@blamejs/pki 0.6.39 → 0.6.41

package/lib/path-validate.js

@@ -80,7 +80,7 @@ var ANCHOR_SPKI_SCHEMA = pkix.spki(NS);
 
 var subtle = webcrypto.webcrypto.subtle;
 
-var OID = {
+var OID = intrinsic.assign(intrinsic.create(null), {
   basicConstraints: oid.byName("basicConstraints"),
   keyUsage: oid.byName("keyUsage"),
   nameConstraints: oid.byName("nameConstraints"),
@@ -98,9 +98,9 @@ var OID = {
   authorityKeyIdentifier: oid.byName("authorityKeyIdentifier"),
   authorityInfoAccess: oid.byName("authorityInfoAccess"),
   caIssuers: oid.byName("caIssuers"),
-};
+});
 
-var PROCESSED_EXTENSIONS = {};
+var PROCESSED_EXTENSIONS = intrinsic.create(null);
 [OID.basicConstraints, OID.keyUsage, OID.nameConstraints, OID.certificatePolicies,
  OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
  OID.extKeyUsage, OID.cRLDistributionPoints].
@@ -137,7 +137,7 @@ _sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", fal
 
 var OID_RSA_PSS = oid.byName("rsassaPss");
 var OID_MGF1 = oid.byName("mgf1");
-var HASH_BY_OID = {};
+var HASH_BY_OID = intrinsic.create(null);
 HASH_BY_OID[oid.byName("sha256")] = "SHA-256";
 HASH_BY_OID[oid.byName("sha384")] = "SHA-384";
 HASH_BY_OID[oid.byName("sha512")] = "SHA-512";
@@ -244,7 +244,7 @@ function compositeKeyUsageCheck(cert) {
   return { ok: true };
 }
 
-var ML_KEM_OIDS = {};
+var ML_KEM_OIDS = intrinsic.create(null);
 ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { ML_KEM_OIDS[oid.byName(n)] = true; });
 
 function kemKeyUsageCheck(cert) {
@@ -316,7 +316,7 @@ function decodeExt(cert, extOid) {
 
 function requireCriticalExt(ext, name, checks) {
   if (ext && ext.critical !== true) {
-    checks.push({ name: name, ok: false, code: "path/extension-not-critical" });
+    guard.list.append(checks,{ name: name, ok: false, code: "path/extension-not-critical" });
     return E("path/extension-not-critical", name + " extension must be marked critical (RFC 5280 4.2.1)");
   }
   return null;
@@ -454,17 +454,17 @@ function certNameForms(cert) {
   if (san) {
     san.value.names.forEach(function (nm) {
       if (nm.tagNumber === 1) hasRfc822San = true;
-      forms.push({ tag: nm.tagNumber, value: nm.value === undefined ? null : nm.value });
+      guard.list.append(forms, { tag: nm.tagNumber, value: nm.value === undefined ? null : nm.value });
     });
   }
   if (!hasRfc822San) {
     cert.subject.rdns.forEach(function (rdn) {
       rdn.forEach(function (atv) {
-        if (atv.type === OID.emailAddress && typeof atv.value === "string") forms.push({ tag: 1, value: atv.value });
+        if (atv.type === OID.emailAddress && typeof atv.value === "string") guard.list.append(forms, { tag: 1, value: atv.value });
       });
     });
   }
-  if (cert.subject.rdns.length > 0) forms.push({ tag: 4, value: cert.subject });
+  if (cert.subject.rdns.length > 0) guard.list.append(forms, { tag: 4, value: cert.subject });
   return forms;
 }
 
@@ -497,12 +497,12 @@ function checkNameConstraints(state, cert) {
 
 function absorbNameConstraints(state, decoded) {
   if (decoded.permittedSubtrees.length) {
-    state.permittedGenerations.push(decoded.permittedSubtrees.map(function (st) {
+    guard.list.append(state.permittedGenerations, decoded.permittedSubtrees.map(function (st) {
       return { tag: st.base.tagNumber, base: st.base.value };
     }));
   }
   decoded.excludedSubtrees.forEach(function (st) {
-    state.excludedSubtrees.push({ tag: st.base.tagNumber, base: st.base.value });
+    guard.list.append(state.excludedSubtrees, { tag: st.base.tagNumber, base: st.base.value });
   });
 }
 
@@ -524,7 +524,7 @@ function leavesAt(tree, depth) {
   var out = [];
   if (!tree) return out;
   (function walk(node) {
-    if (node.depth === depth) { out.push(node); return; }
+    if (node.depth === depth) { guard.list.append(out, node); return; }
     node.children.forEach(walk);
   })(tree);
   return out;
@@ -563,7 +563,7 @@ function checkedSubtreeSeeds(list, optName) {
    * array's constructor and Symbol.species, which is more caller code running mid-copy. */
   var seedsOut = [];
   for (var si = 0; si < list.length; si++) {
-    intrinsic.push(seedsOut, (function (st) {
+    guard.list.append(seedsOut, (function (st) {
     var shapeMsg = "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }";
     if (!st || typeof st !== "object" || intrinsic.types.isProxy(st)) throw E("path/bad-input", shapeMsg);
     /** @internal Read tag and base once each, from their own data properties: an accessor could
@@ -639,7 +639,7 @@ function selfIssued(cert) {
 function processPolicies(state, cert, i, checks) {
   var cp;
   try { cp = decodeExt(cert, OID.certificatePolicies); }
-  catch (e) { checks.push({ name: "policies", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "policies", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
 
   if (cp && state.validPolicyTree) {
     var policies = cp.value;
@@ -678,7 +678,7 @@ function processPolicies(state, cert, i, checks) {
   }
 
