@blamejs/pki 0.6.38 → 0.6.39

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.39 — 2026-09-05
+
+A verdict field is created with the verdict rather than written onto it afterward, so a value left on Object.prototype can no longer answer a question the verification never asked.
+
+### Added
+
+- The pki.ocsp.verify and pki.path.verifyOcspResponse verdicts carry valid, true only when status is good. Every failure these verbs detect already reports status unknown, so the boolean covers exactly the checks they run.
+- The pki.cmc.verify verdict carries valid, true only for the issued outcome. Every other outcome, pending included, reads as false, with outcome, failInfo and pendToken unchanged.
+
+### Changed
+
+- The pki.ocsp.verify and pki.path.verifyOcspResponse verdicts report thisUpdate and nextUpdate as null, not undefined, when no response covered the certificate. Every path now reports both, so a reader gets the same shape whatever the verdict. Code testing them with === undefined should test == null.
+- The container release workflow takes docker/setup-qemu-action v4.3.0.
+
+### Fixed
+
+- A verdict field is now created with the verdict rather than assigned onto it afterward, so a value left on Object.prototype cannot answer a read the verification never wrote. Three verdicts could report an affirmative that had not been established: an OCSP response whose signature does not verify, or that no authorized responder signs, contributed a good status through pki.ocsp.verify, pki.path.verifyOcspResponse and pki.path.ocspChecker, so pki.path.validate accepted a certificate whose revocation status was never determined; pki.cms.verify reported a signer as trusted when it had been given no trust anchors to chain to; and pki.crmf.verifyPop reported verified for a request carrying no proof of possession at all. pki.cmc.verify, pki.smime.verify and the pki.cmp session results carried the same construction and are fixed with them.
+- A verdict also ends the prototype lookup for then, so an accessor installed there cannot rewrite it between the verification and the caller.
+- A pki.cmp session transcript no longer reports a protection result on a request leg. A request records no verdict, and the snapshot read the field without asking whether the entry carried one, so a value left on Object.prototype was copied in and read back as a result the session never reached.
+- The tables that decide how a signature is verified answer from their own entries alone. pki.cms.verify looked its signature scheme up in a table that inherits from Object.prototype, so a message could name an algorithm the toolkit does not implement and have the verification proceed under a descriptor left there. The dispatch tables in pki.cms.verify, pki.path.validate and the composite-signature resolver are fixed.
+
+### Internal
+
+- The test covering the implicit-rejection substitute content key chooses a ciphertext whose outcome it can predict. OpenSSL answers an RSA PKCS#1 v1.5 decode fault with a synthetic key whose length is drawn from the private key and the ciphertext, and a draw equal to the content-key length took the substitute out of the path, so the test failed about once in every few hundred runs.
+
 ## v0.6.38 — 2026-09-05
 
 A trust anchor can name the namespace its root is trusted for, and pki.path.validate enforces it as the initial name-constraint state.

package/lib/cmc-verify.js

@@ -89,12 +89,13 @@ function _assertBound(body, sent) {
     if (Buffer.isBuffer(v) || v instanceof Uint8Array) return v.length > 0;   // allow:byte-source-narrow -- sent.senderNonce / dataReturn are already normalized to a Buffer by _snapshotSent; this is a length test on a settled value, not an input door
     return true;
   }
-  var bound = {
+  var bound = guard.verdict.of({
     transactionId: _carries(sent.transactionId),
     senderNonce: _carries(sent.senderNonce),
     dataReturn: _carries(sent.dataReturn),
     bodyPartIDs: Array.isArray(sent.bodyPartIDs),
-  };
+    boundToRequest: false,
+  });
   if (sent.transactionId != null) {
     var txControl = _findControl(body.controls, OID_TRANSACTION_ID, "Transaction Identifier");
     if (!txControl) {
@@ -197,6 +198,10 @@ function _governingStatus(statuses, outcome) {
  * @defends    cmc-response-replay (CWE-294)
  * @related    pki.schema.cmc.parse, pki.path.validate, pki.cms.verify
  *
+ * The verdict carries `valid`, the toolkit-wide alias the other verify verbs use, true only for the
+ * `issued` outcome. Every other outcome, including `pending`, is `valid: false`, and which one it
+ * was stays in `outcome` alongside `failInfo` and `pendToken`.
+ *
  * Interpret a Full PKI Response into one terminal verdict. `response` is the DER or a PEM `CMS`
  * block; an already-parsed message is interpreted too, but only under `allowUnverified: true`,
  * because both carriers authenticate over BYTES and a parsed object the caller still owns pins
@@ -419,7 +424,8 @@ function _shape(body, sent, signatureVerified, bound) {
   var confirm = _findControl(body.controls, OID_CONFIRM_CERT_ACCEPTANCE, "Confirm Certificate Acceptance");
   var serverNonce = _findControl(body.controls, OID_SENDER_NONCE, "Sender Nonce");
 
