@blamejs/pki 0.6.38 → 0.6.40

package/lib/path-validate.js

@@ -108,7 +108,7 @@ var PROCESSED_EXTENSIONS = {};
 Object.freeze(PROCESSED_EXTENSIONS);
 
 
-var SIG_ALGS = {};
+var SIG_ALGS = intrinsic.create(null);
 function _sig(name, verify, imp, params, ecdsa, sameKeyOid) {
   var entry = { verify: verify, imp: imp, params: params };
   if (ecdsa) entry.ecdsa = true;
@@ -316,7 +316,7 @@ function decodeExt(cert, extOid) {
 
 function requireCriticalExt(ext, name, checks) {
   if (ext && ext.critical !== true) {
-    checks.push({ name: name, ok: false, code: "path/extension-not-critical" });
+    guard.list.append(checks,{ name: name, ok: false, code: "path/extension-not-critical" });
     return E("path/extension-not-critical", name + " extension must be marked critical (RFC 5280 4.2.1)");
   }
   return null;
@@ -454,17 +454,17 @@ function certNameForms(cert) {
   if (san) {
     san.value.names.forEach(function (nm) {
       if (nm.tagNumber === 1) hasRfc822San = true;
-      forms.push({ tag: nm.tagNumber, value: nm.value === undefined ? null : nm.value });
+      guard.list.append(forms, { tag: nm.tagNumber, value: nm.value === undefined ? null : nm.value });
     });
   }
   if (!hasRfc822San) {
     cert.subject.rdns.forEach(function (rdn) {
       rdn.forEach(function (atv) {
-        if (atv.type === OID.emailAddress && typeof atv.value === "string") forms.push({ tag: 1, value: atv.value });
+        if (atv.type === OID.emailAddress && typeof atv.value === "string") guard.list.append(forms, { tag: 1, value: atv.value });
       });
     });
   }
-  if (cert.subject.rdns.length > 0) forms.push({ tag: 4, value: cert.subject });
+  if (cert.subject.rdns.length > 0) guard.list.append(forms, { tag: 4, value: cert.subject });
   return forms;
 }
 
@@ -497,12 +497,12 @@ function checkNameConstraints(state, cert) {
 
 function absorbNameConstraints(state, decoded) {
   if (decoded.permittedSubtrees.length) {
-    state.permittedGenerations.push(decoded.permittedSubtrees.map(function (st) {
+    guard.list.append(state.permittedGenerations, decoded.permittedSubtrees.map(function (st) {
       return { tag: st.base.tagNumber, base: st.base.value };
     }));
   }
   decoded.excludedSubtrees.forEach(function (st) {
-    state.excludedSubtrees.push({ tag: st.base.tagNumber, base: st.base.value });
+    guard.list.append(state.excludedSubtrees, { tag: st.base.tagNumber, base: st.base.value });
   });
 }
 
@@ -524,7 +524,7 @@ function leavesAt(tree, depth) {
   var out = [];
   if (!tree) return out;
   (function walk(node) {
-    if (node.depth === depth) { out.push(node); return; }
+    if (node.depth === depth) { guard.list.append(out, node); return; }
     node.children.forEach(walk);
   })(tree);
   return out;
@@ -563,7 +563,7 @@ function checkedSubtreeSeeds(list, optName) {
    * array's constructor and Symbol.species, which is more caller code running mid-copy. */
   var seedsOut = [];
   for (var si = 0; si < list.length; si++) {
-    intrinsic.push(seedsOut, (function (st) {
+    guard.list.append(seedsOut, (function (st) {
     var shapeMsg = "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }";
     if (!st || typeof st !== "object" || intrinsic.types.isProxy(st)) throw E("path/bad-input", shapeMsg);
     /** @internal Read tag and base once each, from their own data properties: an accessor could
@@ -639,7 +639,7 @@ function selfIssued(cert) {
 function processPolicies(state, cert, i, checks) {
   var cp;
   try { cp = decodeExt(cert, OID.certificatePolicies); }
-  catch (e) { checks.push({ name: "policies", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "policies", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
 
   if (cp && state.validPolicyTree) {
     var policies = cp.value;
@@ -678,7 +678,7 @@ function processPolicies(state, cert, i, checks) {
   }
 
   if (!(state.explicitPolicy > 0 || state.validPolicyTree !== null)) {
-    checks.push({ name: "policy", ok: false, code: "path/policy-required" });
+    guard.list.append(checks,{ name: "policy", ok: false, code: "path/policy-required" });
     return { fatal: true, error: E("path/policy-required", "explicit policy required but the valid-policy tree is empty") };
   }
   return { fatal: false };
@@ -687,7 +687,7 @@ function processPolicies(state, cert, i, checks) {
 function addChild(state, parent, validPolicy, qualifiers, expectedPolicySet, checks) {
   if (state.policyNodeCount >= state.maxPolicyNodes) { state._capHit = true; return; }
   var node = { depth: parent.depth + 1, validPolicy: validPolicy, qualifierSet: qualifiers ? [qualifiers] : [], expectedPolicySet: expectedPolicySet, children: [], parent: parent };
-  parent.children.push(node);
+  guard.list.append(parent.children, node);
   state.policyNodeCount++;
   void checks;
 }
@@ -722,11 +722,11 @@ function ekuPurposeFails(cert, requiredEku, checks) {
   var eku;
   try { eku = decodeExt(cert, OID.extKeyUsage); }
   // allow:fail-open-verify -- ekuPurposeFails returns true to mean the EKU purpose FAILS (a rejecting verdict); a bad extension is recorded in checks and the purpose is treated as failed, which is fail-closed
-  catch (e) { checks.push({ name: "extendedKeyUsage", ok: false, code: pathCode(e, "path/bad-extension-value") }); return true; }
+  catch (e) { guard.list.append(checks,{ name: "extendedKeyUsage", ok: false, code: pathCode(e, "path/bad-extension-value") }); return true; }
   if (!eku) return false;
   var purposes = eku.value;
   var ok = contains(purposes, OID.anyExtendedKeyUsage) || containsAll(purposes, requiredEku);
-  checks.push({ name: "extendedKeyUsage", ok: ok, code: ok ? undefined : "path/eku-not-permitted" });
+  guard.list.append(checks,{ name: "extendedKeyUsage", ok: ok, code: ok ? undefined : "path/eku-not-permitted" });
   return !ok;
 }
 