   if (!(state.explicitPolicy > 0 || state.validPolicyTree !== null)) {
-    checks.push({ name: "policy", ok: false, code: "path/policy-required" });
+    guard.list.append(checks,{ name: "policy", ok: false, code: "path/policy-required" });
     return { fatal: true, error: E("path/policy-required", "explicit policy required but the valid-policy tree is empty") };
   }
   return { fatal: false };
@@ -687,7 +687,7 @@ function processPolicies(state, cert, i, checks) {
 function addChild(state, parent, validPolicy, qualifiers, expectedPolicySet, checks) {
   if (state.policyNodeCount >= state.maxPolicyNodes) { state._capHit = true; return; }
   var node = { depth: parent.depth + 1, validPolicy: validPolicy, qualifierSet: qualifiers ? [qualifiers] : [], expectedPolicySet: expectedPolicySet, children: [], parent: parent };
-  parent.children.push(node);
+  guard.list.append(parent.children, node);
   state.policyNodeCount++;
   void checks;
 }
@@ -722,11 +722,11 @@ function ekuPurposeFails(cert, requiredEku, checks) {
   var eku;
   try { eku = decodeExt(cert, OID.extKeyUsage); }
   // allow:fail-open-verify -- ekuPurposeFails returns true to mean the EKU purpose FAILS (a rejecting verdict); a bad extension is recorded in checks and the purpose is treated as failed, which is fail-closed
-  catch (e) { checks.push({ name: "extendedKeyUsage", ok: false, code: pathCode(e, "path/bad-extension-value") }); return true; }
+  catch (e) { guard.list.append(checks,{ name: "extendedKeyUsage", ok: false, code: pathCode(e, "path/bad-extension-value") }); return true; }
   if (!eku) return false;
   var purposes = eku.value;
   var ok = contains(purposes, OID.anyExtendedKeyUsage) || containsAll(purposes, requiredEku);
-  checks.push({ name: "extendedKeyUsage", ok: ok, code: ok ? undefined : "path/eku-not-permitted" });
+  guard.list.append(checks,{ name: "extendedKeyUsage", ok: ok, code: ok ? undefined : "path/eku-not-permitted" });
   return !ok;
 }
 
@@ -739,10 +739,10 @@ function prepareNext(state, cert, i, checks) {
 
   var pm;
   try { pm = decodeExt(cert, OID.policyMappings); }
-  catch (e) { checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
   if (pm) {
     var badAny = mapsAnyPolicy(pm.value);
-    if (badAny) { checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: E("path/bad-policy", "policyMappings must not map to or from anyPolicy (RFC 5280 6.1.4(a))") }; }
+    if (badAny) { guard.list.append(checks,{ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: E("path/bad-policy", "policyMappings must not map to or from anyPolicy (RFC 5280 6.1.4(a))") }; }
     if (state.validPolicyTree) applyPolicyMappings(state, pm.value, i);
   }
 
@@ -751,7 +751,7 @@ function prepareNext(state, cert, i, checks) {
 
   var nc;
   try { nc = decodeExt(cert, OID.nameConstraints); }
-  catch (e) { checks.push({ name: "nameConstraints", ok: false, code: pathCode(e, "path/bad-name-constraints") }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "nameConstraints", ok: false, code: pathCode(e, "path/bad-name-constraints") }); return { fatal: true, error: e }; }
   var ncCritErr = requireCriticalExt(nc, "nameConstraints", checks);
   if (ncCritErr) return { fatal: true, error: ncCritErr };
   if (nc) absorbNameConstraints(state, nc.value);
@@ -764,7 +764,7 @@ function prepareNext(state, cert, i, checks) {
 
   var pc;
   try { pc = decodeExt(cert, OID.policyConstraints); }
-  catch (e) { checks.push({ name: "policyConstraints", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "policyConstraints", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
   var pcCritErr = requireCriticalExt(pc, "policyConstraints", checks);
   if (pcCritErr) return { fatal: true, error: pcCritErr };
   if (pc) {
@@ -773,31 +773,31 @@ function prepareNext(state, cert, i, checks) {
   }
   var iap;
   try { iap = decodeExt(cert, OID.inhibitAnyPolicy); }
-  catch (e) { checks.push({ name: "inhibitAnyPolicy", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "inhibitAnyPolicy", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
   var iapCritErr = requireCriticalExt(iap, "inhibitAnyPolicy", checks);
   if (iapCritErr) return { fatal: true, error: iapCritErr };
   if (iap && iap.value < state.inhibitAnyPolicy) state.inhibitAnyPolicy = iap.value;
 
   var bc;
   try { bc = decodeExt(cert, OID.basicConstraints); }
-  catch (e) { checks.push({ name: "basicConstraints", ok: false, code: "path/bad-basic-constraints" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "basicConstraints", ok: false, code: "path/bad-basic-constraints" }); return { fatal: true, error: e }; }
   if (!bc || bc.value.cA !== true) {
-    checks.push({ name: "basicConstraints", ok: false, code: "path/not-a-ca" });
+    guard.list.append(checks,{ name: "basicConstraints", ok: false, code: "path/not-a-ca" });
     return { fatal: true, error: E("path/not-a-ca", "intermediate certificate is not a CA (basicConstraints cA is not TRUE, RFC 5280 6.1.4(k))") };
   }
   var bcCritErr = requireCriticalExt(bc, "basicConstraints", checks);
   if (bcCritErr) return { fatal: true, error: bcCritErr };
   if (!isSelfIssued) {
-    if (state.maxPathLength <= 0) { checks.push({ name: "pathLength", ok: false, code: "path/path-length-exceeded" }); return { fatal: true, error: E("path/path-length-exceeded", "certification path is longer than the CA path-length constraint allows") }; }
+    if (state.maxPathLength <= 0) { guard.list.append(checks,{ name: "pathLength", ok: false, code: "path/path-length-exceeded" }); return { fatal: true, error: E("path/path-length-exceeded", "certification path is longer than the CA path-length constraint allows") }; }
     state.maxPathLength--;
   }
   if (bc.value.pathLenConstraint !== null && bc.value.pathLenConstraint < state.maxPathLength) state.maxPathLength = bc.value.pathLenConstraint;
 
   var ku;
   try { ku = decodeExt(cert, OID.keyUsage); }
-  catch (e) { checks.push({ name: "keyUsage", ok: false, code: "path/bad-key-usage" }); return { fatal: true, error: e }; }
+  catch (e) { guard.list.append(checks,{ name: "keyUsage", ok: false, code: "path/bad-key-usage" }); return { fatal: true, error: e }; }
   if (ku && ku.value.keyCertSign !== true) {
-    checks.push({ name: "keyUsage", ok: false, code: "path/missing-key-cert-sign" });
+    guard.list.append(checks,{ name: "keyUsage", ok: false, code: "path/missing-key-cert-sign" });
     return { fatal: true, error: E("path/missing-key-cert-sign", "CA certificate keyUsage does not assert keyCertSign (RFC 5280 6.1.4(n))") };
   }
   return { fatal: false };
@@ -806,8 +806,8 @@ function prepareNext(state, cert, i, checks) {
 function applyPolicyMappings(state, mappings, i) {
   var depth = i;
   if (state.policyMapping > 0) {
-    var mappedFrom = {};
-    mappings.forEach(function (m) { (mappedFrom[m.issuerDomainPolicy] = mappedFrom[m.issuerDomainPolicy] || []).push(m.subjectDomainPolicy); });
+    var mappedFrom = intrinsic.create(null);
+    mappings.forEach(function (m) { guard.list.append(mappedFrom[m.issuerDomainPolicy] = mappedFrom[m.issuerDomainPolicy] || [], m.subjectDomainPolicy); });
     var depthI = leavesAt(state.validPolicyTree, depth);
     var anyNodes = depthI.filter(function (nd) { return nd.validPolicy === OID.anyPolicy; });
     Object.keys(mappedFrom).forEach(function (idp) {
@@ -821,7 +821,7 @@ function applyPolicyMappings(state, mappings, i) {
       }
     });
   } else {
-    var mappedSet = {};
+    var mappedSet = intrinsic.create(null);
     mappings.forEach(function (m) { mappedSet[m.issuerDomainPolicy] = true; });
     if (!state.validPolicyTree) return;
     leavesAt(state.validPolicyTree, depth).forEach(function (node) {
@@ -835,7 +835,7 @@ function applyPolicyMappings(state, mappings, i) {
   }
 }
 