-  return {
+  return guard.verdict.of({
+    valid: outcome === "issued",
     outcome: outcome,
     statuses: body.statuses,
     failInfo: governing ? governing.failInfoName : null,
@@ -448,7 +454,7 @@ function _shape(body, sent, signatureVerified, bound) {
     controls: body.controls,
     unhandled: body.unhandled,
     cms: body.cms,
-  };
+  });
 }
 
 /**

package/lib/cmp-session.js

@@ -590,24 +590,23 @@ function session(opts) {
 
   function _recordTranscript(entry) {
     var len = Buffer.isBuffer(entry.bytes) ? entry.bytes.length : 0;
-    if (transcriptBytes + len > transcriptCap) {
-      entry.byteLength = len; entry.bytes = null; entry.truncated = true;
-    } else {
-      transcriptBytes += len;
-    }
-    transcript.push(entry);
+    var over = transcriptBytes + len > transcriptCap;
+    if (!over) transcriptBytes += len;
+    transcript.push(over
+      ? guard.verdict.of(entry, { byteLength: len, bytes: null, truncated: true })
+      : guard.verdict.of(entry));
   }
 
   function _transcriptSnapshot() {
     return transcript.map(function (e) {
-      var c = Object.assign({}, e);
+      var c = guard.verdict.of(e);
       if (Buffer.isBuffer(c.bytes)) c.bytes = Buffer.from(c.bytes);
-      if (c.verdict) c.verdict = Object.assign({}, c.verdict);
+      if (guard.verdict.carries(c, "verdict") && c.verdict) c.verdict = guard.verdict.of(c.verdict);
       return c;
     });
   }
   function _terminal(outcome, extra) {
-    return Object.assign({
+    return guard.verdict.of({
       outcome: outcome, certificate: null, chain: [], status: null, trusted: true,
       confirmed: false, implicitConfirm: false, transactionID: Buffer.from(transactionID),
       polls: 0, transcript: _transcriptSnapshot(),

package/lib/cms-verify.js

@@ -51,22 +51,29 @@ var pkix = require("./schema-pkix");
 var CmsError = frameworkError.CmsError;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
 var _Promise = Promise, _promiseResolveRaw = Promise.resolve;
-function _pResolve(v) { return intrinsic.apply(_promiseResolveRaw, _Promise, [v]); }
+/**
+ * @internal Every value resolved here is a signer row, and resolving a promise reads `then` off the
+ * value. Building the row through the verdict guard ends that lookup on the row itself, so an
+ * accessor installed while the signature check is pending cannot rewrite the `ok` the message
+ * verdict is derived from before it is read.
+ */
+function _pResolve(v) { return intrinsic.apply(_promiseResolveRaw, _Promise, [_row(v)]); }
+function _row(o) { return guard.verdict.of(o); }
 
 var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_CONTENT_TYPE = oid.byName("contentType");
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
 