@@ -739,10 +739,10 @@ function prepareNext(state, cert, i, checks) {
 
   var pm;
   try { pm = decodeExt(cert, OID.policyMappings); }
-  catch (e) { checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
   if (pm) {
     var badAny = mapsAnyPolicy(pm.value);
-    if (badAny) { checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: E("path/bad-policy", "policyMappings must not map to or from anyPolicy (RFC 5280 6.1.4(a))") }; }
+    if (badAny) { guard.list.append(checks,{ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: E("path/bad-policy", "policyMappings must not map to or from anyPolicy (RFC 5280 6.1.4(a))") }; }
     if (state.validPolicyTree) applyPolicyMappings(state, pm.value, i);
   }
 
@@ -751,7 +751,7 @@ function prepareNext(state, cert, i, checks) {
 
   var nc;
   try { nc = decodeExt(cert, OID.nameConstraints); }
-  catch (e) { checks.push({ name: "nameConstraints", ok: false, code: pathCode(e, "path/bad-name-constraints") }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "nameConstraints", ok: false, code: pathCode(e, "path/bad-name-constraints") }); return { fatal: true, error: e }; }
   var ncCritErr = requireCriticalExt(nc, "nameConstraints", checks);
   if (ncCritErr) return { fatal: true, error: ncCritErr };
   if (nc) absorbNameConstraints(state, nc.value);
@@ -764,7 +764,7 @@ function prepareNext(state, cert, i, checks) {
 
   var pc;
   try { pc = decodeExt(cert, OID.policyConstraints); }
-  catch (e) { checks.push({ name: "policyConstraints", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "policyConstraints", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
   var pcCritErr = requireCriticalExt(pc, "policyConstraints", checks);
   if (pcCritErr) return { fatal: true, error: pcCritErr };
   if (pc) {
@@ -773,31 +773,31 @@ function prepareNext(state, cert, i, checks) {
   }
   var iap;
   try { iap = decodeExt(cert, OID.inhibitAnyPolicy); }
-  catch (e) { checks.push({ name: "inhibitAnyPolicy", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "inhibitAnyPolicy", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
   var iapCritErr = requireCriticalExt(iap, "inhibitAnyPolicy", checks);
   if (iapCritErr) return { fatal: true, error: iapCritErr };
   if (iap && iap.value < state.inhibitAnyPolicy) state.inhibitAnyPolicy = iap.value;
 
   var bc;
   try { bc = decodeExt(cert, OID.basicConstraints); }
-  catch (e) { checks.push({ name: "basicConstraints", ok: false, code: "path/bad-basic-constraints" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "basicConstraints", ok: false, code: "path/bad-basic-constraints" }); return { fatal: true, error: e }; }
   if (!bc || bc.value.cA !== true) {
-    checks.push({ name: "basicConstraints", ok: false, code: "path/not-a-ca" });
+    guard.list.append(checks,{ name: "basicConstraints", ok: false, code: "path/not-a-ca" });
     return { fatal: true, error: E("path/not-a-ca", "intermediate certificate is not a CA (basicConstraints cA is not TRUE, RFC 5280 6.1.4(k))") };
   }
   var bcCritErr = requireCriticalExt(bc, "basicConstraints", checks);
   if (bcCritErr) return { fatal: true, error: bcCritErr };
   if (!isSelfIssued) {
-    if (state.maxPathLength <= 0) { checks.push({ name: "pathLength", ok: false, code: "path/path-length-exceeded" }); return { fatal: true, error: E("path/path-length-exceeded", "certification path is longer than the CA path-length constraint allows") }; }
+    if (state.maxPathLength <= 0) { guard.list.append(checks,{ name: "pathLength", ok: false, code: "path/path-length-exceeded" }); return { fatal: true, error: E("path/path-length-exceeded", "certification path is longer than the CA path-length constraint allows") }; }
     state.maxPathLength--;
   }
   if (bc.value.pathLenConstraint !== null && bc.value.pathLenConstraint < state.maxPathLength) state.maxPathLength = bc.value.pathLenConstraint;
 
