@blamejs/pki 0.5.19 → 0.5.20

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.20 — 2026-08-20
+
+Five verdicts that turned on list membership now decide it by comparison, so replacing an array method after the module loads cannot change what a certificate, a responder or a signed message is found to be.
+
+### Added
+
+- `guard-list`, an internal choke point for membership decided by comparison. Four verbs cover the rule shapes a verdict needs: is this value present, are all of these present, does any member satisfy a test, do all of them. An absent list is honestly empty rather than a throw, because these run on verdict paths where a throw would read as a different verdict. It is not on the public namespace; the surface is the verdicts above.
+
+### Changed
+
+- Certification-path building asks its loop-detection and fetch-dedupe sets through captured methods. These bound the work a hostile chain can cause, and a replaced `Set.prototype.has` answering false let a cycle be walked and a URL be fetched repeatedly until a size cap stopped it.
+
+### Fixed
+
+- `pki.path.validate` holds its `requiredEku` gate against a replaced `Array.prototype.indexOf`. The purpose test IS the decision about what the certificate may be used for, and dispatched live it reported `serverAuth` present on a leaf whose extended key usage carried only `emailProtection`, returning a valid chain for a certificate the caller had asked it to refuse. Certificate-policy membership and the `anyPolicy` scans in the policy tree are decided the same way.
+- `pki.cms.verify` keeps `trusted: false` for a message no supplied anchor covers. The message-level verdict combined the per-signer answers with `every`, and a replaced one reported the whole set trusted without consulting a single signer.
+- An OCSP response is still refused when its delegate lacks id-kp-OCSPSigning. Responder authorization is the decision about who may answer for an issuer, and reading the purpose list through the prototype let a delegate the CA never authorized speak for the whole issuer.
+- A TPM attestation certificate still needs the tcg-kp-AIKCertificate purpose. That test is what makes a leaf an attestation key, so reading it live let an ordinary certificate be accepted as one.
+- A timestamp token carrying an unrecognized critical extension is still refused (RFC 3161 sec. 2.4.2). The scan for a critical extension IS the gate, and a replaced `Array.prototype.some` answering false made the extension invisible and the unusable token acceptable.
+- `pki.cms.verify` keeps `valid: false` for a message whose signature does not verify. The soundness verdict combined the per-signer answers the same way the trust verdict did, so a corrupted signature reported `valid: true`.
+- `pki.path.validate` asks its processed-extension tables for their OWN entries. Freezing a table prevents a write to it and does not prevent an inherited lookup, so a name planted on `Object.prototype` answered for every OID the table did not carry and an unrecognized critical extension counted as processed. On a CA certificate only one of the two tables is consulted, so the chain was accepted rather than refused (RFC 5280 sec. 6.1.4).
+- A trust anchor's `purposes` map is read for its own entries too. The map is the operator's restriction, and an inherited `true` granted the purpose on every anchor whose map did not name it. `distrustAfter` is read the same way.
+- The ML-DSA digest-strength rule (RFC 9882 sec. 3.3) is one question both the signer and the CMS verifier ask, and it answers from the policy table's own entries. A digest name planted on `Object.prototype` answered for every name a parameter set's row omits, so a below-strength digest passed the strength check: `sha256` was accepted for ML-DSA-87 on both paths. The check also had two copies, which is why it now lives in the module that owns the table.
+
 ## v0.5.19 — 2026-08-20
 
 The crypto engine and the JWS signer decide with operations captured at load, so code that runs after the module does cannot change what a permission check concludes.

