@blamejs/pki 0.6.38 → 0.6.40

package/CHANGELOG.md

@@ -4,6 +4,43 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.40 — 2026-09-05
+
+Every verify verdict now reaches its caller as the object the verb built, and a list the toolkit assembles carries the entries the toolkit put in it.
+
+### Fixed
+
+- The verdicts of pki.attrcert.verify, pki.crl.verify, pki.csr.verify, pki.ct.verifySctWithLogList, pki.ct.verifySctList, pki.path.validate, pki.path.build, pki.pkcs12.verifyMac, pki.pkcs12.open, pki.webauthn.verify, pki.webauthn.verifyAssertion, pki.cmp.verify, pki.tsp.verify, pki.ocsp.verifyRequest and pki.sigstore.verifyBundle end the prototype lookup for then on themselves. An accessor installed there while a verification was pending could otherwise run with the verdict as its receiver and change what the caller reads.
+- A list a verdict reports is appended to by defining the entry rather than assigning it, so a setter at the appended index cannot take the value and answer the read with something else. This covers the keys, certificates, CRLs and secrets pki.pkcs12.open returns from an authenticated store, the signers pki.cms.verify reports and the countersignatures under them, the per-SCT results and the distinct operators pki.ct.verifySctList counts its policy against, the per-certificate results pki.path.validate reports and the checks under each of them that name which gate refused, the elements of a compound attestation pki.webauthn.verify returns along with the routes its anchoredTo names, the certificate chain and transcript a pki.cmp session returns, and the signer identities pki.smime.verify reports. The arrays a pki.schema parser fills are not covered: a verify verb re-derives its answer from the bytes and refuses a parse result whose fields were rebuilt, so a substituted entry there decides nothing.
+- pki.webauthn.verify builds the fields it learns after the attestation itself is checked into the verdict rather than writing them onto it. bindingChecked, which tells a relying party which of its expectations were enforced, could otherwise be taken by an inherited setter and reported by its getter as a check that never ran. anchoredTo, anchoredElements, metadata, clientData, safetyNet, tpm and compound are built the same way.
+- The results of pki.path.crlChecker(...).check and pki.path.ocspChecker(...).check, the build-only result pki.path.build returns under validate:false, and the results of pki.ct.signSct and pki.ct.fetchLogList carry the same protection. Each is handed to a caller, so each ends the prototype lookup for then on itself.
+- Path validation, CMS verification, timestamp verification, CMP protection verification and Sigstore bundle verification append to every one of their own lists the same way. Each reads its answer back out of those lists, so the name forms a name-constraint check compares, the CRLs a revocation decision scans, the policy-tree nodes that produce the user-constrained set, the candidate certificates a signer identifier selects, the chains a timestamp is trusted through and the path a Fulcio leaf is anchored by are all written where an indexed setter cannot reach them.
+
+## v0.6.39 — 2026-09-05
+
+A verdict field is created with the verdict rather than written onto it afterward, so a value left on Object.prototype can no longer answer a question the verification never asked.
+
+### Added
+
+- The pki.ocsp.verify and pki.path.verifyOcspResponse verdicts carry valid, true only when status is good. Every failure these verbs detect already reports status unknown, so the boolean covers exactly the checks they run.
+- The pki.cmc.verify verdict carries valid, true only for the issued outcome. Every other outcome, pending included, reads as false, with outcome, failInfo and pendToken unchanged.
+
+### Changed
+
+- The pki.ocsp.verify and pki.path.verifyOcspResponse verdicts report thisUpdate and nextUpdate as null, not undefined, when no response covered the certificate. Every path now reports both, so a reader gets the same shape whatever the verdict. Code testing them with === undefined should test == null.
+- The container release workflow takes docker/setup-qemu-action v4.3.0.
+
+### Fixed
+
+- A verdict field is now created with the verdict rather than assigned onto it afterward, so a value left on Object.prototype cannot answer a read the verification never wrote. Three verdicts could report an affirmative that had not been established: an OCSP response whose signature does not verify, or that no authorized responder signs, contributed a good status through pki.ocsp.verify, pki.path.verifyOcspResponse and pki.path.ocspChecker, so pki.path.validate accepted a certificate whose revocation status was never determined; pki.cms.verify reported a signer as trusted when it had been given no trust anchors to chain to; and pki.crmf.verifyPop reported verified for a request carrying no proof of possession at all. pki.cmc.verify, pki.smime.verify and the pki.cmp session results carried the same construction and are fixed with them.
+- A verdict also ends the prototype lookup for then, so an accessor installed there cannot rewrite it between the verification and the caller.
+- A pki.cmp session transcript no longer reports a protection result on a request leg. A request records no verdict, and the snapshot read the field without asking whether the entry carried one, so a value left on Object.prototype was copied in and read back as a result the session never reached.
+- The tables that decide how a signature is verified answer from their own entries alone. pki.cms.verify looked its signature scheme up in a table that inherits from Object.prototype, so a message could name an algorithm the toolkit does not implement and have the verification proceed under a descriptor left there. The dispatch tables in pki.cms.verify, pki.path.validate and the composite-signature resolver are fixed.
+
+### Internal
+
+- The test covering the implicit-rejection substitute content key chooses a ciphertext whose outcome it can predict. OpenSSL answers an RSA PKCS#1 v1.5 decode fault with a synthetic key whose length is drawn from the private key and the ciphertext, and a draw equal to the content-key length took the substitute out of the path, so the test failed about once in every few hundred runs.
+
 ## v0.6.38 — 2026-09-05
 