-var TARGET_UNPROCESSED_IF_CRITICAL = {};
+var TARGET_UNPROCESSED_IF_CRITICAL = intrinsic.create(null);
 TARGET_UNPROCESSED_IF_CRITICAL[OID.policyMappings] = true;
 Object.freeze(TARGET_UNPROCESSED_IF_CRITICAL);
 
@@ -939,13 +939,13 @@ function validateCriticalExtensionStructure(cert) {
  *   });
  *   res.valid;  // boolean; res.results[0].checks carries the per-check codes
  */
-var _VALIDATE_OPTS = {
+var _VALIDATE_OPTS = intrinsic.assign(intrinsic.create(null), {
   checkPurpose: 1, ctLogList: 1, ctPolicy: 1, historicalMode: 1, initialAnyPolicyInhibit: 1,
   initialExcludedSubtrees: 1, initialExplicitPolicy: 1, initialPermittedSubtrees: 1,
   initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1,
   requiredEku: 1, revocationChecker: 1, softFail: 1, time: 1, trustAnchors: 1,
   userInitialPolicySet: 1, verifier: 1
-};
+});
 
 var OID_SCT_LIST = oid.byName("signedCertificateTimestampList");
 async function ctGateCheck(leaf, certs, anchor, ctLogList, ctPolicy, n, at) {
@@ -953,14 +953,14 @@ async function ctGateCheck(leaf, certs, anchor, ctLogList, ctPolicy, n, at) {
   for (var i = 0; i < exts.length; i++) {
     if (exts[i] && (exts[i].oid === OID_SCT_LIST || exts[i].name === "signedCertificateTimestampList")) { sctExt = exts[i]; break; }
   }
-  if (sctExt == null) return { name: "ct", ok: false, code: "path/ct-required" };
+  if (sctExt == null) return guard.verdict.of({ name: "ct", ok: false, code: "path/ct-required" });
   var issuer = n >= 2 ? certs[n - 2] : { subjectPublicKeyInfo: { bytes: anchor.publicKey } };
   var entry, list;
   try {
     entry = ct.x509CertEntry(leaf, issuer);
     list = ct.parseSctList(sctExt.value);
   } catch (e) {
-    return { name: "ct", ok: false, code: pathCode(e, "path/ct-required") };
+    return guard.verdict.of({ name: "ct", ok: false, code: pathCode(e, "path/ct-required") });
   }
   var verdict;
   try {
@@ -970,7 +970,7 @@ async function ctGateCheck(leaf, certs, anchor, ctLogList, ctPolicy, n, at) {
     if (e && e.isPkiError) throw E("path/bad-input", "validate: the CT policy or log-list is invalid (" + (e.code || "ct/bad-input") + "): " + e.message);
     throw e;
   }
-  return { name: "ct", ok: verdict.policyOk === true, code: verdict.policyOk ? undefined : "path/ct-policy-not-met" };
+  return guard.verdict.of({ name: "ct", ok: verdict.policyOk === true, code: verdict.policyOk ? undefined : "path/ct-policy-not-met" });
 }
 
 async function validate(path, opts) {
@@ -1015,7 +1015,7 @@ async function validate(path, opts) {
     var exclRawOnce = opts.initialExcludedSubtrees;
     var singleOpts = function (a) {
       var keys = intrinsic.ownKeys(opts);
-      var o = {};
+      var o = intrinsic.create(null);
       for (var ki = 0; ki < keys.length; ki++) { o[keys[ki]] = opts[keys[ki]]; }
       o.trustAnchors = a;
       if (permRawOnce != null) o.initialPermittedSubtrees = callerPermitted;
@@ -1080,18 +1080,18 @@ async function validate(path, opts) {
     } else {
       sigRes = await builtinVerify(state, cert);
     }
-    checks.push({ name: "signature", ok: sigRes.ok, code: sigRes.ok ? undefined : (sigRes.code || "path/bad-signature") });
+    guard.list.append(checks, { name: "signature", ok: sigRes.ok, code: sigRes.ok ? undefined : (sigRes.code || "path/bad-signature") });
     if (!sigRes.ok) failed = true;
 
     if (compositeSig.COMPOSITE_ALGS[cert.subjectPublicKeyInfo.algorithm.oid]) {
       var cku = compositeKeyUsageCheck(cert);
-      checks.push({ name: "compositeKeyUsage", ok: cku.ok, code: cku.ok ? undefined : cku.code });
+      guard.list.append(checks,{ name: "compositeKeyUsage", ok: cku.ok, code: cku.ok ? undefined : cku.code });
       if (!cku.ok) failed = true;
     }
 
     if (ML_KEM_OIDS[cert.subjectPublicKeyInfo.algorithm.oid]) {
       var kku = kemKeyUsageCheck(cert);
-      checks.push({ name: "kemKeyUsage", ok: kku.ok, code: kku.ok ? undefined : kku.code });
+      guard.list.append(checks,{ name: "kemKeyUsage", ok: kku.ok, code: kku.ok ? undefined : kku.code });
       if (!kku.ok) failed = true;
     }
 