package/lib/cms-verify.js

@@ -39,7 +39,9 @@ var cmsEncrypt = require("./cms-encrypt");
 var cmsDecrypt = require("./cms-decrypt");
 var cmsCompress = require("./cms-compress");
 var signScheme = require("./sign-scheme");
-var MLDSA_SUITABLE_DIGEST = signScheme.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
+// The digest-strength question is asked of sign-scheme, which owns the policy table, so the signer
+// and this verifier cannot drift (RFC 9882 sec. 3.3).
+var _mldsaDigestSuitable = signScheme.mldsaDigestSuitable;
 var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
 var validator = require("./validator-all");
 var compositeSig = require("./composite-sig");
@@ -71,7 +73,7 @@ var DIGEST_HASH = {
 // foreign fault and loses this module's own unsupported-algorithm verdict.
 var SIG_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 // Is `name` a message-digest algorithm this verifier supports?
-function _supportedDigest(name) { return !!DIGEST_HASH[name]; }
+function _supportedDigest(name) { return guard.intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 // The digest of `content` under the named algorithm, resolved to a Buffer.
 function _computeDigest(name, content) {
   return subtle.digest(DIGEST_HASH[name], content).then(function (d) { return Buffer.from(d); });
@@ -366,7 +368,7 @@ function _verifyOne(si, content, eContentType, parsedCerts, csTarget) {
   // meet the parameter set's security strength -- a below-strength digest is the weaker link and is
   // rejected fail-closed (the RFC's "verifiers MAY reject", taken by the strict-verifier posture).
   // With signed attributes absent the digestAlgorithm has no meaning (sec. 3.3) and is not checked.
-  if (scheme.kind === "mldsa" && si.signedAttrsBytes && !MLDSA_SUITABLE_DIGEST[scheme.name][si.digestAlgorithm.name]) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
+  if (scheme.kind === "mldsa" && si.signedAttrsBytes && !_mldsaDigestSuitable(scheme.name, si.digestAlgorithm.name)) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
   // RFC 9814 sec. 4: an SLH-DSA SignerInfo's message-digest algorithm is the one paired with the
   // parameter set (the sec. 4 list, always at least twice the tree-hash size); the signer emits it
   // and this strict verifier requires it, so a digest that does not match the set's paired hash fails
@@ -768,7 +770,9 @@ function _verify(input, opts) {
     // message a second time to learn it, and a check that needs a second parse is a check most
     // callers will not write.
     var res = {
-      valid: signers.length > 0 && signers.every(function (s) { return s.ok === true; }),
+      // Signature soundness is decided by comparison for the same reason the trust verdict below
+      // is: `every` replaced after load reports the whole set sound without reading one signer.
+      valid: signers.length > 0 && guard.list.allMatch(signers, function (s) { return s.ok === true; }),
       eContentType: parsed.encapContentInfo.eContentType,
       signers: signers,
     };
@@ -873,6 +877,12 @@ function _keyUsagePermitsSigning(parsedCerts, der) {
   return true;                                // absent: unconstrained (sec. 4.2.1.3)
 }
 
+// Every signer trusted? The answer IS the message-level trust verdict, so it is decided by
+// comparison instead of by an `every`. See guard-list.
+function _allTrusted(signers) {
+  return guard.list.allMatch(signers, function (s) { return s.trusted === true; });
+}
+
 // `cfg` is verify's SNAPSHOT, never the caller's options object -- the parameter is named for that
 // so a future caller cannot hand it the live one without noticing.
 function _applyTrust(res, parsedCerts, cfg) {
@@ -963,7 +973,10 @@ function _applyTrust(res, parsedCerts, cfg) {
         });
     });
   }, Promise.resolve()).then(function () {
-    res.trusted = res.valid && res.signers.length > 0 && res.signers.every(function (s) { return s.trusted === true; });
+    // The trust verdict is decided by comparison, not by a prototype method: `every` replaced after
+    // load answers true without consulting a single signer, and a message no anchor covers reports
+    // trusted:true.
+    res.trusted = res.valid && res.signers.length > 0 && _allTrusted(res.signers);
   });
 }
 // Parse a candidate cert DER and index its SKI; a cert that will not parse is skipped (it

package/lib/guard-all.js

@@ -55,6 +55,7 @@ var bytes  = require("./guard-bytes");
 var text   = require("./guard-text");
 var limits = require("./guard-limits");
 var crypto = require("./guard-crypto");
+var list = require("./guard-list");
 var range  = require("./guard-range");
 var time   = require("./guard-time");
 var name   = require("./guard-name");
@@ -74,6 +75,7 @@ module.exports = {
   text:   text,
   limits: limits,
   crypto: crypto,
+  list: list,
   range:  range,
   time:   time,
   name:   name,