 A trust anchor can name the namespace its root is trusted for, and pki.path.validate enforces it as the initial name-constraint state.

package/lib/attrcert-sign.js

@@ -717,7 +717,7 @@ function _verify(ac, issuer, opts) {
   var trust = _resolveIssuer(issuer);
 
   var acIssuer = _acIssuerName(parsed);
-  var result = {
+  var result = guard.verdict.of({
     holder: parsed.holder,
     issuer: acIssuer,
     attributes: parsed.attributes,
@@ -735,7 +735,7 @@ function _verify(ac, issuer, opts) {
     valid: false,
     verified: false,
     reason: undefined,
-  };
+  });
 
   return Promise.resolve(attrcertVerify.verifyAcSignature(parsed, trust.spki)).then(function (sigOk) {
     result.signatureValid = sigOk === true;

package/lib/cmc-verify.js

@@ -89,12 +89,13 @@ function _assertBound(body, sent) {
     if (Buffer.isBuffer(v) || v instanceof Uint8Array) return v.length > 0;   // allow:byte-source-narrow -- sent.senderNonce / dataReturn are already normalized to a Buffer by _snapshotSent; this is a length test on a settled value, not an input door
     return true;
   }
-  var bound = {
+  var bound = guard.verdict.of({
     transactionId: _carries(sent.transactionId),
     senderNonce: _carries(sent.senderNonce),
     dataReturn: _carries(sent.dataReturn),
     bodyPartIDs: Array.isArray(sent.bodyPartIDs),
-  };
+    boundToRequest: false,
+  });
   if (sent.transactionId != null) {
     var txControl = _findControl(body.controls, OID_TRANSACTION_ID, "Transaction Identifier");
     if (!txControl) {
@@ -197,6 +198,10 @@ function _governingStatus(statuses, outcome) {
  * @defends    cmc-response-replay (CWE-294)
  * @related    pki.schema.cmc.parse, pki.path.validate, pki.cms.verify
  *
+ * The verdict carries `valid`, the toolkit-wide alias the other verify verbs use, true only for the
+ * `issued` outcome. Every other outcome, including `pending`, is `valid: false`, and which one it
+ * was stays in `outcome` alongside `failInfo` and `pendToken`.
+ *
  * Interpret a Full PKI Response into one terminal verdict. `response` is the DER or a PEM `CMS`
  * block; an already-parsed message is interpreted too, but only under `allowUnverified: true`,
  * because both carriers authenticate over BYTES and a parsed object the caller still owns pins
@@ -419,7 +424,8 @@ function _shape(body, sent, signatureVerified, bound) {
   var confirm = _findControl(body.controls, OID_CONFIRM_CERT_ACCEPTANCE, "Confirm Certificate Acceptance");
   var serverNonce = _findControl(body.controls, OID_SENDER_NONCE, "Sender Nonce");
 
-  return {
+  return guard.verdict.of({
+    valid: outcome === "issued",
     outcome: outcome,
     statuses: body.statuses,
     failInfo: governing ? governing.failInfoName : null,
@@ -448,7 +454,7 @@ function _shape(body, sent, signatureVerified, bound) {
     controls: body.controls,
     unhandled: body.unhandled,
     cms: body.cms,
-  };
+  });
 }
 