@@ -1099,20 +1099,20 @@ async function validate(path, opts) {
     var vOk = true, vCode;
     if (t < guard.time.instantOf(cert.validity.notBefore)) { vOk = false; vCode = "path/not-yet-valid"; }
     else if (t > guard.time.instantOf(cert.validity.notAfter)) { vOk = false; vCode = "path/expired"; }
-    checks.push({ name: "validity", ok: vOk, code: vCode });
+    guard.list.append(checks,{ name: "validity", ok: vOk, code: vCode });
     if (!vOk) failed = true;
 
     var chainOk;
     try { chainOk = dnEqual(cert.issuer.rdns, state.workingIssuerName.rdns); }
     catch (_e) { chainOk = false; }
-    checks.push({ name: "nameChaining", ok: chainOk === true, code: chainOk === true ? undefined : "path/name-chaining" });
+    guard.list.append(checks,{ name: "nameChaining", ok: chainOk === true, code: chainOk === true ? undefined : "path/name-chaining" });
     if (chainOk !== true) failed = true;
 
     if (!(selfIssued(cert) && i !== n)) {
       var ncRes;
       try { ncRes = checkNameConstraints(state, cert); }
       catch (e) { ncRes = { ok: false, code: pathCode(e, "path/bad-name-constraints") }; }
-      checks.push({ name: "nameConstraints", ok: ncRes.ok, code: ncRes.ok ? undefined : ncRes.code });
+      guard.list.append(checks,{ name: "nameConstraints", ok: ncRes.ok, code: ncRes.ok ? undefined : ncRes.code });
       if (!ncRes.ok) failed = true;
     }
 
@@ -1122,33 +1122,33 @@ async function validate(path, opts) {
       try { rv = await revocationChecker.check(cert, { workingIssuerName: state.workingIssuerName, workingPublicKey: state.workingPublicKey, workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm, issuerCert: issuerCert }, { time: opts.time, historicalMode: opts.historicalMode === true }); }
       catch (e) { rv = { status: "error" }; rvError = e; }
       var rvStatus = (rv && typeof rv.status === "string") ? rv.status : "unknown";
-      if (rv && rv.status === "good") { checks.push({ name: "revocation", ok: true, status: "good" }); }
-      else if (rv && rv.status === "revoked") { checks.push({ name: "revocation", ok: false, status: "revoked", code: "path/revoked" }); failed = true; }
+      if (rv && rv.status === "good") { guard.list.append(checks,{ name: "revocation", ok: true, status: "good" }); }
+      else if (rv && rv.status === "revoked") { guard.list.append(checks,{ name: "revocation", ok: false, status: "revoked", code: "path/revoked" }); failed = true; }
       else if (rvError) {
-        checks.push({ name: "revocation", ok: false, status: "error", code: "path/revocation-checker-error", error: rvError });
+        guard.list.append(checks,{ name: "revocation", ok: false, status: "error", code: "path/revocation-checker-error", error: rvError });
         revocationUndetermined = true;
         failed = true;
       }
       else if (softFail) {
-        checks.push({ name: "revocation", ok: true, status: rvStatus, waived: true });
+        guard.list.append(checks,{ name: "revocation", ok: true, status: rvStatus, waived: true });
         revocationWaived = true;
       } else {
-        checks.push({ name: "revocation", ok: false, status: rvStatus, code: "path/revocation-undetermined" });
+        guard.list.append(checks,{ name: "revocation", ok: false, status: rvStatus, code: "path/revocation-undetermined" });
         revocationUndetermined = true;
         failed = true;
       }
       revocationRan = true;
     } else if (requireRevocation) {
-      checks.push({ name: "revocation", ok: false, code: "path/revocation-undetermined" }); failed = true;
+      guard.list.append(checks,{ name: "revocation", ok: false, code: "path/revocation-undetermined" }); failed = true;
     }
 
     var polRes = processPolicies(state, cert, i, checks);
-    if (state._capHit) { checks.push({ name: "policyTree", ok: false, code: "path/policy-tree-cap" }); failed = true; }
+    if (state._capHit) { guard.list.append(checks,{ name: "policyTree", ok: false, code: "path/policy-tree-cap" }); failed = true; }
     else if (polRes.fatal) failed = true;
 
     if (cert.subject.rdns.length === 0) {
       var san = findExt(cert, OID.subjectAltName);
-      if (!san || !san.critical) { checks.push({ name: "emptySubject", ok: false, code: "path/empty-subject-no-critical-san" }); failed = true; }
+      if (!san || !san.critical) { guard.list.append(checks,{ name: "emptySubject", ok: false, code: "path/empty-subject-no-critical-san" }); failed = true; }
     }
 
     if (i !== n) {
@@ -1160,22 +1160,22 @@ async function validate(path, opts) {
       if (state.explicitPolicy > 0) state.explicitPolicy--;
       var lpc;
       try { lpc = decodeExt(cert, OID.policyConstraints); }
-      catch (_e) { lpc = null; checks.push({ name: "policyConstraints", ok: false, code: "path/bad-policy" }); failed = true; }
+      catch (_e) { lpc = null; guard.list.append(checks,{ name: "policyConstraints", ok: false, code: "path/bad-policy" }); failed = true; }
       if (requireCriticalExt(lpc, "policyConstraints", checks)) failed = true;
       if (lpc && lpc.value.requireExplicitPolicy === 0) state.explicitPolicy = 0;
       var lpm;
       try { lpm = decodeExt(cert, OID.policyMappings); }
-      catch (_e) { lpm = null; checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true; }
+      catch (_e) { lpm = null; guard.list.append(checks,{ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true; }
       if (lpm && mapsAnyPolicy(lpm.value)) {
-        checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true;
+        guard.list.append(checks,{ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true;
       }
       var lnc;
       try { lnc = decodeExt(cert, OID.nameConstraints); }
-      catch (e) { lnc = null; checks.push({ name: "nameConstraints", ok: false, code: pathCode(e, "path/bad-name-constraints") }); failed = true; }
+      catch (e) { lnc = null; guard.list.append(checks,{ name: "nameConstraints", ok: false, code: pathCode(e, "path/bad-name-constraints") }); failed = true; }
       if (requireCriticalExt(lnc, "nameConstraints", checks)) failed = true;
       var liap;
       try { liap = decodeExt(cert, OID.inhibitAnyPolicy); }
-      catch (e) { liap = null; checks.push({ name: "inhibitAnyPolicy", ok: false, code: pathCode(e, "path/bad-policy") }); failed = true; }
+      catch (e) { liap = null; guard.list.append(checks,{ name: "inhibitAnyPolicy", ok: false, code: pathCode(e, "path/bad-policy") }); failed = true; }
       if (requireCriticalExt(liap, "inhibitAnyPolicy", checks)) failed = true;
       if (requiredEku && ekuPurposeFails(cert, requiredEku, checks)) failed = true;
       var ta = anchor;
@@ -1183,25 +1183,25 @@ async function validate(path, opts) {
       if (distrustDate != null) {
         anchorDistrustApplied = true;
         if (guard.time.instantOf(cert.validity.notBefore) > guard.time.instantOf(distrustDate)) {
-          checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
+          guard.list.append(checks,{ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
         }
       }
       if (checkPurpose && ta.purposes) {
         anchorPurposeApplied = true;
         if (!intrinsic.hasOwn(ta.purposes, checkPurpose) || ta.purposes[checkPurpose] !== true) {
-          checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
+          guard.list.append(checks,{ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
         }
       }
       updateWorkingKey(state, cert);
     }
 
     var unk = unrecognizedCriticalExtension(cert, i === n);
-    if (unk) { checks.push({ name: "criticalExtensions", ok: false, code: "path/unrecognized-critical-extension" }); failed = true; }
+    if (unk) { guard.list.append(checks,{ name: "criticalExtensions", ok: false, code: "path/unrecognized-critical-extension" }); failed = true; }
 
     var crit = validateCriticalExtensionStructure(cert);
-    if (crit) { checks.push({ name: "criticalExtensionValue", ok: false, code: crit }); failed = true; }
+    if (crit) { guard.list.append(checks,{ name: "criticalExtensionValue", ok: false, code: crit }); failed = true; }
 