package/lib/guard-list.js

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal, so no operator-facing namespace. The documented surface is every verdict whose rule
+// composes this guard: pki.path.validate (requiredEku, the policy tree), pki.cms.verify (the
+// message trust verdict), the OCSP delegated-responder check, the TPM AIK purpose check, and the
+// timestamp unknown-critical-extension gate.
+//
+// guard-list, membership decided by comparison and never by a prototype method.
+//
+// Defends the intrinsic-substitution class (CWE-349 / CWE-693: a control the caller can neutralize).
+// Written `list.indexOf(v) !== -1` or `list.some(fn)`, a membership test asks the runtime, at the
+// moment of the call, which function `indexOf` or `some` is. A caller who receives control after
+// this package loads, through an option accessor or a `toJSON` or while a verb is suspended on an
+// await, can replace it. The answer becomes whatever they chose, while every check around it still
+// runs and still passes.
+//
+// The distinction that matters is what the answer IS. A scan over a local accumulator produces a
+// value. A scan that decides whether a certificate carries a purpose, whether a policy is expected,
+// or whether every signer is trusted IS the rule. Measured on the tree before this guard existed:
+// with `Array.prototype.indexOf` replaced to report every value present, a certificate restricted
+// to emailProtection satisfied a requiredEku of serverAuth, and pki.path.validate went from
+// valid:false to valid:true.
+//
+// Capturing the method at load (guard-intrinsic) is the other half of the same defense, and is what
+// a module already inside that discipline uses. This guard is for the rule sites themselves. A loop
+// over `===` has nothing to replace, so it holds whatever the prototype says, in a module that has
+// been swept and in one that has not.
+
+// contains(list, value) -> boolean. Strict-equality membership, the `indexOf(v) !== -1` rule.
+// A null / undefined list is honestly empty, never a throw: these run on verdict paths.
+// @enforced-by behavioral -- `.indexOf(x) !== -1` has no rename-proof form that separates a
+//   membership RULE from its legitimate siblings: the identical token is a substring search
+//   (`authority.indexOf(":")`, `addr.indexOf("@")`) and a local index lookup, and a shape matching
+//   all of them fired on 37 sites of which most were strings. What makes a site this guard's is
+//   what the answer IS -- a decision about a certificate, a policy or a signer -- and that is a
+//   judgment no regex makes. The RED vectors are the guard: a codeSigning-only certificate still
+//   fails a serverAuth requiredEku, and an unauthorized responder is still refused, each with
+//   Array.prototype.indexOf replaced after load.
+function contains(list, value) {
+  if (!list) return false;
+  for (var i = 0, n = list.length; i < n; i++) if (list[i] === value) return true;
+  return false;
+}
+
+// containsAll(list, values) -> boolean. Every one of `values` present in `list` -- the shape a
+// "these purposes are all required" rule needs. No `values` is vacuously satisfied.
+// @enforced-by behavioral -- the composition of contains() has no rename-proof shape of its own;
+//   the RED vectors (a codeSigning-only certificate still fails a serverAuth requiredEku with
+//   Array.prototype.indexOf replaced) are the guard.
+function containsAll(list, values) {
+  if (!values) return true;
+  for (var i = 0, n = values.length; i < n; i++) if (!contains(list, values[i])) return false;
+  return true;
+}
+
+// anyMatches(list, predicate) -> boolean. The `some(fn)` rule: does any member satisfy it? The
+// predicate is the caller's own function, so what this guard removes is the DISPATCH, not the test.
+// @enforced-by behavioral -- `.some(` has legitimate non-rule siblings (building a list, reporting
+//   a count), so a blanket detector would false-fire; the RED vectors (a critical extension is
+//   still seen, an untrusted signer still reported) are the guard.
+function anyMatches(list, predicate) {
+  if (!list) return false;
+  for (var i = 0, n = list.length; i < n; i++) if (predicate(list[i], i)) return true;
+  return false;
+}
+
+// allMatch(list, predicate) -> boolean. The `every(fn)` rule, same reasoning as anyMatches. An
+// empty list is vacuously true, matching Array.prototype.every -- a caller that needs "non-empty
+// AND all" tests the length itself, as pki.cms.verify does for the trust verdict.
+// @enforced-by behavioral -- see anyMatches; the RED vector (an untrusted signer keeps
+// trusted:false with Array.prototype.every replaced) is the guard.
+function allMatch(list, predicate) {
+  if (!list) return true;
+  for (var i = 0, n = list.length; i < n; i++) if (!predicate(list[i], i)) return false;
+  return true;
+}
+
+module.exports = {
+  contains: contains,
+  containsAll: containsAll,
+  anyMatches: anyMatches,
+  allMatch: allMatch,
+};

package/lib/ocsp-verify.js

@@ -45,6 +45,9 @@ OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
 OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";
 OCSP_CERTID_HASHES[oid.byName("sha512")] = "SHA-512";
 var OID_OCSP_SIGNING = oid.byName("ocspSigning");
+// Does this extended-key-usage list assert the given purpose? The answer IS an authorization
+// decision, so it goes through the membership guard rather than a prototype method. See guard-list.
+var _asserts = guard.list.contains;
 var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
 var OID_EKU = oid.byName("extKeyUsage");
 var OID_KEY_USAGE = oid.byName("keyUsage");
@@ -105,7 +108,7 @@ function makeOcspVerify(deps) {
   // 5280 sec. 7.1-equal byte encoding of the validated issuer DN to try.
   async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
     if (certID.serialNumberHex !== cert.serialNumberHex) return false;
-    var hashName = OCSP_CERTID_HASHES[certID.hashAlgorithm.oid];
+    var hashName = guard.intrinsic.hasOwn(OCSP_CERTID_HASHES, certID.hashAlgorithm.oid) ? OCSP_CERTID_HASHES[certID.hashAlgorithm.oid] : null;
     if (!hashName) return false;
     var keyHash = await ocspDigest(hashName, issuerKeyBits);
     if (!certID.issuerKeyHash.equals(keyHash)) return false;
@@ -154,7 +157,11 @@ function makeOcspVerify(deps) {
       var eku;
       try { eku = decodeExt(rc, OID_EKU); }
       catch (_e) { continue; }
-      if (!eku || eku.value.indexOf(OID_OCSP_SIGNING) === -1) continue;
+      // The membership test IS the delegation rule, so it is decided by comparison rather than by a
+      // prototype method: dispatched live, an `Array.prototype.indexOf` replaced after load reports
+      // the purpose present on ANY certificate, and a cert an attacker put in the response's own
+      // certs bag is accepted as the authorized responder.
+      if (!eku || !_asserts(eku.value, OID_OCSP_SIGNING)) continue;
       // A delegate asserting keyUsage MUST permit digitalSignature; an absent keyUsage is
       // unrestricted, an unreadable one is not authoritative.
       var ku;

package/lib/path-validate.js

@@ -67,6 +67,20 @@ function pathCode(e, fallback) {
   return (e && typeof e.code === "string" && e.code.indexOf("path/") === 0) ? e.code : fallback;
 }
 