 /**

package/lib/cmp-session.js

@@ -507,7 +507,7 @@ function session(opts) {
         if (!Buffer.isBuffer(c)) return;
         var k = c.toString("base64");
         if (caPubsSeen[k]) {
-          if (isGrantLeg) { for (var pi = 0; pi < caPubsAccum.length; pi++) { if (caPubsAccum[pi].toString("base64") === k) { caPubsAccum.push(caPubsAccum.splice(pi, 1)[0]); if (pi < caPubsWaitingCount) caPubsWaitingCount--; break; } } }
+          if (isGrantLeg) { for (var pi = 0; pi < caPubsAccum.length; pi++) { if (caPubsAccum[pi].toString("base64") === k) { guard.list.append(caPubsAccum, caPubsAccum.splice(pi, 1)[0]); if (pi < caPubsWaitingCount) caPubsWaitingCount--; break; } } }
           return;
         }
         try { x509.parse(c); } catch (e) { throw _err("cmp/bad-cert-response", "an authenticated caPubs entry is not a valid X.509 certificate", e); }
@@ -522,7 +522,7 @@ function session(opts) {
         if (caPubsAccum.length >= CAPUBS_MAX || caPubsBytes + c.length > caPubsByteBudget) return;
         caPubsSeen[k] = 1;
         caPubsBytes += c.length;
-        caPubsAccum.push(Buffer.from(c));
+        guard.list.append(caPubsAccum, Buffer.from(c));
         if (!isGrantLeg) caPubsWaitingCount++;
       });
       if (isGrantLeg) return { state: "granted", resp: resp, code: code };
@@ -590,24 +590,23 @@ function session(opts) {
 
   function _recordTranscript(entry) {
     var len = Buffer.isBuffer(entry.bytes) ? entry.bytes.length : 0;
-    if (transcriptBytes + len > transcriptCap) {
-      entry.byteLength = len; entry.bytes = null; entry.truncated = true;
-    } else {
-      transcriptBytes += len;
-    }
-    transcript.push(entry);
+    var over = transcriptBytes + len > transcriptCap;
+    if (!over) transcriptBytes += len;
+    guard.list.append(transcript, over
+      ? guard.verdict.of(entry, { byteLength: len, bytes: null, truncated: true })
+      : guard.verdict.of(entry));
   }
 
   function _transcriptSnapshot() {
     return transcript.map(function (e) {
-      var c = Object.assign({}, e);
+      var c = guard.verdict.of(e);
       if (Buffer.isBuffer(c.bytes)) c.bytes = Buffer.from(c.bytes);
-      if (c.verdict) c.verdict = Object.assign({}, c.verdict);
+      if (guard.verdict.carries(c, "verdict") && c.verdict) c.verdict = guard.verdict.of(c.verdict);
       return c;
     });
   }
   function _terminal(outcome, extra) {
-    return Object.assign({
+    return guard.verdict.of({
       outcome: outcome, certificate: null, chain: [], status: null, trusted: true,
       confirmed: false, implicitConfirm: false, transactionID: Buffer.from(transactionID),
       polls: 0, transcript: _transcriptSnapshot(),
@@ -704,7 +703,7 @@ function session(opts) {
       var k = _certIdentity(c);
       if (k != null && seenChain[k]) return;
       if (k != null) seenChain[k] = 1;
-      chain.push(c);
+      guard.list.append(chain, c);
     });
     await _validateLeaf(leaf, caPubsAccum);
     var info = { status: PKI_STATUS_NAMES[granted.code] || granted.code, grantedWithMods: granted.code === 1 };

package/lib/cmp-verify.js

@@ -77,7 +77,7 @@ var _engine = null;
 function setEngine(engine) { _engine = engine; }
 
 function _verdict(m, type, protectionAlg, valid, trusted, code, reason, signer) {
-  var v = {
+  return guard.verdict.of({
     valid: valid,
     trusted: trusted,
     protectionType: type,
@@ -88,9 +88,7 @@ function _verdict(m, type, protectionAlg, valid, trusted, code, reason, signer)
     recipNonce: m.header.recipNonce || null,
     header: m.header,
     body: m.body,
-  };
-  if (code) { v.code = code; v.reason = reason; }
-  return v;
+  }, code ? { code: code, reason: reason } : null);
 }
 function _ok(m, type, alg, trusted, signer) { return _verdict(m, type, alg, true, trusted, null, null, signer); }
 function _fail(m, type, alg, code, reason, signer) { return _verdict(m, type, alg, false, false, code, reason, signer || null); }
@@ -438,7 +436,7 @@ async function _verifySignature(m, protectedPart, protectionAlg, protection, opt
 
   if (opts.trustAnchors == null) return _ok(m, "signature", protectionAlg, false, signer);
   var trust = await _chainSigner(signer, m, opts, extra);
-  if (trust.chain) signer.chain = trust.chain;
+  if (trust.chain) guard.verdict.set(signer, "chain", trust.chain);
   return _verdict(m, "signature", protectionAlg, true, trust.trusted, trust.trusted ? null : "cmp/untrusted-signer", trust.reason, signer);
 }
 
