@blamejs/pki 0.6.40 → 0.6.42

package/lib/shbs.js

@@ -48,8 +48,8 @@ function _deriveWinternitz(n, w) {
   return { p: u + v, ls: 16 - v * w };
 }
 
-var LMS_SETS = {};
-var LMOTS_SETS = {};
+var LMS_SETS = Object.create(null);
+var LMOTS_SETS = Object.create(null);
 (function seed() {
   var heights = [5, 10, 15, 20, 25];
   var ws = [1, 2, 4, 8];

package/lib/sign-scheme.js

@@ -26,26 +26,26 @@ var _isU8 = intrinsic.types.isUint8Array;
 
 var HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" });
-var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
-var ECDSA_ALG = { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" };
-var RSA_PKCS1_SIG = { sha256: "sha256WithRSAEncryption", sha384: "sha384WithRSAEncryption", sha512: "sha512WithRSAEncryption" };
-var HASH_NAME_BY_OID = {};
+var PSS_SALT = intrinsic.assign(intrinsic.create(null), { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 });
+var ECDSA_ALG = intrinsic.assign(intrinsic.create(null), { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" });
+var RSA_PKCS1_SIG = intrinsic.assign(intrinsic.create(null), { sha256: "sha256WithRSAEncryption", sha384: "sha384WithRSAEncryption", sha512: "sha512WithRSAEncryption" });
+var HASH_NAME_BY_OID = intrinsic.create(null);
 HASH_NAME_BY_OID[O("sha256")] = "sha256";
 HASH_NAME_BY_OID[O("sha384")] = "sha384";
 HASH_NAME_BY_OID[O("sha512")] = "sha512";
-var EC_BY_CURVE_OID = {};
+var EC_BY_CURVE_OID = intrinsic.create(null);
 EC_BY_CURVE_OID[O("prime256v1")] = { curve: "P-256", coordLen: 32 };
 EC_BY_CURVE_OID[O("secp384r1")] = { curve: "P-384", coordLen: 48 };
 EC_BY_CURVE_OID[O("secp521r1")] = { curve: "P-521", coordLen: 66 };
-var MLDSA_BY_OID = {};
+var MLDSA_BY_OID = intrinsic.create(null);
 MLDSA_BY_OID[O("id-ml-dsa-44")] = "ML-DSA-44";
 MLDSA_BY_OID[O("id-ml-dsa-65")] = "ML-DSA-65";
 MLDSA_BY_OID[O("id-ml-dsa-87")] = "ML-DSA-87";
-var MLDSA_SUITABLE_DIGEST = {
+var MLDSA_SUITABLE_DIGEST = intrinsic.assign(intrinsic.create(null), {
   "ML-DSA-44": { sha256: 1, sha384: 1, sha512: 1, shake256: 1 },
   "ML-DSA-65": { sha384: 1, sha512: 1, shake256: 1 },
   "ML-DSA-87": { sha512: 1, shake256: 1 },
-};
+});
 // @enforced-by behavioral -- an own-property table read has no rename-proof shape distinct from a legitimate lookup, so a RED conformance vector is the guard
 function mldsaDigestSuitable(mlName, md) {
   if (!intrinsic.hasOwn(MLDSA_SUITABLE_DIGEST, mlName)) return false;
@@ -53,7 +53,7 @@ function mldsaDigestSuitable(mlName, md) {
   return !!row && intrinsic.hasOwn(row, md) && !!row[md];
 }
 
-var SLHDSA_BY_OID = {};
+var SLHDSA_BY_OID = intrinsic.create(null);
 [["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
  ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
  ["shake-192s", "shake256"], ["shake-192f", "shake256"], ["shake-256s", "shake256"], ["shake-256f", "shake256"]

package/lib/sigstore.js

@@ -70,14 +70,14 @@ function _stripTrailingEquals(s) {
   return s.slice(0, i);
 }
 
