@blamejs/pki 0.8.55 → 0.8.56

package/lib/webauthn.js

@@ -38,6 +38,10 @@ var intrinsic = require("./guard-intrinsic");
 var _hasOwn = intrinsic.hasOwn;
 var _reverse = intrinsic.reverse;
 var _arrSlice = intrinsic.arraySlice;
+/** @internal The split that cuts an android-safetynet JWS into its three segments decides which bytes
+ *  are the signed input and which are the signature, so a replacement returning segments of its own
+ *  choosing has the attestation verified over bytes the signer never covered. */
+var _strSplit = intrinsic.uncurry(String.prototype.split);
 /** @internal `resolve` and `reject` build their promise from the RECEIVER, so reading the global
  *  binding at the call hands the construction to whatever that binding holds. Two shapes here decide a
  *  verdict: the seeds the attestation trust-path reductions fold over, where a replacement settling
@@ -67,32 +71,57 @@ var subtle = webcrypto.webcrypto.subtle;
 /** @internal The verify operation, captured at load. One answering true accepts an assertion or an
  * attestation statement that the credential's key never signed, which is the whole verdict. */
 var _subtleVerify = intrinsic.uncurry(subtle.verify);
-
-function _sha(name, buf) { return nodeCrypto.createHash(name).update(buf).digest(); }
+/** @internal The import is captured with it. It produces the key the verify above runs under, so a
+ * replacement answering with a key of its own accepts a signature made by whoever holds that key
+ * while the bytes handed in were never the credential's. */
+var _subtleImportKey = intrinsic.uncurry(subtle.importKey);
+
+/** @internal The hash constructor is captured, and so are the methods of the object it returns. Every
+ * attestation comparison in this module rests on a digest, so a replaced `createHash`, or a replaced
+ * `update` or `digest` on the object it hands back, chooses what the comparison sees. */
+var _createHash = nodeCrypto.createHash;
+function _sha(name, buf) {
+  var h = _createHash(name);
+  return _hashDigest(_hashUpdate(h, buf));
+}
+var _hashUpdate = intrinsic.uncurry(nodeCrypto.createHash("sha256").update);
+var _hashDigest = intrinsic.uncurry(nodeCrypto.createHash("sha256").digest);
 /** @internal The comparison goes through the captured operation. This is what decides that an
  *  attestation statement's key is the credential's key, so a replacement answering zero makes a
  *  different key match. */
 function _ucmp(a, b) {
-  function strip(x) { var i = 0; while (i < x.length - 1 && x[i] === 0) i++; return x.subarray(i); }
+  function strip(x) { var i = 0; while (i < x.length - 1 && x[i] === 0) i++; return intrinsic.byteSlice(x, i); }
   return intrinsic.compare(strip(a), strip(b)) === 0;
 }
 function _isInteger(node) { return !!node && !node.constructed && node.tagClass === "universal" && node.tagNumber === asn1.TAGS.INTEGER; }
 var COSE_ALG_HASH = intrinsic.assign(intrinsic.create(null), { "-7": "sha256", "-9": "sha256", "-257": "sha256", "-37": "sha256", "-35": "sha384", "-51": "sha384", "-258": "sha384", "-38": "sha384", "-36": "sha512", "-52": "sha512", "-259": "sha512", "-39": "sha512", "-65535": "sha1" });
+/** @internal The conversion that builds the registry KEY is captured. It selects which hash a
+ * signature is checked under, so a replacement answering with another algorithm's key picks another
+ * hash for the same declared algorithm. */
 function _coseAlgHash(alg, E) {
-  var h = COSE_ALG_HASH[String(alg)];
+  var h = COSE_ALG_HASH[intrinsic.String(alg)];
   if (!h) throw E("webauthn/unsupported-algorithm", "no hash mapping for COSE algorithm " + alg);
   return h;
 }
 
 
 var AAGUID_LEN = 16;
+/** @internal Every slice this takes of authenticatorData goes through the capture that consults no
+ *  construction protocol, along with the classification that admits the buffer in the first place.
+ *  The slices ARE the fields the ceremony is checked against: the RP ID hash, the AAGUID, the
+ *  credential id and the bytes the COSE key is read from, so a replaced slice answers the checks
+ *  below about bytes the authenticator never sent. Capturing `subarray` is not enough on its own,
+ *  because it runs TypedArraySpeciesCreate and so builds its result through a constructor read off
+ *  the receiver: one answering with the expected RP ID hash for a 32-byte slice made an assertion
+ *  produced for another relying party satisfy `expectedRpId`, while the signature was still verified
+ *  over the original bytes. */
 function _parseAuthData(buf, E) {
-  if (!Buffer.isBuffer(buf) || buf.length < 37) throw E("webauthn/bad-auth-data", "authenticatorData is shorter than the 37-byte minimum (RFC WebAuthn sec. 6.1)");
+  if (!intrinsic.isBuffer(buf) || buf.length < 37) throw E("webauthn/bad-auth-data", "authenticatorData is shorter than the 37-byte minimum (RFC WebAuthn sec. 6.1)");
   var flags = buf[32];
   var out = {
-    rpIdHash: buf.subarray(0, 32),
+    rpIdHash: intrinsic.byteSlice(buf, 0, 32),
     flags: { up: !!(flags & 0x01), uv: !!(flags & 0x04), be: !!(flags & 0x08), bs: !!(flags & 0x10), at: !!(flags & 0x40), ed: !!(flags & 0x80) },
-    signCount: buf.readUInt32BE(33),
+    signCount: intrinsic.readUInt32BE(buf, 33),
     aaguid: null, credentialId: null, credentialPublicKey: null, credentialPublicKeyBytes: null, extensions: null,
   };
   if (out.flags.bs && !out.flags.be) throw E("webauthn/bad-auth-data", "authenticatorData sets Backup State (BS) without Backup Eligibility (BE) (WebAuthn sec. 6.1)");
@@ -100,24 +129,24 @@ function _parseAuthData(buf, E) {
   var off = 37;
   if (out.flags.at) {
     if (buf.length < off + AAGUID_LEN + 2) throw E("webauthn/bad-auth-data", "attestedCredentialData is truncated before the credentialId length");
-    out.aaguid = buf.subarray(off, off + AAGUID_LEN); off += AAGUID_LEN;
-    var credLen = buf.readUInt16BE(off); off += 2;
+    out.aaguid = intrinsic.byteSlice(buf, off, off + AAGUID_LEN); off += AAGUID_LEN;
+    var credLen = intrinsic.readUInt16BE(buf, off); off += 2;
     if (credLen < 1 || credLen > 1023) throw E("webauthn/bad-credential-id", "credentialIdLength " + credLen + " is outside 1..1023 (RFC WebAuthn sec. 6.1)");
     if (buf.length < off + credLen) throw E("webauthn/bad-auth-data", "credentialId overruns authenticatorData");
-    out.credentialId = buf.subarray(off, off + credLen); off += credLen;
+    out.credentialId = intrinsic.byteSlice(buf, off, off + credLen); off += credLen;
     var keyNode;
-    try { keyNode = cbor.decode(buf.subarray(off), { allowTrailing: true }); }
+    try { keyNode = cbor.decode(intrinsic.byteSlice(buf, off), { allowTrailing: true }); }
     catch (e) { throw E("webauthn/bad-cose-key", "the credential public key is not well-formed CBOR", e); }
-    out.credentialPublicKeyBytes = buf.subarray(off, off + keyNode.bytes.length);
+    out.credentialPublicKeyBytes = intrinsic.byteSlice(buf, off, off + keyNode.bytes.length);
     out.credentialPublicKey = _decodeCoseKey(keyNode);
     off += keyNode.bytes.length;
   }
   if (out.flags.ed) {
     var extNode;
-    try { extNode = cbor.decode(buf.subarray(off)); }
+    try { extNode = cbor.decode(intrinsic.byteSlice(buf, off)); }
     catch (e) { throw E("webauthn/bad-auth-data", "the authenticatorData extensions are not a single well-formed CBOR map", e); }
     if (extNode.majorType !== 5) throw E("webauthn/bad-auth-data", "the authenticatorData extensions must be a CBOR map");
-    out.extensions = buf.subarray(off);
+    out.extensions = intrinsic.byteSlice(buf, off);
   } else if (off < buf.length) {
     throw E("webauthn/bad-auth-data", "authenticatorData has trailing bytes after attestedCredentialData with the ED flag clear");
   }
@@ -193,16 +222,25 @@ var COSE_ALG = intrinsic.assign(intrinsic.create(null), {
 
 function _derEcdsaToRaw(der, curve) { return validator.sig.ecdsaDerToP1363(der, curve, WebauthnError, "webauthn/bad-signature"); }
 