+// Membership decided by comparison rather than by a prototype method, through the shared guard.
+// Every use below is a RULE: whether a certificate's extended key usages cover the ones the caller
+// required, whether a policy is already expected at a node, whether anyPolicy is in the user's
+// initial set. See guard-list for what a replaced Array.prototype.indexOf did to this validator.
+var contains = guard.list.contains;
+var containsAll = guard.list.containsAll;
+// RFC 5280 6.1.4(a): a policyMappings extension MUST NOT map to or from anyPolicy. The scan for a
+// violating pair is the rule, so it routes through the guard for the same reason.
+function mapsAnyPolicy(mappings) {
+  return guard.list.anyMatches(mappings, function (m) {
+    return !!m && (m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy);
+  });
+}
+
 var NS = pkix.makeNS("path", PathError, oid);
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 
@@ -828,7 +842,7 @@ function processPolicies(state, cert, i, checks) {
       if (p.policyIdentifier === OID.anyPolicy) { anyPolicyPresent = true; anyPolicyQualifiers = p.qualifiersBytes; return; }
       var matched = false;
       leavesAt(state.validPolicyTree, depth).forEach(function (node) {
-        if (node.expectedPolicySet.indexOf(p.policyIdentifier) !== -1) {
+        if (contains(node.expectedPolicySet, p.policyIdentifier)) {
           addChild(state, node, p.policyIdentifier, p.qualifiersBytes, [p.policyIdentifier], checks);
           matched = true;
         }
@@ -849,7 +863,7 @@ function processPolicies(state, cert, i, checks) {
       // certificate's own anyPolicy entry ("set the qualifier_set to AP-Q").
       leavesAt(state.validPolicyTree, depth).forEach(function (node) {
         node.expectedPolicySet.forEach(function (ep) {
-          var already = node.children.some(function (ch) { return ch.validPolicy === ep; });
+          var already = guard.list.anyMatches(node.children, function (ch) { return ch.validPolicy === ep; });
           if (!already) addChild(state, node, ep, anyPolicyQualifiers, [ep], checks);
         });
       });
@@ -929,8 +943,7 @@ function ekuPurposeFails(cert, requiredEku, checks) {
   catch (e) { checks.push({ name: "extendedKeyUsage", ok: false, code: pathCode(e, "path/bad-extension-value") }); return true; }
   if (!eku) return false;   // absent EKU: unrestricted (4.2.1.12 restricts only when present)
   var purposes = eku.value;
-  var ok = purposes.indexOf(OID.anyExtendedKeyUsage) !== -1 ||
-    requiredEku.every(function (p) { return purposes.indexOf(p) !== -1; });
+  var ok = contains(purposes, OID.anyExtendedKeyUsage) || containsAll(purposes, requiredEku);
   checks.push({ name: "extendedKeyUsage", ok: ok, code: ok ? undefined : "path/eku-not-permitted" });
   return !ok;
 }
@@ -950,7 +963,10 @@ function prepareNext(state, cert, i, checks) {
   try { pm = decodeExt(cert, OID.policyMappings); }
   catch (e) { checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
   if (pm) {
-    var badAny = pm.value.some(function (m) { return m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy; });
+    // The scan for a forbidden anyPolicy mapping is the rule itself (RFC 5280 6.1.4(a)), so it is a
+    // loop rather than a `some`: one answering false makes the forbidden mapping invisible and the
+    // certificate is accepted carrying it.
+    var badAny = mapsAnyPolicy(pm.value);
     if (badAny) { checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: E("path/bad-policy", "policyMappings must not map to or from anyPolicy (RFC 5280 6.1.4(a))") }; }
     if (state.validPolicyTree) applyPolicyMappings(state, pm.value, i);
   }
@@ -1084,12 +1100,16 @@ var TARGET_UNPROCESSED_IF_CRITICAL = {};
 TARGET_UNPROCESSED_IF_CRITICAL[OID.policyMappings] = true;
 Object.freeze(TARGET_UNPROCESSED_IF_CRITICAL);
 