@@ -521,9 +519,7 @@ function _boundExtraCerts(extra) {
 
 var _defineOwn = Object.defineProperty;
 var _Date = Date;
-function _append(arr, v) {
-  _defineOwn(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true });
-}
+var _append = guard.list.append;
 
 function _certList(v) {
   if (v == null) return [];

package/lib/cms-verify.js

@@ -51,22 +51,29 @@ var pkix = require("./schema-pkix");
 var CmsError = frameworkError.CmsError;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
 var _Promise = Promise, _promiseResolveRaw = Promise.resolve;
-function _pResolve(v) { return intrinsic.apply(_promiseResolveRaw, _Promise, [v]); }
+/**
+ * @internal Every value resolved here is a signer row, and resolving a promise reads `then` off the
+ * value. Building the row through the verdict guard ends that lookup on the row itself, so an
+ * accessor installed while the signature check is pending cannot rewrite the `ok` the message
+ * verdict is derived from before it is read.
+ */
+function _pResolve(v) { return intrinsic.apply(_promiseResolveRaw, _Promise, [_row(v)]); }
+function _row(o) { return guard.verdict.of(o); }
 
 var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_CONTENT_TYPE = oid.byName("contentType");
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
 
-var DIGEST_HASH = {
+var DIGEST_HASH = intrinsic.assign(intrinsic.create(null), {
   sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512",
   shake128: "SHAKE128", shake256: "SHAKE256",
-};
-var SIG_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
+});
+var SIG_HASH = intrinsic.assign(intrinsic.create(null), { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 function _supportedDigest(name) { return intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 async function _computeDigest(name, content) {
   return intrinsic.bufferFrom(await subtle.digest(DIGEST_HASH[name], content));
 }
-var SIG_SCHEME = {
+var SIG_SCHEME = intrinsic.assign(intrinsic.create(null), {
   rsaEncryption: { kind: "rsa", params: "null" },
   rsassaPss: { kind: "rsapss" },
   ecPublicKey: { kind: "ec", params: "absent" },
@@ -83,13 +90,13 @@ var SIG_SCHEME = {
   ecdsaWithSHA256: { kind: "ec", hash: "SHA-256", params: "absent" },
   ecdsaWithSHA384: { kind: "ec", hash: "SHA-384", params: "absent" },
   ecdsaWithSHA512: { kind: "ec", hash: "SHA-512", params: "absent" },
-};
+});
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
 ].forEach(function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + s.toUpperCase(), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
 function _isDerNull(p) { return Buffer.isBuffer(p) && p.length === 2 && p[0] === 0x05 && p[1] === 0x00; }
 function _algParamsOk(shape, p) { return shape === "null" ? _isDerNull(p) : (p === null || p === undefined); }
-var EC_CURVE = {};
+var EC_CURVE = intrinsic.create(null);
 EC_CURVE[oid.byName("prime256v1")] = { curve: "P-256", coordLen: 32 };
 EC_CURVE[oid.byName("secp384r1")] = { curve: "P-384", coordLen: 48 };
 EC_CURVE[oid.byName("secp521r1")] = { curve: "P-521", coordLen: 66 };
@@ -104,9 +111,9 @@ function _findSignerCerts(sid, parsedCerts) {
   for (var i = 0; i < parsedCerts.length; i++) {
     var c = parsedCerts[i];
     if (sid.subjectKeyIdentifier != null) {
-      if (c.ski && intrinsic.bufferEquals(c.ski, _toBuf(sid.subjectKeyIdentifier, "sid.subjectKeyIdentifier"))) intrinsic.push(out, c);
+      if (c.ski && intrinsic.bufferEquals(c.ski, _toBuf(sid.subjectKeyIdentifier, "sid.subjectKeyIdentifier"))) guard.list.append(out, c);
     } else if (sid.issuer && sid.serialNumberHex != null) {
-      if (c.cert.serialNumberHex === sid.serialNumberHex && guard.name.dnEqual(c.cert.issuer.rdns, sid.issuer.rdns, _err, "cms/bad-name", "the signer certificate issuer")) intrinsic.push(out, c);
+      if (c.cert.serialNumberHex === sid.serialNumberHex && guard.name.dnEqual(c.cert.issuer.rdns, sid.issuer.rdns, _err, "cms/bad-name", "the signer certificate issuer")) guard.list.append(out, c);
     }
   }
   return out;
@@ -122,13 +129,13 @@ async function _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes,
     }
     try {
       var ok = await _verifySignature(scheme, sigHash, sigBytes, c.cert.subjectPublicKeyInfo.bytes, signedBytes, _certCurveOid(c.cert), pssSalt);
-      if (ok === true) return { ok: true, sid: sid, cert: c.der };
+      if (ok === true) return _row({ ok: true, sid: sid, cert: c.der });
     } catch (e) {
       lastErr = (e instanceof CmsError) ? e : _err("cms/verify-error", "the SignerInfo signature could not be evaluated", e);
     }
   }
-  return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
-    : { ok: false, sid: sid, cert: candidates[0].der };
+  return _row(lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+    : { ok: false, sid: sid, cert: candidates[0].der });
 }
 