-var DIGEST_HASH = {
+var DIGEST_HASH = intrinsic.assign(intrinsic.create(null), {
   sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512",
   shake128: "SHAKE128", shake256: "SHAKE256",
-};
-var SIG_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
+});
+var SIG_HASH = intrinsic.assign(intrinsic.create(null), { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 function _supportedDigest(name) { return intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 async function _computeDigest(name, content) {
   return intrinsic.bufferFrom(await subtle.digest(DIGEST_HASH[name], content));
 }
-var SIG_SCHEME = {
+var SIG_SCHEME = intrinsic.assign(intrinsic.create(null), {
   rsaEncryption: { kind: "rsa", params: "null" },
   rsassaPss: { kind: "rsapss" },
   ecPublicKey: { kind: "ec", params: "absent" },
@@ -83,13 +90,13 @@ var SIG_SCHEME = {
   ecdsaWithSHA256: { kind: "ec", hash: "SHA-256", params: "absent" },
   ecdsaWithSHA384: { kind: "ec", hash: "SHA-384", params: "absent" },
   ecdsaWithSHA512: { kind: "ec", hash: "SHA-512", params: "absent" },
-};
+});
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
 ].forEach(function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + s.toUpperCase(), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
 function _isDerNull(p) { return Buffer.isBuffer(p) && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
 function _algParamsOk(shape, p) { return shape === "null" ? _isDerNull(p) : (p === null || p === undefined); }
-var EC_CURVE = {};
+var EC_CURVE = intrinsic.create(null);
 EC_CURVE[oid.byName("prime256v1")] = { curve: "P-256", coordLen: 32 };
 EC_CURVE[oid.byName("secp384r1")] = { curve: "P-384", coordLen: 48 };
 EC_CURVE[oid.byName("secp521r1")] = { curve: "P-521", coordLen: 66 };
@@ -122,13 +129,13 @@ async function _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes,
     }
     try {
       var ok = await _verifySignature(scheme, sigHash, sigBytes, c.cert.subjectPublicKeyInfo.bytes, signedBytes, _certCurveOid(c.cert), pssSalt);
-      if (ok === true) return { ok: true, sid: sid, cert: c.der };
+      if (ok === true) return _row({ ok: true, sid: sid, cert: c.der });
     } catch (e) {
       lastErr = (e instanceof CmsError) ? e : _err("cms/verify-error", "the SignerInfo signature could not be evaluated", e);
     }
   }
-  return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
-    : { ok: false, sid: sid, cert: candidates[0].der };
+  return _row(lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+    : { ok: false, sid: sid, cert: candidates[0].der });
 }
 
 function _certSki(cert) {
@@ -262,7 +269,7 @@ async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, dige
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
 
   var signedBytes = await (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType, digestByName));
-  if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+  if (signedBytes && signedBytes.mismatch) return _row({ ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message });
   return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
 }
 
@@ -347,7 +354,7 @@ async function _verifyComposite(si, comp, content, eContentType, parsedCerts, cs
   if (!signers.length) return _pResolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
   var signedBytes = await (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType, digestByName));
-  if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+  if (signedBytes && signedBytes.mismatch) return _row({ ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message });
   return _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si.sid, signers, si.signatureAlgorithm.oid);
 }
 
@@ -360,11 +367,11 @@ async function _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si
       continue;
     }
     var r = await compositeSig.compositeVerify(c.cert.subjectPublicKeyInfo.bytes, sigBytes, signedBytes, comp, CmsError, "cms/unsupported-algorithm", "cms/bad-signature");
-    if (r.ok === true) return { ok: true, sid: sid, cert: c.der };
+    if (r.ok === true) return _row({ ok: true, sid: sid, cert: c.der });
     if (r.code) lastErr = (r.error instanceof CmsError) ? r.error : _err(r.code, r.error && r.error.message ? r.error.message : "the composite signature could not be evaluated");
   }
-  return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
-    : { ok: false, sid: sid, cert: candidates[0].der };
+  return _row(lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+    : { ok: false, sid: sid, cert: candidates[0].der });
 }
 
