@blamejs/pki 0.8.12 → 0.8.14

package/CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.14 — 2026-09-24
+
+The 0.8.14 tarball is the one to install for everything 0.8.13 added.
+
+### Fixed
+
+- The changelog entry for this release is dated by the UTC day its commit landed on, which is the day the release tooling and the entry now agree on.
+
+## v0.8.13 — 2026-09-24
+
+A trust anchor list published as RFC 5914 drives path validation, constraints and all.
+
+### Added
+
+- `pki.schema.trustanchor.parse(input, caps?)` reads an RFC 5914 `TrustAnchorList` into `{ anchors }`, each entry naming which of the three `TrustAnchorChoice` arms it came from in `kind`: `certificate`, `tbsCert` (a bare `TBSCertificate`, an anchor having no signature to check) or `taInfo`. `parseInfo` reads a bare `TrustAnchorInfo`. `pemDecode` and `pemEncode` carry the `TRUST ANCHOR LIST` label, and `pki.schema.parse` detects and routes the format.
+- A `taInfo` entry is `{ version, pubKey, keyId, taTitle, certPath, exts, excludedExtensions, taTitleLangTag }`. `certPath` carries the anchor's name and its constraints: `policySet`, `policyFlags`, `nameConstr` and `pathLenConstraint`. Every rule RFC 5914 states is enforced: an empty `taName`, a `policySet` carrying policy qualifiers, a negative `pathLenConstraint` and a `requireExplicitPolicy` with no `policySet` are each refused, and where `certPath` carries a certificate its subject, its public key and its `subjectKeyIdentifier` must match `taName`, `pubKey` and `keyId`. The four extension types section 3 excludes from `exts` are listed in `excludedExtensions` and left out of `exts`, because the RFC ignores them rather than refusing the anchor.
+- `pki.trust.parseTrustAnchorList(input, opts?)` turns a list into the trust-store entries `pki.trust.anchor` takes, the same shape `parseCertdata` and `parseCcadbCsv` produce, so a published list drives `pki.path.validate` without being mapped by hand.
+- `pki.path.validate` applies an RFC 5914 anchor's constraints as RFC 5937 section 3.2 states. The anchor's name constraints intersect the caller's permitted subtrees and union its excluded ones, its `policySet` intersects `opts.userInitialPolicySet`, each of its `policyFlags` may turn the matching `initialExplicitPolicy` / `initialPolicyMappingInhibit` / `initialAnyPolicyInhibit` on and never off, and its `pathLenConstraint` bounds the path. An anchor can only narrow what the caller asked for, which is what makes the format's "always enforced" safe to apply.
+- `pki.trustanchor.build(spec, opts?)` writes the list a root program publishes, with `opts.pem` for the PEM form. Every rule the parser enforces is enforced here, so the toolkit does not emit an anchor it would refuse to read, and the result round-trips through the parser before it is returned. The `version` is not a field a caller sets: v1 is the ASN.1 DEFAULT and DER omits it, so each v1 anchor has one encoding.
+
+### Changed
+
+- `pki.trust.anchor` keeps an entry's `purposes` as `null` where the entry states it as `null`, rather than reading it as a set granting nothing. A store that lists a root and grants it no purpose still produces the all-false set, which is what `pki.path.validate` requires `opts.checkPurpose` to judge; a format carrying no purpose bits at all, such as an RFC 5914 anchor, now says nothing instead of saying "trusted for no purpose". An entry that omits `purposes` altogether is unchanged and still defaults to all-false.
+
+### Fixed
+
+- An option supplied as a non-enumerable own property now reaches the code that acts on it. Every verb accepted such an option and some then skipped it, with nothing reported. Two of them let a check pass that should have failed: `pki.webauthn.verifyAssertion` ignored an `expectedRpId` written that way and reported the assertion valid against the wrong relying party, and an `opts.tpmPolicy.objectAttributes` entry went unchecked in `pki.webauthn.verify`. The rest changed what was produced or refused: `pki.attrcert.sign` left the named extension or attribute out of the certificate it signed, `pki.crmf.build` left the control out of the request, and `pki.cmp.session` answered that no enrollment arm or support operation had been named, or classified an `ir` request as central key generation.
+- The same read now applies wherever the toolkit copies or enumerates an object it was handed: `pki.path.validate`, `pki.trust`, `pki.cms.verify`, `pki.cmc`, `pki.est`, `pki.ocsp`, `pki.acme`, `pki.ct`, `pki.scep`, `pki.smime`, `pki.webauthn` and the WebCrypto algorithm surface. It covers the response an `opts.transport` returns, so a `Location`, `WWW-Authenticate`, `Retry-After` or `Content-Type` field a custom transport defines non-enumerably is now found. A caller passing plain objects sees no change.
+- In `pki.path.validate`, an anchor carrying any RFC 5914 constraint could accept a path that the same call without the anchor refused, because the caller's `initialExplicitPolicy`, `initialPolicyMappingInhibit`, `initialAnyPolicyInhibit` and `userInitialPolicySet` were re-read from a copy that kept only the enumerable ones. The caller's options are now read where they were passed.
+- A trust anchor's own `basicConstraints` `pathLenConstraint` now bounds the path below it, as RFC 5937 section 3.2 requires of a basic constraints extension associated with the anchor. It applies wherever the anchor states one: a certificate passed to `pki.path.validate` or `pki.trust.anchor`, the `exts` of an RFC 5914 `TrustAnchorInfo`, and that anchor's `certPath.pathLenConstraint`. Where two of them state a limit, the lower applies. **A path that runs deeper than an anchor certificate's `pathLenConstraint` allows is now refused where it previously validated.** Check the certificates in your trust store for a `pathLenConstraint` if you validate chains with intermediates.
+- `pki.trustanchor.build` refuses a malformed nested record with its own `trustanchor/bad-input` error. A `null` or non-object `taInfo`, `certPath` or `certPath.policyFlags` raised a native `TypeError` from the first field read below it.
+- Parsing no longer writes a decoded field through an accessor planted on `Object.prototype`. Every format parser builds its record in the schema engine by the field names its structure declares, and those writes reached the prototype chain: a getter-only `signatureAlgorithm`, `issuer`, `extensions` or any other declared name made an ordinary `pki.schema.x509.parse` of a valid certificate throw a native `TypeError`, and a setter took the decoded value instead of the record.
+
 ## v0.8.12 — 2026-09-23
 
 A certification path whose policies map to each other validates instead of exhausting the policy-node budget.

