@blamejs/pki 0.8.11 → 0.8.14

package/lib/path-validate.js

@@ -622,39 +622,118 @@ function absorbNameConstraints(state, decoded) {
 }
 
 
-function rootNode() {
-  return { depth: 0, validPolicy: OID.anyPolicy, qualifierSet: [], expectedPolicySet: [OID.anyPolicy], children: [], parent: null };
-}
-function treeWithoutParent(node) {
-  if (!node) return null;
-  return {
-    depth: node.depth,
-    validPolicy: node.validPolicy,
-    qualifierSet: node.qualifierSet,
-    expectedPolicySet: node.expectedPolicySet,
-    children: node.children.map(treeWithoutParent),
-  };
-}
-function leavesAt(tree, depth) {
+/**
+ * @internal The RFC 9618 valid_policy_graph. RFC 5280 sec. 6.1.3 step (d)(1)(i) creates one child per
+ * matching parent, so a chain where several issuer policies map to one subject policy multiplies the
+ * structure at every level: measured on a conforming chain carrying four policies mapped to each
+ * other, the tree wants 5461 nodes at six certificates against this graph's 25, and the node cap
+ * refuses the path. RFC 9618 sec. 5.2 keeps at most ONE node per (depth, policy identifier) and
+ * gives it several parents instead, which holds the same information in linear size.
+ *
+ * `state.policyIndex[depth]` maps a policy identifier to the one node at that depth, so the "is there
+ * already a node here for this policy" question every step asks is a lookup rather than a walk.
+ */
+function graphRoot() {
+  return { depth: 0, validPolicy: OID.anyPolicy, qualifierSet: [], expectedPolicySet: [OID.anyPolicy], children: [], parents: [] };
+}
+function policyLayer(state, depth) {
+  var layer = state.policyIndex[depth];
+  if (layer === undefined) { layer = intrinsic.create(null); state.policyIndex[depth] = layer; }
+  return layer;
+}
+function nodeAt(state, depth, policyOid) {
+  var layer = state.policyIndex[depth];
+  if (layer === undefined || !intrinsic.hasOwn(layer, policyOid)) return null;
+  return layer[policyOid];
+}
+function nodesAt(state, depth) {
+  var layer = state.policyIndex[depth];
+  if (layer === undefined) return [];
   var out = [];
-  if (!tree) return out;
-  (function walk(node) {
-    if (node.depth === depth) { guard.list.append(out, node); return; }
-    node.children.forEach(walk);
-  })(tree);
+  intrinsic.forEach(intrinsic.keys(layer), function (k) { guard.list.append(out, layer[k]); });
   return out;
 }
-function pruneChildless(tree, depth) {
+/** @internal One node per (depth, policy). Meeting the same pair twice joins the parents onto the
+ *  node that is already there rather than making a second one, which is the invariant the wrap-up
+ *  procedure's single-parent test depends on. */
+function addPolicyNode(state, depth, validPolicy, qualifiers, expectedPolicySet, parents) {
+  if (parents.length === 0) return null;
+  var node = nodeAt(state, depth, validPolicy);
+  if (node === null) {
+    if (state.policyNodeCount >= state.maxPolicyNodes) { state._capHit = true; return null; }
+    node = { depth: depth, validPolicy: validPolicy, qualifierSet: qualifiers ? [qualifiers] : [],
+      expectedPolicySet: expectedPolicySet, children: [], parents: [] };
+    policyLayer(state, depth)[validPolicy] = node;
+    state.policyNodeCount++;
+  }
+  for (var i = 0; i < parents.length; i++) {
+    if (node.parents.indexOf(parents[i]) !== -1) continue;
+    guard.list.append(node.parents, parents[i]);
+    guard.list.append(parents[i].children, node);
+  }
+  return node;
+}
+function removePolicyNode(state, node) {
+  node.parents.forEach(function (p) {
+    var idx = p.children.indexOf(node);
+    if (idx !== -1) p.children.splice(idx, 1);
+  });
+  node.children.forEach(function (c) {
+    var idx = c.parents.indexOf(node);
+    if (idx !== -1) c.parents.splice(idx, 1);
+  });
+  node.parents = [];
+  var layer = state.policyIndex[node.depth];
+  if (layer !== undefined && layer[node.validPolicy] === node) delete layer[node.validPolicy];
+  state.policyNodeCount--;
+}
+/** @internal RFC 9618 sec. 5.3 step (d)(3): delete every node of depth `depth` or less that has no
+ *  children, and repeat, since deleting one can leave its own parents childless. Depth zero is the
+ *  root, which is never deleted: an empty graph is a root with no children, which the caller reads
+ *  as NULL. */
+function prunePolicyChildless(state, depth) {
   for (var d = depth; d > 0; d--) {
-    leavesAt(tree, d).forEach(function (node) {
-      if (node.children.length === 0 && node.parent) {
-        var idx = node.parent.children.indexOf(node);
-        if (idx !== -1) node.parent.children.splice(idx, 1);
-      }
+    nodesAt(state, d).forEach(function (node) {
+      if (node.children.length === 0) removePolicyNode(state, node);
+    });
+  }
+}
+function graphIsEmpty(state) { return state.validPolicyGraph.children.length === 0; }
+/**
+ * @internal The graph a caller reads, as a flat list of nodes linked by index. A graph is not a
+ * tree, and handing back a root to walk would invite the caller to recurse into every child and
+ * rebuild the exponential structure this replaced: `JSON.stringify` on such a value re-expands a
+ * shared node once per path that reaches it. A node list is linear however it is read, holds the
+ * parent relation the wrap-up procedure needs, and carries no cycle to serialize. The root is
+ * index 0.
+ */
+function graphSnapshot(root) {
+  if (!root) return null;
+  var originals = [];
+  var indexOfNode = new intrinsic.Map();
+  (function walk(node) {
+    if (intrinsic.mapHas(indexOfNode, node)) return;
+    intrinsic.mapSet(indexOfNode, node, originals.length);
+    guard.list.append(originals, node);
+    node.children.forEach(walk);
+  })(root);
+  function idsOf(list) {
+    var out = [];
+    for (var j = 0; j < list.length; j++) {
+      if (intrinsic.mapHas(indexOfNode, list[j])) guard.list.append(out, intrinsic.mapGet(indexOfNode, list[j]));
+    }
+    return out;
+  }
+  var nodes = [];
+  for (var i = 0; i < originals.length; i++) {
+    var o = originals[i];
+    guard.list.append(nodes, {
+      id: i, depth: o.depth, validPolicy: o.validPolicy, qualifierSet: o.qualifierSet,
+      expectedPolicySet: o.expectedPolicySet, parents: idsOf(o.parents), children: idsOf(o.children),
     });
   }
+  return { nodes: nodes };
 }
-function treeIsEmpty(tree) { return tree.children.length === 0; }
 