 function _surfaceUnsignedAttrs(si) {
@@ -394,14 +401,13 @@ async function _verifyCountersignatures(si, parsedCerts) {
 async function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
   var csSi;
   try { csSi = cms.walkCountersignature(asn1.decode(intrinsic.isBuffer(vDer) ? vDer : intrinsic.bufferFrom(vDer))); }
-  catch (e) { return { ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }; }
+  catch (e) { return _row({ ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }); }
   var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig);
   var nested = await _verifyCountersignatures(csSi, parsedCerts);
-  var node = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
-  if (verdict.code) node.code = verdict.code;
-  node.unsignedAttrs = _surfaceUnsignedAttrs(csSi);
-  node.countersignatures = nested;
-  return node;
+  var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
+  return guard.verdict.of(
+    verdict.code ? guard.verdict.of(head, { code: verdict.code }) : head,
+    { unsignedAttrs: _surfaceUnsignedAttrs(csSi), countersignatures: nested });
 }
 
 /**
@@ -539,19 +545,23 @@ async function _verify(input, opts) {
   for (var _sp = 0; _sp < parsed.signerInfos.length; _sp++) {
     var siOne = parsed.signerInfos[_sp];
     var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName);
-    verdict.countersignatures = await _verifyCountersignatures(siOne, parsedCerts);
-    verdict.unsignedAttrs = _surfaceUnsignedAttrs(siOne);
-    verdict.signedAttributesPresent = !!siOne.signedAttrsBytes;
-    verdict.signedAttributes = _surfaceSignedAttrs(siOne);
-    verdict.digestAlgorithm = siOne.digestAlgorithm.name;
-    intrinsic.push(signers, verdict);
+    var counters = await _verifyCountersignatures(siOne, parsedCerts);
+    intrinsic.push(signers, guard.verdict.of(verdict, {
+      countersignatures: counters,
+      unsignedAttrs: _surfaceUnsignedAttrs(siOne),
+      signedAttributesPresent: !!siOne.signedAttrsBytes,
+      signedAttributes: _surfaceSignedAttrs(siOne),
+      digestAlgorithm: siOne.digestAlgorithm.name,
+      trusted: false,
+    }));
   }
-  var res = {
+  var res = guard.verdict.of({
     valid: signers.length > 0 && guard.list.allMatch(signers, function (s) { return s.ok === true; }),
     eContentType: parsed.encapContentInfo.eContentType,
     eContent: parsed.encapContentInfo.eContent != null ? parsed.encapContentInfo.eContent : null,
     signers: signers,
-  };
+    trusted: false,
+  });
   await _applyTrust(res, parsedCerts, trustCfg);
   return res;
 }

package/lib/composite-sig.js

@@ -24,7 +24,7 @@ var MLDSA_COMPONENT = {
 };
 var EC_CURVE_OID = { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" };
 var PH_CMS = { "SHA-256": "sha256", "SHA-512": "sha512", "SHAKE256": "shake256" };
-var COMPOSITE_ALGS = {};
+var COMPOSITE_ALGS = Object.create(null);
 function _comp(name, mldsa, ph, label, trad) {
   var sz = MLDSA_COMPONENT[mldsa];
   COMPOSITE_ALGS[oid.byName(name)] = {

package/lib/crmf-sign.js

@@ -478,7 +478,10 @@ function _verifyOne(msg) {
     subjectBound: false,
     publicKey: (t && t.publicKey && t.publicKey.bytes) || null,
   };
-  function settle(extra) { var v = Object.assign({}, base, extra); v.valid = v.verified === true; return Promise.resolve(v); }
+  function settle(extra) {
+    var v = guard.verdict.of(base, extra);
+    return Promise.resolve(guard.verdict.of(v, { valid: v.verified === true }));
+  }
 
   var popo = msg.popo;
   if (popo == null) {
@@ -499,7 +502,7 @@ function _verifyOne(msg) {
   var spki = pin ? pin.publicKey : base.publicKey;
   var bound = !pin;
   return crmfVerify.verifyPopSignature(popo, spki, preimage).then(function (ok) {
-    return Object.assign({}, base, {
+    return guard.verdict.of(base, {
       valid: ok === true, verified: ok === true, method: "signature", cryptographicallyVerified: ok === true,
       subject: bound ? base.subject : null,
       subjectBound: bound,
@@ -558,7 +561,7 @@ function _verifyPop(messages) {
   var parsed = _coerceMessages(messages);
   return Promise.all(parsed.messages.map(_verifyOne)).then(function (out) {
     var allVerified = out.length > 0 && out.every(function (m) { return m.verified === true; });
-    return { valid: allVerified, verified: allVerified, messages: out };
+    return guard.verdict.of({ valid: allVerified, verified: allVerified, messages: out });
   });
 }
 