   var ku;
   try { ku = decodeExt(cert, OID.keyUsage); }
-  catch (e) { checks.push({ name: "keyUsage", ok: false, code: "path/bad-key-usage" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "keyUsage", ok: false, code: "path/bad-key-usage" }); return { fatal: true, error: e }; }
   if (ku && ku.value.keyCertSign !== true) {
-    checks.push({ name: "keyUsage", ok: false, code: "path/missing-key-cert-sign" });
+    guard.list.append(checks,{ name: "keyUsage", ok: false, code: "path/missing-key-cert-sign" });
     return { fatal: true, error: E("path/missing-key-cert-sign", "CA certificate keyUsage does not assert keyCertSign (RFC 5280 6.1.4(n))") };
   }
   return { fatal: false };
@@ -807,7 +807,7 @@ function applyPolicyMappings(state, mappings, i) {
   var depth = i;
   if (state.policyMapping > 0) {
     var mappedFrom = {};
-    mappings.forEach(function (m) { (mappedFrom[m.issuerDomainPolicy] = mappedFrom[m.issuerDomainPolicy] || []).push(m.subjectDomainPolicy); });
+    mappings.forEach(function (m) { guard.list.append(mappedFrom[m.issuerDomainPolicy] = mappedFrom[m.issuerDomainPolicy] || [], m.subjectDomainPolicy); });
     var depthI = leavesAt(state.validPolicyTree, depth);
     var anyNodes = depthI.filter(function (nd) { return nd.validPolicy === OID.anyPolicy; });
     Object.keys(mappedFrom).forEach(function (idp) {
@@ -953,14 +953,14 @@ async function ctGateCheck(leaf, certs, anchor, ctLogList, ctPolicy, n, at) {
   for (var i = 0; i < exts.length; i++) {
     if (exts[i] && (exts[i].oid === OID_SCT_LIST || exts[i].name === "signedCertificateTimestampList")) { sctExt = exts[i]; break; }
   }
-  if (sctExt == null) return { name: "ct", ok: false, code: "path/ct-required" };
+  if (sctExt == null) return guard.verdict.of({ name: "ct", ok: false, code: "path/ct-required" });
   var issuer = n >= 2 ? certs[n - 2] : { subjectPublicKeyInfo: { bytes: anchor.publicKey } };
   var entry, list;
   try {
     entry = ct.x509CertEntry(leaf, issuer);
     list = ct.parseSctList(sctExt.value);
   } catch (e) {
-    return { name: "ct", ok: false, code: pathCode(e, "path/ct-required") };
+    return guard.verdict.of({ name: "ct", ok: false, code: pathCode(e, "path/ct-required") });
   }
   var verdict;
   try {
@@ -970,7 +970,7 @@ async function ctGateCheck(leaf, certs, anchor, ctLogList, ctPolicy, n, at) {
     if (e && e.isPkiError) throw E("path/bad-input", "validate: the CT policy or log-list is invalid (" + (e.code || "ct/bad-input") + "): " + e.message);
     throw e;
   }
-  return { name: "ct", ok: verdict.policyOk === true, code: verdict.policyOk ? undefined : "path/ct-policy-not-met" };
+  return guard.verdict.of({ name: "ct", ok: verdict.policyOk === true, code: verdict.policyOk ? undefined : "path/ct-policy-not-met" });
 }
 
 async function validate(path, opts) {
@@ -1080,18 +1080,18 @@ async function validate(path, opts) {
     } else {
       sigRes = await builtinVerify(state, cert);
     }
-    checks.push({ name: "signature", ok: sigRes.ok, code: sigRes.ok ? undefined : (sigRes.code || "path/bad-signature") });
+    guard.list.append(checks, { name: "signature", ok: sigRes.ok, code: sigRes.ok ? undefined : (sigRes.code || "path/bad-signature") });
     if (!sigRes.ok) failed = true;
 
     if (compositeSig.COMPOSITE_ALGS[cert.subjectPublicKeyInfo.algorithm.oid]) {
       var cku = compositeKeyUsageCheck(cert);
-      checks.push({ name: "compositeKeyUsage", ok: cku.ok, code: cku.ok ? undefined : cku.code });
+      guard.list.append(checks,{ name: "compositeKeyUsage", ok: cku.ok, code: cku.ok ? undefined : cku.code });
       if (!cku.ok) failed = true;
     }
 
     if (ML_KEM_OIDS[cert.subjectPublicKeyInfo.algorithm.oid]) {
       var kku = kemKeyUsageCheck(cert);
-      checks.push({ name: "kemKeyUsage", ok: kku.ok, code: kku.ok ? undefined : kku.code });
+      guard.list.append(checks,{ name: "kemKeyUsage", ok: kku.ok, code: kku.ok ? undefined : kku.code });
       if (!kku.ok) failed = true;
     }
 
@@ -1099,20 +1099,20 @@ async function validate(path, opts) {
     var vOk = true, vCode;
     if (t < guard.time.instantOf(cert.validity.notBefore)) { vOk = false; vCode = "path/not-yet-valid"; }
     else if (t > guard.time.instantOf(cert.validity.notAfter)) { vOk = false; vCode = "path/expired"; }
-    checks.push({ name: "validity", ok: vOk, code: vCode });
+    guard.list.append(checks,{ name: "validity", ok: vOk, code: vCode });
     if (!vOk) failed = true;
 
     var chainOk;
     try { chainOk = dnEqual(cert.issuer.rdns, state.workingIssuerName.rdns); }
     catch (_e) { chainOk = false; }
-    checks.push({ name: "nameChaining", ok: chainOk === true, code: chainOk === true ? undefined : "path/name-chaining" });
+    guard.list.append(checks,{ name: "nameChaining", ok: chainOk === true, code: chainOk === true ? undefined : "path/name-chaining" });
     if (chainOk !== true) failed = true;
 
     if (!(selfIssued(cert) && i !== n)) {
       var ncRes;
       try { ncRes = checkNameConstraints(state, cert); }
       catch (e) { ncRes = { ok: false, code: pathCode(e, "path/bad-name-constraints") }; }
-      checks.push({ name: "nameConstraints", ok: ncRes.ok, code: ncRes.ok ? undefined : ncRes.code });
+      guard.list.append(checks,{ name: "nameConstraints", ok: ncRes.ok, code: ncRes.ok ? undefined : ncRes.code });
       if (!ncRes.ok) failed = true;
     }
 