+// Membership is asked of the table's OWN properties. Freezing the table stops a write to it and
+// stops nothing about the prototype chain: a name planted on Object.prototype answers for every OID
+// the table does not carry, and read live this reported an unrecognized critical extension as
+// processed. On a CA certificate only the first table is consulted, so the chain was accepted.
 function unrecognizedCriticalExtension(cert, isTarget) {
   for (var i = 0; i < cert.extensions.length; i++) {
     var ext = cert.extensions[i];
     if (!ext.critical) continue;
-    if (!PROCESSED_EXTENSIONS[ext.oid]) return ext.oid;
-    if (isTarget && TARGET_UNPROCESSED_IF_CRITICAL[ext.oid]) return ext.oid;
+    if (!guard.intrinsic.hasOwn(PROCESSED_EXTENSIONS, ext.oid)) return ext.oid;
+    if (isTarget && guard.intrinsic.hasOwn(TARGET_UNPROCESSED_IF_CRITICAL, ext.oid)) return ext.oid;
   }
   return null;
 }
@@ -1222,7 +1242,7 @@ async function validate(path, opts) {
   // as a SUBSTRING match -- validated to an array of strings instead.
   if (opts.userInitialPolicySet !== undefined) {
     var uipsOk = Array.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
-      opts.userInitialPolicySet.every(function (p) { return typeof p === "string" && p.length > 0; });
+      guard.list.allMatch(opts.userInitialPolicySet, function (p) { return typeof p === "string" && p.length > 0; });
     if (!uipsOk) throw E("path/bad-input", "validate: opts.userInitialPolicySet must be a non-empty array of policy OID strings");
     // Each entry is compared (indexOf) against canonical decoder output, so a
     // non-canonical key would silently never match -- fail the typo closed here.
@@ -1427,7 +1447,7 @@ async function validate(path, opts) {
       var lpm;
       try { lpm = decodeExt(cert, OID.policyMappings); }
       catch (_e) { lpm = null; checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true; }
-      if (lpm && lpm.value.some(function (m) { return m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy; })) {
+      if (lpm && mapsAnyPolicy(lpm.value)) {
         checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true;
       }
       // 4.2.1.10 / 4.2.1.14: nameConstraints and inhibitAnyPolicy MUST be
@@ -1470,7 +1490,9 @@ async function validate(path, opts) {
       }
       if (checkPurpose && ta.purposes) {
         anchorPurposeApplied = true;
-        if (ta.purposes[checkPurpose] !== true) {
+        // The map is the operator's RESTRICTION, so it is asked for its own entry: an inherited
+        // `true` would grant the purpose on every anchor whose map does not name it.
+        if (!guard.intrinsic.hasOwn(ta.purposes, checkPurpose) || ta.purposes[checkPurpose] !== true) {
           checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
         }
       }
@@ -1502,7 +1524,7 @@ async function validate(path, opts) {
   var policyOk = state.explicitPolicy > 0 || ucps.length > 0;
   if (!policyOk) {
     var last = state.results[state.results.length - 1];
-    if (!last.checks.some(function (c) { return c.code === "path/policy-required"; })) {
+    if (!guard.list.anyMatches(last.checks, function (c) { return c.code === "path/policy-required"; })) {
       last.checks.push({ name: "policy", ok: false, code: "path/policy-required" });
     }
     failed = true;
@@ -1539,7 +1561,7 @@ async function validate(path, opts) {
 function userConstrainedPolicies(state, n) {
   if (!state.validPolicyTree) return [];
   var uips = state.userInitialPolicySet;
-  var anyUser = uips.indexOf(OID.anyPolicy) !== -1;
+  var anyUser = contains(uips, OID.anyPolicy);
   var leaves = leavesAt(state.validPolicyTree, n);
   var explicit = {}, hasAnyLeaf = false;
   leaves.forEach(function (node) {
@@ -1547,7 +1569,7 @@ function userConstrainedPolicies(state, n) {
     else explicit[node.validPolicy] = true;
   });
   var set = {};
-  Object.keys(explicit).forEach(function (p) { if (anyUser || uips.indexOf(p) !== -1) set[p] = true; });
+  Object.keys(explicit).forEach(function (p) { if (anyUser || contains(uips, p)) set[p] = true; });
   // 6.1.5(g) step 3: a depth-n anyPolicy node under a restrictive user set
   // expands to each user policy (the intersection of anyPolicy with the user
   // set is the user set itself).
@@ -2193,7 +2215,7 @@ function crlChecker(crls, opts) {
       // nothing can never erase a revocation the checker would otherwise report.
       for (var dj = 0; dj < classified.deltas.length; dj++) {
         var dRec = classified.deltas[dj];
-        if (consumedDeltas.indexOf(dRec) !== -1) continue;
+        if (contains(consumedDeltas, dRec)) continue;
         // A delta that was MERGEABLE with some complete CRL but lost the sec. 5.2.4 @3580 selection
         // does not speak for its scope at all -- the selected delta does, and it was evaluated
         // against the base. Letting a superseded delta contribute its revocation while ignoring its
@@ -2365,7 +2387,7 @@ function ocspChecker(responses) {
       // certificate's own subject encoding -- sec. 7.1-equal but not byte-identical).
       var issuerNameCandidates = [cert.issuer.bytes];
       function addNameCandidate(nm) {
-        if (nm && nm.bytes && !issuerNameCandidates.some(function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
+        if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
       }
       if (issuer.issuerCert) addNameCandidate(issuer.issuerCert.subject);
       addNameCandidate(issuer.workingIssuerName);
@@ -2525,7 +2547,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     if (!sig.ok) return unbound("the target certificate's signature does not verify under the supplied issuer certificate's key");
     var issuerCtx = { workingPublicKey: issuerCert.subjectPublicKeyInfo.bytes, workingIssuerName: issuerCert.subject, issuerCert: issuerCert };
     var issuerNameCandidates = [cert.issuer.bytes];
-    function add(nm) { if (nm && nm.bytes && !issuerNameCandidates.some(function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes); }
+    function add(nm) { if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes); }
     add(issuerCert.subject);
     var issuerKeyBits;
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
@@ -2604,14 +2626,15 @@ function coerceCert(input, label) {
 // inert without one. An EMPTY map states no constraint and is not a reason to refuse.
 function _hasPurposeScopedMetadata(ta) {
   if (!ta || typeof ta !== "object") return false;
-  return ["distrustAfter", "purposes"].some(function (k) {
+  return guard.list.anyMatches(["distrustAfter", "purposes"], function (k) {
     var m = ta[k];
     return !!m && typeof m === "object" && Object.keys(m).length > 0;
   });
 }
 