-    state.results.push({ index: idx, checks: checks });
+    guard.list.append(state.results, { index: idx, checks: checks });
   }
 
   var ucps = userConstrainedPolicies(state, n);
@@ -1209,7 +1209,7 @@ async function validate(path, opts) {
   if (!policyOk) {
     var last = state.results[state.results.length - 1];
     if (!guard.list.anyMatches(last.checks, function (c) { return c.code === "path/policy-required"; })) {
-      last.checks.push({ name: "policy", ok: false, code: "path/policy-required" });
+      guard.list.append(last.checks, { name: "policy", ok: false, code: "path/policy-required" });
     }
     failed = true;
   }
@@ -1218,11 +1218,11 @@ async function validate(path, opts) {
     var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || {}, n, opts.time);
     var target = null;
     for (var tr = 0; tr < state.results.length; tr++) { if (state.results[tr].index === n - 1) { target = state.results[tr]; break; } }
-    if (target) intrinsic.push(target.checks, ctCheck);
+    if (target) guard.list.append(target.checks, ctCheck);
     if (!ctCheck.ok) failed = true;
   }
 
-  return {
+  return guard.verdict.of({
     valid: !failed,
     revocationChecked: !revocationRan ? false
       : revocationUndetermined ? "undetermined"
@@ -1240,7 +1240,7 @@ async function validate(path, opts) {
     workingPublicKeyParameters: state.workingPublicKeyParameters,
     validPolicyTree: treeWithoutParent(state.validPolicyTree),
     userConstrainedPolicySet: ucps,
-  };
+  });
 }
 
 function userConstrainedPolicies(state, n) {
@@ -1248,12 +1248,12 @@ function userConstrainedPolicies(state, n) {
   var uips = state.userInitialPolicySet;
   var anyUser = contains(uips, OID.anyPolicy);
   var leaves = leavesAt(state.validPolicyTree, n);
-  var explicit = {}, hasAnyLeaf = false;
+  var explicit = intrinsic.create(null), hasAnyLeaf = false;
   leaves.forEach(function (node) {
     if (node.validPolicy === OID.anyPolicy) hasAnyLeaf = true;
     else explicit[node.validPolicy] = true;
   });
-  var set = {};
+  var set = intrinsic.create(null);
   Object.keys(explicit).forEach(function (p) { if (anyUser || contains(uips, p)) set[p] = true; });
   if (hasAnyLeaf) {
     if (anyUser) set[OID.anyPolicy] = true;
@@ -1379,13 +1379,13 @@ function classifyCrls(parsed) {
       baseCrlNumber: null,
       mergeable: false,
     };
-    if (deltaRaw === null) { completes.push(rec); continue; }
+    if (deltaRaw === null) { guard.list.append(completes, rec); continue; }
     try {
       var n = asn1.read.integer(asn1.decode(deltaRaw));
       if (crlNumberWithinBound(n) && deltaCritical) { rec.baseCrlNumber = n; rec.mergeable = true; }
     } catch (_e) {
     }
-    deltas.push(rec);
+    guard.list.append(deltas, rec);
   }
   return { completes: completes, deltas: deltas };
 }
@@ -1494,7 +1494,7 @@ function crlChecker(crls, opts) {
         var iku;
         try { iku = decodeExt(issuer.issuerCert, OID.keyUsage); }
         catch (e) {
-          return { status: "unknown", reason: "the CRL issuer's keyUsage extension is unreadable (" + pathCode(e, "path/bad-key-usage") + "), so its authorization to sign CRLs cannot be verified" };
+          return guard.verdict.of({ status: "unknown", reason: "the CRL issuer's keyUsage extension is unreadable (" + pathCode(e, "path/bad-key-usage") + "), so its authorization to sign CRLs cannot be verified" });
         }
         if (iku && iku.value.cRLSign !== true) signerAuthorized = false;
       }
@@ -1600,14 +1600,14 @@ function crlChecker(crls, opts) {
             if (!deltaMergesWith(cand, rec)) continue;
             if (!(await gateCrl(cand))) continue;
             cand.accounted = true;
-            candidates.push(cand);
+            guard.list.append(candidates, cand);
           }
           chosenDelta = selectDelta(candidates);
         }
 
         var status;
         if (chosenDelta) {
-          consumedDeltas.push(chosenDelta);
+          guard.list.append(consumedDeltas, chosenDelta);
           status = scanCrl(chosenDelta.crl);
           if (status === null) status = scanCrl(rec.crl);
         } else {
@@ -1631,20 +1631,20 @@ function crlChecker(crls, opts) {
         if (certStatus === null) certStatus = dStatus;
       }
 