@@ -1122,33 +1122,33 @@ async function validate(path, opts) {
       try { rv = await revocationChecker.check(cert, { workingIssuerName: state.workingIssuerName, workingPublicKey: state.workingPublicKey, workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm, issuerCert: issuerCert }, { time: opts.time, historicalMode: opts.historicalMode === true }); }
       catch (e) { rv = { status: "error" }; rvError = e; }
       var rvStatus = (rv && typeof rv.status === "string") ? rv.status : "unknown";
-      if (rv && rv.status === "good") { checks.push({ name: "revocation", ok: true, status: "good" }); }
-      else if (rv && rv.status === "revoked") { checks.push({ name: "revocation", ok: false, status: "revoked", code: "path/revoked" }); failed = true; }
+      if (rv && rv.status === "good") { guard.list.append(checks,{ name: "revocation", ok: true, status: "good" }); }
+      else if (rv && rv.status === "revoked") { guard.list.append(checks,{ name: "revocation", ok: false, status: "revoked", code: "path/revoked" }); failed = true; }
       else if (rvError) {
-        checks.push({ name: "revocation", ok: false, status: "error", code: "path/revocation-checker-error", error: rvError });
+        guard.list.append(checks,{ name: "revocation", ok: false, status: "error", code: "path/revocation-checker-error", error: rvError });
         revocationUndetermined = true;
         failed = true;
       }
       else if (softFail) {
-        checks.push({ name: "revocation", ok: true, status: rvStatus, waived: true });
+        guard.list.append(checks,{ name: "revocation", ok: true, status: rvStatus, waived: true });
         revocationWaived = true;
       } else {
-        checks.push({ name: "revocation", ok: false, status: rvStatus, code: "path/revocation-undetermined" });
+        guard.list.append(checks,{ name: "revocation", ok: false, status: rvStatus, code: "path/revocation-undetermined" });
         revocationUndetermined = true;
         failed = true;
       }
       revocationRan = true;
     } else if (requireRevocation) {
-      checks.push({ name: "revocation", ok: false, code: "path/revocation-undetermined" }); failed = true;
+      guard.list.append(checks,{ name: "revocation", ok: false, code: "path/revocation-undetermined" }); failed = true;
     }
 
     var polRes = processPolicies(state, cert, i, checks);
-    if (state._capHit) { checks.push({ name: "policyTree", ok: false, code: "path/policy-tree-cap" }); failed = true; }
+    if (state._capHit) { guard.list.append(checks,{ name: "policyTree", ok: false, code: "path/policy-tree-cap" }); failed = true; }
     else if (polRes.fatal) failed = true;
 
     if (cert.subject.rdns.length === 0) {
       var san = findExt(cert, OID.subjectAltName);
-      if (!san || !san.critical) { checks.push({ name: "emptySubject", ok: false, code: "path/empty-subject-no-critical-san" }); failed = true; }
+      if (!san || !san.critical) { guard.list.append(checks,{ name: "emptySubject", ok: false, code: "path/empty-subject-no-critical-san" }); failed = true; }
     }
 
     if (i !== n) {
@@ -1160,22 +1160,22 @@ async function validate(path, opts) {
       if (state.explicitPolicy > 0) state.explicitPolicy--;
       var lpc;
       try { lpc = decodeExt(cert, OID.policyConstraints); }
-      catch (_e) { lpc = null; checks.push({ name: "policyConstraints", ok: false, code: "path/bad-policy" }); failed = true; }
+      catch (_e) { lpc = null; guard.list.append(checks,{ name: "policyConstraints", ok: false, code: "path/bad-policy" }); failed = true; }
       if (requireCriticalExt(lpc, "policyConstraints", checks)) failed = true;
       if (lpc && lpc.value.requireExplicitPolicy === 0) state.explicitPolicy = 0;
       var lpm;
       try { lpm = decodeExt(cert, OID.policyMappings); }
-      catch (_e) { lpm = null; checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true; }
+      catch (_e) { lpm = null; guard.list.append(checks,{ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true; }
       if (lpm && mapsAnyPolicy(lpm.value)) {
-        checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true;
+        guard.list.append(checks,{ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true;
       }
       var lnc;
       try { lnc = decodeExt(cert, OID.nameConstraints); }
-      catch (e) { lnc = null; checks.push({ name: "nameConstraints", ok: false, code: pathCode(e, "path/bad-name-constraints") }); failed = true; }
+      catch (e) { lnc = null; guard.list.append(checks,{ name: "nameConstraints", ok: false, code: pathCode(e, "path/bad-name-constraints") }); failed = true; }
       if (requireCriticalExt(lnc, "nameConstraints", checks)) failed = true;
       var liap;
       try { liap = decodeExt(cert, OID.inhibitAnyPolicy); }
-      catch (e) { liap = null; checks.push({ name: "inhibitAnyPolicy", ok: false, code: pathCode(e, "path/bad-policy") }); failed = true; }
+      catch (e) { liap = null; guard.list.append(checks,{ name: "inhibitAnyPolicy", ok: false, code: pathCode(e, "path/bad-policy") }); failed = true; }
       if (requireCriticalExt(liap, "inhibitAnyPolicy", checks)) failed = true;
       if (requiredEku && ekuPurposeFails(cert, requiredEku, checks)) failed = true;
       var ta = anchor;
@@ -1183,25 +1183,25 @@ async function validate(path, opts) {
       if (distrustDate != null) {
         anchorDistrustApplied = true;
         if (guard.time.instantOf(cert.validity.notBefore) > guard.time.instantOf(distrustDate)) {
-          checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
+          guard.list.append(checks,{ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
         }
       }
       if (checkPurpose && ta.purposes) {
         anchorPurposeApplied = true;
         if (!intrinsic.hasOwn(ta.purposes, checkPurpose) || ta.purposes[checkPurpose] !== true) {
-          checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
+          guard.list.append(checks,{ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
         }
       }
       updateWorkingKey(state, cert);
     }
 
     var unk = unrecognizedCriticalExtension(cert, i === n);
-    if (unk) { checks.push({ name: "criticalExtensions", ok: false, code: "path/unrecognized-critical-extension" }); failed = true; }
+    if (unk) { guard.list.append(checks,{ name: "criticalExtensions", ok: false, code: "path/unrecognized-critical-extension" }); failed = true; }
 
     var crit = validateCriticalExtensionStructure(cert);
-    if (crit) { checks.push({ name: "criticalExtensionValue", ok: false, code: crit }); failed = true; }
+    if (crit) { guard.list.append(checks,{ name: "criticalExtensionValue", ok: false, code: crit }); failed = true; }
 