package/README.md

@@ -247,6 +247,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.schema.c509` | C509 certificates (draft-ietf-cose-cbor-encoded-cert), the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR. `encode` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte, so the original signature still verifies. A `parse` result re-emits its native array in canonical deterministic CBOR, with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms: the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, inhibitAnyPolicy, OCSP No Check, TLS Feature), the general-name-bearing extensions (subjectAltName, issuer alternative name, name constraints, CRL distribution points, freshest CRL, authority and subject information access, and the full authority key identifier) over one shared GeneralNames codec, certificate policies with their CPS-URI and UserNotice qualifiers, policy mappings and policy constraints, subject directory attributes, and the RFC 3779 resource-delegation extensions (IP address blocks and AS identifiers) with their RFC 8360 v2 twins, whose addresses ride either the delta-coded integer form or the byte-string form the specification mandates once an address exceeds eight octets. A value the compact form cannot carry exactly falls back to the byte-string form with its bytes intact; a certificate outside the invertible set throws a typed `C509Error`. Called explicitly, since it is CBOR rather than DER and so is not auto-routed |
 | `pki.schema.crl` | X.509 CRLs (RFC 5280 §5): revoked serials with real-`Date` revocation times, named and partly decoded extensions, each record carrying the raw `extnValue` octets as `valueBytes`. `decodeExtensions` returns the CRL's own extensions and every revoked entry's in one array, each row naming the scope it was read at, and covers the whole §5.2 and §5.3 profile including the issuing distribution point and the delta CRL indicator. `decodeExtension` takes the scope explicitly, since RFC 6960 §4.4.5 carries a CRL entry extension into an OCSP response Fail-closed — `parse`, `pemDecode`, `pemEncode`, `decodeExtensions`, `decodeExtension` |
 | `pki.schema.csr` | PKCS#10 certification requests (RFC 2986): subject DN, public key, requested attributes, signature. `decodeExtensions` is what a CA reads to see what a request asked for, returning the rows of its one `extensionRequest` attribute; a request carrying more than one is refused, and `groups: true` reads each separately Fail-closed — `parse`, `pemDecode`, `pemEncode`, `decodeExtensions`, `decodeExtension` |
+| `pki.schema.trustanchor` | RFC 5914 trust anchor lists: a trust anchor as a structure rather than as a certificate, carrying the constraints a root program otherwise states out of band. `parse` reads a `TrustAnchorList` into `{ anchors }`, each naming which of the three `TrustAnchorChoice` arms it came from: a `certificate`, a bare `tbsCert` (an anchor has no signature to check), or a `taInfo`. A `taInfo` carries the public key, the key identifier, an optional title, and a `certPath` stating the name the anchor is known by plus the policies it may assert, the namespace it is trusted for, and how far below it a path may run. Every rule RFC 5914 states is enforced: an empty `taName`, a policy set carrying qualifiers, a negative path length, and a `requireExplicitPolicy` with no policy set are each refused, and where the anchor carries a certificate its subject, public key and `subjectKeyIdentifier` must match the anchor's own. The four extension types the RFC excludes from `exts` are reported and left out rather than refused, as it says to ignore them. `parseInfo` reads a bare `TrustAnchorInfo`. `pki.trust.parseTrustAnchorList` turns a list into anchors `pki.path.validate` consumes, and `pki.trustanchor.build` writes one Fail-closed — `parse`, `parseInfo`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | PKCS#8 private keys (RFC 5208 / 5958): algorithm, raw key bytes, attributes, optional public key. Encrypted keys are recognized but not decrypted. Fail-closed — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
 | `pki.schema.cms` | CMS (RFC 5652 / 5083 / 9629): SignedData (§5, signer infos plus raw signed-attribute bytes for external verification), EnvelopedData (§6, all five RecipientInfo kinds including RFC 5753 key agreement and RFC 9629 KEM recipients with ML-KEM validation), EncryptedData (§8), AuthenticatedData (§9, MAC surface plus raw `authAttrsBytes`), and AuthEnvelopedData (RFC 5083, with RFC 5084 AES-GCM/CCM parameter validation). §11 attribute placement is enforced, countersignatures validate recursively, certificates and CRLs are validated against the closed CHOICE sets and kept raw, and every result is tagged `contentTypeName` Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | OCSP requests and responses (RFC 6960): per-certificate status (good, revoked, unknown), responder identity, raw tbs bytes for external verification, certificates kept raw. A response's nonce, and a single response's archive cutoff (§4.4.4) and CRL reference (§4.4.2), are decoded onto their extension entries by name; a malformed one is refused. Non-basic response types are recognized but not decoded. Fail-closed — `parseRequest`, `parseResponse`, `pemDecode`, `pemEncode` |
@@ -282,7 +283,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.ocsp` | Online Certificate Status Protocol (RFC 6960), both the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs, with the CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile (obsoleted by RFC 9919) or under SHA-2, plus an optional RFC 9654 nonce (32 to 128 octets, the requester floor that section sets) and an optional requestor signature, under which the signer certificate's subject is the requestorName unless one is stated (RFC 6960 §4.1.2). `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER, from the issuing CA directly or a delegated responder, under any `pki.cms.sign` key including the post-quantum ML-DSA and SLH-DSA sets, with `good`, `revoked` (reason and time), or `unknown` per-certificate status, and per-response `singleExtensions` naming the §4.4.4 archive cutoff and the §4.4.2 CRL reference as fields, each read back by name by the parser. The signer refuses what its own lint would grade an error: a pre-encoded singleExtension that RFC 6960 places in requests or in responseExtensions, a CRL entry extension carried at the wrong criticality, and CRL references or entry extensions on a non-issued response, which itself places the §4.4.8 extended revoked definition in responseExtensions without being asked. `buildErrorResponse(status)` produces the unsigned §2.3 error (`tryLater`, `unauthorized`, and the rest). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA, or a CA-issued delegate bearing id-kp-OCSPSigning and id-pkix-ocsp-nocheck and passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency against `thisUpdate` and `nextUpdate`, and the request-nonce echo. It returns `{ status: "good" / "revoked" / "unknown", ... }` and never silently accepts. `verifyRequest(request, opts)` is the responder-side inverse of `buildRequest`: it verifies a client's signed request (RFC 6960 §4.1.1) under the requestor certificate the request carries, trying each embedded certificate since the field is unordered, and reports `signed`, `signatureValid`, every certificate whose key verified the signature and whose subject is the `requestorName` the request states (`signerCerts`, so a key carried under an expired certificate beside its renewal is not hidden behind ordering, while a same-key certificate under another name is not the requestor) with the first one's decoded subject, the full embedded certificate bag (`certs`, including intermediates for path building), and the request's CertIDs; the name check is reported as `requestorNamed` (RFC 6960 §4.1.2) and `valid` requires it, a request no verifying certificate names falls back to listing the verifying ones with `valid: false`, and an unsigned request is reported with `signed: false` rather than refused. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify`, `verifyRequest` |