 function assertAnchorConstraints(ta, checkPurpose) {
-  var d = (checkPurpose && ta && ta.distrustAfter) ? ta.distrustAfter[checkPurpose] : null;
+  var d = (checkPurpose && ta && ta.distrustAfter && guard.intrinsic.hasOwn(ta.distrustAfter, checkPurpose))
+    ? ta.distrustAfter[checkPurpose] : null;
   if (d == null) return null;
   return guard.time.assertValid(d, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
 }
@@ -2728,9 +2751,12 @@ function _pushCandidates(frame, scored, stack, counter) {
     counter.tick();          // breadth / total-work cap -> throws path/build-limit
     n += 1;
     var cand = scored[ci].cand, candKey = identityKey(cand);
-    if (frame.keys.has(candKey)) continue;   // the (subject, SAN, key) tuple is already on this branch -> a loop, prune
+    // Loop detection and the dedupe sets below are resource bounds, so they are asked through the
+    // captured methods: a replaced `Set.prototype.has` answering false never prunes and the build
+    // walks a cycle until a cap stops it.
+    if (guard.intrinsic.setHas(frame.keys, candKey)) continue;
     var childKeys = new Set(frame.keys);
-    childKeys.add(candKey);
+    guard.intrinsic.setAdd(childKeys, candKey);
     stack.push({ chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
   }
   return n;
@@ -2821,16 +2847,16 @@ async function _fetchAiaIssuers(current, aia) {
     // IP literals only (already validated above), never a hostname whose resolved address we cannot verify.
     if (net.isIP(u.hostname.replace(/^\[(.*)\]$/, "$1")) === 0 && !aia.transportGuardsAddresses) continue;
     u.hash = "";                                          // the fragment is never sent on the wire -> not part of the request/dedupe identity
-    if (aia.fetchedUrls.has(u.href) || seenThisCert.has(u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
+    if (guard.intrinsic.setHas(aia.fetchedUrls, u.href) || guard.intrinsic.setHas(seenThisCert, u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
     if (seenThisCert.size >= aia.maxPerCert) break;       // per-cert DISTINCT-url cap, checked BEFORE appending so maxAiaPerCert:0 collects nothing (no fetch at all)
-    seenThisCert.add(u.href);
+    guard.intrinsic.setAdd(seenThisCert, u.href);
     uris.push(u.href);
   }
   var out = [];
   for (var k = 0; k < uris.length; k++) {
-    if (aia.fetchedUrls.has(uris[k])) continue;   // a same-cert normalization-equal duplicate
+    if (guard.intrinsic.setHas(aia.fetchedUrls, uris[k])) continue;   // a same-cert normalization-equal duplicate
     if (aia.fetches >= aia.maxFetches) break;     // total budget reached -> STOP fetching (a SILENT cap, never a throw that denies a buildable path)
-    aia.fetchedUrls.add(uris[k]);                 // mark BEFORE the fetch -> fetched at most once, even on failure
+    guard.intrinsic.setAdd(aia.fetchedUrls, uris[k]);   // mark BEFORE the fetch -> fetched at most once, even on failure
     aia.fetches += 1;
     var certs;
     try { certs = await _aiaFetchOne(uris[k], aia); }
@@ -2958,7 +2984,7 @@ async function build(leaf, opts) {
   // repeating CMS returning the same issuer) is appended AT MOST ONCE -- it otherwise inflates the pool, charging
   // the candidate budget and the ceiling for each copy before the issuer is ever evaluated.
   var poolDerKeys = new Set();
-  for (var pdk = 0; pdk < pool.length; pdk++) poolDerKeys.add(certDerKey(pool[pdk]));
+  for (var pdk = 0; pdk < pool.length; pdk++) guard.intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
 