+/** @internal Same registry-key conversion, and this one selects the import and the verify routine a
+ * signature is checked with, which is the binding between a declared algorithm and the operation
+ * applied to it. */
 function _verifySig(alg, sig, spkiBytes, message, E) {
-  var d = COSE_ALG[String(alg)];
+  var d = COSE_ALG[intrinsic.String(alg)];
   if (!d) throw _err("webauthn/unsupported-algorithm", "unsupported COSE algorithm " + alg);
   var imp = d.imp, ver = d.verify;
   if (alg === -8) { var nm = _edName(spkiBytes, E); imp = { name: nm }; ver = { name: nm }; }
   if (imp.name === "Ed25519" || imp.name === "Ed448") _requireValidEdPoint(spkiBytes, imp.name);
   var s = d.ecdsa ? _derEcdsaToRaw(sig, d.imp.namedCurve) : sig;
-  return subtle.importKey("spki", spkiBytes, imp, false, ["verify"])
-    .then(function (key) { return _subtleVerify(subtle, ver, key, s, message); })
-    .catch(function (e) { throw _err("webauthn/verify-error", "the attestation signature could not be evaluated", e); });
+  /** @internal Every continuation on this route is taken through the captured `then`. `then` is read
+   *  off the promise at the call, so a replacement settles the chain without running the callback:
+   *  settling here hands back a value in place of the signature check, and each caller below reads
+   *  that value as the verdict. The whole attestation route is continued this way for that reason. */
+  var imported = _subtleImportKey(subtle, "spki", spkiBytes, imp, false, ["verify"]);
+  var checked = intrinsic.chain(imported, function (key) { return _subtleVerify(subtle, ver, key, s, message); });
+  return intrinsic.chain(checked, undefined, function (e) {
+    throw _err("webauthn/verify-error", "the attestation signature could not be evaluated", e);
+  });
 }
 var ED_OID_NAME = intrinsic.create(null);
 ED_OID_NAME[oid.byName("Ed25519")] = "Ed25519";
@@ -223,7 +261,7 @@ function _coseKeyToSpki(key) { return validator.cose.toSpki(key, WebauthnError,
 
 function _certEcCurveOid(cert, E) {
   var params = cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.algorithm && cert.subjectPublicKeyInfo.algorithm.parameters;
-  if (!Buffer.isBuffer(params)) throw E("webauthn/key-mismatch", "the attestation certificate EC key carries no named-curve parameters");
+  if (!intrinsic.isBuffer(params)) throw E("webauthn/key-mismatch", "the attestation certificate EC key carries no named-curve parameters");
   try { return asn1.read.oid(asn1.decode(params)); }
   catch (e) { throw E("webauthn/key-mismatch", "the attestation certificate EC curve is not a valid OBJECT IDENTIFIER", e); }
 }
@@ -239,8 +277,8 @@ function _certKeyAlgNames(cose) {
 function _assertCertKeyAlgorithm(cert, cose, E) {
   var alg = (cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.algorithm) || {};
   var want = _certKeyAlgNames(cose);
-  if (!want.length || want.indexOf(alg.name) < 0) {
-    throw E("webauthn/key-mismatch", "the attestation certificate carries a " + JSON.stringify(alg.name) +
+  if (!want.length || intrinsic.indexOf(want, alg.name) < 0) {
+    throw E("webauthn/key-mismatch", "the attestation certificate carries a " + intrinsic.stringify(alg.name) +
       " key, which is not the kind of key the credential public key declares");
   }
 }
@@ -254,7 +292,7 @@ function _certPubKeyEqualsCose(cert, cose, E) {
     if (_certEcCurveOid(cert, E) !== oid.byName(wantCurve)) throw E("webauthn/key-mismatch", "the attestation certificate EC curve does not equal the credential key curve");
     if (raw.length < 1 || raw[0] !== 0x04) throw E("webauthn/key-mismatch", "the attestation certificate key is not an uncompressed EC point");
     var coordLen = (raw.length - 1) >> 1;
-    var cx = raw.subarray(1, 1 + coordLen), cy = raw.subarray(1 + coordLen);
+    var cx = intrinsic.byteSlice(raw, 1, 1 + coordLen), cy = intrinsic.byteSlice(raw, 1 + coordLen);
     if (!cose.x || !cose.y || !_ucmp(cx, cose.x) || !_ucmp(cy, cose.y)) throw E("webauthn/key-mismatch", "the attestation certificate EC key does not equal the credential public key");
     return;
   }
@@ -269,7 +307,7 @@ function _certPubKeyEqualsCose(cert, cose, E) {
     return;
   }
   if (cose.kty === 1) {
-    if (!cose.x || !Buffer.from(raw).equals(cose.x)) throw E("webauthn/key-mismatch", "the attestation certificate OKP key does not equal the credential public key");
+    if (!cose.x || !intrinsic.bufferEquals(intrinsic.bufferFrom(raw), cose.x)) throw E("webauthn/key-mismatch", "the attestation certificate OKP key does not equal the credential public key");
     return;
   }
   throw E("webauthn/key-mismatch", "unsupported credential key type for the certificate comparison");
@@ -279,9 +317,24 @@ function _parseTpmPubArea(buf) { return validator.tpm.parsePubArea(buf, Webauthn
 function _parseTpmCertInfo(buf) { return validator.tpm.parseCertInfo(buf, WebauthnError, "webauthn/bad-tpm"); }
 function _tpmPubKeyEqualsCose(pub, cose) { validator.tpm.pubKeyEqualsCose(pub, cose, WebauthnError, "webauthn/key-mismatch", "webauthn/bad-tpm"); }
 
+/** @internal The selection that FINDS an extension is captured. Every check that reads an extension
+ * value reads whatever this returns, the android-safetynet hostname requirement among them, so a
+ * replacement answering with another entry hands the check the wrong value to compare. */
+/** @internal An index loop rather than a selection, because a captured `filter` still runs
+ *  ArraySpeciesCreate and builds its result through a constructor read off the receiver: one
+ *  returning `{ length: 0 }` takes the match as property `0` while the length stays zero, so the
+ *  extension reads as ABSENT. Absent is not inert here, since the hostname check falls back from the
+ *  subject alternative name to the common name, and a leaf whose authoritative name is another host
+ *  passes on a matching CN. The loop also avoids indexing an empty result, where index `0` reads
+ *  through to `Array.prototype[0]` and a value installed there answers for an extension the
+ *  certificate does not carry. */
 function _findExt(cert, oidName) {
   var target = oid.byName(oidName);
-  return (cert.extensions || []).filter(function (e) { return e.oid === target; })[0] || null;
+  var exts = cert.extensions || [];
+  for (var i = 0; i < exts.length; i++) {
+    if (exts[i] && exts[i].oid === target) return exts[i];
+  }
+  return null;
 }
 
 
@@ -317,7 +370,7 @@ function parseAttestationObject(bytes) {
   var wantMajor = ATT_STMT_MAJOR[cbor.read.textString(fmtN)];
   if (wantMajor === undefined) wantMajor = 5;
   if (attStmtN.majorType !== wantMajor) {
-    throw _err("webauthn/bad-attestation-object", "attestation object 'attStmt' must be a CBOR " + (wantMajor === 4 ? "array" : "map") + " for format " + JSON.stringify(cbor.read.textString(fmtN)));
+    throw _err("webauthn/bad-attestation-object", "attestation object 'attStmt' must be a CBOR " + (wantMajor === 4 ? "array" : "map") + " for format " + intrinsic.stringify(cbor.read.textString(fmtN)));
   }
   if (authDataN.majorType !== 2) throw _err("webauthn/bad-attestation-object", "attestation object 'authData' must be a byte string");
   var authDataBytes = cbor.read.byteString(authDataN);
@@ -340,23 +393,31 @@ function _attRead(map, key, reader, what) {
   try { return reader(n); }
   catch (e) { throw _err("webauthn/bad-att-stmt", "the attestation statement '" + key + "' must be " + what, e); }
 }
-function _algOf(attStmt) { return Number(_attRead(attStmt, "alg", cbor.read.int, "an integer")); }
+/** @internal The numeric conversion comes from the capture. This value is the algorithm the
+ * attestation DECLARES, and it is compared against the credential key's own algorithm, so a
+ * conversion that answered with a different identifier would let one algorithm's signature be
+ * checked as another's. */
+function _algOf(attStmt) { return intrinsic.Number(_attRead(attStmt, "alg", cbor.read.int, "an integer")); }
 function _sigOf(attStmt) { return _attRead(attStmt, "sig", cbor.read.byteString, "a byte string"); }
 function _requireAttShape(attStmt, allowed, required) {
   var have = intrinsic.create(null);
-  cbor.read.map(attStmt).forEach(function (kv) {
+  /** @internal The walks and the membership test are captured. These are REFUSALS: the first rejects
+   * a field the format does not allow and the second a required field that is absent, so a walk that
+   * skips an entry or a membership test answering differently admits a statement neither rule would
+   * have passed. */
+  intrinsic.forEach(cbor.read.map(attStmt), function (kv) {
     if (kv[0].majorType !== 3) throw _err("webauthn/bad-att-stmt", "the attestation statement has a non-text-string field key");
     have[cbor.read.textString(kv[0])] = true;
   });
-  Object.keys(have).forEach(function (k) { if (allowed.indexOf(k) === -1) throw _err("webauthn/bad-att-stmt", "the attestation statement carries an unexpected field '" + k + "'"); });
-  required.forEach(function (k) { if (!have[k]) throw _err("webauthn/bad-att-stmt", "the attestation statement is missing the '" + k + "' field"); });
+  intrinsic.forEach(intrinsic.keys(have), function (k) { if (intrinsic.indexOf(allowed, k) === -1) throw _err("webauthn/bad-att-stmt", "the attestation statement carries an unexpected field '" + k + "'"); });
+  intrinsic.forEach(required, function (k) { if (!have[k]) throw _err("webauthn/bad-att-stmt", "the attestation statement is missing the '" + k + "' field"); });
 }
 var ATT_STMT_MAJOR = intrinsic.assign(intrinsic.create(null), { compound: 4 });
 
