@blamejs/pki 0.8.11 → 0.8.14

package/lib/trust.js

@@ -46,11 +46,14 @@ var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var x509 = require("./schema-x509");
 var pkix = require("./schema-pkix");
+var oid = require("./oid");
+var trustanchorSchema = require("./schema-trustanchor");
 
 var TrustError = errors.TrustError;
 var LIMITS = constants.LIMITS;
 
 function E(code, message, cause) { return new TrustError(code, message, cause); }
+var _NS = pkix.makeNS("trust", TrustError, oid);
 
 var PURPOSES = ["serverAuth", "emailProtection", "codeSigning"];
 
@@ -351,14 +354,30 @@ function _mkAnchor(cert, meta) {
     label: meta.label,
     mozillaCaPolicy: meta.mozillaCaPolicy,
   };
-  _DERIVED_FROM.set(entry, {
+  /** @internal The certificate's own basic constraints are associated with the anchor, so its
+   * pathLenConstraint bounds the path below it (RFC 5937 sec. 3.2). */
+  var certPathLen = pkix.anchorPathLenFromExtensions(cert.extensions, _NS, "the trust anchor certificate");
+  if (certPathLen !== null) {
+    var cc = intrinsic.create(null);
+    cc.pathLenConstraint = certPathLen;
+    guard.verdict.set(entry, "constraints", cc);
+  }
+  var derived = {
     name: _copyName(cert.subject),
     publicKey: Buffer.from(spki.bytes),
     algorithm: spki.algorithm.oid,
     parameters: spki.algorithm.parameters == null ? spki.algorithm.parameters : Buffer.from(spki.algorithm.parameters),
-    purposes: _copyPurposes(meta.purposes),
+    purposes: _purposesOrNull(meta.purposes),
     distrustAfter: _copyDistrustAfter(meta.distrustAfter),
-  });
+  };
+  /** @internal An independent copy, so editing the entry's own constraints cannot change what
+   * `anchor()` enforces; it reads this record where there is one. */
+  if (certPathLen !== null) {
+    var dc = intrinsic.create(null);
+    dc.pathLenConstraint = certPathLen;
+    derived.constraints = dc;
+  }
+  _DERIVED_FROM.set(entry, derived);
   return entry;
 }
 var _DERIVED_FROM = new WeakMap();
@@ -371,27 +390,39 @@ function _copyPurposes(src) {
   });
 }
 
+/** @internal An EXPLICIT null purposes set stays null; an absent one still defaults to all-false,
+ *  which is the fail-closed reading of a store entry that named no purpose.
+ *
+ *  The two differ because the formats do. A store that lists a root and grants it nothing says
+ *  something, and all-false is how that is written. A format carrying no purpose bits at all, such
+ *  as an RFC 5914 trust anchor, says nothing: turning that into all-false would read as "trusted
+ *  for no purpose" and make `pki.path.validate` demand a purpose to check a constraint the anchor
+ *  never stated. The `anchor` entry gate directly below reads a null the same way, refusing an
+ *  entry whose `purposes` is `!= null` and letting a null through as absent. */
+function _purposesOrNull(src) { return src === null ? null : _copyPurposes(src); }
+
 function _copyDistrustAfter(src) {
   var out = intrinsic.create(null);
   if (!src || typeof src !== "object") return out;
-  Object.keys(src).forEach(function (k) {
-    out[k] = guard.time.isDate(src[k]) ? new Date(guard.time.instantOf(src[k])) : src[k];
-  });
+  var names = guard.identifier.optionNames(src);
+  for (var i = 0; i < names.length; i++) {
+    out[names[i]] = guard.time.isDate(src[names[i]]) ? new Date(guard.time.instantOf(src[names[i]])) : src[names[i]];
+  }
   return out;
 }
 
 function _copyName(name) {
   if (!name || !Array.isArray(name.rdns)) return name;
-  var out = Object.assign({}, name);
+  var out = guard.identifier.ownOptions(name);
   out.rdns = guard.list.copyMap(name.rdns, function (rdn) {
-    return Array.isArray(rdn) ? guard.list.copyMap(rdn, function (atv) { return Object.assign({}, atv); }) : rdn;
+    return Array.isArray(rdn) ? guard.list.copyMap(rdn, function (atv) { return guard.identifier.ownOptions(atv); }) : rdn;
   });
   out.bytes = Buffer.isBuffer(name.bytes) ? Buffer.from(name.bytes) : name.bytes;
   return out;
 }
 
