw _err("smime/bad-mime", "the pkcs7-mime SignedData has no encapsulated content", e); }
-    return Object.assign({ valid: res.valid, trusted: res.trusted, signers: res.signers, form: "pkcs7-mime", content: inner, micalg: null, sender: _senderSurface(res.signers, ent, opts.expectedSender) }, _hpSurface(inner, ent, "clear", res.valid, opts.legacyHeaderProtection === true));
+    return guard.verdict.of({ valid: res.valid, trusted: res.trusted, signers: res.signers, form: "pkcs7-mime", content: inner, micalg: null, sender: _senderSurface(res.signers, ent, opts.expectedSender) }, _hpSurface(inner, ent, "clear", res.valid, opts.legacyHeaderProtection === true));
   }
   if (ct.type === "multipart/signed") {
     if (ct.params.protocol && !_isPkcs7(ct.params.protocol, "signature")) throw _err("smime/bad-multipart", "multipart/signed protocol must be application/pkcs7-signature");
@@ -651,7 +651,7 @@ async function verify(message, opts) {
     if (opts.strictMicalg && micalg && _micalgSet(micalg) !== (_micalgOf(p7s) || "")) {
       throw _err("smime/micalg-mismatch", "the multipart/signed micalg " + JSON.stringify(micalg) + " disagrees with the SignerInfo digests");
     }
-    return Object.assign({ valid: res2.valid, trusted: res2.trusted, signers: res2.signers, form: "multipart/signed", content: parts[0], micalg: micalg, sender: _senderSurface(res2.signers, ent, opts.expectedSender) }, _hpSurface(parts[0], ent, "clear", res2.valid, opts.legacyHeaderProtection === true));
+    return guard.verdict.of({ valid: res2.valid, trusted: res2.trusted, signers: res2.signers, form: "multipart/signed", content: parts[0], micalg: micalg, sender: _senderSurface(res2.signers, ent, opts.expectedSender) }, _hpSurface(parts[0], ent, "clear", res2.valid, opts.legacyHeaderProtection === true));
   }
   throw _err("smime/unsupported-type", "not a signed S/MIME message (Content-Type " + JSON.stringify(ct.type) + ")");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.37",
+  "version": "0.6.39",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:82faf919-c224-4430-992b-dd3055e65ed3",
+  "serialNumber": "urn:uuid:b1c86284-d109-4852-8e85-dc5992b74178",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-05T03:43:35.188Z",
+    "timestamp": "2026-09-05T11:25:26.514Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.37",
+      "bom-ref": "@blamejs/pki@0.6.39",
       "type": "application",
       "name": "pki",
-      "version": "0.6.37",
+      "version": "0.6.39",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.37",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.39",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.37",
+      "ref": "@blamejs/pki@0.6.39",
       "dependsOn": []
     }
   ]