-var _AAGUID_SIGNED_BY_FMT = Object.assign(Object.create(null), { "fido-u2f": false });
+var _AAGUID_SIGNED_BY_FMT = intrinsic.assign(intrinsic.create(null), { "fido-u2f": false });
 function _aaguidIsSigned(fmt) { return _AAGUID_SIGNED_BY_FMT[fmt] !== false; }
 
-var _VERIFY_OPTS = Object.assign(Object.create(null), {
+var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), {
   time: 1, metadata: 1, tpmPolicy: 1, safetyNetRoots: 1, verifySafetyNetJws: 1, requireCtsProfileMatch: 1,
   expectedRpId: 1, requireUserPresence: 1, requireUserVerification: 1, allowedAlgorithms: 1,
   rootCertificates: 1,
@@ -368,11 +429,14 @@ var _FORMAT_SCOPED_BOOLEAN_OPTS = ["verifySafetyNetJws", "requireCtsProfileMatch
 function _cloneParsed(v, depth) {
   if (depth > 64) throw _err("webauthn/bad-input", "opts.rootCertificates[] is nested too deeply to be a parsed certificate");
   if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, _err, "webauthn/bad-input", "a byte field of opts.rootCertificates[]");
-  if (Array.isArray(v)) return guard.list.copyMap(v, function (x) { return _cloneParsed(x, depth + 1); });
-  if (guard.time.isDate(v)) return new Date(guard.time.instantOf(v));
+  if (intrinsic.isArray(v)) return guard.list.copyMap(v, function (x) { return _cloneParsed(x, depth + 1); });
+  if (guard.time.isDate(v)) return new intrinsic.Date(guard.time.instantOf(v));
   if (v && typeof v === "object") {
     var out = intrinsic.create(null);
-    Object.keys(v).forEach(function (k) { out[k] = _cloneParsed(v[k], depth + 1); });
+    /** @internal The key enumeration and the walk over it are captured: this is the copy that stops a
+     *  caller's root certificate changing after it was validated, and an enumeration that omits a key
+     *  leaves that field reading through to the caller's own object. */
+    intrinsic.forEach(intrinsic.keys(v), function (k) { out[k] = _cloneParsed(v[k], depth + 1); });
     return out;
   }
   return v;
@@ -386,9 +450,13 @@ function _bytesArg(v, label) {
   throw _err("webauthn/bad-input", label + " must be a BufferSource (a Buffer, a typed-array view, or an ArrayBuffer)");
 }
 
+/** @internal The classification and the walk are captured. These produce the root set an attestation
+ *  path is anchored to, so a walk answering with entries of its own supplies the anchors rather than
+ *  copying the caller's, and a classification answering `false` hands the caller's live array through
+ *  with no snapshot taken. */
 function _snapshotRoots(supplied) {
-  if (!Array.isArray(supplied)) return supplied;
-  return supplied.map(function (root) {
+  if (!intrinsic.isArray(supplied)) return supplied;
+  return intrinsic.mapList(supplied, function (root) {
     if (_isBufferSource(root)) {
       return guard.bytes.snapshotSource(root, WebauthnError, "webauthn/bad-input", "opts.rootCertificates[]");
     }
@@ -397,10 +465,10 @@ function _snapshotRoots(supplied) {
 }
 
 function _applyCallerRoots(res, supplied, vopts, onlyPaths) {
-  if (!Array.isArray(supplied) || !supplied.length) {
+  if (!intrinsic.isArray(supplied) || !supplied.length) {
     throw _err("webauthn/bad-input", "opts.rootCertificates must be a non-empty array of root certificates (DER, PEM, or parsed)");
   }
-  var roots = supplied.map(function (root, i) {
+  var roots = intrinsic.mapList(supplied, function (root, i) {
     var label = "opts.rootCertificates[" + i + "]";
     return guard.parsed.acceptDerived(root, "certificate", function (bytes) {
       try {
@@ -408,42 +476,46 @@ function _applyCallerRoots(res, supplied, vopts, onlyPaths) {
       } catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
     }, _err, "webauthn/bad-input", label);
   });
-  var paths = onlyPaths || ((res.fmt === "compound" && Array.isArray(res.compound))
-    ? res.compound.filter(function (el) { return el.trustPath && el.trustPath.length; })
-      .map(function (el) { return { tp: el.trustPath, at: el.chainValidatedAt }; })
+  /** @internal The selection of trust paths to anchor is captured. A selection that drops an element
+   *  leaves that element's path unanchored while the refusal below sees a non-empty list, so the
+   *  verdict reports the whole attestation anchored on the strength of the paths that survived. */
+  var paths = onlyPaths || ((res.fmt === "compound" && intrinsic.isArray(res.compound))
+    ? intrinsic.mapList(intrinsic.selectList(res.compound, function (el) { return el.trustPath && el.trustPath.length; }),
+      function (el) { return { tp: el.trustPath, at: el.chainValidatedAt }; })
     : (res.trustPath && res.trustPath.length ? [{ tp: res.trustPath, at: res.chainValidatedAt }] : []));
   if (!onlyPaths) {
-    res = guard.verdict.of(res, { anchoredElements: { total: (res.fmt === "compound" && Array.isArray(res.compound)) ? res.compound.length : 1,
+    res = guard.verdict.of(res, { anchoredElements: { total: (res.fmt === "compound" && intrinsic.isArray(res.compound)) ? res.compound.length : 1,
       anchored: paths.length } });
   }
   if (!paths.length) {
     throw _err("webauthn/anchor-not-applicable",
       "opts.rootCertificates was supplied, but this attestation carries no trust path to anchor (format '" + res.fmt + "')");
   }
-  var at = vopts.time !== undefined ? vopts.time : new Date();
-  return paths.reduce(function (p, info) {
-    return p.then(function () {
+  var at = vopts.time !== undefined ? vopts.time : new intrinsic.Date();
+  var anchoredAll = intrinsic.reduce(paths, function (p, info) {
+    return intrinsic.chain(p, function () {
       var pathAt = vopts.time !== undefined ? vopts.time : (info.at || at);
-      return mds.chainToAnchor(_reverse(_arrSlice(info.tp)), roots, pathAt,
+      return mds.chainToAnchor(_reverse(intrinsic.copyList(info.tp)), roots, pathAt,
         "attestation trust path (against the roots supplied as opts.rootCertificates)");
     });
-  }, _promiseResolve(_Promise, undefined)).then(function () {
+  }, _promiseResolve(_Promise, undefined));
+  return intrinsic.chain(anchoredAll, function () {
     return guard.verdict.of(res, { anchoredTo: _anchoredRoutes(res, "rootCertificates") });
   });
 }
 
 function _safetyNetAnchored(res) {
   if (res.fmt === "android-safetynet") return 1;
-  if (res.fmt === "compound" && Array.isArray(res.compound)) {
-    return res.compound.filter(function (el) { return el && el.fmt === "android-safetynet"; }).length;
+  if (res.fmt === "compound" && intrinsic.isArray(res.compound)) {
+    return intrinsic.selectList(res.compound, function (el) { return el && el.fmt === "android-safetynet"; }).length;
   }
   return 0;
 }
 
 function _anchoredRoutes(res, base) {
-  var routes = base ? base.split("+") : [];
-  if (_safetyNetAnchored(res) && routes.indexOf("safetyNetRoots") < 0) guard.list.append(routes, "safetyNetRoots");
-  return routes.length ? routes.join("+") : null;
+  var routes = base ? intrinsic.splitChar(base, 43) : [];
+  if (_safetyNetAnchored(res) && intrinsic.indexOf(routes, "safetyNetRoots") < 0) guard.list.append(routes, "safetyNetRoots");
+  return routes.length ? intrinsic.join(routes, "+") : null;
 }
 