-var _BUNDLE_MEDIA_TYPES = {
+var _BUNDLE_MEDIA_TYPES = Object.assign(Object.create(null), {
   "application/vnd.dev.sigstore.bundle.v0.1+json": 1,
   "application/vnd.dev.sigstore.bundle.v0.2+json": 1,
   "application/vnd.dev.sigstore.bundle.v0.3+json": 1,
   "application/vnd.dev.sigstore.bundle+json;version=0.1": 1,
   "application/vnd.dev.sigstore.bundle+json;version=0.2": 1,
   "application/vnd.dev.sigstore.bundle+json;version=0.3": 1
-};
+});
 function _isBundleMediaType(mt) {
   return typeof mt === "string" && Object.prototype.hasOwnProperty.call(_BUNDLE_MEDIA_TYPES, mt);
 }
@@ -363,7 +363,7 @@ function _pathToAnchor(leaf, anchor, intBySubject) {
   /** @internal Issuers are collected leaf-first and the path is assembled once, so no element is
    * ever moved to a new index: an indexed setter has nothing to intercept and cannot replace the
    * leaf the preceding signature checks authenticated. */
-  var above = [], cur = leaf, seen = {}, guardN = 0;
+  var above = [], cur = leaf, seen = Object.create(null), guardN = 0;
   function assemble() {
     var path = [];
     for (var k = above.length - 1; k >= 0; k--) guard.list.append(path, above[k]);
@@ -390,7 +390,7 @@ function _pathToAnchor(leaf, anchor, intBySubject) {
 async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
   var roots = _normRoots(fulcioRoots);
   var bundleLinks = chainDers.slice(1).map(function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
-  var intBySubject = {};
+  var intBySubject = Object.create(null);
   function addInt(c) { guard.list.append(intBySubject[_dn(c, "subject")] = intBySubject[_dn(c, "subject")] || [], c); }
   roots.forEach(function (r) { addInt(r.cert); });
   bundleLinks.forEach(addInt);
@@ -421,7 +421,7 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
 var SAN_OID = oid.byName("subjectAltName");
 var FULCIO_PREFIX = oid.byName("otherName").split(".").slice(0, -1).join(".") + ".";
 function _identity(leaf) {
-  var out = { san: null, extensions: {} };
+  var out = { san: null, extensions: Object.create(null) };
   try {
     (leaf.extensions || []).forEach(function (ext) {
       if (ext.oid === SAN_OID) { out.san = _sanValue(ext); return; }
@@ -435,7 +435,7 @@ function _identity(leaf) {
   }
   return out;
 }
-var GN_TYPE = { 1: "rfc822Name", 2: "dNSName", 6: "uri" };
+var GN_TYPE = Object.assign(Object.create(null), { 1: "rfc822Name", 2: "dNSName", 6: "uri" });
 function _sanValue(ext) {
   var seq = asn1.decode(ext.value);
   var names = [];
@@ -467,10 +467,11 @@ function _fulcioExtValue(ext, leafArc) {
 }
 
 var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
-var IDENTITY_KEYS = { san: 1, issuer: 1, sourceRepositoryURI: 1 };
-var _VERIFY_BUNDLE_OPTS = { fulcioRoots: 1, rekorKeys: 1, identity: 1, predicateType: 1, time: 1 };
+var IDENTITY_KEYS = Object.assign(Object.create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
+var _VERIFY_BUNDLE_OPTS = Object.assign(Object.create(null), { fulcioRoots: 1, rekorKeys: 1, identity: 1, predicateType: 1, time: 1 });
 
 function _checkIdentity(id, policy) {
+  // allow:registry-table-inherits-object-prototype -- the identityChecked record an operator reads by field name, whose three keys are the fixed IDENTITY_FIELDS rather than anything the bundle supplies
   var ran = { san: false, issuer: false, sourceRepositoryURI: false };
   if (policy === undefined || policy === null) return ran;
   if (typeof policy !== "object" || Array.isArray(policy)) {

package/lib/smime.js

@@ -48,21 +48,21 @@ var SmimeError = frameworkError.SmimeError;
 
 function _err(code, msg, cause) { return new SmimeError(code, msg, cause); }
 
-var SIGN_OPTS = {
+var SIGN_OPTS = Object.assign(Object.create(null), {
   form: 1, entity: 1, contentType: 1, signingTime: 1, protectHeaders: 1, headers: 1, hcp: 1,
   sid: 1, signedAttributes: 1, additionalSignedAttributes: 1,
-};
-var VERIFY_OPTS = {
+});
+var VERIFY_OPTS = Object.assign(Object.create(null), {
   certs: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1, strictMicalg: 1,
   legacyHeaderProtection: 1, expectedSender: 1,
-};
-var ENCRYPT_OPTS = {
+});
+var ENCRYPT_OPTS = Object.assign(Object.create(null), {
   entity: 1, contentType: 1, protectHeaders: 1, headers: 1, hcp: 1,
   contentEncryptionAlgorithm: 1, oaepHash: 1, keyIdentifier: 1, ukm: 1,
-};
-var DECRYPT_OPTS = { recipientIndex: 1, maxIterations: 1, strictSmimeType: 1, legacyHeaderProtection: 1 };
-var COMPRESS_OPTS = { entity: 1, contentType: 1, level: 1 };
-var DECOMPRESS_OPTS = { maxOutputBytes: 1 };
+});
+var DECRYPT_OPTS = Object.assign(Object.create(null), { recipientIndex: 1, maxIterations: 1, strictSmimeType: 1, legacyHeaderProtection: 1 });
+var COMPRESS_OPTS = Object.assign(Object.create(null), { entity: 1, contentType: 1, level: 1 });
+var DECOMPRESS_OPTS = Object.assign(Object.create(null), { maxOutputBytes: 1 });
 
 function _knownOpts(opts, known, verb) {
   guard.identifier.assertKnownKeys(opts, known, _err, "smime/bad-input", function (k) {
@@ -76,7 +76,7 @@ function _isPkcs7(type, kind) {
   return t === "application/pkcs7-" + kind || t === "application/x-pkcs7-" + kind;
 }
 