 function _certSki(cert) {
@@ -262,7 +269,7 @@ async function _verifyOne(si, content, eContentType, parsedCerts, csTarget, dige
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
 
   var signedBytes = await (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType, digestByName));
-  if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+  if (signedBytes && signedBytes.mismatch) return _row({ ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message });
   return _verifyAgainstCandidates(scheme, sigHash, sigBytes, signedBytes, si.sid, signers, pss ? pss.saltLength : 0, scheme.sameKeyOid ? oid.byName(si.signatureAlgorithm.name) : null);
 }
 
@@ -347,7 +354,7 @@ async function _verifyComposite(si, comp, content, eContentType, parsedCerts, cs
   if (!signers.length) return _pResolve({ ok: false, code: "cms/signer-cert-not-found", sid: si.sid, message: "no certificate matches this SignerInfo's signer identifier" });
   var sigBytes = _toBuf(si.signature, "the SignerInfo signature");
   var signedBytes = await (csTarget != null ? _computeCountersigBytes(si, csTarget) : _computeSignedBytes(si, content, eContentType, digestByName));
-  if (signedBytes && signedBytes.mismatch) return { ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message };
+  if (signedBytes && signedBytes.mismatch) return _row({ ok: false, code: signedBytes.mismatch.code, sid: si.sid, cert: signers[0].der, message: signedBytes.mismatch.message });
   return _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si.sid, signers, si.signatureAlgorithm.oid);
 }
 
@@ -360,11 +367,11 @@ async function _verifyCompositeAgainstCandidates(comp, sigBytes, signedBytes, si
       continue;
     }
     var r = await compositeSig.compositeVerify(c.cert.subjectPublicKeyInfo.bytes, sigBytes, signedBytes, comp, CmsError, "cms/unsupported-algorithm", "cms/bad-signature");
-    if (r.ok === true) return { ok: true, sid: sid, cert: c.der };
+    if (r.ok === true) return _row({ ok: true, sid: sid, cert: c.der });
     if (r.code) lastErr = (r.error instanceof CmsError) ? r.error : _err(r.code, r.error && r.error.message ? r.error.message : "the composite signature could not be evaluated");
   }
-  return lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
-    : { ok: false, sid: sid, cert: candidates[0].der };
+  return _row(lastErr ? { ok: false, code: lastErr.code, sid: sid, cert: candidates[0].der, message: lastErr.message }
+    : { ok: false, sid: sid, cert: candidates[0].der });
 }
 
 function _surfaceUnsignedAttrs(si) {
@@ -384,24 +391,23 @@ async function _verifyCountersignatures(si, parsedCerts) {
   var values = [];
   intrinsic.forEach(si.unsignedAttrs || [], function (a) {
     if (a.type !== OID_COUNTERSIGNATURE) return;
-    intrinsic.forEach(a.values, function (v) { intrinsic.push(values, v && v.bytes ? v.bytes : v); });
+    intrinsic.forEach(a.values, function (v) { guard.list.append(values, v && v.bytes ? v.bytes : v); });
   });
   var out = [];
-  for (var _cp = 0; _cp < values.length; _cp++) intrinsic.push(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts));
+  for (var _cp = 0; _cp < values.length; _cp++) guard.list.append(out, await _verifyOneCountersig(values[_cp], targetSig, parsedCerts));
   return out;
 }
 
 async function _verifyOneCountersig(vDer, targetSig, parsedCerts) {
   var csSi;
   try { csSi = cms.walkCountersignature(asn1.decode(intrinsic.isBuffer(vDer) ? vDer : intrinsic.bufferFrom(vDer))); }
-  catch (e) { return { ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }; }
+  catch (e) { return _row({ ok: false, code: (e instanceof CmsError ? e.code : "cms/bad-countersignature"), message: e && e.message }); }
   var verdict = await _verifyOne(csSi, targetSig, null, parsedCerts, targetSig);
   var nested = await _verifyCountersignatures(csSi, parsedCerts);
-  var node = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
-  if (verdict.code) node.code = verdict.code;
-  node.unsignedAttrs = _surfaceUnsignedAttrs(csSi);
-  node.countersignatures = nested;
-  return node;
+  var head = { ok: verdict.ok, sid: verdict.sid, cert: verdict.cert, digestAlgorithm: csSi.digestAlgorithm.name };
+  return guard.verdict.of(
+    verdict.code ? guard.verdict.of(head, { code: verdict.code }) : head,
+    { unsignedAttrs: _surfaceUnsignedAttrs(csSi), countersignatures: nested });
 }
 
