@blamejs/pki 0.8.31 → 0.8.49

package/lib/ocsp.js

@@ -26,6 +26,19 @@
 var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var pkiBuild = require("./pki-build");
+var _ocspIntrinsic = require("./guard-intrinsic");
+/** @internal The promise a signature self-check is awaited through, built from the constructor captured
+ *  at load. `Promise.resolve` builds from its RECEIVER, so reading the global binding at the call hands
+ *  the construction to whatever that binding holds, and one settling without awaiting its argument runs
+ *  the continuation before the check has finished. */
+var _Promise = _ocspIntrinsic.Promise;
+var _promiseResolve = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseResolve);
+/** @internal A refusal returned as a REJECTED promise is a verdict too: read from the global binding, a
+ *  replacement whose `reject` resolves instead turns each `ocsp/bad-input` below into a pass. */
+var _promiseReject = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseReject);
+/** @internal The CertID hashes bind a response to the certificate it answers for, and they are awaited
+ *  as a pair, so a replaced `all` decides what that pair contains. */
+var _promiseAll = _ocspIntrinsic.uncurry(_ocspIntrinsic.promiseAll);
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var ocspSchema = require("./schema-ocsp");
@@ -100,7 +113,7 @@ var REQUESTER_NONCE_FLOOR = 32, RESPONDER_NONCE_FLOOR = 1;
 function _buildCertID(cert, issuer, hashName) {
   var wc = HASH_WC[guard.text.keyOf(hashName)];
   if (!wc) throw _err("ocsp/bad-input", "unsupported CertID hashAlgorithm " + guard.text.showValue(hashName) + " (sha1 / sha256 / sha384 / sha512)");
-  return Promise.all([
+  return _promiseAll(_Promise, [
     _digest(wc, issuer.subject.bytes),
     _digest(wc, _keyValue(issuer.subjectPublicKeyInfo.bytes)),
   ]).then(function (hashes) {
@@ -189,7 +202,7 @@ function _buildRequest(query, opts) {
     requestorNameDer = signerCert.subject.bytes;
   }
 
-  return Promise.all(queries.map(function (q) {
+  return _promiseAll(_Promise, queries.map(function (q) {
     if (!q || typeof q !== "object") throw _err("ocsp/bad-input", "each query must be { cert, issuer }");
     guard.identifier.assertKnownKeys(q, _QUERY_KEYS, _err, "ocsp/bad-input", "unknown query field (a query is { cert, issuer, singleRequestExtensions? }): ");
     if (q.cert == null || q.issuer == null) throw _err("ocsp/bad-input", "each query must be { cert, issuer }");
@@ -227,7 +240,7 @@ function _buildRequest(query, opts) {
     return signScheme.signOverTbs(scheme, opts.signer.key, tbsRequest, _signE).then(function (sig) {
       /** @internal The request is held to the same proof a certificate is: the signature verifies
        * against the public key the certificate it carries declares. */
-      return Promise.resolve(_b.assertSignatureVerifies(tbsRequest, sig, signerCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+      return _promiseResolve(_Promise, _b.assertSignatureVerifies(tbsRequest, sig, signerCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
         var optionalSignature = b.sequence([scheme.sigAlgId, b.bitString(sig, 0), b.explicit(0, b.sequence([b.raw(signerCertDer)]))]);
         return _emitReq(b.sequence([tbsRequest, b.explicit(0, optionalSignature)]), opts);
       });
@@ -347,7 +360,7 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
   if (!responses.length) throw _err("ocsp/bad-input", "a response MUST include at least one SingleResponse (RFC 6960 sec. 4.2.1)");
 
   return _responderID(responseData.responderID, respCert).then(function (ridNode) {
-    return Promise.all(responses.map(function (r) { return _buildSingleResponse(r, opts); })).then(function (built) {
+    return _promiseAll(_Promise, responses.map(function (r) { return _buildSingleResponse(r, opts); })).then(function (built) {
       var srNodes = built.map(function (x) { return x.node; });
       var anyNonIssued = built.some(function (x) { return x.nonIssued; });
       /** @internal Sec. 2.2 and 4.4.8: a "revoked" answer for a non-issued certificate MUST carry the
@@ -366,7 +379,7 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
       return signScheme.signOverTbs(scheme, responderKey, responseDataDer, _signE).then(function (sig) {
         /** @internal The response is held to the same proof a certificate is: the signature verifies
          * against the public key the responder certificate declares. */
-        return Promise.resolve(_b.assertSignatureVerifies(responseDataDer, sig, respCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+        return _promiseResolve(_Promise, _b.assertSignatureVerifies(responseDataDer, sig, respCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
           var basicChildren = [responseDataDer, scheme.sigAlgId, b.bitString(sig, 0)];
           if (opts.embedCert !== false) basicChildren.push(b.explicit(0, b.sequence([b.raw(respCertDer)])));
           var responseBytes = b.sequence([b.oid(OID_OCSP_BASIC), b.octetString(b.sequence(basicChildren))]);
@@ -406,19 +419,19 @@ function _snapshotSignerKey(key, owned) {
 }
 