 
 function isSubtreeBaseValid(tag, base) {
@@ -725,24 +804,90 @@ function _anchorSubtreeSeeds(anchor) {
   };
 }
 
-function initialize(certs, params, seeds, anchor) {
+/**
+ * @internal An RFC 5914 trust anchor's `certPath` constraints, read off the anchor `pki.trust`
+ * produced. Absent on an anchor from any other source, so every reader below sees empty lists and
+ * nothing changes for a caller who does not use the format.
+ */
+function _anchorRfc5914Constraints(anchor) {
+  var empty = { permitted: [], excluded: [], policySet: null, policyFlags: null, pathLenConstraint: null };
+  var c = anchor === null || anchor === undefined ? undefined : anchor.constraints;
+  if (!c || typeof c !== "object") return empty;
+  var nc = c.nameConstraints;
+  return {
+    permitted: nc && intrinsic.isArray(nc.permitted) ? checkedSubtreeSeeds(nc.permitted, "trustAnchors[].constraints.nameConstraints.permitted") : [],
+    excluded: nc && intrinsic.isArray(nc.excluded) ? checkedSubtreeSeeds(nc.excluded, "trustAnchors[].constraints.nameConstraints.excluded") : [],
+    policySet: intrinsic.isArray(c.policySet) ? c.policySet : null,
+    policyFlags: c.policyFlags && typeof c.policyFlags === "object" ? c.policyFlags : null,
+    pathLenConstraint: intrinsic.isInteger(c.pathLenConstraint) ? c.pathLenConstraint : null,
+  };
+}
+
+/**
+ * @internal RFC 5937 sec. 3.2, the policy set. anyPolicy on either side means "any policy satisfies
+ * me", so intersecting with it leaves the other side's set untouched: filtering it literally would
+ * compare a concrete identifier against the wildcard identifier, find no match, and refuse a path
+ * both sides accept. Only where BOTH name concrete policies is the intersection a comparison, and
+ * an empty result there is a real answer rather than "unconstrained": the two name disjoint policy
+ * spaces, so no policy satisfies both.
+ */
+function _mergedPolicySet(callerSet, anchorSet) {
+  if (anchorSet === null) return callerSet;
+  var callerAny = callerSet === undefined || callerSet === null || contains(callerSet, OID.anyPolicy);
+  var anchorAny = contains(anchorSet, OID.anyPolicy);
+  if (anchorAny && callerAny) return [OID.anyPolicy];
+  if (anchorAny) return intrinsic.map(callerSet, function (p) { return p; });
+  if (callerAny) return intrinsic.map(anchorSet, function (p) { return p; });
+  return intrinsic.filter(anchorSet, function (p) { return contains(callerSet, p); });
+}
+
+/**
+ * @internal RFC 5937 sec. 3.2, the flags. Each is one-directional: a flag the anchor asserts turns
+ * the matching initial value on where it was off and never off where it was on, so an anchor can
+ * only narrow what a caller asked for. That is what makes RFC 5914's "always enforced" safe.
+ */
+function _flagSet(callerValue, anchorFlags, name) {
+  if (callerValue) return true;
+  return anchorFlags !== null && anchorFlags[name] === true;
+}
+
+function initialize(certs, params, seeds, anchor, ta) {
   var n = certs.length;
+  var state = _initialState(certs, params, seeds, anchor, n, ta);
+  /** @internal The root is the depth-zero anyPolicy node, and it is indexed like any other, so the
+   * "is there a node at this depth for this policy" lookup answers for depth zero too. */
+  policyLayer(state, 0)[OID.anyPolicy] = state.validPolicyGraph;
+  return state;
+}
+
+function _initialState(certs, params, seeds, anchor, n, ta) {
+  /** @internal The anchor's constraints are read HERE rather than merged into a copy of `params`,
+   * because a copy answers only for the own properties the copy loop enumerated. A caller option
+   * defined non-enumerably would be dropped by the copy and the anchor would then WIDEN the
+   * validation, which is the one thing sec. 3.2 does not allow. Reading the caller's object
+   * directly keeps every option live whatever its descriptor. */
+  var anchorPathLen = ta.pathLenConstraint;
   return {
-    validPolicyTree: rootNode(),
+    validPolicyGraph: graphRoot(),
+    policyIndex: [],
     policyNodeCount: 1,
     maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
     minRsaModulusBits: params.minRsaModulusBits !== undefined ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
     permittedGenerations: intrinsic.filter(seeds.permittedGenerations, function (g) { return g.length > 0; }),
     excludedSubtrees: seeds.excluded,
-    explicitPolicy: params.initialExplicitPolicy ? 0 : n + 1,
-    inhibitAnyPolicy: params.initialAnyPolicyInhibit ? 0 : n + 1,
-    policyMapping: params.initialPolicyMappingInhibit ? 0 : n + 1,
+    explicitPolicy: _flagSet(params.initialExplicitPolicy, ta.policyFlags, "requireExplicitPolicy") ? 0 : n + 1,
+    inhibitAnyPolicy: _flagSet(params.initialAnyPolicyInhibit, ta.policyFlags, "inhibitAnyPolicy") ? 0 : n + 1,
+    policyMapping: _flagSet(params.initialPolicyMappingInhibit, ta.policyFlags, "inhibitPolicyMapping") ? 0 : n + 1,
     workingPublicKeyAlgorithm: anchor.algorithm,
     workingPublicKey: anchor.publicKey,
     workingPublicKeyParameters: anchor.parameters || null,
     workingIssuerName: anchor.name,
-    maxPathLength: n,
-    userInitialPolicySet: params.userInitialPolicySet || [OID.anyPolicy],
+    /** @internal RFC 5937 sec. 3.2: "If a basic constraints extension is associated with the trust
+     * anchor and contains a pathLenConstraint value, set the max_path_length state variable equal
+     * to the pathLenConstraint value". Taken as the lower of the two, since sec. 6.1.2's own
+     * initial value is the path length and an anchor may only narrow. */
+    maxPathLength: intrinsic.isInteger(anchorPathLen) && anchorPathLen < n ? anchorPathLen : n,
+    userInitialPolicySet: _mergedPolicySet(params.userInitialPolicySet, ta.policySet) || [OID.anyPolicy],
     results: [],
   };
 }
@@ -757,55 +902,61 @@ function processPolicies(state, cert, i, checks) {
   try { cp = decodeExt(cert, OID.certificatePolicies); }
   catch (e) { guard.list.append(checks,{ name: "policies", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
 