 function _assertBool(v, name) {
@@ -456,8 +528,11 @@ function _applyBindings(authData, coseKey, opts) {
     if (typeof opts.expectedRpId !== "string" || !opts.expectedRpId.length) {
       throw _err("webauthn/bad-input", "opts.expectedRpId must be a non-empty RP ID string");
     }
-    if (!guard.crypto.constantTimeEqual(_sha("sha256", Buffer.from(opts.expectedRpId, "utf8")),
-      Buffer.from(authData.rpIdHash))) {
+    /** @internal Both operands of the RP ID comparison are built with captured operations. This is
+     *  what decides the response was produced for the relying party the caller named, so an operation
+     *  answering with bytes of its own matches a response made for another party. */
+    if (!guard.crypto.constantTimeEqual(_sha("sha256", intrinsic.bufferFrom(opts.expectedRpId, "utf8")),
+      intrinsic.bufferFrom(authData.rpIdHash))) {
       throw _err("webauthn/rp-id-mismatch",
         "the authenticatorData rpIdHash is not SHA-256 of opts.expectedRpId, so this response was " +
         "produced for a different relying party (WebAuthn sec. 7.1 step 13 / sec. 7.2 step 15)");
@@ -482,7 +557,9 @@ function _applyBindings(authData, coseKey, opts) {
     }
     checked.userVerification = opts.requireUserVerification;
   }
-  var alg65535Allowed = Array.isArray(opts.allowedAlgorithms) && opts.allowedAlgorithms.indexOf(-65535) !== -1;
+  /** @internal The SHA-1 opt-in is read through captures. This membership test ADMITS COSE -65535, so
+   *  a test answering that -65535 is present waives the refusal for a caller who never named it. */
+  var alg65535Allowed = intrinsic.isArray(opts.allowedAlgorithms) && intrinsic.ownIndexOf(opts.allowedAlgorithms, -65535) !== -1;
   if (coseKey && coseKey.alg === -65535 && !alg65535Allowed) {
     throw _err("webauthn/algorithm-not-allowed",
       "the credential public key declares COSE algorithm -65535 (RSASSA-PKCS1-v1_5 with SHA-1); every " +
@@ -490,12 +567,17 @@ function _applyBindings(authData, coseKey, opts) {
       "names -65535 explicitly");
   }
   if (opts.allowedAlgorithms !== undefined) {
-    if (!Array.isArray(opts.allowedAlgorithms) || !opts.allowedAlgorithms.length ||
-        !opts.allowedAlgorithms.every(function (a) { return typeof a === "number" && Number.isSafeInteger(a); })) {
+    /** @internal The entries are required to be the list's OWN. A hole answers from the prototype at
+     *  that index, and the universal test skips it, so a sparse list with a number installed on
+     *  `Array.prototype` passes this door and then admits that algorithm below. */
+    if (!intrinsic.isArray(opts.allowedAlgorithms) || !opts.allowedAlgorithms.length ||
+        !intrinsic.everyOwn(opts.allowedAlgorithms, function (a) { return typeof a === "number" && intrinsic.isSafeInteger(a); })) {
       throw _err("webauthn/bad-input", "opts.allowedAlgorithms must be a non-empty array of COSE algorithm integers");
     }
     var alg = coseKey && coseKey.alg;
-    if (opts.allowedAlgorithms.indexOf(alg) === -1) {
+    /** @internal The membership test comes from the capture. It REFUSES an algorithm the caller did
+     *  not name, so one answering that any algorithm is present admits every algorithm. */
+    if (intrinsic.ownIndexOf(opts.allowedAlgorithms, alg) === -1) {
       throw _err("webauthn/algorithm-not-allowed",
         "the credential public key declares COSE algorithm " + alg + ", which is not in opts.allowedAlgorithms");
     }
@@ -513,7 +595,10 @@ function _readX5c(attStmt) {
   var x5cN = cbor.read.mapGet(attStmt, "x5c");
   if (!x5cN || x5cN.majorType !== 4 || !x5cN.children || !x5cN.children.length) throw _err("webauthn/bad-att-stmt", "x5c must be a non-empty array of certificates");
   _requireX5cCount(x5cN.children.length);
-  return x5cN.children.map(function (c) {
+  /** @internal The walk over the x5c entries is captured. It produces the chain the attestation is
+   *  verified against, so a walk answering with certificates of its own replaces the chain whose
+   *  signatures are then checked. */
+  return intrinsic.mapList(x5cN.children, function (c) {
     var der;
     try { der = cbor.read.byteString(c); } catch (e) { throw _err("webauthn/bad-att-stmt", "an x5c entry must be a byte string", e); }
     try { return x509.parse(der); } catch (e) { throw _err("webauthn/bad-att-stmt", "an x5c certificate is not a well-formed X.509 certificate", e); }
@@ -530,11 +615,15 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     var isX5c = !!cbor.read.mapGet(att.attStmt, "x5c");
     _requireAttShape(att.attStmt, isX5c ? ["alg", "sig", "x5c"] : ["alg", "sig"], isX5c ? ["alg", "sig", "x5c"] : ["alg", "sig"]);
     var alg = _algOf(att.attStmt), sig = _sigOf(att.attStmt);
-    var message = Buffer.concat([att.authDataBytes, clientDataHash]);
+    /** @internal The signed input is assembled with the captured operation. Every verifier below does
+     *  the same, because the assembly decides WHICH bytes the signature is checked over: an operation
+     *  answering with bytes the attestation statement does carry a signature for verifies a statement
+     *  that was never made about this ceremony's authenticatorData and client data. */
+    var message = intrinsic.bufferConcat([att.authDataBytes, clientDataHash]);
     if (isX5c) {
       var chain = _readX5c(att.attStmt), leaf = chain[0];
       _checkPackedCert(leaf);
-      return _verifySig(alg, sig, leaf.subjectPublicKeyInfo.bytes, message, _err).then(function (ok) {
+      return intrinsic.chain(_verifySig(alg, sig, leaf.subjectPublicKeyInfo.bytes, message, _err), function (ok) {
         if (!ok) throw _err("webauthn/verify-failed", "the packed attestation signature does not verify under the x5c leaf key");
         _checkAaguidExt(leaf, att.authData.aaguid);
         return _result("packed", "Basic", chain, att);
@@ -542,7 +631,7 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     }
     if (alg !== att.authData.credentialPublicKey.alg) throw _err("webauthn/bad-att-stmt", "the packed self-attestation alg does not match the credential public key algorithm (WebAuthn 8.2)");
     var spki = _coseKeyToSpki(att.authData.credentialPublicKey);
-    return _verifySig(alg, sig, spki, message, _err).then(function (ok) {
+    return intrinsic.chain(_verifySig(alg, sig, spki, message, _err), function (ok) {
       if (!ok) throw _err("webauthn/verify-failed", "the packed self-attestation signature does not verify under the credential key");
       return _result("packed", "Self", [], att);
     });
@@ -558,9 +647,9 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     if (key.alg !== -7 || key.kty !== 2 || key.crv !== 1 || !key.x || !key.y || key.x.length !== 32 || key.y.length !== 32) {
       throw _err("webauthn/bad-att-stmt", "fido-u2f requires an ES256 (-7) EC2 P-256 credential public key (WebAuthn 8.6)");
     }
-    var publicKeyU2F = Buffer.concat([Buffer.from([0x04]), key.x, key.y]);
-    var verificationData = Buffer.concat([Buffer.from([0x00]), att.authData.rpIdHash, clientDataHash, att.authData.credentialId, publicKeyU2F]);
-    return _verifySig(-7, sig, leaf.subjectPublicKeyInfo.bytes, verificationData, _err).then(function (ok) {
+    var publicKeyU2F = intrinsic.bufferConcat([intrinsic.bufferFrom([0x04]), key.x, key.y]);
+    var verificationData = intrinsic.bufferConcat([intrinsic.bufferFrom([0x00]), att.authData.rpIdHash, clientDataHash, att.authData.credentialId, publicKeyU2F]);
+    return intrinsic.chain(_verifySig(-7, sig, leaf.subjectPublicKeyInfo.bytes, verificationData, _err), function (ok) {
       if (!ok) throw _err("webauthn/verify-failed", "the fido-u2f attestation signature does not verify under the x5c leaf key");
       return _result("fido-u2f", "Basic", chain, att);
     });
@@ -570,11 +659,11 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     _requireAttShape(att.attStmt, ["alg", "x5c"], ["x5c"]);
     var chain = _readX5c(att.attStmt), leaf = chain[0];
     _requireV3(leaf);
-    var nonce = _sha("sha256", Buffer.concat([att.authDataBytes, clientDataHash]));
+    var nonce = _sha("sha256", intrinsic.bufferConcat([att.authDataBytes, clientDataHash]));
     var ext = _findExt(leaf, "appleAnonymousAttestation");
     if (!ext) throw _err("webauthn/bad-att-cert", "the apple attestation certificate is missing the anonymous-attestation extension (WebAuthn 8.8)");
     var embedded = _appleNonce(ext.value);
-    if (!embedded.equals(nonce)) throw _err("webauthn/verify-failed", "the apple attestation nonce does not equal SHA-256(authData || clientDataHash)");
+    if (!intrinsic.bufferEquals(embedded, nonce)) throw _err("webauthn/verify-failed", "the apple attestation nonce does not equal SHA-256(authData || clientDataHash)");
     _certPubKeyEqualsCose(leaf, att.authData.credentialPublicKey, _err);
     return _promiseResolve(_Promise, _result("apple", "AnonCA", chain, att));
   },
@@ -584,8 +673,8 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     var chain = _readX5c(att.attStmt), leaf = chain[0];
     _requireV3(leaf);
     var alg = _algOf(att.attStmt), sig = _sigOf(att.attStmt);
-    var message = Buffer.concat([att.authDataBytes, clientDataHash]);
-    return _verifySig(alg, sig, leaf.subjectPublicKeyInfo.bytes, message, _err).then(function (ok) {
+    var message = intrinsic.bufferConcat([att.authDataBytes, clientDataHash]);
+    return intrinsic.chain(_verifySig(alg, sig, leaf.subjectPublicKeyInfo.bytes, message, _err), function (ok) {
       if (!ok) throw _err("webauthn/verify-failed", "the android-key attestation signature does not verify under the x5c leaf key");
       _certPubKeyEqualsCose(leaf, att.authData.credentialPublicKey, _err);
       _checkAndroidKeyDescription(leaf, clientDataHash);
@@ -594,7 +683,7 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
   },
 