 function _datesEqual(x, y) {
-  var kx = Object.keys(x).sort(), ky = Object.keys(y).sort();
+  var kx = guard.identifier.optionNames(x).sort(), ky = guard.identifier.optionNames(y).sort();
   if (kx.join(",") !== ky.join(",")) return false;
   return kx.every(function (k) { return guard.time.instantOf(x[k]) === guard.time.instantOf(y[k]); });
 }
@@ -929,7 +960,7 @@ function anchor(entry, opts) {
       throw E("trust/purpose-not-trusted", "this root is not a trusted delegator for " + opts.purpose);
     }
   }
-  if (!derived && (entry.purposes != null || (entry.distrustAfter && Object.keys(entry.distrustAfter).length))) {
+  if (!derived && (entry.purposes != null || (entry.distrustAfter && guard.identifier.optionNames(entry.distrustAfter).length))) {
     throw E("trust/bad-input", "this entry carries a trust store's per-purpose metadata but is not the entry the store produced -- it has been rebuilt, and the metadata is a statement about the key the store read, not about whichever key the copy now names. Pass pki.trust.parseCertdata / parseCcadbCsv output unmodified");
   }
   var nameConstraints = _copyNameConstraints(opts.nameConstraints);
@@ -940,18 +971,168 @@ function anchor(entry, opts) {
     parameters: Buffer.isBuffer(meta.parameters) ? Buffer.from(meta.parameters)
       : (meta.parameters !== undefined ? meta.parameters : null),
     distrustAfter: _copyDistrustAfter(meta.distrustAfter),
-    purposes: _copyPurposes(meta.purposes),
+    purposes: _purposesOrNull(meta.purposes),
   };
   /** @internal Set only when an overlay was supplied, so an anchor without one is the object this
    * verb returned before the option existed, and defined rather than assigned: an accessor planted
    * on Object.prototype under this name would otherwise take the assignment and leave the anchor
    * carrying no restriction at all. */
   if (nameConstraints) guard.verdict.set(out, "nameConstraints", nameConstraints);
+  /** @internal The RFC 5914 anchor's own constraints, kept separate from the `nameConstraints`
+   * overlay a caller may also supply: RFC 5937 sec. 3.2 intersects every permitting set rather than
+   * letting one replace another, so the two have to reach the validator as two statements.
+   *
+   * Read from `meta`, which is the derived record when there is one and the caller's entry when
+   * there is not, so a copy of an entry keeps the restrictions the original carried. They can only
+   * narrow a validation, so an entry that states them is safe to honor whoever built it. */
+  if (meta.constraints) guard.verdict.set(out, "constraints", _copyConstraints(meta.constraints));
   return out;
 }
 