-  if (cp && state.validPolicyTree) {
+  if (cp && state.validPolicyGraph) {
     var policies = cp.value;
-    var depth = i - 1;
+    var prev = i - 1;
     var anyPolicyActive = state.inhibitAnyPolicy > 0 || (i < state._n && selfIssued(cert));
     var anyPolicyPresent = false;
     var anyPolicyQualifiers = null;
+
+    /** @internal RFC 9618 sec. 5.3 step (d)(1): ONE node per policy, carrying every depth i-1 node
+     * that expected it. Creating one per parent instead is what made the structure exponential. */
     policies.forEach(function (p) {
       if (p.policyIdentifier === OID.anyPolicy) { anyPolicyPresent = true; anyPolicyQualifiers = p.qualifiersBytes; return; }
-      var matched = false;
-      leavesAt(state.validPolicyTree, depth).forEach(function (node) {
-        if (contains(node.expectedPolicySet, p.policyIdentifier)) {
-          addChild(state, node, p.policyIdentifier, p.qualifiersBytes, [p.policyIdentifier], checks);
-          matched = true;
-        }
+      var parents = intrinsic.filter(nodesAt(state, prev), function (node) {
+        return contains(node.expectedPolicySet, p.policyIdentifier);
       });
-      if (!matched) {
-        leavesAt(state.validPolicyTree, depth).forEach(function (node) {
-          if (node.validPolicy === OID.anyPolicy) addChild(state, node, p.policyIdentifier, p.qualifiersBytes, [p.policyIdentifier], checks);
-        });
+      if (parents.length === 0) {
+        /** @internal (d)(1)(ii): no node expected it, so it hangs off the anyPolicy node if there
+         * is one. That single anyPolicy parent is what step (g)(2) later reads. */
+        var anyPrev = nodeAt(state, prev, OID.anyPolicy);
+        if (anyPrev === null) return;
+        parents = [anyPrev];
       }
+      addPolicyNode(state, i, p.policyIdentifier, p.qualifiersBytes, [p.policyIdentifier], parents);
     });
+
+    /** @internal (d)(2): for each policy some depth i-1 node expects, if depth i has no node for it
+     * yet, one node carrying every parent that expected it. */
     if (anyPolicyPresent && anyPolicyActive) {
-      leavesAt(state.validPolicyTree, depth).forEach(function (node) {
+      var expected = [];
+      nodesAt(state, prev).forEach(function (node) {
         node.expectedPolicySet.forEach(function (ep) {
-          var already = guard.list.anyMatches(node.children, function (ch) { return ch.validPolicy === ep; });
-          if (!already) addChild(state, node, ep, anyPolicyQualifiers, [ep], checks);
+          if (expected.indexOf(ep) === -1) guard.list.append(expected, ep);
         });
       });
+      expected.forEach(function (ep) {
+        if (nodeAt(state, i, ep) !== null) return;
+        var parents = intrinsic.filter(nodesAt(state, prev), function (node) {
+          return contains(node.expectedPolicySet, ep);
+        });
+        addPolicyNode(state, i, ep, anyPolicyQualifiers, [ep], parents);
+      });
     }
-    if (state._capHit) return { fatal: true, error: E("path/policy-tree-cap", "policy tree exceeded the node cap") };
-    pruneChildless(state.validPolicyTree, depth);
-    if (treeIsEmpty(state.validPolicyTree)) state.validPolicyTree = null;
+
+    if (state._capHit) return { fatal: true, error: E("path/policy-tree-cap", "policy graph exceeded the node cap") };
+    prunePolicyChildless(state, prev);
+    if (graphIsEmpty(state)) state.validPolicyGraph = null;
   } else if (!cp) {
-    state.validPolicyTree = null;
+    state.validPolicyGraph = null;
   }
 
-  if (!(state.explicitPolicy > 0 || state.validPolicyTree !== null)) {
+  if (!(state.explicitPolicy > 0 || state.validPolicyGraph !== null)) {
     guard.list.append(checks,{ name: "policy", ok: false, code: "path/policy-required" });
-    return { fatal: true, error: E("path/policy-required", "explicit policy required but the valid-policy tree is empty") };
+    return { fatal: true, error: E("path/policy-required", "explicit policy required but the valid-policy graph is empty") };
   }
-  return { fatal: false };
-}
-
-function addChild(state, parent, validPolicy, qualifiers, expectedPolicySet, checks) {
-  if (state.policyNodeCount >= state.maxPolicyNodes) { state._capHit = true; return; }
-  var node = { depth: parent.depth + 1, validPolicy: validPolicy, qualifierSet: qualifiers ? [qualifiers] : [], expectedPolicySet: expectedPolicySet, children: [], parent: parent };
-  guard.list.append(parent.children, node);
-  state.policyNodeCount++;
   void checks;
+  return { fatal: false };
 }
 
 function isNullOrAbsentParams(p) {
@@ -859,7 +1010,7 @@ function prepareNext(state, cert, i, checks) {
   if (pm) {
     var badAny = mapsAnyPolicy(pm.value);
     if (badAny) { guard.list.append(checks,{ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: E("path/bad-policy", "policyMappings must not map to or from anyPolicy (RFC 5280 6.1.4(a))") }; }
-    if (state.validPolicyTree) applyPolicyMappings(state, pm.value, i);
+    if (state.validPolicyGraph) applyPolicyMappings(state, pm.value, i);
   }
 
   state.workingIssuerName = cert.subject;
@@ -919,36 +1070,49 @@ function prepareNext(state, cert, i, checks) {
   return { fatal: false };
 }
 