package/lib/guard-all.js

@@ -20,6 +20,7 @@ var header = require("./guard-header");
 var compress = require("./guard-compress");
 var secret = require("./guard-secret");
 var parsed = require("./guard-parsed");
+var verdict = require("./guard-verdict");
 var async_ = require("./guard-async");
 
 module.exports = _freeze({
@@ -39,5 +40,6 @@ module.exports = _freeze({
   compress: compress,
   secret: secret,
   parsed: parsed,
+  verdict: verdict,
   async:  async_,
 });

package/lib/guard-verdict.js

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+// @internal
+
+var _freeze = require("./guard-intrinsic").freeze;
+var _keys = require("./guard-intrinsic").keys;
+var _defineProperty = require("./guard-intrinsic").defineProperty;
+var _getOwnPropertyDescriptor = require("./guard-intrinsic").getOwnPropertyDescriptor;
+var _hasOwn = require("./guard-intrinsic").hasOwn;
+var _Object = require("./guard-intrinsic").Object;
+
+function _copyOwn(out, src) {
+  var keys = _keys(src);
+  for (var i = 0; i < keys.length; i++) {
+    var d = _getOwnPropertyDescriptor(src, keys[i]);
+    if (!d) continue;
+    var value = _hasOwn(d, "value") ? d.value : src[keys[i]];
+    _defineProperty(out, keys[i], { value: value, enumerable: true, configurable: true, writable: true });
+  }
+}
+
+// @enforced-by behavioral -- the defect is the ABSENCE of this call at a construction site, not a
+function of(src, extras) {
+  var out = {};
+  _copyOwn(out, src);
+  if (extras != null) _copyOwn(out, extras);
+  /** @internal Resolving a promise reads `then` off the value, so an inherited accessor would run
+   * with the verdict as its receiver and could rewrite a field or hand the caller a different
+   * object. An own `then` ends that lookup, and is non-enumerable so keys, JSON, a spread and a
+   * deep-equality comparison do not see it. */
+  _defineProperty(out, "then", { value: undefined, enumerable: false, configurable: true, writable: true });
+  return out;
+}
+
+// @enforced-by behavioral -- Object.hasOwn and hasOwnProperty are replaceable at any time, and a
+function carries(obj, key) {
+  return obj != null && _hasOwn(_Object(obj), key);
+}
+
+module.exports = _freeze({ of: of, carries: carries });

package/lib/ocsp-verify.js

@@ -121,19 +121,33 @@ function makeOcspVerify(deps) {
 
   function isOctetAligned(bitString) { return !!bitString && bitString.unusedBits === 0; }
 