+/** @internal Copied entry by entry, for the same reason every other anchor field is: what the
+ *  validator enforces must be what this verb read, not what a caller's object answers later. */
+function _copyConstraints(c) {
+  var out = intrinsic.create(null);
+  if (c.nameConstraints) {
+    out.nameConstraints = {
+      permitted: _copySubtrees(c.nameConstraints.permitted, "permitted"),
+      excluded: _copySubtrees(c.nameConstraints.excluded, "excluded"),
+    };
+  }
+  if (c.policySet) out.policySet = intrinsic.map(c.policySet, function (p) { return p; });
+  if (c.policyFlags) {
+    var f = intrinsic.create(null);
+    intrinsic.forEach(trustanchorSchema.policyFlagBits, function (k) { f[k] = c.policyFlags[k] === true; });
+    out.policyFlags = f;
+  }
+  if (c.pathLenConstraint !== undefined) out.pathLenConstraint = c.pathLenConstraint;
+  return out;
+}
+
+/** @internal An RFC 5914 anchor's constraints, in the shape `pki.path.validate` reads them. Each
+ *  field is absent rather than null when the anchor states nothing, so an anchor that constrains
+ *  nothing is the object this module produced before the format existed. */
+function _anchorConstraintsOf(taInfo) {
+  var cp = taInfo.certPath;
+  /** @internal `exts` is where RFC 5914 sec. 2.6 says an anchor associates any extension outside
+   * the four `certPath` already carries, and basic constraints is one of them, so a path length
+   * stated there binds as much as one stated in `certPath` (RFC 5937 sec. 3.2). Where both state
+   * one, the stricter wins: an anchor may only narrow. */
+  var extsPathLen = pkix.anchorPathLenFromExtensions(taInfo.exts, _NS, "the TrustAnchorInfo exts");
+  if (cp === null) {
+    if (extsPathLen === null) return null;
+    var only = intrinsic.create(null);
+    only.pathLenConstraint = extsPathLen;
+    return only;
+  }
+  var out = intrinsic.create(null);
+  var any = false;
+  if (cp.nameConstr !== null) {
+    out.nameConstraints = {
+      permitted: intrinsic.map(cp.nameConstr.permittedSubtrees || [], _subtreeOf),
+      excluded: intrinsic.map(cp.nameConstr.excludedSubtrees || [], _subtreeOf),
+    };
+    any = true;
+  }
+  if (cp.policySet !== null) {
+    out.policySet = intrinsic.map(cp.policySet, function (p) { return p.policyIdentifier; });
+    any = true;
+  }
+  if (cp.policyFlags !== null) { out.policyFlags = cp.policyFlags; any = true; }
+  var pathLen = pkix.lowerPathLen(cp.pathLenConstraint, extsPathLen);
+  if (pathLen !== null) { out.pathLenConstraint = pathLen; any = true; }
+  return any ? out : null;
+}
+function _subtreeOf(st) { return { tag: st.base.tagNumber, base: st.base.value }; }
+
+/**
+ * @primitive  pki.trust.parseTrustAnchorList
+ * @signature  pki.trust.parseTrustAnchorList(input, opts?) -> { anchors }
+ * @since      0.8.13
+ * @status     stable
+ * @spec       RFC 5914, RFC 5937 sec. 3.2
+ * @related    pki.trust.anchor, pki.schema.trustanchor.parse, pki.path.validate
+ *
+ * Read an RFC 5914 `TrustAnchorList` into the trust-store entries `pki.trust.anchor` takes, the
+ * same shape `parseCertdata` and `parseCcadbCsv` produce. Each entry carries the anchor's name,
+ * public key and algorithm, so a list published by a root program drives `pki.path.validate`
+ * without the operator mapping it by hand.
+ *
+ * A `taInfo` anchor's constraints ride on the entry and are applied as RFC 5937 section 3.2 states,
+ * which is that the stricter of the anchor's value and the caller's always wins: its name
+ * constraints intersect the caller's permitted subtrees and union its excluded ones, its
+ * `policySet` intersects `opts.userInitialPolicySet`, each of its `policyFlags` may turn the
+ * matching `initial*` option on and never off, and its `pathLenConstraint` bounds the path.
+ *
+ * The `certificate` and `tbsCert` arms carry no constraints of their own, so an entry from either
+ * is the anchor that certificate's subject and key describe.
+ *
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for the parse.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var der = pki.trustanchor.build({ anchors: [{ taInfo: {
+ *     pubKey: await pki.key.export(pair.publicKey), keyId: Buffer.alloc(20, 1),
+ *     certPath: { taName: "CN=Example Root" } } }] });
+ *   pki.trust.parseTrustAnchorList(der).anchors.length;   // -> 1
+ */
+function parseTrustAnchorList(input, opts) {
+  var list = trustanchorSchema.parse(input, opts);
+  var out = [];
+  intrinsic.forEach(list.anchors, function (a, i) {
+    guard.list.append(out, _entryFromAnchor(a, i));
+  });
+  return { anchors: out };
+}
+
+function _entryFromAnchor(a, i) {
+  if (a.kind === "certificate" || a.kind === "tbsCert") {
+    var cert = a.kind === "certificate" ? a.certificate : a.tbsCert;
+    return _mkAnchor(cert, { distrustAfter: {}, purposes: null, label: null, mozillaCaPolicy: false });
+  }
+  var info = a.taInfo;
+  if (info.certPath === null) {
+    throw E("trust/bad-input", "anchors[" + i + "] is a TrustAnchorInfo carrying no certPath, so it names no " +
+      "distinguished name to chain to; a trust anchor needs one (RFC 5914 sec. 2)");
+  }
+  var spki = info.pubKey;
+  var constraints = _anchorConstraintsOf(info);
+  var entry = {
+    name: info.certPath.taName,
+    publicKey: spki.bytes,
+    algorithm: spki.algorithm.oid,
+    parameters: spki.algorithm.parameters,
+    subjectDer: info.certPath.taName.bytes,
+    distrustAfter: {},
+    purposes: null,
+    label: info.taTitle,
+    mozillaCaPolicy: false,
+  };
+  /** @internal On the ENTRY, not only in the derived record behind it. The entry carries a name, a
+   * public key and an algorithm, which is exactly the anchor tuple `pki.path.validate` accepts, so
+   * an operator passing `parseTrustAnchorList(der).anchors` straight to `trustAnchors` is doing the
+   * obvious thing. Keeping the constraints out of reach of that call would hand them an
+   * UNCONSTRAINED anchor and silently drop every restriction the list stated. */
+  if (constraints) guard.verdict.set(entry, "constraints", constraints);
+  _DERIVED_FROM.set(entry, {
+    name: _copyName(info.certPath.taName),
+    publicKey: intrinsic.bufferFrom(spki.bytes),
+    algorithm: spki.algorithm.oid,
+    parameters: spki.algorithm.parameters == null ? spki.algorithm.parameters : intrinsic.bufferFrom(spki.algorithm.parameters),
+    purposes: null,
+    distrustAfter: _copyDistrustAfter({}),
+    /** @internal Its OWN copy, not the object the entry carries. The derived record is what
+     * `anchor` trusts in preference to the entry, precisely because the entry is reachable: a
+     * caller who edits `entry.constraints` would otherwise be editing what the anchor enforces,
+     * which is the one thing this record exists to prevent for the name and the key. */
+    constraints: constraints === null ? null : _copyConstraints(constraints),
+  });
+  return entry;
+}
+
 module.exports = {
   parseCertdata: parseCertdata,
   parseCcadbCsv: parseCcadbCsv,
+  parseTrustAnchorList: parseTrustAnchorList,
   anchor: anchor,
 };