+/** @internal RFC 9618 sec. 5.4 rewrites RFC 5280 sec. 6.1.4 step (b) over the graph. Each clause is
+ *  singular where the tree's was plural, because at most one node at a depth carries a given policy.
+ *
+ * A mapping naming anyPolicy on either side is skipped here as well as refused by the caller
+ * (sec. 6.1.4(a)), because mapping one in would rewrite the anyPolicy node's expected policy set and
+ * the graph's invariant is that it is always {anyPolicy}. The caller refusing it keeps that from
+ * happening today; skipping it here is what keeps it true of this function. */
 function applyPolicyMappings(state, mappings, i) {
-  var depth = i;
   if (state.policyMapping > 0) {
     var mappedFrom = intrinsic.create(null);
-    mappings.forEach(function (m) { guard.list.append(mappedFrom[m.issuerDomainPolicy] = mappedFrom[m.issuerDomainPolicy] || [], m.subjectDomainPolicy); });
-    var depthI = leavesAt(state.validPolicyTree, depth);
-    var anyNodes = depthI.filter(function (nd) { return nd.validPolicy === OID.anyPolicy; });
-    Object.keys(mappedFrom).forEach(function (idp) {
-      var idpNodes = depthI.filter(function (nd) { return nd.validPolicy === idp; });
-      if (idpNodes.length) {
-        idpNodes.forEach(function (nd) { nd.expectedPolicySet = mappedFrom[idp].slice(); });
-      } else {
-        anyNodes.forEach(function (anyNode) {
-          if (anyNode.parent) addChild(state, anyNode.parent, idp, anyNode.qualifierSet[0] || null, mappedFrom[idp].slice(), []);
-        });
-      }
+    mappings.forEach(function (m) {
+      if (m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy) return;
+      guard.list.append(mappedFrom[m.issuerDomainPolicy] = mappedFrom[m.issuerDomainPolicy] || [], m.subjectDomainPolicy);
     });
-  } else {
-    var mappedSet = intrinsic.create(null);
-    mappings.forEach(function (m) { mappedSet[m.issuerDomainPolicy] = true; });
-    if (!state.validPolicyTree) return;
-    leavesAt(state.validPolicyTree, depth).forEach(function (node) {
-      if (mappedSet[node.validPolicy] && node.parent) {
-        var idx = node.parent.children.indexOf(node);
-        if (idx !== -1) node.parent.children.splice(idx, 1);
+    intrinsic.forEach(intrinsic.keys(mappedFrom), function (idp) {
+      var node = nodeAt(state, i, idp);
+      if (node !== null) {
+        /** @internal (b)(1) */
+        node.expectedPolicySet = mappedFrom[idp].slice();
+        return;
       }
+      /** @internal (b)(2): no node for the issuer domain policy, so one is generated under the
+       * anyPolicy node at depth i-1, taking the depth-i anyPolicy node's qualifiers. */
+      var anyHere = nodeAt(state, i, OID.anyPolicy);
+      if (anyHere === null) return;
+      var anyPrev = nodeAt(state, i - 1, OID.anyPolicy);
+      if (anyPrev === null) return;
+      addPolicyNode(state, i, idp, anyHere.qualifierSet[0] || null, mappedFrom[idp].slice(), [anyPrev]);
     });
-    pruneChildless(state.validPolicyTree, depth - 1);
-    if (treeIsEmpty(state.validPolicyTree)) state.validPolicyTree = null;
-  }
+    return;
+  }
+  /** @internal (b)(3): mapping is inhibited, so the node for each issuer domain policy is deleted
+   * and every ancestor it leaves childless goes with it. */
+  if (!state.validPolicyGraph) return;
+  var deleted = false;
+  mappings.forEach(function (m) {
+    if (m.issuerDomainPolicy === OID.anyPolicy) return;
+    var node = nodeAt(state, i, m.issuerDomainPolicy);