-var MICALG = { sha1: "sha-1", sha224: "sha-224", sha256: "sha-256", sha384: "sha-384", sha512: "sha-512", md5: "md5", shake128: "shake128", shake256: "shake256" };
+var MICALG = Object.assign(Object.create(null), { sha1: "sha-1", sha224: "sha-224", sha256: "sha-256", sha384: "sha-384", sha512: "sha-512", md5: "md5", shake128: "shake128", shake256: "shake256" });
 
 function _entityBytes(content, opts) {
   var raw = guard.bytes.view(content, SmimeError, "smime/bad-input", "content");
@@ -320,7 +320,7 @@ var SMTP_UTF8_MAILBOX = oid.byName("smtpUtf8Mailbox");
 var EMAIL_ADDRESS_ATTR = oid.byName("emailAddress");
 var _extNs = pkix.makeNS("smime", SmimeError, oid);
 var _extDecoders = pkix.certExtensionDecoders(_extNs);
-var _extCtx = { E: function (c, m, cause) { return new SmimeError(c, m, cause); }, oid: oid };
+var _extCtx = Object.assign(Object.create(null), { E: function (c, m, cause) { return new SmimeError(c, m, cause); }, oid: oid });
 function _signerEmails(certDer) {
   var out = { addresses: [], unreadable: 0 };
   var parsed = null;
@@ -875,7 +875,7 @@ function _decodeCms(ent) {
 
 function _toBuf(v) { return Buffer.isBuffer(v) ? v : Buffer.from(v); }
 
-var CERTS_ONLY_OPTS = { crls: 1 };
+var CERTS_ONLY_OPTS = Object.assign(Object.create(null), { crls: 1 });
 
 /**
  * @primitive  pki.smime.buildCertsOnly

package/lib/tls-cert-compress.js

@@ -62,17 +62,17 @@ var zlib = require("zlib");
 var TlsError = frameworkError.TlsError;
 function _err(code, message, cause) { return new TlsError(code, message, cause); }
 
-var ALG_BY_NUMBER = { 1: "zlib", 2: "brotli", 3: "zstd" };
-var ALG_BY_NAME = {};
+var ALG_BY_NUMBER = intrinsic.assign(intrinsic.create(null), { 1: "zlib", 2: "brotli", 3: "zstd" });
+var ALG_BY_NAME = intrinsic.create(null);
 Object.keys(ALG_BY_NUMBER).forEach(function (n) { ALG_BY_NAME[ALG_BY_NUMBER[n]] = Number(n); });
 
-var COMPRESS = { zlib: zlib.deflateSync, brotli: zlib.brotliCompressSync, zstd: zlib.zstdCompressSync };
+var COMPRESS = intrinsic.assign(intrinsic.create(null), { zlib: zlib.deflateSync, brotli: zlib.brotliCompressSync, zstd: zlib.zstdCompressSync });
 
-var LEVEL_OPT = {
+var LEVEL_OPT = intrinsic.assign(intrinsic.create(null), {
   zlib: function (n) { return { level: n }; },
   brotli: function (n) { var p = {}; p[zlib.constants.BROTLI_PARAM_QUALITY] = n; return { params: p }; },
   zstd: function (n) { var p = {}; p[zlib.constants.ZSTD_c_compressionLevel] = n; return { params: p }; },
-};
+});
 
 var SUPPORTED = guard.compress.algorithms().filter(function (n) {
   return _hasOwn(ALG_BY_NAME, n) && typeof COMPRESS[n] === "function";
@@ -81,7 +81,7 @@ var SUPPORTED = guard.compress.algorithms().filter(function (n) {
 var MIN_CERT_MSG_BYTES = validator.tls.MIN_CERT_MSG_BYTES;
 var MAX_VECTOR_24 = validator.tls.MAX_VECTOR_24;
 
-var FRAMING_CODES = { truncated: "tls/truncated", framing: "tls/bad-framing", trailing: "tls/trailing-data" };
+var FRAMING_CODES = intrinsic.assign(intrinsic.create(null), { truncated: "tls/truncated", framing: "tls/bad-framing", trailing: "tls/trailing-data" });
 
 var HEADER_BYTES = 8;
 

package/lib/trust.js

@@ -327,7 +327,7 @@ function _certEntry(obj) {
 function _trustEntry(obj) {
   var issuer = _requireOctal(obj, "CKA_ISSUER", "trust");
   var serial = _requireOctal(obj, "CKA_SERIAL_NUMBER", "trust");
-  var purposes = { serverAuth: false, emailProtection: false, codeSigning: false };
+  var purposes = intrinsic.assign(intrinsic.create(null), { serverAuth: false, emailProtection: false, codeSigning: false });
   PURPOSE_ATTRS.forEach(function (pair) {
     var a = obj.attrs[pair[0]];
     if (!a) return;
@@ -364,15 +364,15 @@ function _mkAnchor(cert, meta) {
 var _DERIVED_FROM = new WeakMap();
 
 function _copyPurposes(src) {
-  return {
+  return intrinsic.assign(intrinsic.create(null), {
     serverAuth: !!src && src.serverAuth === true,
     emailProtection: !!src && src.emailProtection === true,
     codeSigning: !!src && src.codeSigning === true,
-  };
+  });
 }
 
 function _copyDistrustAfter(src) {
-  var out = {};
+  var out = intrinsic.create(null);
   if (!src || typeof src !== "object") return out;
   Object.keys(src).forEach(function (k) {
     out[k] = guard.time.isDate(src[k]) ? new Date(guard.time.instantOf(src[k])) : src[k];
@@ -521,7 +521,7 @@ function parseCertdata(text) {
     anchors: _dedupAnchors(certs.map(function (c) {
       return _mkAnchor(c.cert, {
         distrustAfter: c.distrustAfter,
-        purposes: c.purposes || { serverAuth: false, emailProtection: false, codeSigning: false },
+        purposes: c.purposes || _copyPurposes(null),
         label: c.label,
         mozillaCaPolicy: c.mozillaCaPolicy,
       });
@@ -579,15 +579,15 @@ function _csvRows(text) {
   return rows;
 }
 
