Potential fix for code scanning alert no. 1: Prototype-polluting assignment

[cjkoepke]

Potential fix for https://github.com/SundaeSwap-finance/sundae-sdk/security/code-scanning/1

To fix prototype pollution, avoid assigning to object keys that come directly from untrusted input (here, policy_id and asset_name) unless those keys are sanitized or rejected if they are dangerous. There are several ways to fix this:

1. Use a Map object instead of a plain object for asset_map and its nested values. Map is not vulnerable to prototype pollution, since its keys live outside normal object/property semantics.
2. Alternatively, you can explicitly reject dangerous keys like __proto__, constructor, and prototype in both policy_id and asset_name before assignment.

The best fix is to replace both asset_map and its nested {} objects with ES6 Map objects, adapting all relevant assignments and lookups to use .get(), .set(), etc., instead of bracket notation. This change will require updating the construction and the usages for both levels of nesting (the outer map for policy_id and the inner map for asset_name). When constructing the datum, if the downstream code expects plain objects, you may need to convert the Maps back to objects via spreading or Object.fromEntries before serialization.

All changes should be made inside the method buildConditionDatum in packages/core/src/DatumBuilders/DatumBuilder.NftCheck.class.ts.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.