   tpm: function (att, clientDataHash, opts) {
-    var tpmPolicy = validator.tpm.normalizeObjectAttributePolicy((opts || {}).tpmPolicy, WebauthnError, "webauthn/bad-input");
+    var tpmPolicy = validator.tpm.normalizeObjectAttributePolicy((opts || intrinsic.create(null)).tpmPolicy, WebauthnError, "webauthn/bad-input");
     _requireAttShape(att.attStmt, ["ver", "alg", "sig", "certInfo", "pubArea", "x5c"], ["ver", "alg", "sig", "certInfo", "pubArea", "x5c"]);
     var verN = cbor.read.mapGet(att.attStmt, "ver");
     if (!verN || verN.majorType !== 3 || cbor.read.textString(verN) !== "2.0") throw _err("webauthn/bad-att-stmt", "tpm attestation 'ver' MUST be \"2.0\" (WebAuthn 8.3)");
@@ -608,15 +697,18 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
 
     var certInfo = _parseTpmCertInfo(certInfoBytes);
 
-    var attToBeSigned = Buffer.concat([att.authDataBytes, clientDataHash]);
-    if (!certInfo.extraData.equals(_sha(_coseAlgHash(alg, _err), attToBeSigned))) throw _err("webauthn/verify-failed", "certInfo extraData does not equal the hash of authData || clientDataHash");
+    var attToBeSigned = intrinsic.bufferConcat([att.authDataBytes, clientDataHash]);
+    /** @internal Both TPM comparisons go through the capture. `extraData` is what binds the quote to
+     *  this ceremony and the attested Name is what binds it to the pubArea key, so one answering true
+     *  accepts a genuine TPM quote taken over another ceremony or over a different key. */
+    if (!intrinsic.bufferEquals(certInfo.extraData, _sha(_coseAlgHash(alg, _err), attToBeSigned))) throw _err("webauthn/verify-failed", "certInfo extraData does not equal the hash of authData || clientDataHash");
 
     var nameHash = validator.tpm.TPM_ALG_HASH[pub.nameAlg];
-    if (!nameHash) throw _err("webauthn/bad-tpm", "unsupported TPM nameAlg 0x" + pub.nameAlg.toString(16));
-    var computedName = Buffer.concat([pub.nameAlgBytes, _sha(nameHash, pubAreaBytes)]);
-    if (!certInfo.attestedName.equals(computedName)) throw _err("webauthn/verify-failed", "certInfo attested Name does not match the pubArea TPM Name");
+    if (!nameHash) throw _err("webauthn/bad-tpm", "unsupported TPM nameAlg 0x" + intrinsic.numberToString(pub.nameAlg, 16));
+    var computedName = intrinsic.bufferConcat([pub.nameAlgBytes, _sha(nameHash, pubAreaBytes)]);
+    if (!intrinsic.bufferEquals(certInfo.attestedName, computedName)) throw _err("webauthn/verify-failed", "certInfo attested Name does not match the pubArea TPM Name");
 
-    return _verifySig(alg, sig, aik.subjectPublicKeyInfo.bytes, certInfoBytes, _err).then(function (ok) {
+    return intrinsic.chain(_verifySig(alg, sig, aik.subjectPublicKeyInfo.bytes, certInfoBytes, _err), function (ok) {
       if (!ok) throw _err("webauthn/verify-failed", "the tpm attestation signature does not verify over certInfo under the AIK");
       _checkAikCert(aik);
       _checkAaguidExt(aik, att.authData.aaguid);
@@ -627,12 +719,12 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
   },
 
   "android-safetynet": function (att, clientDataHash, opts) {
-    opts = opts || {};
+    opts = opts || intrinsic.create(null);
     if (opts.verifySafetyNetJws !== true) {
       throw _err("webauthn/unsupported-format", "attestation statement format 'android-safetynet' is not supported");
     }
     var roots = opts.safetyNetRoots;
-    if (!Array.isArray(roots) || roots.length === 0) {
+    if (!intrinsic.isArray(roots) || roots.length === 0) {
       throw _err("webauthn/safetynet-no-root", "verifying an android-safetynet attestation requires opts.safetyNetRoots -- the Google root(s) to anchor the x5c chain to; this library bundles none (WebAuthn 8.5)");
     }
     if (opts.time !== undefined) guard.time.assertValid(opts.time, _err, "webauthn/bad-input", "opts.time");
@@ -642,24 +734,26 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     var responseBytes = _attRead(att.attStmt, "response", cbor.read.byteString, "a byte string");
     if (!responseBytes.length) throw _err("webauthn/bad-att-stmt", "the android-safetynet response is empty");
 
-    var segs = guard.text.decode(responseBytes, constants.LIMITS.SAFETYNET_JWS_MAX_BYTES, WebauthnError, "webauthn/bad-att-stmt", "the android-safetynet response").split(".");
+    /** @internal The split that divides the JWS is captured: it decides which bytes are the signed
+     * input and which are the signature, so a replacement chooses what the verification covers. */
+    var segs = intrinsic.splitChar(guard.text.decode(responseBytes, constants.LIMITS.SAFETYNET_JWS_MAX_BYTES, WebauthnError, "webauthn/bad-att-stmt", "the android-safetynet response"), 46);
     if (segs.length !== 3) throw _err("webauthn/bad-att-stmt", "the android-safetynet response is not a three-part JWS compact serialization (RFC 7515 sec. 3.1)");
     var header, payload, sigBytes;
     try {
       header = jose.parseJson(jose.base64url.decode(segs[0]));
       payload = jose.parseJson(jose.base64url.decode(segs[1]));
-      sigBytes = Buffer.from(jose.base64url.decode(segs[2]));
+      sigBytes = intrinsic.bufferFrom(jose.base64url.decode(segs[2]));
     } catch (e) { throw _err("webauthn/bad-att-stmt", "the android-safetynet response is not a decodable JWS", e); }
     if (!_isPlainObject(header) || !_isPlainObject(payload)) {
       throw _err("webauthn/bad-att-stmt", "the android-safetynet JWS header and payload must each be a JSON object");
     }
 
-    if (header.alg !== "RS256") throw _err("webauthn/unsupported-algorithm", "the android-safetynet JWS alg must be RS256, got " + JSON.stringify(header.alg));
-    if (!Array.isArray(header.x5c) || header.x5c.length === 0) {
+    if (header.alg !== "RS256") throw _err("webauthn/unsupported-algorithm", "the android-safetynet JWS alg must be RS256, got " + intrinsic.stringify(header.alg));
+    if (!intrinsic.isArray(header.x5c) || header.x5c.length === 0) {
       throw _err("webauthn/bad-att-stmt", "the android-safetynet JWS header carries no x5c certificate chain (RFC 7515 sec. 4.1.6)");
     }
     _requireX5cCount(header.x5c.length);
-    var chain = header.x5c.map(function (entry, i) {
+    var chain = intrinsic.mapList(header.x5c, function (entry, i) {
       if (typeof entry !== "string") throw _err("webauthn/bad-att-stmt", "the android-safetynet x5c entry " + i + " is not a string");
       var der;
       try { der = guard.encoding.base64(entry, constants.LIMITS.SAFETYNET_CERT_MAX_BYTES, _err, "webauthn/bad-att-stmt", "an android-safetynet x5c entry"); }
@@ -669,8 +763,13 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     });
     var leaf = chain[0];
 
-    var wantNonce = _sha("sha256", Buffer.concat([att.authDataBytes, clientDataHash])).toString("base64");
-    if (typeof payload.nonce !== "string" || !guard.crypto.constantTimeEqual(Buffer.from(payload.nonce, "utf8"), Buffer.from(wantNonce, "utf8"))) {
+    /** @internal The digest is taken with the captured hash, and the encoding that turns it back into
+     *  text is captured too, along with the construction of both comparison operands. The nonce is what
+     *  binds this response to this ceremony's authenticatorData and clientDataHash, so an operation that
+     *  chooses either operand makes a correctly signed response replay against different data. */
+    var wantNonce = intrinsic.bufToString(_sha("sha256", intrinsic.bufferConcat([att.authDataBytes, clientDataHash])), "base64");
+    if (typeof payload.nonce !== "string" || !guard.crypto.constantTimeEqual(
+      intrinsic.bufferFrom(payload.nonce, "utf8"), intrinsic.bufferFrom(wantNonce, "utf8"))) {
       throw _err("webauthn/safetynet-nonce-mismatch", "the android-safetynet nonce does not bind this authenticatorData and clientDataHash (WebAuthn 8.5)");
     }
 