-var _TRUST_BIT_TOKENS = {
+var _TRUST_BIT_TOKENS = intrinsic.assign(intrinsic.create(null), {
   "websites": "serverAuth", "server authentication": "serverAuth",
   "email": "emailProtection", "secure email": "emailProtection",
   "code": "codeSigning", "code signing": "codeSigning",
   "client authentication": null, "document signing": null,
   "time stamping": null, "ocsp signing": null,
-};
+});
 function _trustBits(cell) {
-  var purposes = { serverAuth: false, emailProtection: false, codeSigning: false };
+  var purposes = intrinsic.assign(intrinsic.create(null), { serverAuth: false, emailProtection: false, codeSigning: false });
   String(cell).split(";").forEach(function (tok) {
     var t = tok.trim();
     if (t === "") return;
@@ -722,8 +722,39 @@ function parseCcadbCsv(text) {
  * store catches the wrong root before a single validation runs (the
  * authoritative gate stays inside `validate`).
  *
+ * `opts.nameConstraints` attaches the namespace a root program trusts a root
+ * for, when that is narrower than the root certificate itself states. Such a
+ * restriction lives in the program's data rather than in any `nameConstraints`
+ * extension the certificate carries, so it has to be supplied here. It is a
+ * `{ permitted, excluded }` pair of `{ tag, base }` subtrees, the same shape
+ * `pki.path.validate` takes for `opts.initialPermittedSubtrees`, and validate
+ * seeds it as the RFC 5280 sec. 6.1.1(h)(i) initial value: it intersects with
+ * every certificate's own constraints, so a leaf must satisfy both, and an
+ * excluded subtree rejects whatever is permitted. The subtrees are copied out
+ * of the caller's object, so changing that object afterwards does not change
+ * the namespace an anchor already vouches for. An overlay naming no subtree,
+ * or one supplying its subtrees through an accessor, is refused rather than
+ * carried, since either would widen the namespace the operator meant to
+ * restrict. A verdict reports `anchorConstraints.nameConstraintsApplied`.
+ *
+ * A base is held to the form its tag names, and one outside that form is
+ * refused here rather than carried to a comparison that cannot reach a verdict
+ * on it. Tag 1 (`rfc822Name`) is a mailbox, a host name, or a host name written
+ * as a subtree with a leading dot, and a mailbox may name its domain as a
+ * bracketed address literal; tag 2 (`dNSName`) is a host name, with or
+ * without that leading dot; tag 6 (`uniformResourceIdentifier`) is the dotted
+ * host name a certificate's URI is compared by, not a URI; tag 4
+ * (`directoryName`) is `{ rdns }` naming at least one relative name, whose
+ * attribute types are dotted-decimal object identifiers and whose values are
+ * strings; tag 7 (`iPAddress`) is 8 bytes for IPv4 or 32 for IPv6, an address
+ * followed by its mask. A host name is labels of letters, digits and hyphens,
+ * with a hyphen at neither edge of a label, 63 characters to a label and 253 to
+ * the name, and it may carry the one trailing dot the comparison strips. Tags
+ * outside that set are refused.
+ *
  * @opts
  *   purpose: string   // "serverAuth" | "emailProtection" | "codeSigning"; fail-fast purpose check
+ *   nameConstraints: { permitted?: [{ tag, base }], excluded?: [{ tag, base }] }   // the root program's applied namespace; tags 1, 2, 4, 6, 7
  *
  * @example
  *   var ca = await pki.key.generate("Ed25519");
@@ -746,7 +777,138 @@ function parseCcadbCsv(text) {
  *   await pki.path.validate([pki.schema.x509.parse(der)],
  *     { time: new Date("2026-06-01T00:00:00Z"), trustAnchors: anchor, checkPurpose: "serverAuth" });
  */
-var _ANCHOR_OPTS = { purpose: 1 };
+var _ANCHOR_OPTS = intrinsic.assign(intrinsic.create(null), { purpose: 1, nameConstraints: 1 });
+
+/** @internal A subtree list copied entry by entry, reading `tag` and `base` from their own data
+ * properties. An accessor could answer with a narrow subtree while it is checked and a wide one
+ * when it is read again, and a dropped entry widens the namespace the anchor vouches for, so a
+ * list that does not describe itself in plain values is refused rather than partly copied. */
+function _copySubtrees(list, where) {
+  if (list === undefined || list === null) return [];
+  if (!intrinsic.isArray(list) || intrinsic.types.isProxy(list)) {
+    throw E("trust/bad-input", "anchor: nameConstraints." + where + " must be a plain array of { tag, base } subtree entries");
+  }
+  var out = [];
+  for (var i = 0; i < list.length; i++) {
+    var d = intrinsic.getOwnPropertyDescriptor(list, i);
+    if (!d || !_hasOwn(d, "value")) {
+      throw E("trust/bad-input", "anchor: nameConstraints." + where + " entry " + i + " must be a data property, not a hole or an accessor");
+    }
+    var st = d.value;
+    if (!st || typeof st !== "object" || intrinsic.types.isProxy(st)) {
+      throw E("trust/bad-input", "anchor: nameConstraints." + where + " entry " + i + " must be a { tag, base } object");
+    }
+    var tagD = intrinsic.getOwnPropertyDescriptor(st, "tag");
+    var baseD = intrinsic.getOwnPropertyDescriptor(st, "base");
+    if (!tagD || !_hasOwn(tagD, "value") || !baseD || !_hasOwn(baseD, "value")) {
+      throw E("trust/bad-input", "anchor: nameConstraints." + where + " entry " + i + " must carry its own tag and base as plain values");
+    }
+    var tag = tagD.value;
+    if (typeof tag !== "number" || !intrinsic.isInteger(tag) || tag < 0 || tag > 8) {
+      throw E("trust/bad-input", "anchor: nameConstraints." + where + " entry " + i + " tag must be a GeneralName tag number 0..8, got " + guard.text.showValue(tag));
+    }
+    _assertSubtreeBaseForm(tag, baseD.value, where, i);
+    /** @internal Appended through the list guard: a setter planted on the array prototype swallows
+     * a plain index assignment, and a subtree list that came back empty would restrict nothing. */
+    guard.list.append(out, { tag: tag, base: _copySubtreeBase(tag, baseD.value, where) });
+  }
+  return out;
+}
+
+/** @internal The base of one subtree, copied by its name form so the anchor holds no reference the
+ * caller can still reach. A byte base is snapshotted through the byte guard, which accepts every
+ * source `pki.path.validate` does rather than Buffers alone, so bytes changed afterwards do not
+ * change the namespace. A directoryName goes through the guard that owns distinguished-name
+ * capture, which refuses a Proxy or an accessor anywhere in the name instead of running it: reading
+ * such a name is caller code, and it could clear the restriction it is being asked to describe. */
+function _copySubtreeBase(tag, base, where) {