-    state.results.push({ index: idx, checks: checks });
+    guard.list.append(state.results, { index: idx, checks: checks });
   }
 
   var ucps = userConstrainedPolicies(state, n);
@@ -1209,7 +1209,7 @@ async function validate(path, opts) {
   if (!policyOk) {
     var last = state.results[state.results.length - 1];
     if (!guard.list.anyMatches(last.checks, function (c) { return c.code === "path/policy-required"; })) {
-      last.checks.push({ name: "policy", ok: false, code: "path/policy-required" });
+      guard.list.append(last.checks, { name: "policy", ok: false, code: "path/policy-required" });
     }
     failed = true;
   }
@@ -1218,11 +1218,11 @@ async function validate(path, opts) {
     var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || {}, n, opts.time);
     var target = null;
     for (var tr = 0; tr < state.results.length; tr++) { if (state.results[tr].index === n - 1) { target = state.results[tr]; break; } }
-    if (target) intrinsic.push(target.checks, ctCheck);
+    if (target) guard.list.append(target.checks, ctCheck);
     if (!ctCheck.ok) failed = true;
   }
 
-  return {
+  return guard.verdict.of({
     valid: !failed,
     revocationChecked: !revocationRan ? false
       : revocationUndetermined ? "undetermined"
@@ -1240,7 +1240,7 @@ async function validate(path, opts) {
     workingPublicKeyParameters: state.workingPublicKeyParameters,
     validPolicyTree: treeWithoutParent(state.validPolicyTree),
     userConstrainedPolicySet: ucps,
-  };
+  });
 }
 
 function userConstrainedPolicies(state, n) {
@@ -1379,13 +1379,13 @@ function classifyCrls(parsed) {
       baseCrlNumber: null,
       mergeable: false,
     };
-    if (deltaRaw === null) { completes.push(rec); continue; }
+    if (deltaRaw === null) { guard.list.append(completes, rec); continue; }
     try {
       var n = asn1.read.integer(asn1.decode(deltaRaw));
       if (crlNumberWithinBound(n) && deltaCritical) { rec.baseCrlNumber = n; rec.mergeable = true; }
     } catch (_e) {
     }
-    deltas.push(rec);
+    guard.list.append(deltas, rec);
   }
   return { completes: completes, deltas: deltas };
 }
@@ -1494,7 +1494,7 @@ function crlChecker(crls, opts) {
         var iku;
         try { iku = decodeExt(issuer.issuerCert, OID.keyUsage); }
         catch (e) {
-          return { status: "unknown", reason: "the CRL issuer's keyUsage extension is unreadable (" + pathCode(e, "path/bad-key-usage") + "), so its authorization to sign CRLs cannot be verified" };
+          return guard.verdict.of({ status: "unknown", reason: "the CRL issuer's keyUsage extension is unreadable (" + pathCode(e, "path/bad-key-usage") + "), so its authorization to sign CRLs cannot be verified" });
         }
         if (iku && iku.value.cRLSign !== true) signerAuthorized = false;
       }
@@ -1600,14 +1600,14 @@ function crlChecker(crls, opts) {
             if (!deltaMergesWith(cand, rec)) continue;
             if (!(await gateCrl(cand))) continue;
             cand.accounted = true;
-            candidates.push(cand);
+            guard.list.append(candidates, cand);
           }
           chosenDelta = selectDelta(candidates);
         }
 
         var status;
         if (chosenDelta) {
-          consumedDeltas.push(chosenDelta);
+          guard.list.append(consumedDeltas, chosenDelta);
           status = scanCrl(chosenDelta.crl);
           if (status === null) status = scanCrl(rec.crl);
         } else {
@@ -1631,20 +1631,20 @@ function crlChecker(crls, opts) {
         if (certStatus === null) certStatus = dStatus;
       }
 