+  /**
+   * @internal Every field the callers decide on is present on every return, so a field an early
+   * return would have left absent is read from the response that was evaluated rather than from
+   * whatever a polluted Object.prototype answers: a rejected response would otherwise be able to
+   * report `sawGood`, and a certificate with no authoritative response would read as good.
+   */
+  function _evaluation(extras) {
+    return guard.verdict.of({
+      applicable: false, matched: false, responderAuthorized: false, signatureValid: false,
+      revoked: null, sawGood: false, sawUnknownStatus: false,
+      thisUpdate: null, nextUpdate: null, reason: "",
+    }, extras);
+  }
+
   async function evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) {
-    if (resp.responseStatus.code !== 0) return { applicable: false, matched: false, reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" };
+    if (resp.responseStatus.code !== 0) return _evaluation({ reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" });
     var br = resp.basicResponse;
-    if (!br) return { applicable: false, matched: false, reason: "successful OCSP response carries no BasicOCSPResponse" };
+    if (!br) return _evaluation({ reason: "successful OCSP response carries no BasicOCSPResponse" });
     var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
-    if (!signerSpki) return { applicable: true, matched: false, responderAuthorized: false, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" };
+    if (!signerSpki) return _evaluation({ applicable: true, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" });
     if (!(await verifyWithSpki(br.signatureAlgorithm, br.signature, signerSpki, br.tbsResponseDataBytes))) {
-      return { applicable: true, matched: false, responderAuthorized: true, signatureValid: false, reason: "the OCSP response signature does not verify over tbsResponseData" };
+      return _evaluation({ applicable: true, responderAuthorized: true, reason: "the OCSP response signature does not verify over tbsResponseData" });
     }
     if (ocspHasCriticalExtension(br.responseExtensions)) {
-      return { applicable: true, matched: false, responderAuthorized: true, signatureValid: true, reason: "the OCSP response carries an unrecognized critical extension" };
+      return _evaluation({ applicable: true, responderAuthorized: true, signatureValid: true, reason: "the OCSP response carries an unrecognized critical extension" });
     }
-    var out = { applicable: true, matched: false, responderAuthorized: true, signatureValid: true, revoked: null, sawGood: false, sawUnknownStatus: false, reason: "no current SingleResponse names this certificate" };
+    var out = _evaluation({ applicable: true, responderAuthorized: true, signatureValid: true, reason: "no current SingleResponse names this certificate" });
     for (var s = 0; s < br.responses.length; s++) {
       var sr = br.responses[s];
       if (!(await ocspCertIdMatches(sr.certID, cert, issuerNameCandidates, issuerKeyBits))) continue;

package/lib/ocsp.js

@@ -374,7 +374,7 @@ function buildErrorResponse(status) {
 
 /**
  * @primitive pki.ocsp.verify
- * @signature pki.ocsp.verify(response, opts) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, nonceMatched?, reason }>
+ * @signature pki.ocsp.verify(response, opts) -> Promise<{ valid, status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, nonceMatched?, reason }>
  * @since 0.2.22
  * @status stable
  * @spec RFC 6960, RFC 9654, RFC 5019
@@ -389,6 +389,11 @@ function buildErrorResponse(status) {
  * unauthorized, stale, or CertID-mismatched response is a `"unknown"` verdict (never a silent
  * accept); a malformed response's parse fault surfaces as the parser's `ocsp/*` / `asn1/*`.
  *
+ * `valid` is the toolkit-wide verdict alias the other verify verbs carry, and it is true only when
+ * `status` is `"good"`. Because every failure this verb detects already collapses to `"unknown"`,
+ * `valid` states exactly what `status === "good"` does and hides no unrun check. A revoked
+ * certificate is `valid: false`; which of the two it was stays in `status`.
+ *
  * The request-nonce check is reported, and downgrades `good` alone. Every verdict carries
  * `nonceMatched` (true / false / null when the client sent no nonce). An unmatched nonce turns a
  * `good` into `"unknown"`, because a response that is not an answer to this request cannot be relied
@@ -437,16 +442,20 @@ function verify(response, opts) {
     time = opts.time == null ? new Date() : _asDate(opts.time);
   } catch (e) { return Promise.reject(e); }
   return pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time, { historicalMode: opts.historicalMode === true }).then(function (verdict) {
-    if (opts.requestNonce == null) return Object.assign({}, verdict, { nonceMatched: null });
-    var respNonce = _responseNonce(parsed);
-    var reqNonce = guard.bytes.isByteSource(opts.requestNonce)
-      ? guard.bytes.snapshotSource(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
-    var matched = respNonce != null && reqNonce != null && guard.crypto.constantTimeEqual(respNonce, reqNonce);
-    var out = Object.assign({}, verdict, { nonceMatched: matched });
-    if (!matched && verdict.status === "good") {
-      return Object.assign(out, { status: "unknown", reason: "the OCSP response nonce does not echo the request nonce (RFC 9654)" });
+    var out;
+    if (opts.requestNonce == null) {
+      out = guard.verdict.of(verdict, { nonceMatched: null });
+    } else {
+      var respNonce = _responseNonce(parsed);
+      var reqNonce = guard.bytes.isByteSource(opts.requestNonce)
+        ? guard.bytes.snapshotSource(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
+      var matched = respNonce != null && reqNonce != null && guard.crypto.constantTimeEqual(respNonce, reqNonce);
+      out = guard.verdict.of(verdict, { nonceMatched: matched });
+      if (!matched && out.status === "good") {
+        out = guard.verdict.of(out, { status: "unknown", reason: "the OCSP response nonce does not echo the request nonce (RFC 9654)" });
+      }
     }
-    return out;
+    return guard.verdict.of(out, { valid: out.status === "good" });
   });
 }
 function _responseNonce(parsed) {
@@ -462,7 +471,7 @@ function _requestFromBytes(request) {
   return ocspSchema.parseRequest(request);
 }
 function _reqVerdict(parsed, extra) {
-  return {
+  return guard.verdict.of({
     valid: extra.signed === true && extra.signatureValid === true,
     signed: extra.signed, signatureValid: extra.signatureValid,
     signerCert: extra.signerCert != null ? extra.signerCert : null,
@@ -472,7 +481,7 @@ function _reqVerdict(parsed, extra) {
     requestorName: parsed.requestorName, requestList: parsed.requestList,
     requestExtensions: parsed.requestExtensions, version: parsed.version,
     reason: extra.reason != null ? extra.reason : null,
-  };
+  });
 }
 async function _findRequestSigners(candidates, strict, parsed, sig, sigBits) {
   var parsedList = [];