+  if (typeof base === "string") return base;
+  if (tag === 7) {
+    return guard.bytes.snapshotSource(base, TrustError, "trust/bad-input", "anchor: nameConstraints." + where + " iPAddress base");
+  }
+  var rdns = guard.name.capturedRdns(base, E, "trust/bad-input", "anchor: nameConstraints." + where + " directoryName base");
+  if (rdns === undefined) {
+    throw E("trust/bad-input", "anchor: nameConstraints." + where + " directoryName base must carry its own rdns array");
+  }
+  return { rdns: rdns };
+}
+
+var _NC_KEYS = intrinsic.assign(intrinsic.create(null), { permitted: 1, excluded: 1 });
+
+/** @internal One of the overlay's two subtree lists, taken from its own data property. A list the
+ * object only inherits is refused rather than read as absent: treating it as absent drops the
+ * restriction it carries, and dropping an exclusion admits the namespace it was written to keep
+ * out. An accessor is refused for the same reason, since it decides what it says while it is read. */
+function _subtreeListDescriptor(nc, key) {
+  var d = intrinsic.getOwnPropertyDescriptor(nc, key);
+  if (d === undefined) {
+    if (key in intrinsic.Object(nc)) {
+      throw E("trust/bad-input", "anchor: opts.nameConstraints." + key + " must be the object's own property, not one it inherits");
+    }
+    return undefined;
+  }
+  if (!_hasOwn(d, "value")) {
+    throw E("trust/bad-input", "anchor: opts.nameConstraints." + key + " must be a plain value, not an accessor");
+  }
+  return d;
+}
+
+/** @internal A subtree base held to the form its tag names, so a base that cannot describe a
+ * namespace is refused here rather than carried to the validator, and so no shape falls through to
+ * being returned by reference: a base the anchor still shares with the caller is one the caller can
+ * complete afterwards, which moves the namespace an anchor has already vouched for. */
+function _assertSubtreeBaseForm(tag, base, where, index) {
+  var who = "anchor: nameConstraints." + where + " entry " + index;
+  if (tag === 1 || tag === 2 || tag === 6) {
+    var why = guard.name.constraintBaseRefusal(tag, base);
+    if (why !== null) throw E("trust/bad-input", who + " base " + why);
+    return;
+  }
+  if (tag === 7) {
+    if (!guard.bytes.isByteSource(base)) throw E("trust/bad-input", who + " iPAddress base must be a byte source");
+    /** @internal An iPAddress subtree is an address followed by its mask, so 8 bytes for IPv4 and
+     * 32 for IPv6. Any other length names no range, and the validator refuses it later; refusing it
+     * here means the anchor an operator is handed is one that can be enforced. */
+    var ipLen = guard.bytes.lengthOf(guard.bytes.source(base, TrustError, "trust/bad-input", who + " iPAddress base"));
+    if (ipLen !== 8 && ipLen !== 32) {
+      throw E("trust/bad-input", who + " iPAddress base must be 8 bytes (IPv4 address and mask) or 32 (IPv6), got " + ipLen);
+    }
+    return;
+  }
+  if (tag === 4) {
+    if (base === null || typeof base !== "object") throw E("trust/bad-input", who + " directoryName base must be an object carrying rdns");
+    return;
+  }
+  throw E("trust/bad-input", who + " tag " + tag + " names a form this overlay cannot constrain; use tag 1, 2, 4, 6 or 7");
+}
+
+/** @internal The overlay a root program applies to a root outside any nameConstraints extension the
+ * certificate carries. It only ever narrows, so an absent one is the status quo and is left off the
+ * anchor entirely; a malformed one is refused, since carrying it wrongly would widen a namespace the
+ * operator meant to restrict. The subtrees are held to their shapes again by `pki.path.validate`,
+ * which is where the RFC 5280 sec. 6.1.1(h)(i) seeding happens. */
+function _copyNameConstraints(nc) {
+  if (nc === undefined || nc === null) return null;
+  if (typeof nc !== "object" || intrinsic.isArray(nc) || intrinsic.types.isProxy(nc)) {
+    throw E("trust/bad-input", "anchor: opts.nameConstraints must be a { permitted, excluded } object of { tag, base } subtree entries");
+  }
+  /** @internal Runs before the membership tests below, which is what makes them safe to ask: this
+   * refuses an overlay inheriting from a Proxy, whose has trap would otherwise answer `in` with
+   * caller code while the lists are being read. It also names a misspelled field, which would
+   * otherwise be read as an absent list, and an absent excluded list admits the namespace the
+   * operator wrote it to keep out. */
+  guard.identifier.assertKnownKeys(nc, _NC_KEYS, E, "trust/bad-input", "anchor: opts.nameConstraints has an unknown field ");
+  var pD = _subtreeListDescriptor(nc, "permitted");
+  var eD = _subtreeListDescriptor(nc, "excluded");
+  var out = {
+    permitted: _copySubtrees(pD ? pD.value : null, "permitted"),
+    excluded: _copySubtrees(eD ? eD.value : null, "excluded"),
+  };
+  if (!out.permitted.length && !out.excluded.length) {
+    throw E("trust/bad-input", "anchor: opts.nameConstraints names no subtree; omit it rather than passing an empty restriction");
+  }
+  return out;
+}
 function anchor(entry, opts) {
   if (!entry || typeof entry !== "object") {
     throw E("trust/bad-input", "anchor expects a trust-store entry ({ name, publicKey, algorithm, ... })");
@@ -770,7 +932,8 @@ function anchor(entry, opts) {
   if (!derived && (entry.purposes != null || (entry.distrustAfter && Object.keys(entry.distrustAfter).length))) {
     throw E("trust/bad-input", "this entry carries a trust store's per-purpose metadata but is not the entry the store produced -- it has been rebuilt, and the metadata is a statement about the key the store read, not about whichever key the copy now names. Pass pki.trust.parseCertdata / parseCcadbCsv output unmodified");
   }
-  return {
+  var nameConstraints = _copyNameConstraints(opts.nameConstraints);
+  var out = {
     name: _copyName(meta.name),
     publicKey: Buffer.isBuffer(meta.publicKey) ? Buffer.from(meta.publicKey) : meta.publicKey,
     algorithm: meta.algorithm,
@@ -779,6 +942,12 @@ function anchor(entry, opts) {
     distrustAfter: _copyDistrustAfter(meta.distrustAfter),
     purposes: _copyPurposes(meta.purposes),
   };
+  /** @internal Set only when an overlay was supplied, so an anchor without one is the object this
+   * verb returned before the option existed, and defined rather than assigned: an accessor planted
+   * on Object.prototype under this name would otherwise take the assignment and leave the anchor
+   * carrying no restriction at all. */
+  if (nameConstraints) guard.verdict.set(out, "nameConstraints", nameConstraints);
+  return out;
 }
 