 | `pki.ct` | Certificate Transparency (RFC 6962). `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries, a TLS-presentation-language payload inside the §3.3 double DER wrap, into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature. `reconstructSignedData` rebuilds the exact `digitally-signed` preimage, and `verifySct` verifies an SCT signature against a log's public key, routing an ECDSA signature through the strict DER-conformance gate and verifying through the crypto engine, resolving true or false and throwing a typed error on a structural fault. On the producing side, `encodeSctList` builds the extension value byte for byte as the exact inverse of `parseSctList`, and `signSct` performs a log's signing step. For trust, `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs, recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2) and decoding the state and temporal-interval constraints; `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable, qualified, and readonly trusted; retired only before retirement; pending and rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. `verifyLogListSignature(json, signature, publicKey)` verifies the detached `log_list.sig` over the raw log-list bytes against a caller-pinned signer key (RSASSA-PKCS1-v1.5/SHA-256 and an EC P-256 arm, with forgeable-key defenses failing closed), cross-checked against `openssl dgst`. `fetchLogList(opts)` turns that chain into a live client: it GETs the `log_list.json` and its detached `log_list.sig` over `pki.transport`, verifies the detached signature over the raw fetched bytes against a caller-pinned distributor key before parsing, so an unverified document is never parsed, read, cached, or surfaced, then ingests the same bytes through `parseLogList` and returns the trusted-log set plus the surfaced `version` and `timestamp`. Above the per-SCT layer, `verifySctList` renders a certificate-level verdict over every SCT a certificate carries (§3.3), reporting how many distinct trusted logs verified an SCT (so a duplicated SCT cannot inflate the count) and from how many distinct trusted operators against a caller's CT policy (`minScts` and `minOperators`, both defaulting to the RFC floor of one), where a policy shortfall is a verdict and a per-SCT failure is a recorded row rather than a thrown call; `x509CertEntry` reconstructs the precertificate log entry from a final certificate by removing the SCT-list extension from its TBSCertificate as byte surgery, so its embedded SCTs verify end to end (§3.2). The toolkit bakes in no vendor URL or key, TLS trust is explicit with `rejectUnauthorized` always on, each response is size-capped before the trust chain, and the transport is injectable so the whole path is testable offline — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList`, `verifySctList`, `x509CertEntry`, `verifyLogListSignature`, `fetchLogList` |
 | `pki.merkle` | Merkle-tree proof verification (RFC 6962 / RFC 9162). `leafHash`, `nodeHash`, and `emptyRootHash` build the domain-separated (0x00 leaf, 0x01 node) SHA-256 tree hashes. `verifyInclusion` folds an audit proof back to a root, and `verifyConsistency` reconstructs both the old and new root, which is the append-only guarantee; each is constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
-| `pki.trust` | Mozilla and CCADB trust-store ingestion. `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export, both into one constraint-carrying anchor shape: the per-purpose trust bits, where only `CKT_NSS_TRUSTED_DELEGATOR` grants, and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer and serial rather than adjacency and are cross-checked against the parsed DER, so metadata cannot attach to the wrong root. `anchor()` hands an entry to `pki.path.validate({ trustAnchors, checkPurpose })`, and `anchor(entry, { nameConstraints })` attaches the namespace a root program trusts a root for when that is narrower than the root certificate states, a `{ permitted, excluded }` pair of `{ tag, base }` subtrees that `validate` seeds as the RFC 5280 §6.1.1(h)(i) initial value, intersecting with each certificate's own constraints. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
+| `pki.trust` | Mozilla and CCADB trust-store ingestion. `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export, both into one constraint-carrying anchor shape: the per-purpose trust bits, where only `CKT_NSS_TRUSTED_DELEGATOR` grants, and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer and serial rather than adjacency and are cross-checked against the parsed DER, so metadata cannot attach to the wrong root. `anchor()` hands an entry to `pki.path.validate({ trustAnchors, checkPurpose })`, and `anchor(entry, { nameConstraints })` attaches the namespace a root program trusts a root for when that is narrower than the root certificate states, a `{ permitted, excluded }` pair of `{ tag, base }` subtrees that `validate` seeds as the RFC 5280 §6.1.1(h)(i) initial value, intersecting with each certificate's own constraints. `parseTrustAnchorList` reads the IETF's own interchange format for the same thing, an RFC 5914 `TrustAnchorList`, into the same entries, so a list a root program publishes drives `validate` without being mapped by hand. An RFC 5914 anchor's constraints are applied as RFC 5937 §3.2 states, which is that the stricter of the anchor's value and the caller's always wins: its name constraints intersect the caller's permitted subtrees and union its excluded ones, its policy set intersects `userInitialPolicySet`, each of its policy flags may turn the matching `initial*` option on and never off, and its path length bounds the path. `pki.trustanchor.build` writes the list. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `parseTrustAnchorList`, `anchor` |
 | `pki.shbs` | Stateful hash-based signature verification: HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and in CMS by RFC 9708, profiled by NIST SP 800-208 for CNSA 2.0 firmware signing. `verify` checks an HSS signature, where every level must pass, and `verifyLms` a single-tree LMS, over the raw public-key and signature blobs the parsers already surface. Pure public-input SHA-256 and SHAKE256 hashing, a data-driven typecode registry, and bounds-before-slice reads; a malformed blob throws a typed `ShbsError` while a well-formed but wrong signature returns `false`. Verification only by design, since stateful signing needs atomic one-time-key state that belongs in an HSM. `pki.path.validate` verifies an HSS-signed certificate on its own, so a chain reaching one needs no separate call: the signature covers the whole tbsCertificate rather than a digest of it (RFC 9802 §7.1), and a CertificateList naming the algorithm takes the same route. It is proven against the self-signed certificate RFC 9802 Appendix A publishes — `verify`, `verifyLms` |
 | `pki.hpke` | Hybrid Public Key Encryption (RFC 9180), the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS` and `setupR` establish a sender or recipient context (KEM encapsulation plus the HKDF key schedule); the context's `seal` and `open` AEAD-encrypt with a sequence-counter nonce, and `export` derives further secrets; the module-level `seal` and `open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) in all four modes, proven against the RFC 9180 Appendix A vectors, and the post-quantum ML-KEM-512/768/1024 KEMs (IANA 0x0040 to 0x0042) in the base and psk modes, proven against the draft-ietf-hpke-pq Appendix A vectors; HKDF-SHA256/SHA384/SHA512 by AES-GCM / ChaCha20Poly1305 / export-only. DHKEM(P-384) has no vector under an HKDF key schedule and fails closed. Pure composition over `node:crypto`; the PQ/T hybrid KEMs are a registry data-row extension once the CFRG combiner draft stabilizes — `suites`, `setupS`, `setupR`, `seal`, `open` |
 | `pki.kem` | Composite ML-KEM key establishment (draft-ietf-lamps-pq-composite-kem), a post-quantum ML-KEM hybridized with a traditional RSA-OAEP, ECDH, X25519, or X448 so the established secret holds if either component is later broken. `encapsulate` turns a recipient's composite `SubjectPublicKeyInfo` into a 256-bit shared secret and a ciphertext; `decapsulate` recovers the same secret from the ciphertext and the composite PKCS#8 private key. Each component KEM runs independently and the two secrets are mixed through a SHA3-256 combiner that binds the traditional ciphertext, the traditional public key, and a per-algorithm label. The twelve algorithms pair ML-KEM-768 and ML-KEM-1024 with RSA-OAEP 2048/3072/4096, ECDH over P-256/P-384/P-521 and brainpoolP256r1/P384r1, X25519, and X448, each verified against the draft Appendix G known-answer vectors; a malformed key or ciphertext, an unsupported algorithm, or a component decapsulation failure throws a typed `KemError` — `encapsulate`, `decapsulate` |