 function _responderID(rid, respCert) {
-  if (rid == null || rid === "byName") return Promise.resolve(b.explicit(1, b.raw(respCert.subject.bytes)));
+  if (rid == null || rid === "byName") return _promiseResolve(_Promise, b.explicit(1, b.raw(respCert.subject.bytes)));
   if (rid === "byKey") return _digest("SHA-1", _keyValue(respCert.subjectPublicKeyInfo.bytes)).then(function (kh) { return b.explicit(2, b.octetString(kh)); });
   throw _err("ocsp/bad-input", "responderID must be \"byName\" or \"byKey\"");
 }
 function _buildSingleResponse(r, opts) {
   r = r || {};
   var certIdP;
-  if (typeof r !== "object") return Promise.reject(_err("ocsp/bad-input", "each response entry must be an object"));
+  if (typeof r !== "object") return _promiseReject(_Promise, _err("ocsp/bad-input", "each response entry must be an object"));
   try { guard.identifier.assertKnownKeys(r, _SINGLE_RESPONSE_KEYS, _err, "ocsp/bad-input", "unknown response entry field (accepted: cert, issuer, certID, hashAlgorithm, status, thisUpdate, nextUpdate, singleExtensions): "); }
-  catch (e) { return Promise.reject(e); }
-  if (r.certID != null) certIdP = Promise.resolve(b.raw(guard.bytes.view(r.certID, OcspError, "ocsp/bad-input", "a response entry's certID")));
+  catch (e) { return _promiseReject(_Promise, e); }
+  if (r.certID != null) certIdP = _promiseResolve(_Promise, b.raw(guard.bytes.view(r.certID, OcspError, "ocsp/bad-input", "a response entry's certID")));
   else if (r.cert != null && r.issuer != null) certIdP = _buildCertID(_certOf(r.cert, "a response certificate"), _certOf(r.issuer, "a response issuer"), r.hashAlgorithm || "sha1");
-  else return Promise.reject(_err("ocsp/bad-input", "each response entry needs { certID } or { cert, issuer }"));
+  else return _promiseReject(_Promise, _err("ocsp/bad-input", "each response entry needs { certID } or { cert, issuer }"));
   /** @internal Every per-entry refusal stays INSIDE this chain. These entries are built through a
    * map into Promise.all, so a synchronous throw here would abort the map before Promise.all
    * attached handlers, and an earlier entry's rejection would be orphaned: the caller catches
@@ -653,15 +666,15 @@ function verify(response, opts) {
     opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.verify options");
     guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "ocsp/bad-input",
       "pki.ocsp.verify has an unknown option (the request nonce to bind against is `requestNonce`): ");
-  } catch (e) { return Promise.reject(e); }
-  if (opts.cert == null || opts.issuer == null) return Promise.reject(_err("ocsp/bad-input", "verify requires opts.cert and opts.issuer"));
+  } catch (e) { return _promiseReject(_Promise, e); }
+  if (opts.cert == null || opts.issuer == null) return _promiseReject(_Promise, _err("ocsp/bad-input", "verify requires opts.cert and opts.issuer"));
   var parsed, cert, issuerCert, time;
   try {
     parsed = _responseFromBytes(response);
     cert = _certOf(opts.cert, "the target certificate");
     issuerCert = _certOf(opts.issuer, "the issuer certificate");
     time = opts.time == null ? new Date() : _asDate(opts.time);
-  } catch (e) { return Promise.reject(e); }
+  } catch (e) { return _promiseReject(_Promise, e); }
   /** @internal The nonce rule is applied by the acceptance gate rather than restated here, so this
    * door and every other consumer of that gate answer alike. The bytes are snapshotted here so a
    * fault in them carries this door's own code; a value that is not bytes is passed through for the
@@ -670,7 +683,7 @@ function verify(response, opts) {
   var reqNonce = opts.requestNonce;
   if (guard.bytes.isByteSource(reqNonce)) {
     try { reqNonce = guard.bytes.snapshotSource(reqNonce, OcspError, "ocsp/bad-input", "opts.requestNonce"); }
-    catch (e) { return Promise.reject(e); }
+    catch (e) { return _promiseReject(_Promise, e); }
   }
   return pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time,
     { historicalMode: opts.historicalMode === true, requestNonce: reqNonce }).then(function (verdict) {

package/lib/oid.js

@@ -65,11 +65,13 @@ var FAMILIES = Object.assign(Object.create(null), {
     policyConstraints: 36, extKeyUsage: 37, freshestCRL: 46,
     inhibitAnyPolicy: 54,
     anyPolicy: [32, 0], anyExtendedKeyUsage: [37, 0],
-    targetInformation: 55, noRevAvail: 56 } },
+    targetInformation: 55, noRevAvail: 56,
+    subjectAltPublicKeyInfo: 72, altSignatureAlgorithm: 73, altSignatureValue: 74 } },
 
   pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
     authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10,
     acmeIdentifier: 31,
+    relatedCertificate: 36,
     subjectInfoAccess: 11,
     tlsFeature: 24,
     qcStatements: 3,
@@ -187,6 +189,12 @@ var FAMILIES = Object.assign(Object.create(null), {
 