+    if (node !== null) { removePolicyNode(state, node); deleted = true; }
+  });
+  if (!deleted) return;
+  prunePolicyChildless(state, i - 1);
+  if (graphIsEmpty(state)) state.validPolicyGraph = null;
 }
 
 var TARGET_UNPROCESSED_IF_CRITICAL = intrinsic.create(null);
@@ -1028,11 +1192,20 @@ function _revocationRow(row, rv) {
  * are validated at the entry point. A mis-shaped value throws `path/bad-input`,
  * so it cannot silently go unapplied. Returns `{ valid, revocationChecked, anchorConstraints,
  * path, results, workingPublicKey, workingPublicKeyAlgorithm,
- * workingPublicKeyParameters, validPolicyTree, userConstrainedPolicySet }` where `results[i].checks`
+ * workingPublicKeyParameters, validPolicyGraph, userConstrainedPolicySet }` where `results[i].checks`
  * carries a per-check reason code (`path/*`) for every step. Pure and
  * re-entrant: no input object is mutated. An empty path or a missing anchor
  * throws a typed `PathError`.
  *
+ * Certificate policies are processed as the RFC 9618 `valid_policy_graph`, which replaces the
+ * RFC 5280 sec. 6.1 `valid_policy_tree`. `validPolicyGraph` is a directed acyclic graph holding at
+ * most one node per depth and policy identifier; a node reached from several policies carries them
+ * all in `parents`, where the tree held a separate node under each. The graph is linear in the
+ * number of policies and mappings on the path, so a chain whose tree would not fit inside
+ * `maxPolicyNodes` validates. It is `{ nodes }`, a flat list linked by index, each entry
+ * `{ id, depth, validPolicy, qualifierSet, expectedPolicySet, parents, children }` where `parents`
+ * and `children` hold the ids of other entries and the root is id 0.
+ *
  * A certificate signed with the RFC 9802 stateful hash-based algorithm
  * `id-alg-hss-lms-hashsig` is verified like any other, through the toolkit's own
  * HSS engine rather than the crypto engine. The signature covers the whole
@@ -1240,16 +1413,22 @@ async function _validate(path, opts, run) {
   guard.limits.cap(opts.maxPolicyNodes, "validate: opts.maxPolicyNodes", undefined, { E: E, code: "path/bad-input", min: 1 });
   _assertUserInitialPolicySet(opts.userInitialPolicySet, "validate");
   var anchorNc = _anchorSubtreeSeeds(anchor);
+  /** @internal RFC 5937 sec. 3.2 says how an RFC 5914 anchor's own constraints reach this
+   * algorithm, and the rule is uniform: the stricter of the anchor's value and the caller's wins.
+   * Its name constraints are a SEPARATE generation from the caller's and from the `nameConstraints`
+   * overlay, because generations intersect and a replacement would let one loosen the other. */
+  var taConstraints = _anchorRfc5914Constraints(anchor);
   var seeds = {
-    permittedGenerations: [callerPermitted, anchorNc.permitted],
-    excluded: intrinsic.concat(callerExcluded, anchorNc.excluded),
+    permittedGenerations: [callerPermitted, anchorNc.permitted, taConstraints.permitted],
+    excluded: intrinsic.concat(intrinsic.concat(callerExcluded, anchorNc.excluded), taConstraints.excluded),
   };
-  var anchorNameConstraintsApplied = anchorNc.permitted.length > 0 || anchorNc.excluded.length > 0;
+  var anchorNameConstraintsApplied = anchorNc.permitted.length > 0 || anchorNc.excluded.length > 0 ||
+    taConstraints.permitted.length > 0 || taConstraints.excluded.length > 0;
   var purposeOpts = resolvePurposeOpts(opts);
   var requiredEku = purposeOpts.requiredEku;
   var checkPurpose = purposeOpts.checkPurpose;
 