package/lib/trustanchor-build.js

@@ -0,0 +1,278 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.trustanchor
+ * @nav        Trust
+ * @title      Trust anchor lists
+ * @order      178
+ * @slug       trustanchor-build
+ *
+ * @intro
+ *   Write the RFC 5914 `TrustAnchorList` a root program publishes: each anchor
+ *   as a certificate, as a bare `TBSCertificate`, or as a `TrustAnchorInfo`
+ *   carrying the name it is known by and the constraints a relying party
+ *   applies to paths beneath it. Every anchor is held to the same rules
+ *   `pki.schema.trustanchor.parse` holds one to, and the result round-trips
+ *   through that parser before it is returned.
+ *
+ * @card
+ *   Build RFC 5914 trust anchor lists: the anchor carries its own policies,
+ *   name constraints and path length.
+ */
+
+var asn1 = require("./asn1-der");
+var schema = require("./schema-engine");
+var pkix = require("./schema-pkix");
+var trustanchor = require("./schema-trustanchor");
+var x509 = require("./schema-x509");
+var pkiBuild = require("./pki-build");
+var oid = require("./oid");
+var frameworkError = require("./framework-error");
+var intrinsic = require("./guard-intrinsic");
+var guard = require("./guard-all");
+
+var TrustAnchorError = frameworkError.TrustAnchorError;
+var b = asn1.build;
+
+function _err(code, message, cause) { return new TrustAnchorError(code, message, cause); }
+function O(n) { return oid.byName(n); }
+
+var NS = pkix.makeNS("trustanchor", TrustAnchorError, oid);
+var NAME_SCHEMA = pkix.name(NS);
+var SPKI_SCHEMA = pkix.spki(NS);
+var _b = pkiBuild.makeBuilder({ ErrorClass: TrustAnchorError, prefix: "trustanchor", O: O, NS: NS,
+  NAME_SCHEMA: NAME_SCHEMA, SPKI_SCHEMA: SPKI_SCHEMA, EXT_DECODERS: {} });
+
+var CERT_EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+var OID_NAME_CONSTRAINTS = oid.byName("nameConstraints");
+
+var _ANCHOR_KEYS = intrinsic.assign(intrinsic.create(null), { certificate: 1, tbsCert: 1, taInfo: 1 });
+var _INFO_KEYS = intrinsic.assign(intrinsic.create(null), {
+  pubKey: 1, keyId: 1, taTitle: 1, certPath: 1, exts: 1, taTitleLangTag: 1 });
+var _CERT_PATH_KEYS = intrinsic.assign(intrinsic.create(null), {
+  taName: 1, certificate: 1, policySet: 1, policyFlags: 1, nameConstr: 1, pathLenConstraint: 1 });
+var _FLAG_KEYS = intrinsic.assign(intrinsic.create(null), {
+  inhibitPolicyMapping: 1, requireExplicitPolicy: 1, inhibitAnyPolicy: 1 });
+var _BUILD_KEYS = intrinsic.assign(intrinsic.create(null), { anchors: 1, pem: 1 });
+
+/** @internal The shape check comes first, so every nested record reports a typed refusal naming
+ *  the field instead of a native TypeError from the first property read below it. */
+function _known(obj, allowed, what) {
+  guard.identifier.assertPlainRecord(obj, _err, "trustanchor/bad-input", what);
+  guard.identifier.assertKnownKeys(obj, allowed, _err, "trustanchor/bad-input", "unknown " + what + " field ");
+}
+
+function _policySetDer(list) {
+  if (!intrinsic.isArray(list) || list.length === 0) {
+    throw _err("trustanchor/bad-input", "certPath.policySet must be a non-empty array of policy identifiers");
+  }
+  return b.sequence(intrinsic.map(list, function (p) {
+    if (typeof p !== "string" || !oid.isDottedDecimal(p)) {
+      throw _err("trustanchor/bad-input", "certPath.policySet entries must be dotted-decimal policy identifiers");
+    }
+    /** @internal RFC 5914 sec. 2 forbids the qualifiers, so there is no place to put one and a
+     * caller cannot supply one: the element is the identifier alone. */
+    return b.sequence([b.oid(p)]);
+  }));
+}
+
+var FLAG_BITS = trustanchor.policyFlagBits;
+function _policyFlagsDer(flags) {
+  _known(flags, _FLAG_KEYS, "certPath.policyFlags");
+  var bits = [];
+  for (var i = 0; i < FLAG_BITS.length; i++) {
+    var v = flags[FLAG_BITS[i]];
+    if (v === undefined || v === false) continue;
+    if (v !== true) throw _err("trustanchor/bad-input", "certPath.policyFlags." + FLAG_BITS[i] + " must be a boolean");
+    guard.list.append(bits, i);
+  }
+  if (bits.length === 0) return null;
+  return b.implicit(2, b.namedBitString(bits));
+}
+
+function _certPathDer(spec) {
+  _known(spec, _CERT_PATH_KEYS, "certPath");
+  var nameDer = _b.encodeName(spec.taName);
+  if (_b.isEmptyName(nameDer)) {
+    throw _err("trustanchor/bad-input", "certPath.taName must be a non-empty distinguished name (RFC 5914 sec. 2)");
+  }
+  var kids = [b.raw(nameDer)];
+  /** @internal The RFC 5914 module is IMPLICIT TAGS, so a context tag REPLACES the member's own
+   * universal tag rather than wrapping it. `b.implicit` re-tags the value it is given; only the
+   * three members the module writes EXPLICIT beside get a wrapper. */
+  if (spec.certificate !== undefined) {
+    guard.list.append(kids, b.implicit(0, _b.reqDer(spec.certificate, "certPath.certificate")));
+  }