   wisun: { base: [1, 3, 6, 1, 4, 1, 45605], of: { fanDevice: 1 } },
 
+  /** @internal RFC 9883 assigns its attribute on a private-enterprise arc rather than a PKIX one, and
+   *  uses the SAME value as a PKCS#10 attribute and as a CRMF registration control, so the two names
+   *  resolve to one dotted OID. `byName` is one-to-one in the other direction, so the attribute name is
+   *  the one the registry returns for the dotted form. */
+  rfc9883: { base: [1, 3, 6, 1, 4, 1, 22112, 2], of: { statementOfPossession: 1 } },
+
   ct: { base: [1, 3, 6, 1, 4, 1, 11129, 2, 4], of: {
     signedCertificateTimestampList: 2, precertificatePoison: 3,
     precertificateSigningCert: 4, ocspSignedCertificateTimestampList: 5 } },
@@ -314,7 +322,9 @@ var FAMILIES = Object.assign(Object.create(null), {
     msgSigDigest: 5, contentIdentifier: 7, equivalentLabels: 9, contentReference: 10,
     signingCertificate: 12, timeStampToken: 14, decryptKeyID: 37, signingCertificateV2: 47,
     cmcUnsignedData: 34,
-    asymmDecryptKeyID: 54, certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
+    binarySigningTime: 46,
+    asymmDecryptKeyID: 54, relatedCertRequest: 60,
+    certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
 
   ansiX962: { base: [1, 2, 840, 10045], of: {
     ecPublicKey: [2, 1], prime192v1: [3, 1, 1], prime256v1: [3, 1, 7],
@@ -443,8 +453,8 @@ function _assertEncodableArcs(arcs, who) {
   if (arcs.length < 2) {
     throw new OidError("oid/bad-input", who + ": an OID must have at least 2 arcs");
   }
-  var root = typeof arcs[0] === "bigint" ? arcs[0] : BigInt(arcs[0]);
-  var second = typeof arcs[1] === "bigint" ? arcs[1] : BigInt(arcs[1]);
+  var root = guard.range.authoredInteger(arcs[0], _oidError, "oid/bad-arc", who + ": the root arc");
+  var second = guard.range.authoredInteger(arcs[1], _oidError, "oid/bad-arc", who + ": the second arc");
   if (root > 2n) throw new OidError("oid/bad-arc", who + ": the root arc must be 0, 1, or 2 (X.660)");
   if (root < 2n && second > 39n) throw new OidError("oid/bad-arc", who + ": the second arc must be 0..39 under roots 0 and 1 (X.660)");
 }

package/lib/path-validate.js

@@ -47,15 +47,26 @@ var csrVerify = require("./csr-verify");
 var crmfVerify = require("./crmf-verify");
 var attrcertVerify = require("./attrcert-verify");
 var ocspRequestVerify = require("./ocsp-request-verify");
+var relatedCert = require("./related-cert");
+var altSig = require("./alt-sig");
+var possession = require("./possession");
 var cmpVerify = require("./cmp-verify");
 var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _pop = intrinsic.pop;
+var _splice = intrinsic.splice;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _strIndexOf = intrinsic.uncurry(String.prototype.indexOf);
 var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
+var _reject = intrinsic.uncurry(intrinsic.promiseReject);
+/** @internal The promise constructor, captured at load. `promiseResolve` builds its promise from the
+ * RECEIVER it is called on, so reading the global binding at the call hands that construction to
+ * whatever the binding holds: a descriptor failure answering `false` through a replaced constructor is
+ * not a refusal, and this module's verdicts are what a caller acts on. */
+var _Promise = intrinsic.Promise;
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
@@ -90,6 +101,11 @@ var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 var ANCHOR_SPKI_SCHEMA = pkix.spki(NS);
 
 var subtle = webcrypto.webcrypto.subtle;
+/** @internal The two SubtleCrypto operations a certificate signature verdict rests on, captured at
+ * load. The object was held and its METHODS fetched per call, which leaves them replaceable: a
+ * `verify` answering true accepts a certificate nothing in the path signed. */
+var _subtleImportKey = intrinsic.uncurry(subtle.importKey);
+var _subtleVerify = intrinsic.uncurry(subtle.verify);
 
 var OID = intrinsic.assign(intrinsic.create(null), {
   basicConstraints: oid.byName("basicConstraints"),
@@ -250,18 +266,18 @@ function assertKeyMatchesSigAlg(spkiBytes, sigOid, d) {
 function compositeKeyUsageCheck(cert) {
   var ku;
   try { ku = decodeExt(cert, OID.keyUsage); }
-  catch (e) { return { ok: false, code: "path/composite-key-usage", error: e }; }
-  if (!ku) return { ok: true };
+  catch (e) { return guard.verdict.of({ ok: false, code: "path/composite-key-usage", error: e }); }
+  if (!ku) return guard.verdict.of({ ok: true });
   var v = ku.value;
   if (v.keyEncipherment || v.dataEncipherment || v.keyAgreement || v.encipherOnly || v.decipherOnly) {
-    return { ok: false, code: "path/composite-key-usage",
-      error: E("path/composite-key-usage", "a composite ML-DSA key asserts a forbidden encryption/key-establishment keyUsage bit (draft-ietf-lamps-pq-composite-sigs sec. 5.2)") };
+    return guard.verdict.of({ ok: false, code: "path/composite-key-usage",
+      error: E("path/composite-key-usage", "a composite ML-DSA key asserts a forbidden encryption/key-establishment keyUsage bit (draft-ietf-lamps-pq-composite-sigs sec. 5.2)") });
   }
   if (!(v.digitalSignature || v.nonRepudiation || v.keyCertSign || v.cRLSign)) {
-    return { ok: false, code: "path/composite-key-usage",
-      error: E("path/composite-key-usage", "a composite ML-DSA key's keyUsage asserts no signature bit (draft-ietf-lamps-pq-composite-sigs sec. 5.2)") };
+    return guard.verdict.of({ ok: false, code: "path/composite-key-usage",
+      error: E("path/composite-key-usage", "a composite ML-DSA key's keyUsage asserts no signature bit (draft-ietf-lamps-pq-composite-sigs sec. 5.2)") });
   }
-  return { ok: true };
+  return guard.verdict.of({ ok: true });
 }
 