-      if (releasedByUnmergedDelta) return { status: "unknown", reason: "a delta CRL released this serial from hold; without merging its base CRL the revocation status is undetermined" };
+      if (releasedByUnmergedDelta) return guard.verdict.of({ status: "unknown", reason: "a delta CRL released this serial from hold; without merging its base CRL the revocation status is undetermined" });
       if (certStatus !== null) {
         var reasonName = constants.NAMES.CRL_REASON[String(certStatus)] || "unspecified";
-        return { status: "revoked", reasonCode: certStatus, reason: "serial listed in a CRL (" + reasonName + ")" };
+        return guard.verdict.of({ status: "revoked", reasonCode: certStatus, reason: "serial listed in a CRL (" + reasonName + ")" });
       }
-      if (sawUnmergedDelta) return { status: "unknown", reason: "a delta CRL cannot be combined with any complete CRL held here, so the revocation picture is incomplete" };
-      if ((reasonsMask & ALL_REASONS) === ALL_REASONS) return { status: "good" };
+      if (sawUnmergedDelta) return guard.verdict.of({ status: "unknown", reason: "a delta CRL cannot be combined with any complete CRL held here, so the revocation picture is incomplete" });
+      if ((reasonsMask & ALL_REASONS) === ALL_REASONS) return guard.verdict.of({ status: "good" });
       if (certScopeFault) {
-        return { status: "unknown", reason: "no authoritative in-scope CRL covers this certificate; its basicConstraints extension is unreadable (" + certScopeFault + "), so scope-limited CRLs were skipped" };
+        return guard.verdict.of({ status: "unknown", reason: "no authoritative in-scope CRL covers this certificate; its basicConstraints extension is unreadable (" + certScopeFault + "), so scope-limited CRLs were skipped" });
       }
       if (reasonsMask !== 0) {
-        return { status: "unknown", reason: "the CRLs available cover only some revocation reasons for this certificate; no combination covers all of them" };
+        return guard.verdict.of({ status: "unknown", reason: "the CRLs available cover only some revocation reasons for this certificate; no combination covers all of them" });
       }
-      return { status: "unknown", reason: "no authoritative in-scope CRL covers this certificate" };
+      return guard.verdict.of({ status: "unknown", reason: "no authoritative in-scope CRL covers this certificate" });
     },
   };
 }
@@ -1736,13 +1736,13 @@ function ocspChecker(responses) {
       var historical = ctx.historicalMode === true;
       var issuerNameCandidates = [cert.issuer.bytes];
       function addNameCandidate(nm) {
-        if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
+        if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) guard.list.append(issuerNameCandidates, nm.bytes);
       }
       if (issuer.issuerCert) addNameCandidate(issuer.issuerCert.subject);
       addNameCandidate(issuer.workingIssuerName);
       var issuerKeyBits;
       try { issuerKeyBits = ocspVerify.ocspKeyValue(issuer.workingPublicKey); }
-      catch (_e) { return { status: "unknown", reason: "the issuer public key could not be read to recompute the OCSP CertID" }; }
+      catch (_e) { return guard.verdict.of({ status: "unknown", reason: "the issuer public key could not be read to recompute the OCSP CertID" }); }
 
       var revokedResult = null;
       var sawGood = false;
@@ -1751,19 +1751,19 @@ function ocspChecker(responses) {
       for (var k = 0; k < parsed.length; k++) {
         var v = await ocspCore.evaluateResponse(parsed[k], cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical);
         if (v.revoked && !revokedResult) {
-          revokedResult = { status: "revoked", revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason };
+          revokedResult = guard.verdict.of({ status: "revoked", revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason });
         }
         if (v.sawGood) sawGood = true;
         if (v.sawUnknownStatus) sawUnknownStatus = true;
       }
       if (revokedResult) return revokedResult;
-      if (sawGood) return { status: "good" };
-      return {
+      if (sawGood) return guard.verdict.of({ status: "good" });
+      return guard.verdict.of({
         status: "unknown",
         reason: sawUnknownStatus
           ? "the OCSP responder reported certStatus unknown for this certificate"
           : "no authoritative, current, in-scope OCSP response covers this certificate",
-      };
+      });
     },
   };
 }
@@ -1865,7 +1865,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     if (!sig.ok) return unbound("the target certificate's signature does not verify under the supplied issuer certificate's key");
     var issuerCtx = { workingPublicKey: issuerCert.subjectPublicKeyInfo.bytes, workingIssuerName: issuerCert.subject, issuerCert: issuerCert };
     var issuerNameCandidates = [cert.issuer.bytes];
-    function add(nm) { if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes); }
+    function add(nm) { if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) guard.list.append(issuerNameCandidates, nm.bytes); }
     add(issuerCert.subject);
     var issuerKeyBits;
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
@@ -1941,7 +1941,7 @@ function resolvePurposeOpts(opts) {
 }
 
 function _snapshotConstraintMap(m, E, code, who) {
-  var out = {};
+  var out = intrinsic.create(null);
   var proto = intrinsic.getPrototypeOf(m);
   if (proto !== null && proto !== intrinsic.ObjectProto) throw E(code, who + ": a trustAnchor constraint map must be a plain object (its own entries only), not one with a custom or cross-realm prototype");
   var keys = intrinsic.getOwnPropertyNames(m);
@@ -2019,9 +2019,9 @@ function _copyDnRdns(rdns, who) {
       if (!intrinsic.hasOwn(atvOut, "type") || !intrinsic.hasOwn(atvOut, "value")) {
         throw E("path/bad-input", who + "[" + i + "][" + j + "] must carry its type and value as own data properties");
       }
-      intrinsic.push(rdnOut, atvOut);
+      guard.list.append(rdnOut, atvOut);
     }
-    intrinsic.push(out, rdnOut);
+    guard.list.append(out, rdnOut);
   }
   return out;
 }
@@ -2107,7 +2107,7 @@ function _copyAnchorSubtreeList(list, key, who) {
       }
       intrinsic.defineProperty(out, field, { value: fv, enumerable: true, configurable: true, writable: true });
     }
-    intrinsic.push(copied, out);
+    guard.list.append(copied, out);
   }
   return copied;
 }
@@ -2128,7 +2128,7 @@ function _ownAnchorEntries(list, who) {
     var d = intrinsic.getOwnPropertyDescriptor(list, i);
     if (d === undefined) throw E("path/bad-input", who + ": trustAnchors index " + i + " is a hole or is inherited; every entry must be its own");
     if (!intrinsic.hasOwn(d, "value")) throw E("path/bad-input", who + ": trustAnchors entry " + i + " must be a data property, not an accessor");
-    intrinsic.push(out, d.value);
+    guard.list.append(out, d.value);
   }
   return out;
 }
@@ -2141,7 +2141,7 @@ function _precaptureAnchorNameConstraints(list, who) {
       var raw = _captureConstraintMap(entry, "nameConstraints", E, "path/bad-input", who);
       captured = raw == null ? undefined : _copyAnchorNameConstraints(raw, who);
     }
-    intrinsic.push(out, captured);
+    guard.list.append(out, captured);
   }
   return out;
 }
@@ -2441,7 +2441,7 @@ function _pushCandidates(frame, scored, stack, counter, down) {
     if (intrinsic.setHas(frame.keys, candKey)) continue;
     var childKeys = new Set(frame.keys);
     intrinsic.setAdd(childKeys, candKey);
-    stack.push(down
+    guard.list.append(stack, down
       ? { chain: intrinsic.concat(frame.chain, [cand]), hop: frame.hop + 1, keys: childKeys, anchor: frame.anchor }
       : { chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
   }
@@ -2468,7 +2468,9 @@ function _aiaParseBody(body, contentType, maxCerts) {
 }
 