-      if (releasedByUnmergedDelta) return { status: "unknown", reason: "a delta CRL released this serial from hold; without merging its base CRL the revocation status is undetermined" };
+      if (releasedByUnmergedDelta) return guard.verdict.of({ status: "unknown", reason: "a delta CRL released this serial from hold; without merging its base CRL the revocation status is undetermined" });
       if (certStatus !== null) {
         var reasonName = constants.NAMES.CRL_REASON[String(certStatus)] || "unspecified";
-        return { status: "revoked", reasonCode: certStatus, reason: "serial listed in a CRL (" + reasonName + ")" };
+        return guard.verdict.of({ status: "revoked", reasonCode: certStatus, reason: "serial listed in a CRL (" + reasonName + ")" });
       }
-      if (sawUnmergedDelta) return { status: "unknown", reason: "a delta CRL cannot be combined with any complete CRL held here, so the revocation picture is incomplete" };
-      if ((reasonsMask & ALL_REASONS) === ALL_REASONS) return { status: "good" };
+      if (sawUnmergedDelta) return guard.verdict.of({ status: "unknown", reason: "a delta CRL cannot be combined with any complete CRL held here, so the revocation picture is incomplete" });
+      if ((reasonsMask & ALL_REASONS) === ALL_REASONS) return guard.verdict.of({ status: "good" });
       if (certScopeFault) {
-        return { status: "unknown", reason: "no authoritative in-scope CRL covers this certificate; its basicConstraints extension is unreadable (" + certScopeFault + "), so scope-limited CRLs were skipped" };
+        return guard.verdict.of({ status: "unknown", reason: "no authoritative in-scope CRL covers this certificate; its basicConstraints extension is unreadable (" + certScopeFault + "), so scope-limited CRLs were skipped" });
       }
       if (reasonsMask !== 0) {
-        return { status: "unknown", reason: "the CRLs available cover only some revocation reasons for this certificate; no combination covers all of them" };
+        return guard.verdict.of({ status: "unknown", reason: "the CRLs available cover only some revocation reasons for this certificate; no combination covers all of them" });
       }
-      return { status: "unknown", reason: "no authoritative in-scope CRL covers this certificate" };
+      return guard.verdict.of({ status: "unknown", reason: "no authoritative in-scope CRL covers this certificate" });
     },
   };
 }
@@ -1736,13 +1736,13 @@ function ocspChecker(responses) {
       var historical = ctx.historicalMode === true;
       var issuerNameCandidates = [cert.issuer.bytes];
       function addNameCandidate(nm) {
-        if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
+        if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) guard.list.append(issuerNameCandidates, nm.bytes);
       }
       if (issuer.issuerCert) addNameCandidate(issuer.issuerCert.subject);
       addNameCandidate(issuer.workingIssuerName);
       var issuerKeyBits;
       try { issuerKeyBits = ocspVerify.ocspKeyValue(issuer.workingPublicKey); }
-      catch (_e) { return { status: "unknown", reason: "the issuer public key could not be read to recompute the OCSP CertID" }; }
+      catch (_e) { return guard.verdict.of({ status: "unknown", reason: "the issuer public key could not be read to recompute the OCSP CertID" }); }
 
       var revokedResult = null;
       var sawGood = false;
@@ -1751,26 +1751,26 @@ function ocspChecker(responses) {
       for (var k = 0; k < parsed.length; k++) {
         var v = await ocspCore.evaluateResponse(parsed[k], cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical);
         if (v.revoked && !revokedResult) {
-          revokedResult = { status: "revoked", revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason };
+          revokedResult = guard.verdict.of({ status: "revoked", revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason });
         }
         if (v.sawGood) sawGood = true;
         if (v.sawUnknownStatus) sawUnknownStatus = true;
       }
       if (revokedResult) return revokedResult;
-      if (sawGood) return { status: "good" };
-      return {
+      if (sawGood) return guard.verdict.of({ status: "good" });
+      return guard.verdict.of({
         status: "unknown",
         reason: sawUnknownStatus
           ? "the OCSP responder reported certStatus unknown for this certificate"
           : "no authoritative, current, in-scope OCSP response covers this certificate",
-      };
+      });
     },
   };
 }
 
 /**
  * @primitive  pki.path.verifyOcspResponse
- * @signature  pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, reason }>
+ * @signature  pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ valid, status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, reason }>
  * @since       0.2.22
  * @status      stable
  * @spec        RFC 6960
@@ -1826,14 +1826,16 @@ function ocspChecker(responses) {
  *   var v = await pki.path.verifyOcspResponse(der, cert, issuerCert, new Date());
  *   v.status;   // "good" | "revoked" | "unknown"
  */
-function verifyOcspResponse(response, cert, issuerCert, time, opts) {
+async function verifyOcspResponse(response, cert, issuerCert, time, opts) {
   var parsedResponse, subject, issuer;
   try {
     parsedResponse = _ocspFromBytes(response);
     subject = coerceCert(cert, "the certificate");
     issuer = coerceCert(issuerCert, "the issuer certificate");
   } catch (e) { return Promise.reject(e); }
-  return _verifyOcspParsed(parsedResponse, subject, issuer, time, opts);
+  var v = await _verifyOcspParsed(parsedResponse, subject, issuer, time, opts);
+  var out = guard.verdict.of(v);
+  return guard.verdict.of(out, { valid: out.status === "good" });
 }
 