 var STATEFUL_HBS_OIDS = intrinsic.create(null);
@@ -284,24 +300,24 @@ function _isCaCert(cert) {
 function statefulHbsKeyUsageCheck(cert, isCa) {
   var ku;
   try { ku = decodeExt(cert, OID.keyUsage); }
-  catch (e) { return { ok: false, code: "path/hbs-key-usage", error: e }; }
-  if (!ku) return { ok: true };
+  catch (e) { return guard.verdict.of({ ok: false, code: "path/hbs-key-usage", error: e }); }
+  if (!ku) return guard.verdict.of({ ok: true });
   var v = ku.value;
   var where = isCa ? "a certification authority" : "an end entity";
   var allowed = isCa ? "digitalSignature, nonRepudiation, keyCertSign or cRLSign"
     : "digitalSignature, nonRepudiation or cRLSign";
   var asserted = v.digitalSignature || v.nonRepudiation || v.cRLSign || v.keyCertSign;
   if (!asserted) {
-    return { ok: false, code: "path/hbs-key-usage",
-      error: E("path/hbs-key-usage", "a stateful hash-based key in " + where + " certificate must assert at least one of " + allowed + " (RFC 9802 sec. 6)") };
+    return guard.verdict.of({ ok: false, code: "path/hbs-key-usage",
+      error: E("path/hbs-key-usage", "a stateful hash-based key in " + where + " certificate must assert at least one of " + allowed + " (RFC 9802 sec. 6)") });
   }
   var forbidden = v.keyEncipherment || v.dataEncipherment || v.keyAgreement || v.encipherOnly ||
     v.decipherOnly || (!isCa && v.keyCertSign) || (v.reservedBitsSet === true);
   if (forbidden) {
-    return { ok: false, code: "path/hbs-key-usage",
-      error: E("path/hbs-key-usage", "a stateful hash-based key in " + where + " certificate must assert no keyUsage value outside " + allowed + " (RFC 9802 sec. 6)") };
+    return guard.verdict.of({ ok: false, code: "path/hbs-key-usage",
+      error: E("path/hbs-key-usage", "a stateful hash-based key in " + where + " certificate must assert no keyUsage value outside " + allowed + " (RFC 9802 sec. 6)") });
   }
-  return { ok: true };
+  return guard.verdict.of({ ok: true });
 }
 
 var ML_KEM_OIDS = intrinsic.create(null);
@@ -310,23 +326,23 @@ var ML_KEM_OIDS = intrinsic.create(null);
 function kemKeyUsageCheck(cert) {
   var ku;
   try { ku = decodeExt(cert, OID.keyUsage); }
-  catch (e) { return { ok: false, code: "path/kem-key-usage", error: e }; }
-  if (!ku) return { ok: true };
+  catch (e) { return guard.verdict.of({ ok: false, code: "path/kem-key-usage", error: e }); }
+  if (!ku) return guard.verdict.of({ ok: true });
   var v = ku.value;
   var others = v.digitalSignature || v.nonRepudiation || v.dataEncipherment || v.keyAgreement ||
     v.keyCertSign || v.cRLSign || v.encipherOnly || v.decipherOnly || (v.reservedBitsSet === true);
   if (!v.keyEncipherment || others) {
-    return { ok: false, code: "path/kem-key-usage",
-      error: E("path/kem-key-usage", "an ML-KEM key's keyUsage must assert keyEncipherment as the only bit (RFC 9935 sec. 5)") };
+    return guard.verdict.of({ ok: false, code: "path/kem-key-usage",
+      error: E("path/kem-key-usage", "an ML-KEM key's keyUsage must assert keyEncipherment as the only bit (RFC 9935 sec. 5)") });
   }
-  return { ok: true };
+  return guard.verdict.of({ ok: true });
 }
 
 function _importVerifyKey(spkiBytes, d) {
   try {
     if (d.eddsa) edwardsPoint.validateSpki(spkiBytes, d.eddsa, PathError, "path/bad-signature");
-  } catch (e) { return Promise.reject(e); }
-  return subtle.importKey("spki", spkiBytes, d.imp, false, ["verify"]);
+  } catch (e) { return _reject(_Promise, e); }
+  return _subtleImportKey(subtle, "spki", spkiBytes, d.imp, false, ["verify"]);
 }
 