 async function _aiaFetchOne(uri, aia) {
-  var res = await aia.transport({ method: "GET", url: uri, tls: aia.tls, timeout: aia.timeout, maxResponseBytes: aia.maxResponseBytes, blockPrivateAddresses: true });
+  var res = await guard.async.invoked(aia.transport,
+    [{ method: "GET", url: uri, tls: aia.tls, timeout: aia.timeout, maxResponseBytes: aia.maxResponseBytes, blockPrivateAddresses: true }],
+    E, "path/bad-input", "opts.transport");
   res = res || {};
   if (res.status !== 200) throw E("path/aia-status", "an AIA fetch returned HTTP " + res.status + " (only 200 is a cert source; no redirect following)");
   var body = guard.bytes.isByteSource(res.body)
@@ -2476,7 +2478,7 @@ async function _aiaFetchOne(uri, aia) {
     : Buffer.from(res.body == null ? "" : String(res.body), "latin1");
   if (body.length === 0) throw E("path/aia-empty", "an AIA fetch returned an empty body");
   if (body.length > aia.maxResponseBytes) throw E("path/aia-too-large", "an AIA response exceeds the " + aia.maxResponseBytes + "-byte cap");
-  var headers = {};
+  var headers = intrinsic.create(null);
   Object.keys(res.headers || {}).forEach(function (k) { headers[k.toLowerCase()] = res.headers[k]; });
   return _aiaParseBody(body, headers["content-type"], aia.maxCertsPerResponse);
 }
@@ -2500,7 +2502,7 @@ async function _fetchAiaIssuers(current, aia) {
     if (intrinsic.setHas(aia.fetchedUrls, u.href) || intrinsic.setHas(seenThisCert, u.href)) continue;
     if (seenThisCert.size >= aia.maxPerCert) break;
     intrinsic.setAdd(seenThisCert, u.href);
-    uris.push(u.href);
+    guard.list.append(uris, u.href);
   }
   var out = [];
   for (var k = 0; k < uris.length; k++) {
@@ -2509,13 +2511,18 @@ async function _fetchAiaIssuers(current, aia) {
     intrinsic.setAdd(aia.fetchedUrls, uris[k]);
     aia.fetches += 1;
     var certs;
+    /** @internal Every failure of a fetch is skipped and the next URL tried, because AIA is a
+     * best-effort source of issuers and one unreachable host must not fail a build that another URL
+     * can complete. A transport that throws where a rejecting one would only reject is the same
+     * failure reported a different way, so the two are treated alike rather than one of them ending
+     * the build. */
     try { certs = await _aiaFetchOne(uris[k], aia); }
     catch (_e2) { continue; }
     for (var c = 0; c < certs.length; c++) {
       var parsed;
       try { parsed = coerceCert(certs[c]); }
       catch (_e3) { /* allow:swallow-unverified verified-unreachable: every cert here already passed the IDENTICAL x509.parse in _aiaParseBody (single-DER validates `body`; certs-only validates each via parseCertsOnly), so coerceCert re-parsing the same bytes cannot throw -- the guard stays as defense-in-depth */ continue; }
-      out.push(parsed);
+      guard.list.append(out, parsed);
     }
   }
   return out;
@@ -2591,11 +2598,11 @@ async function _fetchAiaIssuers(current, aia) {
  *   result.valid;                  // true when a path to a trust anchor was found and validated
  */
 var _BUILD_OPTS = (function () {
-  var o = {
+  var o = intrinsic.assign(intrinsic.create(null), {
     aiaTimeout: 1, candidates: 1, direction: 1, fetchAia: 1, intermediates: 1, maxAiaFetches: 1,
     maxAiaPerCert: 1, maxCandidatesConsidered: 1, maxDepth: 1, maxPathCerts: 1,
     maxResponseBytes: 1, time: 1, tls: 1, transport: 1, trustAnchors: 1, validate: 1
-  };
+  });
   Object.keys(_VALIDATE_OPTS).forEach(function (k) { o[k] = 1; });
   return o;
 })();
@@ -2604,6 +2611,12 @@ async function build(leaf, opts) {
   opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "build: opts");
   guard.identifier.assertKnownKeys(opts, _BUILD_OPTS, E, "path/bad-input",
     "pki.path.build has an unknown option (the anchor option is `trustAnchors`). The unknown option was: ");
+  /** @internal Checked at the door, before any certificate is parsed, and whether or not AIA
+   * fetching is on: supplying a transport that cannot be called is a wiring fault at the moment it
+   * is written. The checked value is the one used below, since reading the option again would ask a
+   * second time and an accessor can answer differently on each read. */
+  var checkedTransport = guard.identifier.assertCallableOption(opts, "transport", E, "path/bad-input",
+    "build: opts.transport", "(request) -> Promise<{ status, headers, body }>");
   var leafCert;
   try { leafCert = coerceCert(leaf); }
   catch (e) { throw E("path/bad-input", "build: the leaf certificate did not parse", e); }
@@ -2632,7 +2645,7 @@ async function build(leaf, opts) {
   for (var bai = 0; bai < buildEntries.length; bai++) {
     var bAnchor = toAnchor(buildEntries[bai], "build");
     if (buildPreNc[bai] !== undefined) intrinsic.defineProperty(bAnchor, "nameConstraints", { value: buildPreNc[bai], enumerable: true, configurable: true, writable: true });
-    intrinsic.push(anchors, bAnchor);
+    guard.list.append(anchors, bAnchor);
   }
 
   guard.time.assertValid(opts.time, E, "path/bad-input", "build: opts.time (the validity-window check date, forwarded to validate)");
@@ -2652,13 +2665,10 @@ async function build(leaf, opts) {
 