 var _OCSP_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
@@ -1852,7 +1854,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   if (!guard.time.isDate(time) || isNaN(guard.time.instantOf(time))) {
     return Promise.reject(E("path/bad-input", "verifyOcspResponse: time must be a valid Date (the currency + responder-validity check date)"));
   }
-  function unbound(reason) { return { status: "unknown", responderAuthorized: false, signatureValid: false, matched: false, reason: reason }; }
+  function unbound(reason) { return guard.verdict.of({ status: "unknown", responderAuthorized: false, signatureValid: false, matched: false, thisUpdate: null, nextUpdate: null, reason: reason }); }
   var boundName;
   try { boundName = dnEqual(cert.issuer.rdns, issuerCert.subject.rdns); }
   catch (e) { return Promise.reject(e); }
@@ -1863,15 +1865,15 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     if (!sig.ok) return unbound("the target certificate's signature does not verify under the supplied issuer certificate's key");
     var issuerCtx = { workingPublicKey: issuerCert.subjectPublicKeyInfo.bytes, workingIssuerName: issuerCert.subject, issuerCert: issuerCert };
     var issuerNameCandidates = [cert.issuer.bytes];
-    function add(nm) { if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes); }
+    function add(nm) { if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) guard.list.append(issuerNameCandidates, nm.bytes); }
     add(issuerCert.subject);
     var issuerKeyBits;
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
     catch (_e) { return unbound("the issuer public key could not be read to recompute the OCSP CertID"); }
     return ocspCore.evaluateResponse(parsedResponse, cert, issuerCtx, issuerKeyBits, issuerNameCandidates, time, opts.historicalMode === true).then(function (v) {
-      if (v.revoked) return { status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason };
-      if (v.sawGood) return { status: "good", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: "good" };
-      return { status: "unknown", responderAuthorized: v.responderAuthorized === true, signatureValid: v.signatureValid === true, matched: v.matched === true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: v.reason };
+      if (v.revoked) return guard.verdict.of({ status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason });
+      if (v.sawGood) return guard.verdict.of({ status: "good", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: "good" });
+      return guard.verdict.of({ status: "unknown", responderAuthorized: v.responderAuthorized === true, signatureValid: v.signatureValid === true, matched: v.matched === true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: v.reason });
     });
   });
 }
@@ -2017,9 +2019,9 @@ function _copyDnRdns(rdns, who) {
       if (!intrinsic.hasOwn(atvOut, "type") || !intrinsic.hasOwn(atvOut, "value")) {
         throw E("path/bad-input", who + "[" + i + "][" + j + "] must carry its type and value as own data properties");
       }
-      intrinsic.push(rdnOut, atvOut);
+      guard.list.append(rdnOut, atvOut);
     }
-    intrinsic.push(out, rdnOut);
+    guard.list.append(out, rdnOut);
   }
   return out;
 }
@@ -2105,7 +2107,7 @@ function _copyAnchorSubtreeList(list, key, who) {
       }
       intrinsic.defineProperty(out, field, { value: fv, enumerable: true, configurable: true, writable: true });
     }
-    intrinsic.push(copied, out);
+    guard.list.append(copied, out);
   }
   return copied;
 }
@@ -2126,7 +2128,7 @@ function _ownAnchorEntries(list, who) {
     var d = intrinsic.getOwnPropertyDescriptor(list, i);
     if (d === undefined) throw E("path/bad-input", who + ": trustAnchors index " + i + " is a hole or is inherited; every entry must be its own");
     if (!intrinsic.hasOwn(d, "value")) throw E("path/bad-input", who + ": trustAnchors entry " + i + " must be a data property, not an accessor");
-    intrinsic.push(out, d.value);
+    guard.list.append(out, d.value);
   }
   return out;
 }
@@ -2139,7 +2141,7 @@ function _precaptureAnchorNameConstraints(list, who) {
       var raw = _captureConstraintMap(entry, "nameConstraints", E, "path/bad-input", who);
       captured = raw == null ? undefined : _copyAnchorNameConstraints(raw, who);
     }
-    intrinsic.push(out, captured);
+    guard.list.append(out, captured);
   }
   return out;
 }
@@ -2439,7 +2441,7 @@ function _pushCandidates(frame, scored, stack, counter, down) {
     if (intrinsic.setHas(frame.keys, candKey)) continue;
     var childKeys = new Set(frame.keys);
     intrinsic.setAdd(childKeys, candKey);
-    stack.push(down
+    guard.list.append(stack, down
       ? { chain: intrinsic.concat(frame.chain, [cand]), hop: frame.hop + 1, keys: childKeys, anchor: frame.anchor }
       : { chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
   }
@@ -2498,7 +2500,7 @@ async function _fetchAiaIssuers(current, aia) {
     if (intrinsic.setHas(aia.fetchedUrls, u.href) || intrinsic.setHas(seenThisCert, u.href)) continue;
     if (seenThisCert.size >= aia.maxPerCert) break;
     intrinsic.setAdd(seenThisCert, u.href);
-    uris.push(u.href);
+    guard.list.append(uris, u.href);
   }
   var out = [];
   for (var k = 0; k < uris.length; k++) {
@@ -2513,7 +2515,7 @@ async function _fetchAiaIssuers(current, aia) {
       var parsed;
       try { parsed = coerceCert(certs[c]); }
       catch (_e3) { /* allow:swallow-unverified verified-unreachable: every cert here already passed the IDENTICAL x509.parse in _aiaParseBody (single-DER validates `body`; certs-only validates each via parseCertsOnly), so coerceCert re-parsing the same bytes cannot throw -- the guard stays as defense-in-depth */ continue; }
-      out.push(parsed);
+      guard.list.append(out, parsed);
     }
   }
   return out;
@@ -2630,7 +2632,7 @@ async function build(leaf, opts) {
   for (var bai = 0; bai < buildEntries.length; bai++) {
     var bAnchor = toAnchor(buildEntries[bai], "build");
     if (buildPreNc[bai] !== undefined) intrinsic.defineProperty(bAnchor, "nameConstraints", { value: buildPreNc[bai], enumerable: true, configurable: true, writable: true });
-    intrinsic.push(anchors, bAnchor);
+    guard.list.append(anchors, bAnchor);
   }
 