 /** @internal The RFC 8554 public key the SubjectPublicKeyInfo carries, and the verdict on a signature over
@@ -397,23 +413,24 @@ function builtinVerify(state, cert) {
   try {
     d = resolveDescriptor(cert.signatureAlgorithm);
     assertKeyMatchesSigAlg(state.workingPublicKey, cert.signatureAlgorithm.oid, d);
-  /** @internal Resolving reads `then` off the value, so a synchronous verdict is built with an own one:
-   * an inherited accessor would otherwise run with the verdict as its receiver and hand the caller a
-   * different object (see guard-verdict). */
-  } catch (e) { return _resolve(Promise, guard.verdict.of({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e })); }
-  if (!guard.crypto.isOctetAligned(cert.signatureValue)) return _resolve(Promise, guard.verdict.of({ ok: false, code: "path/bad-signature" }));
+  /** @internal Resolving reads `then` off the value, so every verdict here is built with an own one,
+   * on the asynchronous arms as much as the synchronous ones: an inherited accessor would otherwise run
+   * with the verdict as its receiver and hand the caller a different object (see guard-verdict). The
+   * resolution of the `.then` callbacks below is the same window as the `_resolve` calls here. */
+  } catch (e) { return _resolve(_Promise, guard.verdict.of({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e })); }
+  if (!guard.crypto.isOctetAligned(cert.signatureValue)) return _resolve(_Promise, guard.verdict.of({ ok: false, code: "path/bad-signature" }));
   if (d.composite) return compositeSig.compositeVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature");
-  if (d.shbs) return _resolve(Promise, _shbsVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes));
+  if (d.shbs) return _resolve(_Promise, _shbsVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes));
   var key;
   return _importVerifyKey(state.workingPublicKey, d).then(function (k) {
     key = k;
     var sig = cert.signatureValue.bytes;
     if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");
-    return subtle.verify(d.verify, key, sig, cert.tbsBytes);
+    return _subtleVerify(subtle, d.verify, key, sig, cert.tbsBytes);
   }).then(function (ok) {
-    return { ok: ok === true };
+    return guard.verdict.of({ ok: ok === true });
   }, function (e) {
-    return { ok: false, code: pathCode(e, "path/bad-signature"), error: e };
+    return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-signature"), error: e });
   });
 }
 
@@ -596,8 +613,8 @@ function checkNameConstraints(state, cert) {
     var ex = state.excludedSubtrees[e];
     for (var i = 0; i < forms.length; i++) {
       var m = nameMatchesConstraint(forms[i].tag, forms[i].value, { tagNumber: ex.tag, value: ex.base }, true);
-      if (m === true) return { ok: false, code: "path/name-constraint-excluded" };
-      if (m === "unsupported") return { ok: false, code: "path/name-constraint-unsupported" };
+      if (m === true) return guard.verdict.of({ ok: false, code: "path/name-constraint-excluded" });
+      if (m === "unsupported") return guard.verdict.of({ ok: false, code: "path/name-constraint-unsupported" });
     }
   }
   for (var f = 0; f < forms.length; f++) {
@@ -611,10 +628,10 @@ function checkNameConstraints(state, cert) {
         if (r === true) permitted = true;
         else if (r === "unsupported") unsupported = true;
       });
-      if (!permitted) return { ok: false, code: unsupported ? "path/name-constraint-unsupported" : "path/name-constraint-not-permitted" };
+      if (!permitted) return guard.verdict.of({ ok: false, code: unsupported ? "path/name-constraint-unsupported" : "path/name-constraint-not-permitted" });
     }
   }
-  return { ok: true };
+  return guard.verdict.of({ ok: true });
 }
 
 function absorbNameConstraints(state, decoded) {
@@ -683,11 +700,11 @@ function addPolicyNode(state, depth, validPolicy, qualifiers, expectedPolicySet,
 function removePolicyNode(state, node) {
   node.parents.forEach(function (p) {
     var idx = p.children.indexOf(node);
-    if (idx !== -1) p.children.splice(idx, 1);
+    if (idx !== -1) _splice(p.children, idx, 1);
   });
   node.children.forEach(function (c) {
     var idx = c.parents.indexOf(node);
-    if (idx !== -1) c.parents.splice(idx, 1);
+    if (idx !== -1) _splice(c.parents, idx, 1);
   });
   node.parents = [];
   var layer = state.policyIndex[node.depth];
@@ -1156,7 +1173,9 @@ function validateCriticalExtensionStructure(cert) {
  * `crlChecker` gives the CRLReason integer and `revocationReason` the name `ocspChecker` gives it;
  * both are read so the row does not depend on which checker answered. */
 function _revocationRow(row, rv) {
-  if (rv == null) return row;
+  /** @internal The row carries the sentinel from here rather than only from the walk that shields the
+   * finished results, so a row returned to anything that awaits it is shielded on both arms. */
+  if (rv == null) return guard.verdict.shield(row);
   var reason = rv.reason;
   if (typeof reason === "string" && reason.length > 0) row.reason = reason;
   var code = rv.revocationReason;
@@ -1164,7 +1183,7 @@ function _revocationRow(row, rv) {
   if (intrinsic.numberIsFinite(code)) row.revocationReason = code;
   var at = rv.revocationTime;
   if (guard.time.isDate(at)) row.revocationTime = new intrinsic.Date(guard.time.instantOf(at));
-  return row;
+  return guard.verdict.shield(row);
 }
 