@@ -685,17 +784,18 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
       apkCertificateDigestSha256: payload.apkCertificateDigestSha256, advice: payload.advice,
     };
     if (opts.requireCtsProfileMatch === true && signals.ctsProfileMatch !== true) {
-      throw _err("webauthn/safetynet-cts-profile", "the android-safetynet response reports ctsProfileMatch " + JSON.stringify(signals.ctsProfileMatch) + ", and opts.requireCtsProfileMatch demands true");
+      throw _err("webauthn/safetynet-cts-profile", "the android-safetynet response reports ctsProfileMatch " + intrinsic.stringify(signals.ctsProfileMatch) + ", and opts.requireCtsProfileMatch demands true");
     }
 
-    return _verifySig(-257, sigBytes, leaf.subjectPublicKeyInfo.bytes,
-      Buffer.from(segs[0] + "." + segs[1], "ascii"), _err).then(function (ok) {
+    var jwsTrusted = intrinsic.chain(_verifySig(-257, sigBytes, leaf.subjectPublicKeyInfo.bytes,
+      intrinsic.bufferFrom(segs[0] + "." + segs[1], "ascii"), _err), function (ok) {
       if (!ok) throw _err("webauthn/verify-failed", "the android-safetynet JWS signature does not verify under the x5c leaf key");
       chainAt = opts.time !== undefined ? opts.time
-        : (typeof payload.timestampMs === "number" && isFinite(payload.timestampMs) && payload.timestampMs > 0
-          ? new Date(payload.timestampMs) : undefined);
+        : (typeof payload.timestampMs === "number" && intrinsic.isFinite(payload.timestampMs) && payload.timestampMs > 0
+          ? new intrinsic.Date(payload.timestampMs) : undefined);
       return _safetyNetChainTrusted(chain, roots, chainAt);
-    }).then(function () {
+    });
+    return intrinsic.chain(jwsTrusted, function () {
       var res = guard.verdict.of(_result("android-safetynet", "Basic", chain, att), { safetyNet: signals });
       if (chainAt !== undefined) res = guard.verdict.of(res, { chainValidatedAt: chainAt });
       return res;
@@ -708,7 +808,11 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
     if (kids.length > constants.LIMITS.WEBAUTHN_COMPOUND_MAX_STATEMENTS) {
       throw _err("webauthn/bad-att-stmt", "a compound attestation statement carries " + kids.length + " nested statements, above the " + constants.LIMITS.WEBAUTHN_COMPOUND_MAX_STATEMENTS + " this toolkit will verify");
     }
-    var elements = kids.map(function (el, i) {
+    /** @internal The walk that builds the element list and the fold that verifies them are both
+     *  captured. A walk that drops an element leaves it unverified while the compound verdict still
+     *  reports, and a fold that returns its seed without visiting an element answers for a statement
+     *  nothing checked. */
+    var elements = intrinsic.mapList(kids, function (el, i) {
       if (!el || el.majorType !== 5) throw _err("webauthn/bad-att-stmt", "compound element " + i + " must be a CBOR map { fmt, attStmt } (WebAuthn 8.9)");
       var fN = cbor.read.mapGet(el, "fmt"), sN = cbor.read.mapGet(el, "attStmt");
       if (el.children.length !== 2 || !fN || !sN) throw _err("webauthn/bad-att-stmt", "compound element " + i + " must be exactly { fmt, attStmt } (WebAuthn 8.9)");
@@ -722,14 +826,16 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
       return { fmt: f, index: i, att: { fmt: f, attStmt: sN, authData: att.authData, authDataBytes: att.authDataBytes } };
     });
     var out = [];
-    return elements.reduce(function (p, e) {
-      return p.then(function () {
-        return _promiseResolve(_Promise, undefined).then(function () { return VERIFIERS[e.fmt](e.att, clientDataHash, opts); })
-          .then(function (r) { guard.list.append(out, r); }, function (err) {
-            throw _err("webauthn/compound-element-failed", "compound element " + e.index + " (format '" + e.fmt + "') did not verify", err);
-          });
+    var allVerified = intrinsic.reduce(elements, function (p, e) {
+      return intrinsic.chain(p, function () {
+        var ran = intrinsic.chain(_promiseResolve(_Promise, undefined),
+          function () { return VERIFIERS[e.fmt](e.att, clientDataHash, opts); });
+        return intrinsic.chain(ran, function (r) { guard.list.append(out, r); }, function (err) {
+          throw _err("webauthn/compound-element-failed", "compound element " + e.index + " (format '" + e.fmt + "') did not verify", err);
+        });
       });
-    }, _promiseResolve(_Promise, undefined)).then(function () {
+    }, _promiseResolve(_Promise, undefined));
+    return intrinsic.chain(allVerified, function () {
       return guard.verdict.of(_result("compound", "Compound", [], att), { compound: out });
     });
   },
@@ -742,17 +848,40 @@ var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
   },
 });
 
-function _isPlainObject(v) { return !!v && typeof v === "object" && !Array.isArray(v); }
+function _isPlainObject(v) { return !!v && typeof v === "object" && !intrinsic.isArray(v); }
 
+/** @internal The case fold comes from the load-time capture, not the live prototype. This is an
+ * ADMISSION gate: it answers `true` when the leaf is issued to the one name WebAuthn 8.5 requires, so
+ * a replacement that answers with that name admits ANY leaf. Measured, with the fold replaced for the
+ * leaf's own name alone, `pki.webauthn.verify` ACCEPTED an android-safetynet attestation whose x5c
+ * leaf names `other.example`. Replacing the fold for every string instead breaks an earlier step and
+ * hides it, which is why the vector narrows the replacement to one value. */
 function _safetyNetHostnameOk(leaf) {
   var want = "attest.android.com";
   var san = _decodeExt(leaf, "subjectAltName");
-  var entries = san && Array.isArray(san.value) ? san.value : [];
-  var dns = entries.filter(function (gn) { return gn && gn.type === "dNSName" && typeof gn.value === "string"; });
-  if (dns.length) return dns.some(function (gn) { return gn.value.toLowerCase() === want; });
-  return leaf.subject.rdns.some(function (rdn) {
-    return rdn.some(function (atv) {
-      return atv.name === "commonName" && typeof atv.value === "string" && atv.value.toLowerCase() === want;
+  /** @internal The entries come from the decoded record's `names`, and a dNSName is GeneralName
+   * `[2]`, which is how `path-validate` and `identity-match` read the same structure. Read as a bare
+   * array under a `type` field, this branch selected nothing at all: the decoder returns
+   * `{ names, bytes }` and each entry carries `tagNumber`, so every leaf fell through to the
+   * commonName fallback. That accepted a leaf whose authoritative SAN named another host while its
+   * commonName named the wanted one, and refused a SAN-only leaf whose commonName differed. */
+  var entries = (san && san.value && intrinsic.isArray(san.value.names)) ? san.value.names : [];
+  /** @internal The WALKS are captured as well as the fold. The fold alone is not the gate: a replaced
+   * `some` answering `true` passes the requirement whatever the names compare as, and a selection
+   * that drops every dNSName entry sends this down the commonName fallback instead. Both reach the
+   * same `true` this function exists to withhold. */
+  var dns = intrinsic.selectList(entries, function (gn) { return gn && gn.tagNumber === 2 && typeof gn.value === "string"; });
+  /** @internal A subjectAltName that is PRESENT is authoritative, whichever name forms it carries,
+   * so the commonName is consulted only for a leaf that carries no such extension at all. Gating the
+   * fallback on "no dNSName was selected" instead let a leaf whose SAN holds only a URI or an
+   * address fall through to its commonName, and a rooted leaf naming another host in the one place
+   * that binds it was accepted on a commonName that read `attest.android.com`. A leaf with no SAN is
+   * still read by commonName, which is how the service's own certificates were issued. */
+  if (san) return intrinsic.some(dns, function (gn) { return intrinsic.toLowerCase(gn.value) === want; });
+  return intrinsic.some(leaf.subject.rdns, function (rdn) {
+    return intrinsic.some(rdn, function (atv) {
+      return atv.name === "commonName" && typeof atv.value === "string" &&
+        intrinsic.toLowerCase(atv.value) === want;
     });
   });
 }
@@ -760,7 +889,7 @@ function _safetyNetHostnameOk(leaf) {
 function _safetyNetChainTrusted(chain, roots, time) {
   var anchors;
   try {
-    anchors = roots.map(function (root, i) {
+    anchors = intrinsic.mapList(roots, function (root, i) {
       var label = "opts.safetyNetRoots[" + i + "]";
       return guard.parsed.acceptDerived(root, "certificate", function (bytes) {
         try {
@@ -769,14 +898,14 @@ function _safetyNetChainTrusted(chain, roots, time) {
       }, _err, "webauthn/bad-input", label);
     });
   } catch (e) { return _promiseReject(_Promise, e); }
-  return mds.chainToAnchor(chain, anchors, time === undefined ? new Date() : time,
+  return mds.chainToAnchor(chain, anchors, time === undefined ? new intrinsic.Date() : time,
     "android-safetynet x5c certificate chain", "webauthn/safetynet-cert-untrusted");
 }
 