 module.exports = {

package/lib/tsp-sign.js

@@ -48,9 +48,9 @@ var _b = pkiBuild.makeBuilder({
 });
 
 var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512" });
-var HASH_LEN = { sha256: 32, sha384: 48, sha512: 64 };
+var HASH_LEN = intrinsic.assign(intrinsic.create(null), { sha256: 32, sha384: 48, sha512: 64 });
 
-var _REVOCATION_RANK = { "false": 0, "undetermined": 1, "waived": 2, "determined": 3 };
+var _REVOCATION_RANK = intrinsic.assign(intrinsic.create(null), { "false": 0, "undetermined": 1, "waived": 2, "determined": 3 });
 function _rankRevocation(v) {
   var r = _REVOCATION_RANK[String(v)];
   return r === undefined ? 0 : r;
@@ -132,12 +132,12 @@ function sign(messageImprint, tsa, opts) {
   ], _sign);
 }
 
-var _TSA_KEYS = { cert: 1, key: 1 };
-var _IMPRINT_KEYS = { hashAlgorithm: 1, hashedMessage: 1 };
-var _SIGN_OPTS = {
+var _TSA_KEYS = intrinsic.assign(intrinsic.create(null), { cert: 1, key: 1 });
+var _IMPRINT_KEYS = intrinsic.assign(intrinsic.create(null), { hashAlgorithm: 1, hashedMessage: 1 });
+var _SIGN_OPTS = intrinsic.assign(intrinsic.create(null), {
   policy: 1, serialNumber: 1, genTime: 1, nonce: 1, accuracy: 1, ordering: 1, sid: 1,
   digestAlgorithm: 1, certHashAlgorithm: 1, additionalSignedAttributes: 1, pss: 1, pem: 1,
-};
+});
 
 function _sign(messageImprint, tsa, opts) {
   opts = opts || {};
@@ -187,7 +187,7 @@ function _sign(messageImprint, tsa, opts) {
   });
 }
 