 /**
@@ -489,7 +495,7 @@ async function _resolveContentDigests(parsed, streamSource) {
   var names = [], seen = {};
   intrinsic.forEach(parsed.signerInfos, function (si) {
     var dn = si.digestAlgorithm.name;
-    if (si.signedAttrsBytes && _supportedDigest(dn) && !seen[dn]) { seen[dn] = 1; intrinsic.push(names, dn); }
+    if (si.signedAttrsBytes && _supportedDigest(dn) && !seen[dn]) { seen[dn] = 1; guard.list.append(names, dn); }
   });
   if (!names.length) return {};
   var ds;
@@ -539,19 +545,23 @@ async function _verify(input, opts) {
   for (var _sp = 0; _sp < parsed.signerInfos.length; _sp++) {
     var siOne = parsed.signerInfos[_sp];
     var verdict = await _verifyOne(siOne, content, eContentType, parsedCerts, null, digestByName);
-    verdict.countersignatures = await _verifyCountersignatures(siOne, parsedCerts);
-    verdict.unsignedAttrs = _surfaceUnsignedAttrs(siOne);
-    verdict.signedAttributesPresent = !!siOne.signedAttrsBytes;
-    verdict.signedAttributes = _surfaceSignedAttrs(siOne);
-    verdict.digestAlgorithm = siOne.digestAlgorithm.name;
-    intrinsic.push(signers, verdict);
+    var counters = await _verifyCountersignatures(siOne, parsedCerts);
+    guard.list.append(signers, guard.verdict.of(verdict, {
+      countersignatures: counters,
+      unsignedAttrs: _surfaceUnsignedAttrs(siOne),
+      signedAttributesPresent: !!siOne.signedAttrsBytes,
+      signedAttributes: _surfaceSignedAttrs(siOne),
+      digestAlgorithm: siOne.digestAlgorithm.name,
+      trusted: false,
+    }));
   }
-  var res = {
+  var res = guard.verdict.of({
     valid: signers.length > 0 && guard.list.allMatch(signers, function (s) { return s.ok === true; }),
     eContentType: parsed.encapContentInfo.eContentType,
     eContent: parsed.encapContentInfo.eContent != null ? parsed.encapContentInfo.eContent : null,
     signers: signers,
-  };
+    trusted: false,
+  });
   await _applyTrust(res, parsedCerts, trustCfg);
   return res;
 }
@@ -667,7 +677,7 @@ function _addCert(out, der) {
   try {
     cert = x509.parse(buf);
   } catch (_e2) { return; }
-  out.push({ cert: cert, der: buf, ski: _certSki(cert) });
+  guard.list.append(out, { cert: cert, der: buf, ski: _certSki(cert) });
 }
 
 /**

package/lib/composite-sig.js

@@ -24,7 +24,7 @@ var MLDSA_COMPONENT = {
 };
 var EC_CURVE_OID = { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" };
 var PH_CMS = { "SHA-256": "sha256", "SHA-512": "sha512", "SHAKE256": "shake256" };
-var COMPOSITE_ALGS = {};
+var COMPOSITE_ALGS = Object.create(null);
 function _comp(name, mldsa, ph, label, trad) {
   var sz = MLDSA_COMPONENT[mldsa];
   COMPOSITE_ALGS[oid.byName(name)] = {

package/lib/crl-sign.js

@@ -525,14 +525,14 @@ function _verify(crl, issuer) {
   return crlVerify.verifyCrlSignature(parsed, resolved.spki).then(function (sigOk) {
     var signatureValid = sigOk === true;
     var valid = issuerMaySign && signatureValid;
-    var out = { valid: valid, issuerMaySign: issuerMaySign, signatureValid: signatureValid, issuer: parsed.issuer };
-    if (!valid) {
-      out.code = !issuerMaySign ? "crl/issuer-may-not-sign" : "crl/bad-signature";
-      out.reason = !issuerMaySign
-        ? "the issuer certificate is not this CRL's issuer, or its keyUsage does not assert cRLSign (RFC 5280 sec. 4.2.1.3)"
-        : "the CRL signature did not verify under the issuer key";
-    }
-    return out;
+    return guard.verdict.of(
+      { valid: valid, issuerMaySign: issuerMaySign, signatureValid: signatureValid, issuer: parsed.issuer },
+      valid ? null : {
+        code: !issuerMaySign ? "crl/issuer-may-not-sign" : "crl/bad-signature",
+        reason: !issuerMaySign
+          ? "the issuer certificate is not this CRL's issuer, or its keyUsage does not assert cRLSign (RFC 5280 sec. 4.2.1.3)"
+          : "the CRL signature did not verify under the issuer key",
+      });
   });
 }
 

