DCQL `id` allows `__proto__` and `toString` as Credential Query identifiers

Section 6.1 constrains a Credential Query id:

The value MUST be a non-empty string consisting of alphanumeric, underscore (_), or hyphen (-) characters.

Section 6.3 applies the same rule to a Claims Query id. Section 8.1 then makes those Verifier-chosen values member names in a JSON object:

vp_token: REQUIRED. This is a JSON-encoded object containing entries where the key is the id value used for a Credential Query in the DCQL query

Twelve strings satisfy that character class and are also own properties of Object.prototype in ECMAScript: constructor, __defineGetter__, __defineSetter__, hasOwnProperty, __lookupGetter__, __lookupSetter__, isPrototypeOf, propertyIsEnumerable, toString, valueOf, __proto__, toLocaleString. So id: "__proto__" and id: "toString" are both conformant.

In a JavaScript Wallet that has two consequences. First, the response entry silently disappears:

const out = {};
out["__proto__"] = ["presentation"];
out["real_id"]   = ["presentation"];
JSON.stringify(out);   // {"real_id":["presentation"]}

No error is raised, and Section 8.1 gives that absence a meaning: "There MUST NOT be any entry in the JSON-encoded object for optional Credential Queries when there are no matching Credentials for the respective Credential Query." So the Verifier reads "no matching Credential" for one that matched.

Second, resolving credential_sets options is a lookup rather than a construction, so a required set reports satisfied while the Wallet holds nothing:

const matched = {};                      // nothing matched
["toString"].every(id => matched[id]);   // true

A character class can say which characters are allowed, but it cannot exclude particular strings, so the rule cannot be repaired in its current form. Enumerating the twelve names does not work either, since the set is not stable even within one runtime: Node with --disable-proto=delete reports eleven.

Start with Sections 6.1, 6.3, and 8.1 of the DCQL specification, then trace how the identifier rule affects JSON object keys and credential-set resolution. Done means the specification defines an unambiguous treatment for prototype-related identifiers and the resulting Wallet and Verifier behavior is consistent.