-  var state = initialize(certs, opts, seeds, anchor);
+  var state = initialize(certs, opts, seeds, anchor, taConstraints);
   state._n = n;
   state.requiredEku = requiredEku;
   var verifier = opts.verifier || null;
@@ -1488,28 +1667,42 @@ async function _validate(path, opts, run) {
     workingPublicKey: state.workingPublicKey,
     workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm,
     workingPublicKeyParameters: state.workingPublicKeyParameters,
-    validPolicyTree: treeWithoutParent(state.validPolicyTree),
+    validPolicyGraph: graphSnapshot(state.validPolicyGraph),
     userConstrainedPolicySet: ucps,
   });
 }
 
+/**
+ * @internal RFC 9618 sec. 5.5 rewrites RFC 5280 sec. 6.1.5 step (g) over the graph. The set is read
+ * from the nodes whose only parent is the anyPolicy node, at ANY depth rather than at the deepest
+ * one, plus the anyPolicy node at depth n. Policy qualifiers are not collected: sec. 5.5 step
+ * (g)(4)(ii) lets an application that does not use them skip it, and this returns identifiers.
+ */
 function userConstrainedPolicies(state, n) {
-  if (!state.validPolicyTree) return [];
+  if (!state.validPolicyGraph) return [];
+  var authority = [];
+  function note(node) {
+    if (authority.indexOf(node.validPolicy) === -1) guard.list.append(authority, node.validPolicy);
+  }
+  /** @internal (g)(2) */
+  for (var d = 1; d <= n; d++) {
+    nodesAt(state, d).forEach(function (node) {
+      if (node.validPolicy === OID.anyPolicy) return;
+      if (node.parents.length === 1 && node.parents[0].validPolicy === OID.anyPolicy) note(node);
+    });
+  }
+  /** @internal (g)(3) */
+  var anyAtN = nodeAt(state, n, OID.anyPolicy);
+  if (anyAtN !== null) note(anyAtN);
+
+  /** @internal (g)(5) and (g)(6) */
   var uips = state.userInitialPolicySet;
-  var anyUser = contains(uips, OID.anyPolicy);
-  var leaves = leavesAt(state.validPolicyTree, n);
-  var explicit = intrinsic.create(null), hasAnyLeaf = false;
-  leaves.forEach(function (node) {
-    if (node.validPolicy === OID.anyPolicy) hasAnyLeaf = true;
-    else explicit[node.validPolicy] = true;
-  });
-  var set = intrinsic.create(null);
-  Object.keys(explicit).forEach(function (p) { if (anyUser || contains(uips, p)) set[p] = true; });
-  if (hasAnyLeaf) {
-    if (anyUser) set[OID.anyPolicy] = true;
-    else uips.forEach(function (p) { set[p] = true; });
+  if (contains(uips, OID.anyPolicy)) return authority;
+  var out = intrinsic.filter(authority, function (p) { return contains(uips, p); });
+  if (contains(authority, OID.anyPolicy)) {
+    uips.forEach(function (p) { if (out.indexOf(p) === -1) guard.list.append(out, p); });
   }
-  return Object.keys(set);
+  return out;
 }
 