   var aiaCtx = null;
   if (opts.fetchAia === true) {
-    if (opts.transport !== undefined && typeof opts.transport !== "function") {
-      throw E("path/bad-input", "build: opts.transport must be a transport function (request) -> Promise<{ status, headers, body }>");
-    }
     if (opts.aiaTimeout !== undefined) {
       guard.limits.cap(opts.aiaTimeout, "build: opts.aiaTimeout", 1, { E: E, code: "path/bad-input", min: 1, max: httpTransport.MAX_TIMEOUT });
     }
-    var aiaTransport = opts.transport || httpTransport.https({ E: E, errPrefix: "path" });
+    var aiaTransport = checkedTransport || httpTransport.https({ E: E, errPrefix: "path" });
     aiaCtx = {
       transport: aiaTransport,
       transportGuardsAddresses: aiaTransport.blocksPrivateAddresses === true,
@@ -2704,7 +2714,7 @@ async function build(leaf, opts) {
       if (uip === OID.anyPolicy) { containsAny = true; break; }
       var dupUip = false;
       for (var uj = 0; uj < uipsDistinct.length; uj++) { if (uipsDistinct[uj] === uip) { dupUip = true; break; } }
-      if (!dupUip) intrinsic.push(uipsDistinct, uip);
+      if (!dupUip) guard.list.append(uipsDistinct, uip);
     }
     selectByPolicy = !containsAny;
   }
@@ -2713,7 +2723,7 @@ async function build(leaf, opts) {
   try {
   if (direction === "reverse") {
     var rstack = [];
-    for (var rsi = 0; rsi < anchors.length; rsi++) intrinsic.push(rstack, { chain: [], hop: 0, keys: new Set([identityKey(leafCert)]), anchor: anchors[rsi] });
+    for (var rsi = 0; rsi < anchors.length; rsi++) guard.list.append(rstack, { chain: [], hop: 0, keys: new Set([identityKey(leafCert)]), anchor: anchors[rsi] });
     while (rstack.length) {
       var rframe = rstack.pop();
       var frontierCert = rframe.chain.length ? rframe.chain[rframe.chain.length - 1] : null;
@@ -2727,7 +2737,7 @@ async function build(leaf, opts) {
           var racc = { valid: true, path: rpath, trustAnchor: rframe.anchor, result: rres };
           if (!selectByPolicy) { success = racc; break; }
           if (_policyScore(rres, uipsDistinct) >= uipsDistinct.length) { success = racc; break; }
-          intrinsic.push(accepted, racc);
+          guard.list.append(accepted, racc);
         } else if (!bestFail) bestFail = { path: rpath, trustAnchor: rframe.anchor, result: rres };
       }
       if (rframe.hop >= maxDepth) continue;
@@ -2736,7 +2746,7 @@ async function build(leaf, opts) {
         if (nameMatchSoft(pool[rpi].subject.rdns, rframe.anchor.name.rdns) &&
           intrinsic.bufferEquals(pool[rpi].subjectPublicKeyInfo.bytes, rframe.anchor.publicKey)) continue;
         if (nameMatchSoft(pool[rpi].issuer.rdns, frontierName)) {
-          intrinsic.push(rscored, { cand: pool[rpi], score: scoreCandidateReverse(pool[rpi], frontierCert, leafCert, opts.time) });
+          guard.list.append(rscored, { cand: pool[rpi], score: scoreCandidateReverse(pool[rpi], frontierCert, leafCert, opts.time) });
         }
       }
       considered += _pushCandidates(rframe, rscored, rstack, counter, true);
@@ -2764,7 +2774,7 @@ async function build(leaf, opts) {
           var fdk = certDerKey(fetched[fj]);
           if (intrinsic.setHas(poolDerKeys, fdk)) continue;
           intrinsic.setAdd(poolDerKeys, fdk);
-          if (pool.length < poolCeiling) pool.push(fetched[fj]);
+          if (pool.length < poolCeiling) guard.list.append(pool, fetched[fj]);
         }
       }
       fb.fetched = true;
@@ -2772,7 +2782,7 @@ async function build(leaf, opts) {
       var fbScored = [];
       for (var pj = fb.poolMark; pj < pool.length; pj++) {
         if (nameMatchSoft(pool[pj].subject.rdns, fbCur.issuer.rdns)) {
-          fbScored.push({ cand: pool[pj], score: scoreCandidate(pool[pj], fbAki, anchors, opts.time) });
+          guard.list.append(fbScored, { cand: pool[pj], score: scoreCandidate(pool[pj], fbAki, anchors, opts.time) });
         }
       }
       fb.poolMark = pool.length;
@@ -2791,7 +2801,7 @@ async function build(leaf, opts) {
         var acc = { valid: true, path: frame.chain.slice(), trustAnchor: anchors[ai], result: res };
         if (!selectByPolicy) { success = acc; break; }
         if (_policyScore(res, uipsDistinct) >= uipsDistinct.length) { success = acc; break; }
-        intrinsic.push(accepted, acc);
+        guard.list.append(accepted, acc);
       } else if (!bestFail) bestFail = { path: frame.chain.slice(), trustAnchor: anchors[ai], result: res };
     }
     if (success || frame.hop >= maxDepth) continue;
@@ -2800,11 +2810,11 @@ async function build(leaf, opts) {
     var scored = [];
     for (var pi = 0; pi < pool.length; pi++) {
       if (nameMatchSoft(pool[pi].subject.rdns, current.issuer.rdns)) {
-        scored.push({ cand: pool[pi], score: scoreCandidate(pool[pi], childAki, anchors, opts.time) });
+        guard.list.append(scored, { cand: pool[pi], score: scoreCandidate(pool[pi], childAki, anchors, opts.time) });
       }
     }
     if (aiaCtx && frame.hop < maxDepth && aiaCtx.fetches < aiaCtx.maxFetches) {
-      deferredAia.push({ chain: frame.chain, hop: frame.hop, keys: frame.keys, poolMark: pool.length, seq: deferSeq, fetched: false });
+      guard.list.append(deferredAia, { chain: frame.chain, hop: frame.hop, keys: frame.keys, poolMark: pool.length, seq: deferSeq, fetched: false });
       deferSeq += 1;
     }
     considered += _pushCandidates(frame, scored, stack, counter);
@@ -2820,11 +2830,11 @@ async function build(leaf, opts) {
 
   var aiaFetches = aiaCtx ? aiaCtx.fetches : 0;
   if (success) {
-    if (doValidate) return { valid: true, path: success.path, trustAnchor: success.trustAnchor, result: success.result, candidatesConsidered: considered, aiaFetches: aiaFetches };
-    return { path: success.path, trustAnchor: success.trustAnchor, candidatesConsidered: considered, aiaFetches: aiaFetches };
+    if (doValidate) return guard.verdict.of({ valid: true, path: success.path, trustAnchor: success.trustAnchor, result: success.result, candidatesConsidered: considered, aiaFetches: aiaFetches });
+    return guard.verdict.of({ path: success.path, trustAnchor: success.trustAnchor, candidatesConsidered: considered, aiaFetches: aiaFetches });
   }
   if (anyChainAssembled) {
-    return { valid: false, path: bestFail.path, trustAnchor: bestFail.trustAnchor, result: bestFail.result, candidatesConsidered: considered, aiaFetches: aiaFetches };
+    return guard.verdict.of({ valid: false, path: bestFail.path, trustAnchor: bestFail.trustAnchor, result: bestFail.result, candidatesConsidered: considered, aiaFetches: aiaFetches });
   }
   throw E("path/no-path", "build: no certification path from the leaf to any configured trust anchor could be assembled");
 }