package/index.js

@@ -63,6 +63,7 @@ var transport  = require("./lib/http-transport");
 var jose       = require("./lib/jose");
 var acme       = require("./lib/acme");
 var trust      = require("./lib/trust");
+var trustanchorBuild = require("./lib/trustanchor-build");
 var inspect    = require("./lib/inspect");
 var lint       = require("./lib/lint");
 var webauthn   = require("./lib/webauthn");
@@ -213,6 +214,11 @@ module.exports = {
   // root list omits); pki.trust.anchor hands one to pki.path.validate. Offline:
   // the operator supplies the text; no fetch.
   trust:     trust,
+  // `trustanchor` writes the RFC 5914 TrustAnchorList a root program publishes:
+  // each anchor as a certificate, a bare TBSCertificate, or a TrustAnchorInfo
+  // carrying the name it is known by plus the policies, namespace and path
+  // length a relying party applies beneath it. pki.schema.trustanchor reads one.
+  trustanchor: trustanchorBuild,
   // `inspect` is human-readable inspection -- pki.inspect.certificate(pem|der|parsed)
   // renders an OpenSSL-familiar `x509 -text`-style report from the strict parser +
   // OID registry, naming extension/algorithm OIDs OpenSSL shows only as raw bytes.

package/lib/acme.js

@@ -1631,7 +1631,10 @@ function _parseLinkValue(raw) {
 function _parseLinkRelation(headers, base, relName, opts) {
   opts = opts || {};
   var raw = null;
-  for (var k in headers) { if (_hasOwn(headers, k) && k.toLowerCase() === "link") { raw = headers[k]; break; } }
+  var hNames = guard.identifier.optionNames(headers);
+  for (var hi = 0; hi < hNames.length; hi++) {
+    if (hNames[hi].toLowerCase() === "link") { raw = headers[hNames[hi]]; break; }
+  }
   if (raw == null) return [];
   var baseUrl = new URL(base), baseOrigin = baseUrl.origin, baseHref = baseUrl.href;
   var baseKey = _dedupKey(baseHref);
@@ -1867,8 +1870,7 @@ function client(directoryUrl, opts) {
       return guard.async.invoked(transport, [{ method: method, url: url, headers: reqHeaders, body: body, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "acme/bad-input", "opts.transport");
     }).then(function (res) {
       res = res || {};
-      var h = intrinsic.create(null);
-      Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
+      var h = guard.header.lowerCased(res.headers);
       var blen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8")
         : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, E, "acme/bad-response", "the response body"))));
       if (blen > budgets.maxResponseBytes) throw E("acme/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");
@@ -1940,7 +1942,11 @@ function client(directoryUrl, opts) {
   }
   function _post(url, builder, extra, mode, accept, okStatuses) {
     return _postJws(url, function (nonce, override) {
-      var base = Object.assign({}, extra || {}, { key: override ? override.key : accountKey, alg: override ? override.alg : alg, nonce: nonce, url: url });
+      var base = guard.identifier.ownOptions(extra);
+      base.key = override ? override.key : accountKey;
+      base.alg = override ? override.alg : alg;
+      base.nonce = nonce;
+      base.url = url;
       if (mode === "jwk") base.jwk = override ? _jwkForAlg(accountJwk, override.alg) : accountJwk; else base.kid = _requireKid();
       return builder(base);
     }, accept, okStatuses, true);
@@ -2136,7 +2142,9 @@ function client(directoryUrl, opts) {
       return _resource("revokeCert").then(function (url) {
         if (certKeyMode) {
           return _postJws(url, function (nonce) {
-            return revokeCert(Object.assign({}, extra, { key: o.certKey, alg: o.certAlg, nonce: nonce, url: url, jwk: o.certJwk }));
+            var rb = guard.identifier.ownOptions(extra);
+            rb.key = o.certKey; rb.alg = o.certAlg; rb.nonce = nonce; rb.url = url; rb.jwk = o.certJwk;
+            return revokeCert(rb);
           }).then(function () { return true; });
         }
         return _post(url, revokeCert, extra, "kid").then(function () { return true; });