+  var hasPolicySet = spec.policySet !== undefined;
+  if (hasPolicySet) guard.list.append(kids, b.implicit(1, _policySetDer(spec.policySet)));
+  if (spec.policyFlags !== undefined) {
+    if (!spec.policyFlags || typeof spec.policyFlags !== "object") {
+      throw _err("trustanchor/bad-input", "certPath.policyFlags must be an object of boolean flags");
+    }
+    /** @internal RFC 5914 sec. 2: "This bit MUST be set to FALSE if policySet is absent." Refused
+     * here as well as at the parse, so the builder cannot emit what the parser would reject. */
+    if (spec.policyFlags.requireExplicitPolicy === true && !hasPolicySet) {
+      throw _err("trustanchor/bad-input", "certPath.policyFlags.requireExplicitPolicy requires a policySet (RFC 5914 sec. 2)");
+    }
+    var flagsDer = _policyFlagsDer(spec.policyFlags);
+    if (flagsDer !== null) guard.list.append(kids,flagsDer);
+  }
+  if (spec.nameConstr !== undefined) {
+    var ncDer = _b.reqDer(spec.nameConstr, "certPath.nameConstr");
+    try { CERT_EXT_DECODERS[OID_NAME_CONSTRAINTS](ncDer); }
+    catch (e) { throw _err("trustanchor/bad-input", "certPath.nameConstr is not a well-formed NameConstraints (RFC 5280 sec. 4.2.1.10)", e); }
+    guard.list.append(kids, b.implicit(3, ncDer));
+  }
+  if (spec.pathLenConstraint !== undefined) {
+    var n = spec.pathLenConstraint;
+    if (!intrinsic.isInteger(n) || n < 0) {
+      throw _err("trustanchor/bad-input", "certPath.pathLenConstraint must be a non-negative integer (INTEGER (0..MAX), RFC 5914 sec. 2)");
+    }
+    guard.list.append(kids,b.implicit(4, b.integer(intrinsic.BigInt(n))));
+  }
+  return b.sequence(kids);
+}
+
+function _taInfoDer(spec) {
+  _known(spec, _INFO_KEYS, "taInfo");
+  /** @internal The version is the DEFAULT v1 and DER omits it, so it is not a field a caller sets
+   * and there is exactly one encoding of a v1 anchor. */
+  var spki = _b.reqDer(spec.pubKey, "taInfo.pubKey");
+  _b.assertValidSpki(spki, "taInfo.pubKey");
+  var keyId = guard.bytes.snapshotSource(spec.keyId, TrustAnchorError, "trustanchor/bad-input", "taInfo.keyId");
+  if (keyId.length === 0) throw _err("trustanchor/bad-input", "taInfo.keyId must not be empty");
+  var kids = [b.raw(spki), b.octetString(keyId)];
+  if (spec.taTitle !== undefined) {
+    /** @internal Counted the way the reader counts, in characters rather than UTF-16 code units,
+     * so the writer admits exactly the titles the reader does. */
+    if (typeof spec.taTitle !== "string") {
+      throw _err("trustanchor/bad-input", "taInfo.taTitle must be a string");
+    }
+    var titleLen = trustanchor.titleChars(spec.taTitle);
+    if (titleLen < 1 || titleLen > 64) {
+      throw _err("trustanchor/bad-input", "taInfo.taTitle must be 1 to 64 characters (SIZE (1..64), RFC 5914 sec. 2), got " + titleLen);
+    }
+    guard.list.append(kids,b.utf8(spec.taTitle));
+  }
+  if (spec.certPath !== undefined) guard.list.append(kids,_certPathDer(spec.certPath));
+  if (spec.exts !== undefined) {
+    if (!intrinsic.isArray(spec.exts) || spec.exts.length === 0) {
+      throw _err("trustanchor/bad-input", "taInfo.exts must be a non-empty array of pre-encoded Extension DER");
+    }
+    var extDers = intrinsic.map(spec.exts, function (e, i) {
+      var der = _b.reqDer(e, "taInfo.exts[" + i + "]");
+      var extnId;
+      try { extnId = asn1.read.oid(asn1.decode(der).children[0]); }
+      catch (err) { throw _err("trustanchor/bad-input", "taInfo.exts[" + i + "] is not a well-formed Extension", err); }
+      /** @internal RFC 5914 sec. 3 names four extension types that MUST NOT appear here. The parser
+       * ignores one that does, as the RFC says to; the builder refuses to write one, so this
+       * toolkit never produces an anchor carrying a constraint nothing will read. */
+      if (trustanchor.excludedExtensionOids[extnId] === true) {
+        throw _err("trustanchor/bad-input", "taInfo.exts must not carry " + (oid.name(extnId) || extnId) +
+          ", which RFC 5914 sec. 3 excludes and a reader ignores; state it in certPath instead");
+      }
+      return b.raw(der);
+    });
+    guard.list.append(kids,b.explicit(1, b.sequence(extDers)));
+  }
+  if (spec.taTitleLangTag !== undefined) {
+    /** @internal The type carries no SIZE constraint, so the reader accepts an empty language tag
+     * and this refuses to write one: an empty tag names no language, and the field exists to say
+     * which language the title is in. The docstring states it, since the module does not. */
+    if (typeof spec.taTitleLangTag !== "string" || spec.taTitleLangTag.length === 0) {
+      throw _err("trustanchor/bad-input", "taInfo.taTitleLangTag must be a non-empty string; an empty one names no language");
+    }
+    /** @internal `[2] UTF8String` with no EXPLICIT beside it in the module, so the context tag
+     * replaces the UTF8String tag rather than wrapping it. */