package/lib/path-validate.js

@@ -108,7 +108,7 @@ var PROCESSED_EXTENSIONS = {};
 Object.freeze(PROCESSED_EXTENSIONS);
 
 
-var SIG_ALGS = {};
+var SIG_ALGS = intrinsic.create(null);
 function _sig(name, verify, imp, params, ecdsa, sameKeyOid) {
   var entry = { verify: verify, imp: imp, params: params };
   if (ecdsa) entry.ecdsa = true;
@@ -1770,7 +1770,7 @@ function ocspChecker(responses) {
 
 /**
  * @primitive  pki.path.verifyOcspResponse
- * @signature  pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, reason }>
+ * @signature  pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ valid, status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, reason }>
  * @since       0.2.22
  * @status      stable
  * @spec        RFC 6960
@@ -1826,14 +1826,16 @@ function ocspChecker(responses) {
  *   var v = await pki.path.verifyOcspResponse(der, cert, issuerCert, new Date());
  *   v.status;   // "good" | "revoked" | "unknown"
  */
-function verifyOcspResponse(response, cert, issuerCert, time, opts) {
+async function verifyOcspResponse(response, cert, issuerCert, time, opts) {
   var parsedResponse, subject, issuer;
   try {
     parsedResponse = _ocspFromBytes(response);
     subject = coerceCert(cert, "the certificate");
     issuer = coerceCert(issuerCert, "the issuer certificate");
   } catch (e) { return Promise.reject(e); }
-  return _verifyOcspParsed(parsedResponse, subject, issuer, time, opts);
+  var v = await _verifyOcspParsed(parsedResponse, subject, issuer, time, opts);
+  var out = guard.verdict.of(v);
+  return guard.verdict.of(out, { valid: out.status === "good" });
 }
 