package/lib/attrcert-sign.js

@@ -202,7 +202,7 @@ function _objectDigestInfoContent(odi) {
 function _encodeHolder(holder) {
   if (!holder || typeof holder !== "object" || Buffer.isBuffer(holder)) throw _err("attrcert/bad-input", "holder must be an object with exactly one form");
   guard.identifier.assertKnownKeys(holder, KNOWN_HOLDER_KEYS, _err, "attrcert/bad-input", "unknown holder form ");
-  var forms = Object.keys(holder).filter(function (k) { return holder[k] != null; });
+  var forms = guard.identifier.optionNames(holder, KNOWN_HOLDER_KEYS).filter(function (k) { return holder[k] != null; });
   if (forms.length !== 1) throw _err("attrcert/bad-input", "holder must carry exactly one form (entityName, baseCertificateID, fromCertificate, or objectDigestInfo), got " + forms.length);
   if (holder.entityName != null) {
     return b.sequence([_b.encodeGeneralNames(_gnList(holder.entityName), 1)]);
@@ -403,7 +403,7 @@ function _buildAttributes(attrSpec) {
   guard.identifier.assertKnownKeys(attrSpec, ATTR_VALUE_ENCODER, _err, "attrcert/bad-input", function (k) {
     return "unknown attribute " + JSON.stringify(k) + "; pass a pre-encoded Attribute DER via the array form for a custom attribute";
   });
-  Object.keys(attrSpec).forEach(function (k) {
+  guard.identifier.optionNames(attrSpec, ATTR_VALUE_ENCODER).forEach(function (k) {
     add(O(ATTR_OID_NAME[k]), ATTR_VALUE_ENCODER[k](attrSpec[k]));
   });
   if (!attrs.length) throw _err("attrcert/bad-attributes", "attributes must carry at least one Attribute (RFC 5755 sec. 4.2.7)");
@@ -462,7 +462,7 @@ function _buildExtensions(extSpec, ctx) {
   });
   var out = [], seen = intrinsic.create(null);
   var akiDeclined = false;
-  Object.keys(extSpec).forEach(function (k) {
+  guard.identifier.optionNames(extSpec, EXT_META).forEach(function (k) {
     var val = extSpec[k];
     if (val == null) return;
     if (k === "authorityKeyIdentifier" && val === false) { akiDeclined = true; return; }

package/lib/cmc-build.js

@@ -983,10 +983,10 @@ async function _build(spec, signer, opts) {
 function _copySigners(signer, owned) {
   function one(s) {
     if (!s || typeof s !== "object") return s;
-    var out = intrinsic.create(null), k;
-    for (k in s) {
-      if (!_hasOwn(s, k)) continue;
-      out[k] = copyValue(s[k], k === "key");
+    var out = intrinsic.create(null);
+    var sNames = guard.identifier.optionNames(s);
+    for (var si = 0; si < sNames.length; si++) {
+      out[sNames[si]] = copyValue(s[sNames[si]], sNames[si] === "key");
     }
     return out;
   }
@@ -997,11 +997,11 @@ function _copySigners(signer, owned) {
     }
     if (Buffer.isBuffer(v) || v instanceof Uint8Array) return _own(Buffer.from(v), true);   // allow:byte-source-narrow -- private key bytes (Buffer borrowed / Uint8Array copied+wiped)
     if (!v || typeof v !== "object" || typeof v.type === "string") return v;
-    var c = intrinsic.create(null), ck;
-    for (ck in v) {
-      if (!_hasOwn(v, ck)) continue;
-      var cv = v[ck];
-      c[ck] = (Buffer.isBuffer(cv) || cv instanceof Uint8Array) ? _own(Buffer.from(cv), true) : cv;   // allow:byte-source-narrow -- composite key component
+    var c = intrinsic.create(null);
+    var cNames = guard.identifier.optionNames(v);
+    for (var ci = 0; ci < cNames.length; ci++) {
+      var cv = v[cNames[ci]];
+      c[cNames[ci]] = (Buffer.isBuffer(cv) || cv instanceof Uint8Array) ? _own(Buffer.from(cv), true) : cv;   // allow:byte-source-narrow -- composite key component
     }
     return c;
   }

package/lib/cmc-verify.js

@@ -336,8 +336,7 @@ function _copyAnyBytes(v) {
 }
 
 function _snapshotSent(sent) {
-  var out = intrinsic.create(null), k;
-  for (k in sent) { if (_hasOwn(sent, k)) out[k] = sent[k]; }
+  var out = guard.identifier.ownOptions(sent);
   if (out.transactionId != null) {
     out.transactionIdValue = guard.range.authoredInteger(out.transactionId, E, "cmc/bad-input", "sent.transactionId");
   }
@@ -355,9 +354,10 @@ function _snapshotSent(sent) {
   var takenSecret = null;
   try {
     if (out.recipient && typeof out.recipient === "object") {
-      var r = intrinsic.create(null), rk;
-      for (rk in out.recipient) {
-        if (!_hasOwn(out.recipient, rk)) continue;
+      var r = intrinsic.create(null);
+      var rNames = guard.identifier.optionNames(out.recipient);
+      for (var ri = 0; ri < rNames.length; ri++) {
+        var rk = rNames[ri];
         r[rk] = _copyAnyBytes(out.recipient[rk]);
         if (rk === "secret" && guard.bytes.isByteSource(r[rk])) takenSecret = r[rk];
       }

package/lib/cmp-build.js

@@ -552,7 +552,7 @@ function _encodeNestedContent(list) {
 
 function _encodeBody(bodySpec, key, opts) {
   if (!bodySpec || typeof bodySpec !== "object" || Buffer.isBuffer(bodySpec)) throw _err("cmp/bad-input", "message.body must be a single-key object");
-  var keys = Object.keys(bodySpec);
+  var keys = guard.identifier.optionNames(bodySpec);
   if (keys.length !== 1) throw _err("cmp/bad-input", "message.body must have exactly one arm, got " + keys.length);
   var arm = keys[0];
   if (!KNOWN_BODY_KEYS[guard.text.keyOf(arm)]) throw _err("cmp/bad-input", "unknown body arm " + guard.text.showValue(arm));
@@ -1055,7 +1055,7 @@ function _transfer(url, message, opts) {
   try { proxy = httpTransport.snapshotProxy(opts.proxy); }
   catch (e) { throw _err("cmp/bad-input", "the options object could not be read", e); }
   var headers = intrinsic.create(null);
-  Object.keys(opts.headers || {}).forEach(function (k) {
+  guard.identifier.optionNames(opts.headers).forEach(function (k) {
     var lk = k.toLowerCase();
     if (lk !== "content-length" && lk !== "transfer-encoding" && lk !== "content-type") headers[k] = opts.headers[k];
   });
@@ -1063,8 +1063,7 @@ function _transfer(url, message, opts) {
   var tls = _tlsForTransfer(opts);
   return guard.async.invoked(transport, [{ method: "POST", url: parsedUrl.href, headers: headers, body: der, tls: tls, proxy: proxy, timeout: timeout, maxResponseBytes: maxResponseBytes }], _err, "cmp/bad-input", "opts.transport").then(function (res) {
     res = res || {};
-    var h = intrinsic.create(null);
-    Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
+    var h = guard.header.lowerCased(res.headers);
     var body = guard.bytes.isByteSource(res.body)
       ? guard.bytes.source(res.body, CmpError, "cmp/bad-response", "the CMP response body")
       : Buffer.from(String(res.body == null ? "" : res.body), "utf8");