+    guard.list.append(kids, b.implicit(2, b.utf8(spec.taTitleLangTag)));
+  }
+  return b.sequence(kids);
+}
+
+function _anchorDer(spec, i) {
+  if (!spec || typeof spec !== "object" || intrinsic.isArray(spec)) {
+    throw _err("trustanchor/bad-input", "anchors[" + i + "] must be an object naming exactly one of certificate, tbsCert or taInfo");
+  }
+  _known(spec, _ANCHOR_KEYS, "anchors[" + i + "]");
+  var named = [];
+  intrinsic.forEach(["certificate", "tbsCert", "taInfo"], function (k) {
+    if (spec[k] !== undefined) guard.list.append(named, k);
+  });
+  if (named.length !== 1) {
+    throw _err("trustanchor/bad-input", "anchors[" + i + "] must name exactly one of certificate, tbsCert or taInfo, got " +
+      (named.length === 0 ? "none" : intrinsic.join(named, " and ")));
+  }
+  if (named[0] === "certificate") return b.raw(_b.reqDer(spec.certificate, "anchors[" + i + "].certificate"));
+  if (named[0] === "tbsCert") return b.explicit(1, b.raw(_b.reqDer(spec.tbsCert, "anchors[" + i + "].tbsCert")));
+  return b.explicit(2, _taInfoDer(spec.taInfo));
+}
+
+/**
+ * @primitive  pki.trustanchor.build
+ * @signature  pki.trustanchor.build(spec, opts?) -> Buffer | string
+ * @since      0.8.13
+ * @status     stable
+ * @spec       RFC 5914
+ * @related    pki.schema.trustanchor.parse, pki.trust.parseTrustAnchorList
+ *
+ * Build an RFC 5914 `TrustAnchorList`, the structure a root program publishes. `spec.anchors` is a
+ * non-empty array, each entry naming exactly one of `certificate` (pre-encoded Certificate DER),
+ * `tbsCert` (pre-encoded TBSCertificate DER) or `taInfo`.
+ *
+ * A `taInfo` entry is `{ pubKey, keyId, taTitle?, certPath?, exts?, taTitleLangTag? }`, where
+ * `pubKey` is SubjectPublicKeyInfo DER and `keyId` the key identifier bytes. `certPath` carries the
+ * constraints: `taName` (a distinguished name string or an array of relative names), `certificate`,
+ * `policySet` (an array of policy identifiers), `policyFlags`
+ * (`{ inhibitPolicyMapping, requireExplicitPolicy, inhibitAnyPolicy }`), `nameConstr` (pre-encoded
+ * NameConstraints DER) and `pathLenConstraint`.
+ *
+ * Every rule the parser enforces is enforced here, so this toolkit does not emit an anchor it would
+ * refuse to read: an empty `taName`, a `requireExplicitPolicy` with no `policySet`, a negative
+ * `pathLenConstraint`, and an `exts` entry naming one of the four extension types RFC 5914
+ * section 3 excludes. The result round-trips through `pki.schema.trustanchor.parse` before it is
+ * returned.
+ *
+ * The version is not a field a caller sets: v1 is the ASN.1 DEFAULT and DER omits it, so every v1
+ * anchor has one encoding.
+ *
+ * Two refusals are stricter than the module, on the principle that what this
+ * writes is what an operator publishes: `taTitleLangTag` may not be the empty string, which
+ * names no language, and `exts` may not carry one of the four extension types RFC 5914 section 3
+ * excludes, which a reader is told to ignore and which `certPath` states properly.
+ *
+ * @opts
+ *   - `pem` (boolean) -- return a PEM `TRUST ANCHOR LIST` string instead of DER.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var der = pki.trustanchor.build({ anchors: [{ taInfo: {
+ *     pubKey: await pki.key.export(pair.publicKey),
+ *     keyId: Buffer.alloc(20, 1),
+ *     taTitle: "Example Root CA",
+ *     certPath: { taName: "CN=Example Root", pathLenConstraint: 2 } } }] });
+ *   pki.schema.trustanchor.parse(der).anchors[0].taInfo.certPath.pathLenConstraint;  // -> 2
+ */
+function build(spec, opts) {
+  if (!spec || typeof spec !== "object" || intrinsic.isArray(spec)) {
+    throw _err("trustanchor/bad-input", "build expects a { anchors } specification object");
+  }
+  _known(spec, _BUILD_KEYS, "build");
+  var checked = guard.identifier.optionsObject(opts, _err, "trustanchor/bad-input", "pki.trustanchor.build options");
+  guard.identifier.assertKnownKeys(checked, intrinsic.assign(intrinsic.create(null), { pem: 1 }),
+    _err, "trustanchor/bad-input", "unknown pki.trustanchor.build option ");
+  if (!intrinsic.isArray(spec.anchors) || spec.anchors.length === 0) {
+    throw _err("trustanchor/bad-input", "build: anchors must be a non-empty array (TrustAnchorList is SIZE (1..MAX))");
+  }
+  var der = b.sequence(intrinsic.map(spec.anchors, function (a, i) { return _anchorDer(a, i); }));
+  /** @internal The reader reads the writer's output back before it is returned, so a shape the two
+   * disagree about fails the build instead of reaching an operator. */
+  try { trustanchor.parse(der); }
+  catch (e) { throw _err("trustanchor/bad-input", "the built trust anchor list does not parse: " + guard.text.describeThrown(e), e); }
+  if (checked.pem === true) return trustanchor.pemEncode(der);
+  return der;
+}
+
+void schema;
+void x509;
+
+module.exports = { build: build };