package/lib/crmf-sign.js

@@ -478,7 +478,10 @@ function _verifyOne(msg) {
     subjectBound: false,
     publicKey: (t && t.publicKey && t.publicKey.bytes) || null,
   };
-  function settle(extra) { var v = Object.assign({}, base, extra); v.valid = v.verified === true; return Promise.resolve(v); }
+  function settle(extra) {
+    var v = guard.verdict.of(base, extra);
+    return Promise.resolve(guard.verdict.of(v, { valid: v.verified === true }));
+  }
 
   var popo = msg.popo;
   if (popo == null) {
@@ -499,7 +502,7 @@ function _verifyOne(msg) {
   var spki = pin ? pin.publicKey : base.publicKey;
   var bound = !pin;
   return crmfVerify.verifyPopSignature(popo, spki, preimage).then(function (ok) {
-    return Object.assign({}, base, {
+    return guard.verdict.of(base, {
       valid: ok === true, verified: ok === true, method: "signature", cryptographicallyVerified: ok === true,
       subject: bound ? base.subject : null,
       subjectBound: bound,
@@ -558,7 +561,7 @@ function _verifyPop(messages) {
   var parsed = _coerceMessages(messages);
   return Promise.all(parsed.messages.map(_verifyOne)).then(function (out) {
     var allVerified = out.length > 0 && out.every(function (m) { return m.verified === true; });
-    return { valid: allVerified, verified: allVerified, messages: out };
+    return guard.verdict.of({ valid: allVerified, verified: allVerified, messages: out });
   });
 }
 

package/lib/csr-sign.js

@@ -205,14 +205,14 @@ function verify(request) { return guard.async.deferred(function () { return _ver
 function _verify(request) {
   var parsed = _coerceCsr(request);
   return Promise.resolve(csrVerify.verifyCsrSignature(parsed)).then(function (ok) {
-    return {
+    return guard.verdict.of({
       valid: ok === true,
       verified: ok === true,
       subject: parsed.subject,
       subjectPublicKeyInfo: parsed.subjectPublicKeyInfo,
       attributes: parsed.attributes,
       certificationRequestInfoBytes: parsed.certificationRequestInfoBytes,
-    };
+    });
   });
 }
 

package/lib/ct.js

@@ -551,7 +551,7 @@ async function signSct(entry, logKey, opts) {
   var priv = await subtle.importKey("pkcs8", mat.pkcs8, imp, false, ["sign"]);
   var sigRaw = Buffer.from(await subtle.sign(sign, priv, preimage));
   var signature = ecdsaDer ? validator.sig.rawToEcdsaDer(sigRaw, coordLen) : sigRaw;
-  return {
+  return guard.verdict.of({
     version: 0,
     logId: logId, logIdHex: logId.toString("hex"),
     timestamp: timestamp,
@@ -559,7 +559,7 @@ async function signSct(entry, logKey, opts) {
     hashAlg: hashAlg, sigAlg: sigAlg,
     signatureAlgorithm: { hash: hashAlg, hashName: HASH_ALGORITHMS[hashAlg] || null, signature: sigAlg, signatureName: SIGNATURE_ALGORITHMS[sigAlg] || null },
     signature: signature,
-  };
+  });
 }
 
 
@@ -766,14 +766,14 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
   var c = _classifyLog(sct, logList, entry, opts);
   if (c.status !== "ok") throw _ctErr(c.code, c.message);
   var valid = await verifySct(entry, sct, c.log.key);
-  return {
+  return guard.verdict.of({
     valid: valid,
     logId: c.log.logId,
     logIdHex: c.log.logIdHex,
     operator: c.log.operator,
     logState: c.log.state.name,
     timestamp: sct.timestamp,
-  };
+  });
 }
 