 function _result(fmt, attestationType, chain, att) {
   return guard.verdict.of({
     valid: true, attestationVerified: true, fmt: fmt, attestationType: attestationType,
-    trustPath: _reverse(_arrSlice(chain || [])),
+    trustPath: _reverse(intrinsic.copyList(chain || [])),
     aaguid: att.authData.aaguid,
     credentialId: att.authData.credentialId,
     credentialPublicKey: att.authData.credentialPublicKey,
@@ -920,13 +1049,18 @@ function verify(attestationObject, clientDataHash, opts) {
       !_isBufferSource(clientDataHash) && _isPlainObject(clientDataHash)) {
     opts = clientDataHash; clientDataHash = undefined;
   }
-  opts = opts || {};
+  /** @internal A caller who passes no options gets a record with NO prototype. Defaulted to `{}` it
+   *  inherits, so a property installed on `Object.prototype` reads as an option this call never set. */
+  opts = opts || intrinsic.create(null);
   try {
     if (!_isPlainObject(opts)) throw _err("webauthn/bad-input", "opts must be an object");
     guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "webauthn/bad-input", "opts has an unknown key ");
     opts = guard.identifier.ownOptions(opts);
     if (opts.time !== undefined) guard.time.assertValid(opts.time, _err, "webauthn/bad-input", "opts.time");
-    _FORMAT_SCOPED_BOOLEAN_OPTS.forEach(function (k) {
+    /** @internal The walk comes from the capture. Each pass of it is a REFUSAL of a mistyped option,
+     *  and a mistyped one that survives is read for truthiness later where the rule wants exactly
+     *  `true`, so a walk that visits nothing admits `"true"` as the opt-in. */
+    intrinsic.forEach(_FORMAT_SCOPED_BOOLEAN_OPTS, function (k) {
       if (opts[k] !== undefined && typeof opts[k] !== "boolean") throw _err("webauthn/bad-input", "opts." + k + " must be a boolean");
     });
   } catch (e) { return _promiseReject(_Promise, e); }
@@ -979,27 +1113,30 @@ function verify(attestationObject, clientDataHash, opts) {
     vopts.rootCertificates = _snapshotRoots(opts.rootCertificates);
     vopts.safetyNetRoots = _snapshotRoots(opts.safetyNetRoots);
   } catch (e) { return _promiseReject(_Promise, e); }
-  return _promiseResolve(_Promise, undefined).then(function () { return verifier(att, clientDataHash, vopts); })
-    .then(function (res) {
-      return guard.verdict.of(res, { clientData: clientData });
-    })
-    .then(function (res) {
+  var ranVerifier = intrinsic.chain(_promiseResolve(_Promise, undefined),
+    function () { return verifier(att, clientDataHash, vopts); });
+  var withClientData = intrinsic.chain(ranVerifier, function (res) {
+    return guard.verdict.of(res, { clientData: clientData });
+  });
+  var anchoredRes = intrinsic.chain(withClientData, function (res) {
       if (vopts.metadata === undefined) {
         if (vopts.rootCertificates !== undefined) return _applyCallerRoots(res, vopts.rootCertificates, vopts);
         var anchored = guard.verdict.of(res, { anchoredTo: _anchoredRoutes(res, null) });
         var sn = _safetyNetAnchored(anchored);
         if (sn) {
           anchored = guard.verdict.of(anchored, { anchoredElements: {
-            total: (anchored.fmt === "compound" && Array.isArray(anchored.compound)) ? anchored.compound.length : 1,
+            total: (anchored.fmt === "compound" && intrinsic.isArray(anchored.compound)) ? anchored.compound.length : 1,
             anchored: sn } });
         }
         return anchored;
       }
-      return _promiseResolve(_Promise, undefined).then(function () { return _applyMetadata(res, att, vopts); })
-        .then(function (out) { return guard.verdict.of(out, { anchoredTo: _anchoredRoutes(out, "metadata") }); }, function (e) {
+      var applyMd = intrinsic.chain(_promiseResolve(_Promise, undefined),
+        function () { return _applyMetadata(res, att, vopts); });
+      return intrinsic.chain(applyMd,
+        function (out) { return guard.verdict.of(out, { anchoredTo: _anchoredRoutes(out, "metadata") }); }, function (e) {
           if (!e || e.code !== "webauthn/metadata-not-found" || vopts.rootCertificates === undefined) throw e;
-          return _promiseResolve(_Promise, _applyCallerRoots(res, vopts.rootCertificates, vopts, e.missedPaths))
-            .then(function (withRoots) {
+          return intrinsic.chain(_promiseResolve(_Promise, _applyCallerRoots(res, vopts.rootCertificates, vopts, e.missedPaths)),
+            function (withRoots) {
               /** @internal The element coverage the metadata attempt measured is the whole
                * statement's, so it travels on the error rather than being recomputed from the
                * fallback's own paths. */
@@ -1009,13 +1146,13 @@ function verify(attestationObject, clientDataHash, opts) {
               var primary = applied[0];
               var withMd = guard.verdict.of(out, { metadata: { aaguid: primary.entry.aaguid,
                 keyIdentifiers: primary.entry.keyIdentifiers || [],
-                entry: primary.entry, entries: applied.map(function (a) { return a.entry; }),
+                entry: primary.entry, entries: intrinsic.mapList(applied, function (a) { return a.entry; }),
                 anchors: primary.anchors.length } });
               return guard.verdict.of(withMd, { anchoredTo: _anchoredRoutes(withMd, "metadata+rootCertificates") });
             });
         });
-    })
-    .then(function (res) { return guard.verdict.of(res, { bindingChecked: bindingChecked }); });
+  });
+  return intrinsic.chain(anchoredRes, function (res) { return guard.verdict.of(res, { bindingChecked: bindingChecked }); });
 }
 
 function _applyMetadata(res, att, opts) {
@@ -1023,12 +1160,12 @@ function _applyMetadata(res, att, opts) {
   if (!mds.isVerifiedResult(md)) {
     throw _err("webauthn/bad-input", "opts.metadata must be a pki.webauthn.verifyMetadataBlob result, not a raw BLOB");
   }
-  var paths = (res.fmt === "compound" && Array.isArray(res.compound))
-    ? res.compound.filter(function (el) { return el.trustPath && el.trustPath.length; })
-      .map(function (el) { return { tp: el.trustPath, fmt: el.fmt, at: el.chainValidatedAt }; })
+  var paths = (res.fmt === "compound" && intrinsic.isArray(res.compound))
+    ? intrinsic.mapList(intrinsic.selectList(res.compound, function (el) { return el.trustPath && el.trustPath.length; }),
+      function (el) { return { tp: el.trustPath, fmt: el.fmt, at: el.chainValidatedAt }; })
     : (res.trustPath && res.trustPath.length ? [{ tp: res.trustPath, fmt: res.fmt, at: res.chainValidatedAt }] : []);
   res = guard.verdict.of(res, { anchoredElements: {
-    total: (res.fmt === "compound" && Array.isArray(res.compound)) ? res.compound.length : 1,
+    total: (res.fmt === "compound" && intrinsic.isArray(res.compound)) ? res.compound.length : 1,
     anchored: paths.length } });
   if (!paths.length) {
     throw _err("webauthn/metadata-not-applicable", "opts.metadata was supplied, but this attestation carries no trust path to anchor (format '" + res.fmt + "')");
@@ -1056,7 +1193,7 @@ function _applyMetadata(res, att, opts) {
     guard.list.append(applied, { entry: entry, anchors: anchors, identifier: identifier });
     return { anchors: anchors, identifier: identifier };
   }
-  var at = opts.time !== undefined ? opts.time : new Date();
+  var at = opts.time !== undefined ? opts.time : new intrinsic.Date();
   mds.assertFresh(md, at, "the metadata supplied as opts.metadata");
   var governed = [];
   var missed = null;
@@ -1074,20 +1211,21 @@ function _applyMetadata(res, att, opts) {
     guard.verdict.set(missed, "appliedEntries", applied);
     guard.verdict.set(missed, "anchoredElements", res.anchoredElements);
   }
-  return governed.reduce(function (p, item) {
-    return p.then(function () {
+  var governedAnchored = intrinsic.reduce(governed, function (p, item) {
+    return intrinsic.chain(p, function () {
       var g = item.g, info = item.info;
       var pathAt = opts.time !== undefined ? opts.time : (info.at || at);
-      return mds.chainToAnchor(_reverse(_arrSlice(info.tp)), g.anchors, pathAt,
+      return mds.chainToAnchor(_reverse(intrinsic.copyList(info.tp)), g.anchors, pathAt,
         "attestation trust path for " + g.identifier + " (against the roots its metadata entry registers)");
     });
-  }, _promiseResolve(_Promise, undefined))
-    .then(function () {
+  }, _promiseResolve(_Promise, undefined));
+  return intrinsic.chain(governedAnchored,
+    function () {
       if (missed) throw missed;
       var primary = applied[0];
       return guard.verdict.of(res, { metadata: { aaguid: primary.entry.aaguid,
         keyIdentifiers: primary.entry.keyIdentifiers || [],
-        entry: primary.entry, entries: applied.map(function (a) { return a.entry; }),
+        entry: primary.entry, entries: intrinsic.mapList(applied, function (a) { return a.entry; }),
         anchors: primary.anchors.length } });
     });
 }
@@ -1095,7 +1233,11 @@ function _applyMetadata(res, att, opts) {
 function _formatCarries(att, fmt) {
   if (att.fmt === fmt) return true;
   if (att.fmt !== "compound") return false;
-  return (att.attStmt.children || []).some(function (el) {
+  /** @internal The membership walk is captured. It decides whether a format-scoped option applies to
+   *  a compound statement, so one answering `false` for a format the statement does carry leaves that
+   *  element's option unapplied, and one answering `true` applies an option to a statement that has
+   *  no element of that format. */
+  return intrinsic.some(att.attStmt.children || [], function (el) {
     if (!el || el.majorType !== 5) return false;
     var fN = cbor.read.mapGet(el, "fmt");
     return !!fN && fN.majorType === 3 && cbor.read.textString(fN) === fmt;
@@ -1234,7 +1376,7 @@ void constants;
  */
 