-var _ACCURACY_KEYS = { seconds: 1, millis: 1, micros: 1 };
+var _ACCURACY_KEYS = intrinsic.assign(intrinsic.create(null), { seconds: 1, millis: 1, micros: 1 });
 
 function _accuracy(a) {
   guard.identifier.assertKnownKeys(a, _ACCURACY_KEYS, _err, "tsp/bad-input", function (k) {
@@ -260,7 +260,7 @@ function _assertImprint(mi) {
  *   var sha256Digest = Buffer.from(await pki.webcrypto.subtle.digest("SHA-256", Buffer.from("hello")));
  *   var req = pki.tsp.request({ hashAlgorithm: "sha256", hashedMessage: sha256Digest }, { nonce: 0x0102030405060708n, certReq: true });
  */
-var _REQUEST_OPTS = { reqPolicy: 1, nonce: 1, certReq: 1, extensions: 1, pem: 1 };
+var _REQUEST_OPTS = intrinsic.assign(intrinsic.create(null), { reqPolicy: 1, nonce: 1, certReq: 1, extensions: 1, pem: 1 });
 
 function request(messageImprint, opts) {
   opts = opts || {};
@@ -282,7 +282,7 @@ function request(messageImprint, opts) {
   if (opts.certReq === true) guard.list.append(fields,b.boolean(true));
   if (opts.extensions != null) {
     if (!Array.isArray(opts.extensions) || !guard.list.allMatch(opts.extensions, function (e) { return guard.bytes.isByteSource(e); })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
-    var seenExt = {};
+    var seenExt = intrinsic.create(null);
     var encoded = opts.extensions.map(function (e, i) {
       var der = guard.bytes.source(e, TspError, "tsp/bad-input", "an extension");
       _b.assertValidExtension(der, i);
@@ -347,7 +347,7 @@ function parseRequest(input) { return schemaTsp.parseRequest(input); }
  *   var resp = pki.tsp.response(token, {});                                  // granted
  *   var rej  = pki.tsp.response(null, { status: 2, failInfo: ["badAlg"] });  // rejection
  */
-var _RESPONSE_OPTS = { status: 1, statusString: 1, failInfo: 1, pem: 1 };
+var _RESPONSE_OPTS = intrinsic.assign(intrinsic.create(null), { status: 1, statusString: 1, failInfo: 1, pem: 1 });
 
 function response(token, opts) {
   opts = opts || {};
@@ -585,7 +585,7 @@ function _buildTsaChains(leaf, pool) {
  *   res.valid;     // boolean; pass opts.trustAnchors to also chain the TSA cert to a root
  *   res.genTime;   // Date, read from the verified eContent
  */
-var _VERIFY_OPTS = { certs: 1, trustAnchors: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 };
+var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, trustAnchors: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 });
 
 function _anyCritical(extensions) {
   return guard.list.anyMatches(extensions, function (e) { return !!e && !!e.critical; });

package/lib/validator-attcert.js

@@ -25,7 +25,7 @@ function assertNotCa(cert, exts, E, code) {
 function packedCert(cert, exts, E, code) {
   requireV3(cert, E, code);
   assertNotCa(cert, exts, E, code);
-  var have = {};
+  var have = Object.create(null);
   (cert.subject.rdns || []).forEach(function (rdn) { rdn.forEach(function (a) { have[a.type] = a.value; }); });
   if (have[oid.byName("countryName")] == null || have[oid.byName("organizationName")] == null || have[oid.byName("commonName")] == null) {
     throw new E(code, "the packed attestation certificate subject MUST set C, O, OU, and CN (WebAuthn 8.2.1)");
@@ -46,7 +46,7 @@ function aikCert(cert, exts, E, code) {
   }
   var san = exts.decode(cert, "subjectAltName");
   var dirName = san && san.value && san.value.names && san.value.names.filter(function (n) { return n.tagNumber === 4; })[0];
-  var types = {};
+  var types = Object.create(null);
   if (dirName && dirName.value && dirName.value.rdns) {
     dirName.value.rdns.forEach(function (rdn) { rdn.forEach(function (a) { types[a.type] = true; }); });
   }

package/lib/validator-cose.js

@@ -9,20 +9,20 @@ var oid = require("./oid");
 var edwardsPoint = require("./edwards-point");
 var nodeCrypto = require("crypto");
 
-var EC2_CRV_LEN = { 1: 32, 2: 48, 3: 66 };
-var EC2_CRV_OID = { 1: "prime256v1", 2: "secp384r1", 3: "secp521r1" };
-var OKP_CRV = { 6: { oid: "Ed25519", len: 32 }, 7: { oid: "Ed448", len: 57 } };
+var EC2_CRV_LEN = Object.assign(Object.create(null), { 1: 32, 2: 48, 3: 66 });
+var EC2_CRV_OID = Object.assign(Object.create(null), { 1: "prime256v1", 2: "secp384r1", 3: "secp521r1" });
+var OKP_CRV = Object.assign(Object.create(null), { 6: { oid: "Ed25519", len: 32 }, 7: { oid: "Ed448", len: 57 } });
 var RSA_MIN_MODULUS_BITS = 2048;
 var RSA_MAX_EXPONENT_BYTES = 8;
 function _modulusBits(n) { return (n.length - 1) * 8 + (32 - Math.clz32(n[0])); }
 