   if (!Array.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
   var anchors = opts.trustAnchors.map(toAnchor);
@@ -3120,8 +3146,8 @@ async function build(leaf, opts) {
         var fetched = await _fetchAiaIssuers(fbCur, aiaCtx);   // append newly-fetched issuer(s) to the SHARED pool
         for (var fj = 0; fj < fetched.length; fj++) {
           var fdk = certDerKey(fetched[fj]);
-          if (poolDerKeys.has(fdk)) continue;                  // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
-          poolDerKeys.add(fdk);
+          if (guard.intrinsic.setHas(poolDerKeys, fdk)) continue;   // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
+          guard.intrinsic.setAdd(poolDerKeys, fdk);
           if (pool.length < poolCeiling) pool.push(fetched[fj]);
         }
       }

package/lib/sign-scheme.js

@@ -52,6 +52,20 @@ var MLDSA_SUITABLE_DIGEST = {
   "ML-DSA-65": { sha384: 1, sha512: 1, shake256: 1 },
   "ML-DSA-87": { sha512: 1, shake256: 1 },
 };
+// mldsaDigestSuitable(mlName, md) -- is `md` listed as meeting `mlName`'s security strength?
+// Both levels are asked for their OWN entries. The gate rejects on a falsy lookup, so a digest name
+// planted on Object.prototype answers for every name the row omits and a below-strength digest
+// passes the RFC 9882 sec. 3.3 check. This is the single home for that question: the signer and the
+// verifier both ask it, and a copy at either would let the two drift.
+// @enforced-by behavioral -- an own-property table read has no rename-proof shape distinct from a
+//   legitimate one; the RED vectors (a below-strength digest still refused with its name planted on
+//   Object.prototype, on both the sign and verify paths) are the guard.
+function mldsaDigestSuitable(mlName, md) {
+  if (!guard.intrinsic.hasOwn(MLDSA_SUITABLE_DIGEST, mlName)) return false;
+  var row = MLDSA_SUITABLE_DIGEST[mlName];
+  return !!row && guard.intrinsic.hasOwn(row, md) && !!row[md];
+}
+
 var SLHDSA_BY_OID = {};
 [["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
  ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
@@ -173,7 +187,7 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
     } else {
       md = so.digestAlgorithm || "sha512";
       if (!NODE_DIGEST[md]) throw E("unsupported-algorithm", "unsupported ML-DSA message digest " + JSON.stringify(md));
-      if (!MLDSA_SUITABLE_DIGEST[mlName][md]) throw E("unsupported-algorithm", "the " + md + " message digest is below the security strength of " + mlName + " (RFC 9882 sec. 3.3)");
+      if (!mldsaDigestSuitable(mlName, md)) throw E("unsupported-algorithm", "the " + md + " message digest is below the security strength of " + mlName + " (RFC 9882 sec. 3.3)");
     }
     return { digest: md, digestAlgId: _algId(md, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: mlName }, sign: { name: mlName }, ecdsaDer: false };
   }
@@ -266,5 +280,6 @@ module.exports = {
   pssSpkiPinnedHash: pssSpkiPinnedHash,
   signOverTbs: signOverTbs,
   MLDSA_SUITABLE_DIGEST: MLDSA_SUITABLE_DIGEST,
+  mldsaDigestSuitable: mldsaDigestSuitable,
   SLHDSA_BY_OID: SLHDSA_BY_OID,
 };

package/lib/tsp-sign.js

@@ -336,7 +336,7 @@ function request(messageImprint, opts) {
   if (opts.certReq != null && typeof opts.certReq !== "boolean") throw _err("tsp/bad-input", "certReq must be a boolean");
   if (opts.certReq === true) fields.push(b.boolean(true));
   if (opts.extensions != null) {
-    if (!Array.isArray(opts.extensions) || !opts.extensions.every(function (e) { return Buffer.isBuffer(e) || e instanceof Uint8Array; })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
+    if (!Array.isArray(opts.extensions) || !guard.list.allMatch(opts.extensions, function (e) { return Buffer.isBuffer(e) || e instanceof Uint8Array; })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
     // Each pre-encoded Extension is validated as one, and its extnID must not repeat -- the same
     // gate every other request builder applies. Spliced in unchecked, a caller relaying a blob it
     // did not author put fully chosen bytes inside [0] and this encoder emitted DER its own
@@ -507,7 +507,7 @@ var _BIND_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
 // tsp/* verdict code; a config-shape error throws (the caller's contract).
 function _imprintMatches(mi, data) {
   var name = mi.hashAlgorithm && mi.hashAlgorithm.name;
-  var nodeAlg = name && _VERIFY_DIGEST[name];
+  var nodeAlg = (name && guard.intrinsic.hasOwn(_VERIFY_DIGEST, name)) ? _VERIFY_DIGEST[name] : null;
   if (!nodeAlg) return "tsp/unsupported-algorithm";   // cannot recompute -> never assume a match
   var wantLen = _VERIFY_DIGEST_LEN[name];
   // The token's messageImprint MUST be a full-length digest for its algorithm. A short/empty
@@ -732,6 +732,12 @@ function _buildTsaChains(leaf, pool) {
 // Every option pki.tsp.verify reads. Adding one here is the only way to make it accepted.
 var _VERIFY_OPTS = { certs: 1, trustAnchor: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 };
 