 
@@ -2367,6 +2560,70 @@ function _precaptureAnchorNameConstraints(list, who) {
   }
   return out;
 }
+var _TA_CONSTRAINT_KEYS = intrinsic.assign(intrinsic.create(null), {
+  nameConstraints: 1, policySet: 1, policyFlags: 1, pathLenConstraint: 1 });
+var _TA_FLAG_KEYS = intrinsic.assign(intrinsic.create(null), {
+  inhibitPolicyMapping: 1, requireExplicitPolicy: 1, inhibitAnyPolicy: 1 });
+/**
+ * @internal An RFC 5914 anchor's own constraints, snapshotted the way every other anchor field is:
+ * read once from its own data property, copied, and never read again. A caller object that answered
+ * one value to the check and another to the enforcement would otherwise decide the namespace and
+ * the policy set a path is held to.
+ */
+function _copyAnchorRfc5914Constraints(c, who) {
+  var label = who + ": a trustAnchor constraints";
+  if (c === null || typeof c !== "object" || intrinsic.isArray(c)) {
+    throw E("path/bad-input", label + " must be a { nameConstraints, policySet, policyFlags, pathLenConstraint } object");
+  }
+  guard.identifier.assertPlainRecord(c, E, "path/bad-input", label);
+  guard.identifier.assertKnownKeys(c, _TA_CONSTRAINT_KEYS, E, "path/bad-input",
+    label + " names nameConstraints, policySet, policyFlags and pathLenConstraint. The unknown key was: ");
+  var out = {};
+  var ncD = intrinsic.getOwnPropertyDescriptor(c, "nameConstraints");
+  if (ncD !== undefined) {
+    if (!intrinsic.hasOwn(ncD, "value")) throw E("path/bad-input", label + ".nameConstraints must be a data property, not an accessor");
+    intrinsic.defineProperty(out, "nameConstraints", { value: _copyAnchorNameConstraints(ncD.value, who + ": a trustAnchor constraints"), enumerable: true, configurable: true, writable: true });
+  }
+  var psD = intrinsic.getOwnPropertyDescriptor(c, "policySet");
+  if (psD !== undefined) {
+    if (!intrinsic.hasOwn(psD, "value")) throw E("path/bad-input", label + ".policySet must be a data property, not an accessor");
+    var ps = psD.value;
+    if (!intrinsic.isArray(ps) || intrinsic.types.isProxy(ps)) throw E("path/bad-input", label + ".policySet must be a plain array of policy identifiers");
+    var psOut = [];
+    for (var i = 0; i < ps.length; i++) {
+      var pd = intrinsic.getOwnPropertyDescriptor(ps, i);
+      if (pd === undefined || !intrinsic.hasOwn(pd, "value")) throw E("path/bad-input", label + ".policySet entry " + i + " must be a data property, not a hole or an accessor");
+      if (typeof pd.value !== "string" || pd.value.length === 0) throw E("path/bad-input", label + ".policySet entries must be dotted-decimal policy identifiers");
+      guard.list.append(psOut, guard.identifier.assertCanonicalOid(pd.value, E, "path/bad-input", label + ".policySet entry " + pd.value));
+    }
+    intrinsic.defineProperty(out, "policySet", { value: psOut, enumerable: true, configurable: true, writable: true });
+  }
+  var pfD = intrinsic.getOwnPropertyDescriptor(c, "policyFlags");
+  if (pfD !== undefined) {
+    if (!intrinsic.hasOwn(pfD, "value")) throw E("path/bad-input", label + ".policyFlags must be a data property, not an accessor");
+    var pf = pfD.value;
+    if (pf === null || typeof pf !== "object" || intrinsic.isArray(pf)) throw E("path/bad-input", label + ".policyFlags must be an object of boolean flags");
+    guard.identifier.assertPlainRecord(pf, E, "path/bad-input", label + ".policyFlags");
+    guard.identifier.assertKnownKeys(pf, _TA_FLAG_KEYS, E, "path/bad-input", label + ".policyFlags names the three RFC 5914 flags. The unknown key was: ");
+    var fOut = {};
+    intrinsic.forEach(intrinsic.keys(_TA_FLAG_KEYS), function (k) {
+      var fd = intrinsic.getOwnPropertyDescriptor(pf, k);
+      if (fd === undefined) return;
+      if (!intrinsic.hasOwn(fd, "value")) throw E("path/bad-input", label + ".policyFlags." + k + " must be a data property, not an accessor");
+      if (typeof fd.value !== "boolean") throw E("path/bad-input", label + ".policyFlags." + k + " must be a boolean");
+      intrinsic.defineProperty(fOut, k, { value: fd.value, enumerable: true, configurable: true, writable: true });
+    });
+    intrinsic.defineProperty(out, "policyFlags", { value: fOut, enumerable: true, configurable: true, writable: true });
+  }
+  var plD = intrinsic.getOwnPropertyDescriptor(c, "pathLenConstraint");
+  if (plD !== undefined) {
+    if (!intrinsic.hasOwn(plD, "value")) throw E("path/bad-input", label + ".pathLenConstraint must be a data property, not an accessor");