 /**
@@ -1333,12 +1352,26 @@ async function validate(path, opts) {
    * holds its state against this object; the object is unreachable once the validation returns, so
    * a checker stays reusable and nothing accumulates between runs. The anchor recursion carries the
    * same one, and a caller has no way to supply one, so two validations never share a budget. */
-  return _validate(path, checked, intrinsic.freeze(intrinsic.create(null)));
+  /** @internal The verifier's `verify` is read ONCE here, in the door, and carried through every anchor
+   * attempt. Read inside `_validate` it was read once per attempt, because a list of trust anchors
+   * whose names all match the first certificate's issuer retries the walk per anchor: measured, an
+   * accessor whose first answer refused both certificates and whose second accepted them returned
+   * `valid: true` over two matching anchors. It is the function that answers whether each signature in
+   * the path verifies, so one reading of it governs the whole call. */
+  var suppliedVerifier = checked.verifier || null;
+  var suppliedVerify = suppliedVerifier === null ? null : suppliedVerifier.verify;
+  if (suppliedVerifier !== null && typeof suppliedVerify !== "function") {
+    throw E("path/bad-input", "validate: opts.verifier must carry a verify(args) function");
+  }
+  var scope = intrinsic.freeze(intrinsic.assign(intrinsic.create(null), {
+    verifier: suppliedVerifier, verify: suppliedVerify,
+  }));
+  return _validate(path, checked, intrinsic.freeze(intrinsic.create(null)), scope);
 }
 
 /** @internal The options are the ones the door above checked, and each anchor attempt is handed a
  * copy this module built, so the door runs once per call rather than once per anchor. */
-async function _validate(path, opts, run) {
+async function _validate(path, opts, run, scope) {
   if (opts.ctPolicy != null && opts.ctLogList == null) throw E("path/bad-input", "validate: opts.ctPolicy requires opts.ctLogList (the trusted CT log-list to verify the certificate's SCTs against)");
   if (opts.ctLogList != null) {
     if (typeof opts.ctLogList !== "object" || opts.ctLogList.byLogId == null) throw E("path/bad-input", "validate: opts.ctLogList must be a pki.ct.parseLogList result");
@@ -1409,11 +1442,11 @@ async function _validate(path, opts, run) {
     for (var ai = 0; ai < tuples.length; ai++) {
       if (!dnEqual(tuples[ai].name.rdns, certs[0].issuer.rdns)) continue;
       anyMatched = true;
-      var oneRes = await _validate(path, singleOpts(tuples[ai]), run);
+      var oneRes = await _validate(path, singleOpts(tuples[ai]), run, scope);
       if (oneRes && oneRes.valid) return oneRes;
       lastMatched = oneRes;
     }
-    return anyMatched ? lastMatched : _validate(path, singleOpts(tuples[0]), run);
+    return anyMatched ? lastMatched : _validate(path, singleOpts(tuples[0]), run, scope);
   }
   var anchor = toAnchor(anchorList[0], "validate");
   guard.time.assertValid(opts.time, E, "path/bad-input", "validate: opts.time (the always-on validity-window check date)");
@@ -1438,7 +1471,11 @@ async function _validate(path, opts, run) {
   var state = initialize(certs, opts, seeds, anchor, taConstraints);
   state._n = n;
   state.requiredEku = requiredEku;
-  var verifier = opts.verifier || null;
+  /** @internal The verifier comes from the per-call scope the door built, never from `opts`: the option
+   * bag is rebuilt per anchor attempt and reading it again would ask the caller's object once per
+   * attempt (see the note in `validate`). */
+  var verifier = scope.verifier;
+  var verifierVerify = scope.verify;
   var revocationChecker = opts.revocationChecker || null;
   var softFail = opts.softFail === true;
   var requireRevocation = opts.requireRevocation === true;
@@ -1458,18 +1495,18 @@ async function _validate(path, opts, run) {
     var sigRes;
     var weak = _weakIssuerKey(state);
     if (weak) {
-      sigRes = { ok: false, code: "path/weak-key", error: weak };
+      sigRes = guard.verdict.of({ ok: false, code: "path/weak-key", error: weak });
     } else if (verifier) {
       var vv;
       try {
-        vv = await verifier.verify({
+        vv = await intrinsic.apply(verifierVerify, verifier, [{
           cert: cert,
           workingPublicKey: state.workingPublicKey,
           workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm,
           workingPublicKeyParameters: state.workingPublicKeyParameters,
-        });
+        }]);
       } catch (_e) { vv = false; }
-      sigRes = { ok: vv === true };
+      sigRes = guard.verdict.of({ ok: vv === true });
     } else {
       sigRes = await builtinVerify(state, cert);
     }
@@ -1670,7 +1707,7 @@ async function _validate(path, opts, run) {
       nameConstraintsApplied: anchorNameConstraintsApplied,
     },
     path: certs,
-    results: state.results,
+    results: shieldResults(state.results),
     workingPublicKey: state.workingPublicKey,
     workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm,
     workingPublicKeyParameters: state.workingPublicKeyParameters,
@@ -1679,6 +1716,22 @@ async function _validate(path, opts, run) {
   });
 }
 