 var _OCSP_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
@@ -1852,7 +1854,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   if (!guard.time.isDate(time) || isNaN(guard.time.instantOf(time))) {
     return Promise.reject(E("path/bad-input", "verifyOcspResponse: time must be a valid Date (the currency + responder-validity check date)"));
   }
-  function unbound(reason) { return { status: "unknown", responderAuthorized: false, signatureValid: false, matched: false, reason: reason }; }
+  function unbound(reason) { return guard.verdict.of({ status: "unknown", responderAuthorized: false, signatureValid: false, matched: false, thisUpdate: null, nextUpdate: null, reason: reason }); }
   var boundName;
   try { boundName = dnEqual(cert.issuer.rdns, issuerCert.subject.rdns); }
   catch (e) { return Promise.reject(e); }
@@ -1869,9 +1871,9 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
     catch (_e) { return unbound("the issuer public key could not be read to recompute the OCSP CertID"); }
     return ocspCore.evaluateResponse(parsedResponse, cert, issuerCtx, issuerKeyBits, issuerNameCandidates, time, opts.historicalMode === true).then(function (v) {
-      if (v.revoked) return { status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason };
-      if (v.sawGood) return { status: "good", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: "good" };
-      return { status: "unknown", responderAuthorized: v.responderAuthorized === true, signatureValid: v.signatureValid === true, matched: v.matched === true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: v.reason };
+      if (v.revoked) return guard.verdict.of({ status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason });
+      if (v.sawGood) return guard.verdict.of({ status: "good", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: "good" });
+      return guard.verdict.of({ status: "unknown", responderAuthorized: v.responderAuthorized === true, signatureValid: v.signatureValid === true, matched: v.matched === true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: v.reason });
     });
   });
 }

package/lib/smime.js

@@ -630,7 +630,7 @@ async function verify(message, opts) {
     var inner;
     try { inner = _toBuf(schemaCms.parse(p7m).encapContentInfo.eContent); }
     catch (e) { throw _err("smime/bad-mime", "the pkcs7-mime SignedData has no encapsulated content", e); }
-    return Object.assign({ valid: res.valid, trusted: res.trusted, signers: res.signers, form: "pkcs7-mime", content: inner, micalg: null, sender: _senderSurface(res.signers, ent, opts.expectedSender) }, _hpSurface(inner, ent, "clear", res.valid, opts.legacyHeaderProtection === true));
+    return guard.verdict.of({ valid: res.valid, trusted: res.trusted, signers: res.signers, form: "pkcs7-mime", content: inner, micalg: null, sender: _senderSurface(res.signers, ent, opts.expectedSender) }, _hpSurface(inner, ent, "clear", res.valid, opts.legacyHeaderProtection === true));
   }
   if (ct.type === "multipart/signed") {
     if (ct.params.protocol && !_isPkcs7(ct.params.protocol, "signature")) throw _err("smime/bad-multipart", "multipart/signed protocol must be application/pkcs7-signature");
@@ -651,7 +651,7 @@ async function verify(message, opts) {
     if (opts.strictMicalg && micalg && _micalgSet(micalg) !== (_micalgOf(p7s) || "")) {
       throw _err("smime/micalg-mismatch", "the multipart/signed micalg " + JSON.stringify(micalg) + " disagrees with the SignerInfo digests");
     }
-    return Object.assign({ valid: res2.valid, trusted: res2.trusted, signers: res2.signers, form: "multipart/signed", content: parts[0], micalg: micalg, sender: _senderSurface(res2.signers, ent, opts.expectedSender) }, _hpSurface(parts[0], ent, "clear", res2.valid, opts.legacyHeaderProtection === true));
+    return guard.verdict.of({ valid: res2.valid, trusted: res2.trusted, signers: res2.signers, form: "multipart/signed", content: parts[0], micalg: micalg, sender: _senderSurface(res2.signers, ent, opts.expectedSender) }, _hpSurface(parts[0], ent, "clear", res2.valid, opts.legacyHeaderProtection === true));
   }
   throw _err("smime/unsupported-type", "not a signed S/MIME message (Content-Type " + JSON.stringify(ct.type) + ")");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.38",
+  "version": "0.6.39",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:adf5e979-6804-475f-a0d0-8aef04be0317",
+  "serialNumber": "urn:uuid:b1c86284-d109-4852-8e85-dc5992b74178",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-05T07:57:13.454Z",
+    "timestamp": "2026-09-05T11:25:26.514Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.38",
+      "bom-ref": "@blamejs/pki@0.6.39",
       "type": "application",
       "name": "pki",
-      "version": "0.6.38",
+      "version": "0.6.39",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.38",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.39",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.38",
+      "ref": "@blamejs/pki@0.6.39",
       "dependsOn": []
     }
   ]