   guard.time.assertValid(opts.time, E, "path/bad-input", "build: opts.time (the validity-window check date, forwarded to validate)");
@@ -2702,7 +2704,7 @@ async function build(leaf, opts) {
       if (uip === OID.anyPolicy) { containsAny = true; break; }
       var dupUip = false;
       for (var uj = 0; uj < uipsDistinct.length; uj++) { if (uipsDistinct[uj] === uip) { dupUip = true; break; } }
-      if (!dupUip) intrinsic.push(uipsDistinct, uip);
+      if (!dupUip) guard.list.append(uipsDistinct, uip);
     }
     selectByPolicy = !containsAny;
   }
@@ -2711,7 +2713,7 @@ async function build(leaf, opts) {
   try {
   if (direction === "reverse") {
     var rstack = [];
-    for (var rsi = 0; rsi < anchors.length; rsi++) intrinsic.push(rstack, { chain: [], hop: 0, keys: new Set([identityKey(leafCert)]), anchor: anchors[rsi] });
+    for (var rsi = 0; rsi < anchors.length; rsi++) guard.list.append(rstack, { chain: [], hop: 0, keys: new Set([identityKey(leafCert)]), anchor: anchors[rsi] });
     while (rstack.length) {
       var rframe = rstack.pop();
       var frontierCert = rframe.chain.length ? rframe.chain[rframe.chain.length - 1] : null;
@@ -2725,7 +2727,7 @@ async function build(leaf, opts) {
           var racc = { valid: true, path: rpath, trustAnchor: rframe.anchor, result: rres };
           if (!selectByPolicy) { success = racc; break; }
           if (_policyScore(rres, uipsDistinct) >= uipsDistinct.length) { success = racc; break; }
-          intrinsic.push(accepted, racc);
+          guard.list.append(accepted, racc);
         } else if (!bestFail) bestFail = { path: rpath, trustAnchor: rframe.anchor, result: rres };
       }
       if (rframe.hop >= maxDepth) continue;
@@ -2734,7 +2736,7 @@ async function build(leaf, opts) {
         if (nameMatchSoft(pool[rpi].subject.rdns, rframe.anchor.name.rdns) &&
           intrinsic.bufferEquals(pool[rpi].subjectPublicKeyInfo.bytes, rframe.anchor.publicKey)) continue;
         if (nameMatchSoft(pool[rpi].issuer.rdns, frontierName)) {
-          intrinsic.push(rscored, { cand: pool[rpi], score: scoreCandidateReverse(pool[rpi], frontierCert, leafCert, opts.time) });
+          guard.list.append(rscored, { cand: pool[rpi], score: scoreCandidateReverse(pool[rpi], frontierCert, leafCert, opts.time) });
         }
       }
       considered += _pushCandidates(rframe, rscored, rstack, counter, true);
@@ -2762,7 +2764,7 @@ async function build(leaf, opts) {
           var fdk = certDerKey(fetched[fj]);
           if (intrinsic.setHas(poolDerKeys, fdk)) continue;
           intrinsic.setAdd(poolDerKeys, fdk);
-          if (pool.length < poolCeiling) pool.push(fetched[fj]);
+          if (pool.length < poolCeiling) guard.list.append(pool, fetched[fj]);
         }
       }
       fb.fetched = true;
@@ -2770,7 +2772,7 @@ async function build(leaf, opts) {
       var fbScored = [];
       for (var pj = fb.poolMark; pj < pool.length; pj++) {
         if (nameMatchSoft(pool[pj].subject.rdns, fbCur.issuer.rdns)) {
-          fbScored.push({ cand: pool[pj], score: scoreCandidate(pool[pj], fbAki, anchors, opts.time) });
+          guard.list.append(fbScored, { cand: pool[pj], score: scoreCandidate(pool[pj], fbAki, anchors, opts.time) });
         }
       }
       fb.poolMark = pool.length;
@@ -2789,7 +2791,7 @@ async function build(leaf, opts) {
         var acc = { valid: true, path: frame.chain.slice(), trustAnchor: anchors[ai], result: res };
         if (!selectByPolicy) { success = acc; break; }
         if (_policyScore(res, uipsDistinct) >= uipsDistinct.length) { success = acc; break; }
-        intrinsic.push(accepted, acc);
+        guard.list.append(accepted, acc);
       } else if (!bestFail) bestFail = { path: frame.chain.slice(), trustAnchor: anchors[ai], result: res };
     }
     if (success || frame.hop >= maxDepth) continue;
@@ -2798,11 +2800,11 @@ async function build(leaf, opts) {
     var scored = [];
     for (var pi = 0; pi < pool.length; pi++) {
       if (nameMatchSoft(pool[pi].subject.rdns, current.issuer.rdns)) {
-        scored.push({ cand: pool[pi], score: scoreCandidate(pool[pi], childAki, anchors, opts.time) });
+        guard.list.append(scored, { cand: pool[pi], score: scoreCandidate(pool[pi], childAki, anchors, opts.time) });
       }
     }
     if (aiaCtx && frame.hop < maxDepth && aiaCtx.fetches < aiaCtx.maxFetches) {
-      deferredAia.push({ chain: frame.chain, hop: frame.hop, keys: frame.keys, poolMark: pool.length, seq: deferSeq, fetched: false });
+      guard.list.append(deferredAia, { chain: frame.chain, hop: frame.hop, keys: frame.keys, poolMark: pool.length, seq: deferSeq, fetched: false });
       deferSeq += 1;
     }
     considered += _pushCandidates(frame, scored, stack, counter);
@@ -2818,11 +2820,11 @@ async function build(leaf, opts) {
 
   var aiaFetches = aiaCtx ? aiaCtx.fetches : 0;
   if (success) {
-    if (doValidate) return { valid: true, path: success.path, trustAnchor: success.trustAnchor, result: success.result, candidatesConsidered: considered, aiaFetches: aiaFetches };
-    return { path: success.path, trustAnchor: success.trustAnchor, candidatesConsidered: considered, aiaFetches: aiaFetches };
+    if (doValidate) return guard.verdict.of({ valid: true, path: success.path, trustAnchor: success.trustAnchor, result: success.result, candidatesConsidered: considered, aiaFetches: aiaFetches });
+    return guard.verdict.of({ path: success.path, trustAnchor: success.trustAnchor, candidatesConsidered: considered, aiaFetches: aiaFetches });
   }
   if (anyChainAssembled) {
-    return { valid: false, path: bestFail.path, trustAnchor: bestFail.trustAnchor, result: bestFail.result, candidatesConsidered: considered, aiaFetches: aiaFetches };
+    return guard.verdict.of({ valid: false, path: bestFail.path, trustAnchor: bestFail.trustAnchor, result: bestFail.result, candidatesConsidered: considered, aiaFetches: aiaFetches });
   }
   throw E("path/no-path", "build: no certification path from the leaf to any configured trust anchor could be assembled");
 }