+// Does any extension carry the critical flag? The answer IS the unknown-critical-extension gate, so
+// it is decided by comparison instead of by a `some`. See guard-list.
+function _anyCritical(extensions) {
+  return guard.list.anyMatches(extensions, function (e) { return !!e && !!e.critical; });
+}
+
 async function verify(token, data, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
@@ -742,7 +748,7 @@ async function verify(token, data, opts) {
   // nothing to notice it by. Naming the difference at the boundary is the only place it is cheap.
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
     "pki.tsp.verify has an unknown option (note the anchor option here is `trustAnchor`, singular, an anchor tuple -- not the `trustAnchors` certificate list pki.cms.verify takes) ");
-  if (opts.certs != null && (!Array.isArray(opts.certs) || !opts.certs.every(function (c) { return Buffer.isBuffer(c) || c instanceof Uint8Array; }))) {
+  if (opts.certs != null && (!Array.isArray(opts.certs) || !guard.list.allMatch(opts.certs, function (c) { return Buffer.isBuffer(c) || c instanceof Uint8Array; }))) {
     throw _err("tsp/bad-input", "pki.tsp.verify opts.certs must be an array of DER certificate Buffers");   // a bad element is a caller error, never silently dropped
   }
   var tokenDer = _tokenDer(token);   // DER Buffer / PEM -> DER; a non-token input throws tsp/bad-input
@@ -789,7 +795,9 @@ async function verify(token, data, opts) {
   // A TSTInfo carrying a CRITICAL extension the verifier cannot process is unusable: RFC 3161 sec.
   // 2.4.2 defers extension handling to RFC 5280 sec. 4.2, and defines no TSTInfo extension, so any
   // critical one is unrecognized (the unknown-critical-extension gate the cert path also applies).
-  if (tst.extensions && tst.extensions.some(function (e) { return e.critical; })) {
+  // The scan for a critical extension IS the gate, so it is a loop rather than a `some`: one
+  // answering false makes the unrecognized critical extension invisible and the token is accepted.
+  if (tst.extensions && _anyCritical(tst.extensions)) {
     return fail("tsp/unknown-critical-extension");
   }
   // M13 -- the ESSCertID(V2) binding: the verifying cert MUST be the one the signer identified.

package/lib/validator-attcert.js

@@ -29,6 +29,12 @@
 
 var oid = require("./oid");
 var asn1 = require("./asn1-der");
+var guard = require("./guard-all");
+
+// Does this extended-key-usage list assert the given purpose? The answer decides whether a
+// certificate qualifies as the kind the rule names, so it goes through the membership guard
+// instead of a prototype method. See guard-list.
+var _asserts = guard.list.contains;
 
 // requireV3(cert, E, code) -- the leaf attestation certificate MUST be X.509 v3.
 // @enforced-by behavioral -- a version-field check has no rename-proof code shape; the RED
@@ -73,7 +79,10 @@ function aikCert(cert, exts, E, code) {
   assertNotCa(cert, exts, E, code);
   if ((cert.subject.rdns || []).length !== 0) throw new E(code, "the tpm AIK certificate subject MUST be empty (WebAuthn 8.3.1)");
   var eku = exts.decode(cert, "extKeyUsage");
-  if (!eku || !Array.isArray(eku.value) || eku.value.indexOf(oid.byName("tcgKpAikCertificate")) === -1) {
+  // The purpose test IS the rule that makes this an AIK certificate, so it is decided by comparison
+  // rather than by a prototype method: a replaced `indexOf` reports the purpose present on any
+  // certificate and an ordinary leaf is accepted as a TPM attestation key.
+  if (!eku || !Array.isArray(eku.value) || !_asserts(eku.value, oid.byName("tcgKpAikCertificate"))) {
     throw new E(code, "the tpm AIK certificate lacks the tcg-kp-AIKCertificate extended key purpose (WebAuthn 8.3.1)");
   }
   var san = exts.decode(cert, "subjectAltName");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.19",
+  "version": "0.5.20",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:d0064cbc-a37c-4d4f-ae67-0b9ba6887de2",
+  "serialNumber": "urn:uuid:e979b712-f27c-4c30-ba8e-4e9ab88715fd",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-20T21:35:06.293Z",
+    "timestamp": "2026-08-20T23:29:06.438Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.19",
+      "bom-ref": "@blamejs/pki@0.5.20",
       "type": "application",
       "name": "pki",
-      "version": "0.5.19",
+      "version": "0.5.20",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.19",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.20",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.19",
+      "ref": "@blamejs/pki@0.5.20",
       "dependsOn": []
     }
   ]