package/lib/validator-tpm.js

@@ -122,7 +122,7 @@ function normalizeObjectAttributePolicy(policy, E, code) {
   var explicit = policy.objectAttributes;
   if (explicit !== undefined) {
     if (!explicit || typeof explicit !== "object" || Array.isArray(explicit)) throw new E(code, "opts.tpmPolicy.objectAttributes must be an object");
-    Object.keys(explicit).forEach(function (n) {
+    guard.identifier.optionNames(explicit).forEach(function (n) {
       if (TPMA_OBJECT_BITS[n] === undefined) throw new E(code, "opts.tpmPolicy.objectAttributes has an unknown attribute " + JSON.stringify(n));
       if (typeof explicit[n] !== "boolean") throw new E(code, "opts.tpmPolicy.objectAttributes." + n + " must be a boolean");
       want[n] = explicit[n];

package/lib/webauthn-mds.js

@@ -440,7 +440,7 @@ function metadataAnchors(entry, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Array.isArray(opts)) throw _err("webauthn/bad-input", "metadataAnchors opts must be an object");
   guard.identifier.assertKnownKeys(opts, _ANCHOR_OPTS, _err, "webauthn/bad-input", "metadataAnchors opts has an unknown key ");
-  opts = Object.assign({}, opts);
+  opts = guard.identifier.ownOptions(opts);
   if (opts.time !== undefined) guard.time.assertValid(opts.time, _err, "webauthn/bad-input", "opts.time");
   if (opts.metadata !== undefined) {
     if (!isVerifiedResult(opts.metadata)) {