+/**
+ * @internal A per-certificate result and every check row inside it is a verdict a caller reads `ok`
+ * off, and the rows are appended from some thirty places, two of them after the result itself is
+ * recorded. The sentinel is applied once over the finished set rather than at each append, so a row
+ * a check written later contributes carries it without being told to. `shield` adds the member in
+ * place, which keeps the row identity the appends and the identity lookup above rely on.
+ */
+function shieldResults(results) {
+  for (var r = 0; r < results.length; r++) {
+    var row = results[r];
+    for (var c = 0; c < row.checks.length; c++) guard.verdict.shield(row.checks[c]);
+    guard.verdict.shield(row);
+  }
+  return results;
+}
+
 /**
  * @internal RFC 9618 sec. 5.5 rewrites RFC 5280 sec. 6.1.5 step (g) over the graph. The set is read
  * from the nodes whose only parent is the anyPolicy node, at ANY depth rather than at the deepest
@@ -1902,6 +1955,14 @@ function selectDelta(candidates) {
  *   typeof checker.check;                     // "function"
  */
 function crlChecker(crls, opts) {
+  /** @internal A LIST, held to being one before it is mapped. An omitted list is "nothing to check" and
+   *  stays accepted; anything else that is not an array fell through to `.map`, where an ArrayBuffer or a
+   *  plain object raised a bare TypeError naming an internal expression and a single CRL Buffer mapped
+   *  over its BYTES and reported the first byte as a malformed CRL. Passing one CRL where a list belongs
+   *  is the natural slip, and it is the one that read furthest before failing. */
+  if (crls !== undefined && crls !== null && !intrinsic.isArray(crls)) {
+    throw E("path/bad-input", "crlChecker: crls must be an array of CRLs");
+  }
   var parsed = (crls || []).map(function (c, ci) {
     return guard.parsed.acceptDerived(c, "crl", crl.parse, E, "path/bad-input",
       "crlChecker: crls[" + ci + "]");
@@ -2101,15 +2162,15 @@ function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
   try {
     d = resolveDescriptor(sigAlg);
     assertKeyMatchesSigAlg(spkiBytes, sigAlg.oid, d);
-  } catch (_e) { return Promise.resolve(false); }
+  } catch (_e) { return _resolve(_Promise, false); }
   if (d.composite) return compositeSig.compositeVerify(spkiBytes, rawSig, tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature").then(function (r) { return r.ok === true; });
   /** @internal RFC 9802 sec. 6 names the CertificateList as well as the Certificate, so a revocation list
    * signed with a stateful hash-based key reaches the same engine the certificate path uses. */
-  if (d.shbs) return _resolve(Promise, _shbsVerify(spkiBytes, rawSig, tbsBytes).ok === true);
+  if (d.shbs) return _resolve(_Promise, _shbsVerify(spkiBytes, rawSig, tbsBytes).ok === true);
   return _importVerifyKey(spkiBytes, d).then(function (key) {
     var sig = rawSig;
     if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");
-    return subtle.verify(d.verify, key, sig, tbsBytes);
+    return _subtleVerify(subtle, d.verify, key, sig, tbsBytes);
   }).then(function (ok) { return ok === true; }, function () { return false; });
 }
 
@@ -2123,6 +2184,21 @@ attrcertVerify.setEngine(_verifyWithSpki);
 
 ocspRequestVerify.setEngine(_verifyWithSpki);
 
+/** @internal RFC 9763 sec. 3.1's proof of possession is a signature by the key of a certificate the
+ *  request names, so it reaches the same engine the certificate path uses and the same binding of the
+ *  advertised algorithm to the key. */
+relatedCert.setEngine(_verifyWithSpki);
+
+/** @internal An ITU-T X.509 (2019) clause 9.8 alternative signature is a signature over a certificate
+ *  or a CRL by a key in an extension, so it reaches the same engine and the same binding of the
+ *  advertised algorithm to the key. */
+altSig.setEngine(_verifyWithSpki);
+
+/** @internal RFC 9883 sec. 4 makes certification path validation of the signature certificate a MUST
+ *  alongside the signature check, so the possession verb needs the validator as well as the engine and
+ *  runs the same `validate` a caller would call rather than holding a second copy of it. */
+possession.setEngine({ verifyWithSpki: _verifyWithSpki, validate: validate });
+
 