package/lib/cmp-session.js

@@ -435,7 +435,7 @@ function session(opts) {
    * drop the one the caller supplied, and send the session to the default client instead. */
   var _transport = guard.identifier.assertCallableOption(opts, "transport", _err, "cmp/bad-input",
     "opts.transport", "(url, reqDer, opts) => Promise<{ responseBytes, status }>");
-  opts = Object.assign({}, opts);
+  opts = guard.identifier.ownOptions(opts);
   if (typeof opts.url !== "string" || !opts.url) throw _err("cmp/bad-input", "opts.url (the CMP endpoint) is required");
 
   var isSig = opts.key != null || opts.cert != null;
@@ -930,12 +930,12 @@ function session(opts) {
    * than a record, and is left to the builder's own snapshot. */
   function _snapshotArm(armSpec) {
     if (!_isRecord(armSpec)) return armSpec;
-    var copy = Object.assign({}, armSpec);
-    if (_isRecord(copy.certTemplate)) copy.certTemplate = Object.assign({}, copy.certTemplate);
+    var copy = guard.identifier.ownOptions(armSpec);
+    if (_isRecord(copy.certTemplate)) copy.certTemplate = guard.identifier.ownOptions(copy.certTemplate);
     /** @internal The proof of possession is copied for the same reason the template is: the session
      * decides on `pop.type` which modes it will send, and a field answering one way to that decision
      * and another to the builder would put a request on the wire in a mode the session refused. */
-    if (_isRecord(copy.pop)) copy.pop = Object.assign({}, copy.pop);
+    if (_isRecord(copy.pop)) copy.pop = guard.identifier.ownOptions(copy.pop);
     return copy;
   }
   /** @internal A record the session copies field by field, as opposed to a byte source, which every
@@ -1132,7 +1132,7 @@ function session(opts) {
      * sends the ONE arm it read out of this object, so a key the session does not recognize would
      * otherwise be dropped silently instead of naming the caller's mistake. */
     guard.identifier.assertKnownKeys(request, ENROLL_ARMS, _err, "cmp/bad-input", "unknown enroll request field ");
-    var arms = Object.keys(request).filter(function (k) { return request[k] != null; });
+    var arms = guard.identifier.optionNames(request, ENROLL_ARMS).filter(function (k) { return request[k] != null; });
     if (arms.length !== 1 || !ENROLL_ARMS[arms[0]]) {
       throw _err("cmp/bad-input", "enroll(request) must carry EXACTLY ONE enrollment arm (ir / cr / kur / p10cr)");
     }
@@ -1569,7 +1569,7 @@ function session(opts) {
   async function _info(request) {
     guard.identifier.assertPlainRecord(request, _err, "cmp/bad-input", "info(request), an object naming one support operation (caCerts / rootCaCert / certReqTemplate / crlUpdate),");
     guard.identifier.assertKnownKeys(request, INFO_OPS, _err, "cmp/bad-input", "unknown info request field ");
-    var keys = Object.keys(request), names = [], values = [];
+    var keys = guard.identifier.optionNames(request, INFO_OPS), names = [], values = [];
     for (var ki = 0; ki < keys.length; ki++) {
       var kv = request[keys[ki]];
       if (kv == null) continue;

package/lib/cms-verify.js

@@ -608,10 +608,10 @@ function _cloneAnchorValue(v, depth) {
       " levels, so it cannot be copied before the chain is walked; pass the anchor as certificate DER or a { name, publicKey, algorithm } tuple");
   }
   if (Array.isArray(v)) return guard.list.copyMap(v, function (e) { return _cloneAnchorValue(e, depth + 1); });
-  var out = intrinsic.create(null), k;
-  for (k in v) {
-    if (!intrinsic.hasOwn(v, k)) continue;
-    out[k] = _cloneAnchorValue(v[k], depth + 1);
+  var out = intrinsic.create(null);
+  var vNames = guard.identifier.optionNames(v);
+  for (var vi = 0; vi < vNames.length; vi++) {
+    out[vNames[vi]] = _cloneAnchorValue(v[vNames[vi]], depth + 1);
   }
   return out;
 }

package/lib/crl-sign.js

@@ -196,7 +196,7 @@ function _validatePreEncodedIdp(inner) {
 function _freshestValue(spec) {
   if (!Array.isArray(spec) || !spec.length) throw _err("crl/bad-input", "freshestCRL must be a non-empty array of GeneralNames (or { fullName } distribution points)");
   var dense = _b.reqDenseArray(spec, "freshestCRL");
-  var dps = dense.every(function (e) { return e && typeof e === "object" && !Buffer.isBuffer(e) && Object.keys(e).length === 1 && e.fullName != null; })
+  var dps = dense.every(function (e) { return e && typeof e === "object" && !Buffer.isBuffer(e) && guard.identifier.optionNames(e).length === 1 && e.fullName != null; })
     ? dense.map(function (dp) { return dp.fullName; })
     : [dense];
   return b.sequence(dps.map(function (fullName) {

package/lib/crmf-sign.js

@@ -136,7 +136,7 @@ function _buildAttrTypeAndValues(spec, code, label, valueMap) {
   guard.identifier.assertKnownKeys(spec, valueMap, _err, "crmf/bad-input", function (k) {
     return "unknown " + label + " " + JSON.stringify(k) + "; pass a pre-encoded AttributeTypeAndValue DER via the array form for a " + label + " entry outside " + Object.keys(valueMap).join("/");
   });
-  Object.keys(spec).forEach(function (k) {
+  guard.identifier.optionNames(spec, valueMap).forEach(function (k) {
     var enc = valueMap[k];
     var typeOid = O(k);
     if (seen[typeOid]) throw _err(code, "duplicate " + label + " type " + k);