+    if (!intrinsic.isInteger(plD.value) || plD.value < 0) throw E("path/bad-input", label + ".pathLenConstraint must be a non-negative integer");
+    intrinsic.defineProperty(out, "pathLenConstraint", { value: plD.value, enumerable: true, configurable: true, writable: true });
+  }
+  return out;
+}
+
 function _copyAnchorNameConstraints(nc, who) {
   if (nc === null || typeof nc !== "object" || intrinsic.isArray(nc)) {
     throw E("path/bad-input", who + ": a trustAnchor nameConstraints must be a { permitted, excluded } object of { tag, base } subtree entries");
@@ -2435,7 +2692,7 @@ function _copyRdnsDeep(rdns) {
 function toAnchor(entry, verb) {
   var who = verb || "build";
   var isTuple = false, alg = null, pubRaw, nameRaw = null, pk = null, purposesSnap, distrustSnap;
-  var subjectDerRaw, labelRaw, mozRaw, ncSnap;
+  var subjectDerRaw, labelRaw, mozRaw, ncSnap, taSnap;
   if (intrinsic.types.isProxy(entry)) {
     throw E("path/bad-input", who + ": a trustAnchor must not be a Proxy");
   }
@@ -2454,6 +2711,8 @@ function toAnchor(entry, verb) {
       distrustSnap = _normalizeConstraintField(dRaw, E, "path/bad-input", who);
       var ncRaw = _captureConstraintMap(entry, "nameConstraints", E, "path/bad-input", who);
       ncSnap = ncRaw == null ? undefined : _copyAnchorNameConstraints(ncRaw, who);
+      var taRaw = _captureConstraintMap(entry, "constraints", E, "path/bad-input", who);
+      taSnap = taRaw == null ? undefined : _copyAnchorRfc5914Constraints(taRaw, who);
       subjectDerRaw = _captureOwnData(entry, "subjectDer");
       labelRaw = _captureOwnData(entry, "label");
       mozRaw = _captureOwnData(entry, "mozillaCaPolicy");
@@ -2522,6 +2781,7 @@ function toAnchor(entry, verb) {
     if (purposesSnap !== undefined) intrinsic.defineProperty(flat, "purposes", { value: purposesSnap, enumerable: true, configurable: true, writable: true });
     if (distrustSnap !== undefined) intrinsic.defineProperty(flat, "distrustAfter", { value: distrustSnap, enumerable: true, configurable: true, writable: true });
     if (ncSnap !== undefined) intrinsic.defineProperty(flat, "nameConstraints", { value: ncSnap, enumerable: true, configurable: true, writable: true });
+    if (taSnap !== undefined) intrinsic.defineProperty(flat, "constraints", { value: taSnap, enumerable: true, configurable: true, writable: true });
     if (subjectDerRaw !== undefined) intrinsic.defineProperty(flat, "subjectDer", { value: subjectDerRaw, enumerable: true, configurable: true, writable: true });
     if (labelRaw !== undefined) intrinsic.defineProperty(flat, "label", { value: labelRaw, enumerable: true, configurable: true, writable: true });
     if (mozRaw !== undefined) intrinsic.defineProperty(flat, "mozillaCaPolicy", { value: mozRaw, enumerable: true, configurable: true, writable: true });
@@ -2537,7 +2797,17 @@ function toAnchor(entry, verb) {
   try { cert = coerceCert(entry); }
   catch (e) { throw E("path/bad-input", who + ": a trustAnchor entry must be a { name, publicKey, algorithm } tuple or a certificate", e); }
   var spki = cert.subjectPublicKeyInfo;
-  return { name: cert.subject, publicKey: spki.bytes, algorithm: spki.algorithm.oid, parameters: spki.algorithm.parameters, subjectDer: cert.subject.bytes };
+  var out = { name: cert.subject, publicKey: spki.bytes, algorithm: spki.algorithm.oid, parameters: spki.algorithm.parameters, subjectDer: cert.subject.bytes };
+  /** @internal The certificate's own basic constraints are associated with the anchor, so its
+   * pathLenConstraint bounds the path below it (RFC 5937 sec. 3.2). Defined rather than assigned,
+   * for the reason every other anchor field is. */
+  var certPathLen = pkix.anchorPathLenFromExtensions(cert.extensions, NS, who + ": the trustAnchor certificate");
+  if (certPathLen !== null) {
+    var c = intrinsic.create(null);
+    c.pathLenConstraint = certPathLen;
+    guard.verdict.set(out, "constraints", c);
+  }
+  return out;
 }
 
 /**
@@ -2773,8 +3043,7 @@ async function _aiaFetchOne(uri, aia) {
     : Buffer.from(res.body == null ? "" : String(res.body), "latin1");
   if (body.length === 0) throw E("path/aia-empty", "an AIA fetch returned an empty body");
   if (body.length > aia.maxResponseBytes) throw E("path/aia-too-large", "an AIA response exceeds the " + aia.maxResponseBytes + "-byte cap");
-  var headers = intrinsic.create(null);
-  Object.keys(res.headers || {}).forEach(function (k) { headers[k.toLowerCase()] = res.headers[k]; });
+  var headers = guard.header.lowerCased(res.headers);
   return _aiaParseBody(body, headers["content-type"], aia.maxCertsPerResponse);
 }