-var ALG_PROFILE = {
+var ALG_PROFILE = Object.assign(Object.create(null), {
   "-7": { kty: 2, crv: 1 }, "-35": { kty: 2, crv: 2 }, "-36": { kty: 2, crv: 3 },
   "-9": { kty: 2, crv: 1 }, "-51": { kty: 2, crv: 2 }, "-52": { kty: 2, crv: 3 },
   "-8": { kty: 1, crv: 6 }, "-19": { kty: 1, crv: 6 }, "-53": { kty: 1, crv: 7 },
   "-257": { kty: 3 }, "-258": { kty: 3 }, "-259": { kty: 3 },
   "-37": { kty: 3 }, "-38": { kty: 3 }, "-39": { kty: 3 }, "-65535": { kty: 3 },
-};
+});
 
 // @enforced-by validator-shape-reinlined
 // @validator-shape kty\s*===\s*2n

package/lib/validator-sig.js

@@ -15,12 +15,12 @@ function rawToEcdsaDer(raw, coordLen) {
   return asn1.build.sequence([asn1.build.integer(r), asn1.build.integer(s)]);
 }
 
-var CURVE_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
-var CURVE_ORDER = {
+var CURVE_FIELD_BYTES = Object.assign(Object.create(null), { "P-256": 32, "P-384": 48, "P-521": 66 });
+var CURVE_ORDER = Object.assign(Object.create(null), {
   "P-256": BigInt("0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"),
   "P-384": BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"),
   "P-521": BigInt("0x01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409"),
-};
+});
 
 // @enforced-by behavioral -- a DER ECDSA-Sig-Value decode has no rename-proof code shape distinct
 function ecdsaDerToP1363(der, curve, E, code) {

package/lib/validator-tpm.js

@@ -8,9 +8,9 @@ var guard = require("./guard-all");
 
 var TPM_GENERATED_VALUE = 0xff544347;
 var TPM_ST_ATTEST_CERTIFY = 0x8017;
-var TPM_ALG = { RSA: 0x0001, SHA1: 0x0004, SHA256: 0x000b, SHA384: 0x000c, SHA512: 0x000d, NULL: 0x0010, ECC: 0x0023 };
-var TPM_ALG_HASH = {}; TPM_ALG_HASH[TPM_ALG.SHA1] = "sha1"; TPM_ALG_HASH[TPM_ALG.SHA256] = "sha256"; TPM_ALG_HASH[TPM_ALG.SHA384] = "sha384"; TPM_ALG_HASH[TPM_ALG.SHA512] = "sha512";
-var TPM_CURVE_TO_COSE = {}; TPM_CURVE_TO_COSE[0x0003] = 1; TPM_CURVE_TO_COSE[0x0004] = 2; TPM_CURVE_TO_COSE[0x0005] = 3;
+var TPM_ALG = Object.assign(Object.create(null), { RSA: 0x0001, SHA1: 0x0004, SHA256: 0x000b, SHA384: 0x000c, SHA512: 0x000d, NULL: 0x0010, ECC: 0x0023 });
+var TPM_ALG_HASH = Object.create(null); TPM_ALG_HASH[TPM_ALG.SHA1] = "sha1"; TPM_ALG_HASH[TPM_ALG.SHA256] = "sha256"; TPM_ALG_HASH[TPM_ALG.SHA384] = "sha384"; TPM_ALG_HASH[TPM_ALG.SHA512] = "sha512";
+var TPM_CURVE_TO_COSE = Object.create(null); TPM_CURVE_TO_COSE[0x0003] = 1; TPM_CURVE_TO_COSE[0x0004] = 2; TPM_CURVE_TO_COSE[0x0005] = 3;
 
 function _ucmp(a, b) {
   function strip(x) { var i = 0; while (i < x.length - 1 && x[i] === 0) i++; return x.subarray(i); }
@@ -32,6 +32,7 @@ var TPMA_OBJECT_RESERVED = 0xfff0f009;
 
 // @enforced-by behavioral -- a bit-position table lookup has no rename-proof code shape; the RED
 function _decodeAttributes(oa) {
+  // allow:registry-table-inherits-object-prototype -- the attributes record an operator reads as result.tpm.attributes by field name, whose keys are the fixed TPMA_OBJECT_BITS list rather than anything the attestation supplies
   var out = {};
   Object.keys(TPMA_OBJECT_BITS).forEach(function (n) { out[n] = ((oa >>> TPMA_OBJECT_BITS[n]) & 1) === 1; });
   return out;
@@ -112,7 +113,7 @@ function normalizeObjectAttributePolicy(policy, E, code) {
   if (policy === undefined) return null;
   if (!policy || typeof policy !== "object" || Array.isArray(policy)) throw new E(code, "opts.tpmPolicy must be an object");
   guard.identifier.assertKnownKeys(policy, _TPM_POLICY_KEYS, function (c, m) { return new E(c, m); }, code, "opts.tpmPolicy has an unknown key ");
-  var want = {};
+  var want = Object.create(null);
   if (policy.profile !== undefined) {
     var preset = TPM_POLICY_PROFILES[guard.text.keyOf(policy.profile)];
     if (!preset) throw new E(code, "opts.tpmPolicy.profile " + guard.text.showValue(policy.profile) + " is not a defined profile");