package/lib/ct.js

@@ -1076,7 +1076,7 @@ function _fetchBody(transport, url, req, label) {
   }).then(function (res) {
     res = res || {};
     var h = intrinsic.create(null);
-    Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
+    guard.identifier.optionNames(res.headers).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
     var body = guard.bytes.isByteSource(res.body)
       ? guard.bytes.source(res.body, CtError, "ct/bad-input", label)
       : Buffer.from(String(res.body == null ? "" : res.body), "utf8");
@@ -1149,7 +1149,7 @@ async function fetchLogList(opts) {
   var timeout = guard.limits.cap(opts.timeout, "timeout", DEFAULT_FETCH_TIMEOUT, { E: _ctErr, code: "ct/bad-input", min: 1, max: MAX_FETCH_TIMEOUT });
   var maxResponseBytes = guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.CT_LOG_LIST_MAX_BYTES, { E: _ctErr, code: "ct/bad-input", min: 1, max: C.LIMITS.CT_LOG_LIST_MAX_BYTES });
   var headers = intrinsic.create(null);
-  Object.keys(opts.headers || {}).forEach(function (k) {
+  guard.identifier.optionNames(opts.headers).forEach(function (k) {
     var lk = k.toLowerCase();
     if (lk !== "content-length" && lk !== "transfer-encoding") headers[k] = opts.headers[k];
   });

package/lib/est.js

@@ -105,7 +105,8 @@ var CLIENT_OPTS = intrinsic.assign(intrinsic.create(null), {
 function _withClient(extra) {
   var out = intrinsic.create(null);
   Object.keys(CLIENT_OPTS).forEach(function (k) { out[k] = 1; });
-  Object.keys(extra || {}).forEach(function (k) { out[k] = 1; });
+  var en = guard.identifier.optionNames(extra);
+  for (var ei = 0; ei < en.length; ei++) out[en[ei]] = 1;
   return out;
 }
 var CACERTS_OPTS = _withClient(null);
@@ -886,7 +887,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   function _headersFor(u) {
     digestSent = false;
     if (u.origin !== initialOrigin || (!authValue && !digestChallenge)) return headers;
-    var hh = Object.assign({}, headers);
+    var hh = guard.identifier.ownOptions(headers);
     if (digestChallenge) {
       if (!httpDigest.inProtectionSpace(digestChallenge, u.origin, u.pathname + u.search)) return headers;
       var nkey = digestChallenge.nonce;
@@ -912,7 +913,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
         if (status === 303 && method !== "GET" && method !== "HEAD") {
           method = "GET";
           body = null;
-          if (headers["content-type"]) { headers = Object.assign({}, headers); delete headers["content-type"]; }
+          if (headers["content-type"]) { headers = guard.identifier.ownOptions(headers); delete headers["content-type"]; }
         }
         url = _redirectTarget(url, h.location, method, opts);
         redirects += 1;
@@ -987,7 +988,7 @@ function _client(op, method, baseUrl, body, headers, opts, proxySnap, onAttempt,
     onAttempt: typeof onAttempt === "function" ? onAttempt : null,
   };
   _authScheme(opts);
-  return _drive(method, url, body, Object.assign({}, headers), opts, transport, budgets);
+  return _drive(method, url, body, guard.identifier.ownOptions(headers), opts, transport, budgets);
 }
 
 function _certsResult(op, res, opts, csrSpki) {
@@ -1313,18 +1314,16 @@ function _assertAgrees(name, supplied, carried) {
 
 function _copyRecipient(r) {
   if (!r || typeof r !== "object") return r;
-  var out = intrinsic.create(null), k;
-  for (k in r) { if (_hasOwn(r, k)) out[k] = _copyBytes(r[k]); }
+  var out = intrinsic.create(null);
+  var rNames = guard.identifier.optionNames(r);
+  for (var ri = 0; ri < rNames.length; ri++) out[rNames[ri]] = _copyBytes(r[rNames[ri]]);
   return out;
 }
 
 function _shallowCopy(o) {
-  var out = intrinsic.create(null), k;
-  for (k in o) { if (_hasOwn(o, k)) out[k] = o[k]; }
+  var out = guard.identifier.ownOptions(o);
   if (out.auth && typeof out.auth === "object") {
-    var a = intrinsic.create(null), ak;
-    for (ak in out.auth) { if (_hasOwn(out.auth, ak)) a[ak] = out.auth[ak]; }
-    out.auth = a;
+    out.auth = guard.identifier.ownOptions(out.auth);
   }
   return out;
 }
@@ -1696,7 +1695,7 @@ function _assertConfidentialCipher(res) {
 
 function _ciHeaderList(headers, name) {
   headers = headers || {};
-  var lname = name.toLowerCase(), keys = Object.keys(headers), parts = [];
+  var lname = name.toLowerCase(), keys = guard.identifier.optionNames(headers), parts = [];
   for (var i = 0; i < keys.length; i++) {
     if (keys[i].toLowerCase() !== lname) continue;
     var v = headers[keys[i]];
@@ -1708,7 +1707,7 @@ function _ciHeaderList(headers, name) {
 
 function _ciHeader(headers, name) {
   headers = headers || {};
-  var lname = name.toLowerCase(), keys = Object.keys(headers), found = null, n = 0;
+  var lname = name.toLowerCase(), keys = guard.identifier.optionNames(headers), found = null, n = 0;
   for (var i = 0; i < keys.length; i++) {
     if (keys[i].toLowerCase() !== lname) continue;
     n += 1;

package/lib/framework-error.js

@@ -176,6 +176,8 @@ var AttrCertError = defineClass("AttrCertError", { withCause: true });
 
 var CrmfError = defineClass("CrmfError", { withCause: true });
 
+var TrustAnchorError = defineClass("TrustAnchorError", { withCause: true });
+
 var Pkcs12Error = defineClass("Pkcs12Error", { withCause: true });
 
 var CmpError = defineClass("CmpError", { withCause: true });
@@ -238,6 +240,7 @@ module.exports = {
   TspError:         TspError,
   AttrCertError:    AttrCertError,
   CrmfError:        CrmfError,
+  TrustAnchorError: TrustAnchorError,
   Pkcs12Error:      Pkcs12Error,
   CmpError:         CmpError,
   PathError:        PathError,

package/lib/guard-header.js

@@ -9,6 +9,9 @@ var _freeze = require("./guard-intrinsic").freeze;
 var _charCodeAt = require("./guard-intrinsic").uncurry(String.prototype.charCodeAt);
 var _stringify = require("./guard-intrinsic").stringify;
 var _String = require("./guard-intrinsic").String;
+var _create = require("./guard-intrinsic").create;
+var _toLowerCase = require("./guard-intrinsic").uncurry(String.prototype.toLowerCase);
+var _optionNames = require("./guard-identifier").optionNames;
 