 var ocspCore = ocspVerify.makeOcspVerify({
   verifyWithSpki: _verifyWithSpki,
@@ -2170,6 +2246,10 @@ cmsVerify.setEngine({ build: build, validate: validate, toAnchor: toAnchor,
  *   typeof checker.check;                       // "function"
  */
 function ocspChecker(responses) {
+  /** @internal A LIST, for the reason at `crlChecker`. */
+  if (responses !== undefined && responses !== null && !intrinsic.isArray(responses)) {
+    throw E("path/bad-input", "ocspChecker: responses must be an array of OCSP responses");
+  }
   var parsed = (responses || []).map(function (r) { return _ocspFromBytes(r); });
   return {
     check: async function (cert, issuer, ctx) {
@@ -2288,7 +2368,7 @@ async function verifyOcspResponse(response, cert, issuerCert, time, opts) {
     parsedResponse = _ocspFromBytes(response);
     subject = coerceCert(cert, "the certificate");
     issuer = coerceCert(issuerCert, "the issuer certificate");
-  } catch (e) { return Promise.reject(e); }
+  } catch (e) { return _reject(_Promise, e); }
   var v = await _verifyOcspParsed(parsedResponse, subject, issuer, time, checkedOpts);
   var out = guard.verdict.of(v);
   return guard.verdict.of(out, { valid: out.status === "good" });
@@ -2308,7 +2388,7 @@ function _ocspFromBytes(response) {
 function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   opts = opts || {};
   if (!guard.time.isDate(time) || isNaN(guard.time.instantOf(time))) {
-    return Promise.reject(E("path/bad-input", "verifyOcspResponse: time must be a valid Date (the currency + responder-validity check date)"));
+    return _reject(_Promise, E("path/bad-input", "verifyOcspResponse: time must be a valid Date (the currency + responder-validity check date)"));
   }
   /** @internal Snapshotted in the synchronous prologue: the bytes compared are the bytes the caller
    * passed, not what its BufferSource holds once the verify has awaited. A value that is not bytes
@@ -2327,9 +2407,9 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   }
   var boundName;
   try { boundName = dnEqual(cert.issuer.rdns, issuerCert.subject.rdns); }
-  catch (e) { return Promise.reject(e); }
+  catch (e) { return _reject(_Promise, e); }
   if (!boundName) {
-    return Promise.resolve(unbound("the supplied issuer certificate's subject does not match the target certificate's issuer"));
+    return _resolve(_Promise, unbound("the supplied issuer certificate's subject does not match the target certificate's issuer"));
   }
   return builtinVerify({ workingPublicKey: issuerCert.subjectPublicKeyInfo.bytes }, cert).then(function (sig) {
     if (!sig.ok) return unbound("the target certificate's signature does not verify under the supplied issuer certificate's key");
@@ -2984,7 +3064,9 @@ function _bestByPolicy(accepted, uips) {
     var s = _policyScore(accepted[i].result, uips);
     if (s > bestScore) { best = accepted[i]; bestScore = s; }
   }
-  return best;
+  /** @internal The candidate carries a verdict in its `result`, so the wrapper carries the sentinel
+   * too: whichever of the two a caller awaits, the lookup ends on the object itself. */
+  return guard.verdict.shield(best);
 }
 
 function _assertUserInitialPolicySet(uips, prefix) {
@@ -3015,7 +3097,7 @@ function _pushCandidates(frame, scored, stack, counter, down) {
     intrinsic.setAdd(childKeys, candKey);
     guard.list.append(stack, down
       ? { chain: intrinsic.concat(frame.chain, [cand]), hop: frame.hop + 1, keys: childKeys, anchor: frame.anchor }
-      : { chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
+      : { chain: intrinsic.concat([cand], frame.chain), hop: frame.hop + 1, keys: childKeys });
   }
   return n;
 }
@@ -3216,7 +3298,7 @@ async function build(leaf, opts) {
   var poolCeiling = constants.LIMITS.PATH_BUILD_MAX_CANDIDATES;
   if (poolInput.length > poolCeiling) throw E("path/bad-input", "build: the candidate pool has " + poolInput.length + " certificates, exceeding the " + poolCeiling + " ceiling");
   var pool;
-  try { pool = poolInput.map(coerceCert); }
+  try { pool = intrinsic.map(poolInput, coerceCert); }
   catch (e) { throw E("path/bad-input", "build: a candidate certificate did not parse", e); }
   var poolDerKeys = new Set();
   for (var pdk = 0; pdk < pool.length; pdk++) intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
@@ -3280,7 +3362,7 @@ async function build(leaf, opts) {
   var BUILD_ONLY_OPT = { candidates: 1, intermediates: 1, trustAnchors: 1, maxDepth: 1, maxCandidatesConsidered: 1, validate: 1,
     fetchAia: 1, transport: 1, tls: 1, maxAiaFetches: 1, maxAiaPerCert: 1, aiaTimeout: 1, maxResponseBytes: 1 };
   var forwarded = Object.create(null);
-  Object.keys(_VALIDATE_OPTS).forEach(function (k) {
+  intrinsic.forEach(intrinsic.keys(_VALIDATE_OPTS), function (k) {
     if (intrinsic.hasOwn(BUILD_ONLY_OPT, k)) return;
     if (k in opts) forwarded[k] = opts[k];
   });
@@ -3319,7 +3401,7 @@ async function build(leaf, opts) {
     var rstack = [];
     for (var rsi = 0; rsi < anchors.length; rsi++) guard.list.append(rstack, { chain: [], hop: 0, keys: new Set([identityKey(leafCert)]), anchor: anchors[rsi] });
     while (rstack.length) {
-      var rframe = rstack.pop();
+      var rframe = _pop(rstack);
       var frontierCert = rframe.chain.length ? rframe.chain[rframe.chain.length - 1] : null;
       var frontierName = frontierCert ? frontierCert.subject.rdns : rframe.anchor.name.rdns;
       if (nameMatchSoft(leafCert.issuer.rdns, frontierName)) {
@@ -3384,7 +3466,7 @@ async function build(leaf, opts) {
       considered += _pushCandidates(fb, fbScored, stack, counter);
       continue;
     }
-    var frame = stack.pop();
+    var frame = _pop(stack);
     var current = frame.chain[0];
 
     for (var ai = 0; ai < anchors.length; ai++) {