package/lib/webauthn.js

@@ -906,7 +906,7 @@ function verify(attestationObject, clientDataHash, opts) {
   try {
     if (!_isPlainObject(opts)) throw _err("webauthn/bad-input", "opts must be an object");
     guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "webauthn/bad-input", "opts has an unknown key ");
-    opts = Object.assign({}, opts);
+    opts = guard.identifier.ownOptions(opts);
     if (opts.time !== undefined) guard.time.assertValid(opts.time, _err, "webauthn/bad-input", "opts.time");
     _FORMAT_SCOPED_BOOLEAN_OPTS.forEach(function (k) {
       if (opts[k] !== undefined && typeof opts[k] !== "boolean") throw _err("webauthn/bad-input", "opts." + k + " must be a boolean");
@@ -957,10 +957,9 @@ function verify(attestationObject, clientDataHash, opts) {
   var bindingChecked, vopts;
   try {
     bindingChecked = _applyBindings(att.authData, att.authData.credentialPublicKey, opts);
-    vopts = Object.assign({}, opts, {
-      rootCertificates: _snapshotRoots(opts.rootCertificates),
-      safetyNetRoots: _snapshotRoots(opts.safetyNetRoots),
-    });
+    vopts = guard.identifier.ownOptions(opts);
+    vopts.rootCertificates = _snapshotRoots(opts.rootCertificates);
+    vopts.safetyNetRoots = _snapshotRoots(opts.safetyNetRoots);
   } catch (e) { return Promise.reject(e); }
   return Promise.resolve().then(function () { return verifier(att, clientDataHash, vopts); })
     .then(function (res) {
@@ -1478,8 +1477,7 @@ var _ASSERT_OPTS = Object.assign(Object.create(null), {
 function _snapshotAssertion(input) {
   if (!_isPlainObject(input)) throw _err("webauthn/bad-input", "pki.webauthn.verifyAssertion takes an options object");
   guard.identifier.assertKnownKeys(input, _ASSERT_OPTS, _err, "webauthn/bad-input", "verifyAssertion input has an unknown key ");
-  var out = intrinsic.create(null), k;
-  for (k in input) { if (_hasOwn(input, k)) out[k] = input[k]; }
+  var out = guard.identifier.ownOptions(input);
   ["authenticatorData", "clientDataJSON", "clientDataHash", "signature", "expectedChallenge"].forEach(function (f) {
     if (_isBufferSource(out[f])) out[f] = guard.bytes.snapshotSource(out[f], WebauthnError, "webauthn/bad-input", f);
   });
@@ -1487,9 +1485,10 @@ function _snapshotAssertion(input) {
     out.credentialPublicKey = guard.bytes.snapshotSource(out.credentialPublicKey, WebauthnError,
       "webauthn/bad-input", "credentialPublicKey");
   } else if (_isPlainObject(out.credentialPublicKey)) {
-    var key = intrinsic.create(null), kk;
-    for (kk in out.credentialPublicKey) {
-      if (!_hasOwn(out.credentialPublicKey, kk)) continue;
+    var key = intrinsic.create(null);
+    var coseNames = guard.identifier.optionNames(out.credentialPublicKey);
+    for (var ci = 0; ci < coseNames.length; ci++) {
+      var kk = coseNames[ci];
       var v;
       try { v = out.credentialPublicKey[kk]; }
       catch (e) { throw _err("webauthn/bad-cose-key", "credentialPublicKey." + kk + " could not be read", e); }

package/lib/webcrypto.js

@@ -116,8 +116,7 @@ function _normalizeAlg(algorithm, who) {
   if (!alg || typeof alg.name !== "string") {
     throw new WebCryptoError("webcrypto/syntax", (who || "operation") + ": algorithm must be a string or an object with a name");
   }
-  var out = intrinsic.create(null);
-  for (var k in alg) { if (_hasOwn(alg, k)) out[k] = alg[k]; }
+  var out = guard.identifier.ownOptions(alg);
   out.name = _toUpperCase(alg.name);
   return out;
 }
@@ -1030,7 +1029,8 @@ function _algFromImport(name, alg, keyObject) {
 function _curveFromKey(ko) {
   try {
     var jwk = ko.export({ format: "jwk" });
-    for (var k in CURVE_NODE) { if (jwk.crv === k) return k; }
+    var curves = guard.identifier.optionNames(CURVE_NODE);
+    for (var k = 0; k < curves.length; k++) { if (jwk.crv === curves[k]) return curves[k]; }
   }
   catch (_e) { }
   return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.11",
+  "version": "0.8.14",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",