 // @enforced-by behavioral -- the CR/LF/NUL value reject + the ftext name check have
 function assertField(name, value, E, code) {
@@ -28,4 +31,15 @@ function assertField(name, value, E, code) {
   return v;
 }
 
-module.exports = _freeze({ assertField: assertField });
+/** @internal A response's header fields on a prototype-less object, keyed by the lowercased name,
+ *  which is how RFC 9110 sec. 5.1 says to compare them. Read by own key, so a field an injected
+ *  transport defines non-enumerably is not lost between the response and the lookup. */
+// @enforced-by option-bag-read-by-enumerable-key
+function lowerCased(headers) {
+  var out = _create(null);
+  var names = _optionNames(headers);
+  for (var i = 0; i < names.length; i++) out[_toLowerCase(names[i])] = headers[names[i]];
+  return out;
+}
+
+module.exports = _freeze({ assertField: assertField, lowerCased: lowerCased });

package/lib/guard-identifier.js

@@ -100,6 +100,38 @@ function snapshotOptions(obj, known) {
   return out;
 }
 
+/** @internal The option names a bag carries, read the way assertKnownKeys read them: every own
+ *  string key, whatever its descriptor says. Object.keys reports only the enumerable ones, so an
+ *  option written with `enumerable: false` clears the door and then vanishes from the read.
+ *  `known` narrows the result to the declared options. */
+// @enforced-by option-bag-read-by-enumerable-key
+function optionNames(obj, known) {
+  if (obj === null || obj === undefined) return [];
+  var out = [];
+  _forEach(_ownKeys(_Object(obj)), function (k) {
+    if (typeof k !== "string") return;
+    if (known !== null && known !== undefined && !_hasOwn(known, k)) return;
+    _append(out, k);
+  });
+  return out;
+}
+
+/** @internal A caller's options bag copied onto a prototype-less object, keyed by every own string
+ *  property, not the enumerable ones alone. Each is read once, so an accessor-backed option
+ *  answers the copy and not the later reads. Inherited properties are left behind: the copy is
+ *  what the decisions read, and a name reaching it from a prototype is not one the caller set. */
+// @enforced-by option-bag-read-by-enumerable-key
+function ownOptions(obj) {
+  var out = _create(null);
+  if (obj === null || obj === undefined) return out;
+  var o = _Object(obj);
+  _forEach(_ownKeys(o), function (k) {
+    if (typeof k !== "string") return;
+    out[k] = o[k];
+  });
+  return out;
+}
+
 var _PRISTINE_OBJECT_PROTO = (function () {
   var s = _create(null);
   _forEach(["constructor", "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable", "toLocaleString",
@@ -528,6 +560,8 @@ module.exports = intrinsic.freeze({
   optionsObject: optionsObject,
   refuseAccessorFields: refuseAccessorFields,
   snapshotOptions: snapshotOptions,
+  optionNames: optionNames,
+  ownOptions: ownOptions,
   readableNames: readableNames,
   readableIndices: readableIndices
 });

package/lib/hpke.js

@@ -228,7 +228,11 @@ function _extractAndExpand(kem, dh, kemContext) {
   try { return _labeledExpand(kdf, sid, eaePrk, "shared_secret", kemContext, kem.Nsecret); }
   finally { guard.secret.zeroize(eaePrk, HpkeError, "hpke/bad-input", "the KEM extract PRK"); }
 }
-function _kemId(kem) { for (var k in KEMS) if (KEMS[k] === kem) return Number(k); return 0; }
+function _kemId(kem) {
+  var names = guard.identifier.optionNames(KEMS);
+  for (var i = 0; i < names.length; i++) if (KEMS[names[i]] === kem) return Number(names[i]);
+  return 0;
+}
 
 function _ephemeral(kem, eph) {
   if (eph != null) {
@@ -429,7 +433,8 @@ var _COMMON_KEYS = intrinsic.assign(intrinsic.create(null), { mode: 1, info: 1,
 function _withCommon(extra) {
   var out = intrinsic.create(null);
   Object.keys(_COMMON_KEYS).forEach(function (k) { out[k] = 1; });
-  Object.keys(extra).forEach(function (k) { out[k] = 1; });
+  var en = guard.identifier.optionNames(extra);
+  for (var ei = 0; ei < en.length; ei++) out[en[ei]] = 1;
   return out;
 }
 var _SETUP_S_KEYS = _withCommon({

package/lib/http-transport.js

@@ -279,10 +279,10 @@ function _copyableArray(a) {
 function snapshotProxy(p) {
   try {
     if (!_copyableRecord(p)) return p;
-    var out = Object.assign(Object.create(null), p);
-    if (_copyableRecord(p.auth)) out.auth = Object.assign(Object.create(null), p.auth);
+    var out = guard.identifier.ownOptions(p);
+    if (_copyableRecord(p.auth)) out.auth = guard.identifier.ownOptions(p.auth);
     if (_copyableRecord(p.tls)) {
-      out.tls = Object.assign(Object.create(null), p.tls);
+      out.tls = guard.identifier.ownOptions(p.tls);
       var a = p.tls.anchors;
       if (_copyableArray(a)) {
         var copied = [];
@@ -492,7 +492,7 @@ function httpsTransport(defaults) {
     var bodyIsFn = typeof body === "function";
     if (!bodyIsFn && guard.bytes.isByteSource(body)) body = guard.bytes.source(body, E, C("bad-input"), "the request body");
 
-    var reqHeaders = Object.assign(Object.create(null), request.headers || {});
+    var reqHeaders = guard.identifier.ownOptions(request.headers);
     Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "proxy-authorization" || lk === "proxy-connection") delete reqHeaders[k]; });
     if (bodyIsFn) {
       Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "content-length" || lk === "transfer-encoding" || lk === "expect") delete reqHeaders[k]; });
@@ -609,8 +609,7 @@ function httpsTransport(defaults) {
               if (settled) return;
               settled = true;
               clearTimer();
-              var lower = Object.create(null);
-              Object.keys(res.headers || {}).forEach(function (k) { lower[k.toLowerCase()] = res.headers[k]; });
+              var lower = guard.header.lowerCased(res.headers);
               resolve({
                 status: res.statusCode,
                 headers: lower,