 var _VERIFY_SCT_LIST_OPTS = { minScts: 1, minOperators: 1, certNotAfter: 1, at: 1 };
@@ -860,37 +860,37 @@ async function verifySctList(entry, list, logList, opts) {
     try { c = _classifyLog(sct, logList, entry, opts); }
     catch (e) {
       if (!(e && e.isPkiError)) throw e;
-      row.code = e.code; row.reason = e.message; intrinsic.push(results, row); continue;
+      row.code = e.code; row.reason = e.message; guard.list.append(results, row); continue;
     }
     if (c.log) { row.operator = c.log.operator; row.logState = c.log.state.name; }
-    if (c.status !== "ok") { row.code = c.code; row.reason = c.message; intrinsic.push(results, row); continue; }
+    if (c.status !== "ok") { row.code = c.code; row.reason = c.message; guard.list.append(results, row); continue; }
     var ok;
     try { ok = await verifySct(entry, sct, c.log.key); }
     catch (e) {
       if (!(e && e.isPkiError)) throw e;
-      row.code = e.code; row.reason = e.message; intrinsic.push(results, row); continue;
+      row.code = e.code; row.reason = e.message; guard.list.append(results, row); continue;
     }
     if (ok === true && atMs != null && sct.timestamp > atMs) {
       row.code = "ct/future-timestamp"; row.reason = "the SCT timestamp is later than the validation time (RFC 6962 sec. 5.2)";
-      intrinsic.push(results, row); continue;
+      guard.list.append(results, row); continue;
     }
     row.valid = ok === true;
     if (row.valid && !seenLogs[sct.logIdHex]) {
       seenLogs[sct.logIdHex] = true;
       validScts++;
-      if (c.log.operator != null && !seenOps[c.log.operator]) { seenOps[c.log.operator] = true; intrinsic.push(operators, c.log.operator); }
+      if (c.log.operator != null && !seenOps[c.log.operator]) { seenOps[c.log.operator] = true; guard.list.append(operators, c.log.operator); }
     }
-    intrinsic.push(results, row);
+    guard.list.append(results, row);
   }
   var operatorCount = operators.length;
   var policyOk = validScts >= minScts && operatorCount >= minOperators;
-  return {
+  return guard.verdict.of({
     valid: policyOk,
     policyOk: policyOk, totalScts: scts.length + unknownScts, validScts: validScts, unknownScts: unknownScts,
     operatorCount: operatorCount, operators: operators, required: { minScts: minScts, minOperators: minOperators },
     results: results,
     reason: policyOk ? null : ("CT policy not met: " + validScts + " valid SCT(s) from " + operatorCount + " distinct operator(s); require at least " + minScts + " SCT(s) from at least " + minOperators + " operator(s)"),
-  };
+  });
 }
 
 function _asParsedCert(v, field) {
@@ -1143,10 +1143,10 @@ async function fetchLogList(opts) {
   var ok = await verifyLogListSignature(jsonRes.body, sigRes.body, opts.signerKey);
   if (ok !== true) throw _ctErr("ct/log-list-untrusted", "the CT log-list detached signature did not verify against the pinned distributor key -- the fetched list is untrusted and was not parsed");
   var parsed = parseLogList(jsonRes.body);
-  return {
+  return guard.verdict.of({
     logs: parsed.logs, byLogId: parsed.byLogId, version: parsed.version, timestamp: parsed.timestamp,
     raw: { json: jsonRes.body, sig: sigRes.body }, status: jsonRes.status, contentType: jsonRes.contentType, tls: jsonRes.tls,
-  };
+  });
 }
 
 module.exports = {

package/lib/guard-all.js

@@ -20,6 +20,7 @@ var header = require("./guard-header");
 var compress = require("./guard-compress");
 var secret = require("./guard-secret");
 var parsed = require("./guard-parsed");
+var verdict = require("./guard-verdict");
 var async_ = require("./guard-async");
 
 module.exports = _freeze({
@@ -39,5 +40,6 @@ module.exports = _freeze({
   compress: compress,
   secret: secret,
   parsed: parsed,
+  verdict: verdict,
   async:  async_,
 });

package/lib/guard-bytes.js

@@ -41,7 +41,7 @@ var _mapSet = intrinsic.mapSet;
 var _taSet = intrinsic.typedArraySet;
 var _Set = intrinsic.Set;
 var _Map = intrinsic.Map;
-function _append(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
+var _append = require("./guard-list").append;
 
 function _ownArrayIndices(v, n) {
   var keys = _ownKeys(v);

package/lib/guard-identifier.js

@@ -38,7 +38,7 @@ var _Number = intrinsic.Number;
 var _BigInt = intrinsic.BigInt;
 var _Object = intrinsic.Object;
 var _BufferProto = intrinsic.BufferProto;
-function _append(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
+var _append = require("./guard-list").append;
 
 function _isDottedDecimal(str) {
   if (str.length === 0) return false;

package/lib/guard-json.js

@@ -12,7 +12,7 @@ var _hasOwn = require("./guard-intrinsic").hasOwn;
 var _Number = require("./guard-intrinsic").Number;
 var _isFinite = require("./guard-intrinsic").isFinite;
 var _stringify = require("./guard-intrinsic").stringify;
-function _append(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
+var _append = require("./guard-list").append;
 var limits = require("./guard-limits");
 
 function _hexVal(c) {