 
-var CLIENT_DATA_TYPE = Object.assign(Object.create(null), { "webauthn.create": 1, "webauthn.get": 1 });
+var CLIENT_DATA_TYPE = intrinsic.assign(intrinsic.create(null), { "webauthn.create": 1, "webauthn.get": 1 });
 
 /**
  * @primitive pki.webauthn.parseClientData
@@ -1289,7 +1431,7 @@ var CLIENT_DATA_TYPE = Object.assign(Object.create(null), { "webauthn.create": 1
  *   cd.crossOrigin;         // false
  */
 function parseClientData(bytes, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!_isPlainObject(opts)) throw _err("webauthn/bad-input", "opts must be an object");
   guard.identifier.assertKnownKeys(opts, _CLIENT_DATA_OPTS, _err, "webauthn/bad-input", "opts has an unknown key ");
   /** @internal Each expected* option is read to decide whether to compare and read again for the
@@ -1298,7 +1440,7 @@ function parseClientData(bytes, opts) {
    *  the caller never supplied. Take each option once. */
   opts = guard.identifier.snapshotOptions(opts, _CLIENT_DATA_OPTS);
   bytes = _bytesArg(bytes, "clientDataJSON");
-  var doc = guard.json.parse(Buffer.from(bytes), _err, {
+  var doc = guard.json.parse(intrinsic.bufferFrom(bytes), _err, {
     maxBytes: constants.LIMITS.JSON_MAX_BYTES, maxDepth: constants.LIMITS.JSON_MAX_DEPTH,
     badJson: "webauthn/bad-client-data", tooDeep: "webauthn/bad-client-data",
     duplicateMember: "webauthn/bad-client-data", tooLarge: "webauthn/bad-client-data",
@@ -1307,7 +1449,7 @@ function parseClientData(bytes, opts) {
   if (!_isPlainObject(doc)) throw _err("webauthn/bad-client-data", "clientDataJSON is not a JSON object (WebAuthn sec. 5.8.1)");
   if (typeof doc.type !== "string" || CLIENT_DATA_TYPE[doc.type] !== 1) {
     throw _err("webauthn/bad-client-data",
-      "clientDataJSON type must be \"webauthn.create\" or \"webauthn.get\", got " + JSON.stringify(doc.type) +
+      "clientDataJSON type must be \"webauthn.create\" or \"webauthn.get\", got " + intrinsic.stringify(doc.type) +
       " (WebAuthn sec. 5.8.1)");
   }
   if (typeof doc.origin !== "string" || !doc.origin.length) {
@@ -1351,13 +1493,23 @@ function parseClientData(bytes, opts) {
     checked.challenge = true;
   }
   if (opts.expectedOrigin !== undefined) {
-    var allowed = Array.isArray(opts.expectedOrigin) ? opts.expectedOrigin : [opts.expectedOrigin];
-    if (!allowed.length || !allowed.every(function (o) { return typeof o === "string" && o.length; })) {
+    /** @internal The origin allow-list is read through captures end to end. The membership test is
+     *  what REFUSES a response produced at an origin this relying party does not accept, so one
+     *  answering that any origin is present admits a ceremony completed on another site, and the
+     *  classification above it decides whether the caller's single origin or their whole list is the
+     *  set that gets tested. */
+    var allowed = intrinsic.isArray(opts.expectedOrigin) ? opts.expectedOrigin : [opts.expectedOrigin];
+    /** @internal The entries are required to be the list's OWN, and the membership test reads own
+     *  indexes. A hole answers from the prototype at that index while the universal test skips it, so
+     *  a one-element sparse list carrying no origin of its own passed this door and then admitted a
+     *  response whose origin had been installed on `Array.prototype`, with the origin reported as
+     *  checked although the caller listed none. */
+    if (!allowed.length || !intrinsic.everyOwn(allowed, function (o) { return typeof o === "string" && o.length; })) {
       throw _err("webauthn/bad-input", "opts.expectedOrigin must be a non-empty origin string, or an array of them");
     }
-    if (allowed.indexOf(doc.origin) === -1) {
+    if (intrinsic.ownIndexOf(allowed, doc.origin) === -1) {
       throw _err("webauthn/client-data-mismatch",
-        "the clientDataJSON origin " + JSON.stringify(doc.origin) + " is not one this relying party accepts " +
+        "the clientDataJSON origin " + intrinsic.stringify(doc.origin) + " is not one this relying party accepts " +
         "(WebAuthn sec. 7.1 step 10 / sec. 7.2 step 13)");
     }
     checked.origin = true;
@@ -1368,19 +1520,19 @@ function parseClientData(bytes, opts) {
     if (wantTop === null) {
       if (framed || doc.topOrigin !== undefined) {
         throw _err("webauthn/client-data-mismatch",
-          "the clientDataJSON describes a cross-origin ceremony (crossOrigin " + JSON.stringify(doc.crossOrigin) +
-          ", topOrigin " + JSON.stringify(doc.topOrigin === undefined ? null : doc.topOrigin) +
+          "the clientDataJSON describes a cross-origin ceremony (crossOrigin " + intrinsic.stringify(doc.crossOrigin) +
+          ", topOrigin " + intrinsic.stringify(doc.topOrigin === undefined ? null : doc.topOrigin) +
           "), and this relying party requires an unframed one (WebAuthn sec. 5.8.1)");
       }
     } else {
-      var allowedTop = Array.isArray(wantTop) ? wantTop : [wantTop];
-      if (!allowedTop.length || !allowedTop.every(function (o) { return typeof o === "string" && o.length; })) {
+      var allowedTop = intrinsic.isArray(wantTop) ? wantTop : [wantTop];
+      if (!allowedTop.length || !intrinsic.everyOwn(allowedTop, function (o) { return typeof o === "string" && o.length; })) {
         throw _err("webauthn/bad-input", "opts.expectedTopOrigin must be null, a non-empty origin string, or an array of them");
       }
-      if (!framed || allowedTop.indexOf(doc.topOrigin) === -1) {
+      if (!framed || intrinsic.ownIndexOf(allowedTop, doc.topOrigin) === -1) {
         throw _err("webauthn/client-data-mismatch",
-          "the clientDataJSON topOrigin " + JSON.stringify(doc.topOrigin === undefined ? null : doc.topOrigin) +
-          " (crossOrigin " + JSON.stringify(doc.crossOrigin) + ") is not a framing this relying party accepts (WebAuthn sec. 5.8.1)");
+          "the clientDataJSON topOrigin " + intrinsic.stringify(doc.topOrigin === undefined ? null : doc.topOrigin) +
+          " (crossOrigin " + intrinsic.stringify(doc.crossOrigin) + ") is not a framing this relying party accepts (WebAuthn sec. 5.8.1)");
       }
     }
     checked.topOrigin = true;
@@ -1392,7 +1544,7 @@ function parseClientData(bytes, opts) {
     checked: checked,
   };
 }
-var _CLIENT_DATA_OPTS = Object.assign(Object.create(null), {
+var _CLIENT_DATA_OPTS = intrinsic.assign(intrinsic.create(null), {
   expectedType: 1, expectedChallenge: 1, expectedOrigin: 1, expectedTopOrigin: 1,
 });
 
@@ -1426,7 +1578,7 @@ function parseAuthenticatorData(bytes) {
   return _parseAuthData(_bytesArg(bytes, "authenticatorData"), _err);
 }
 
-var _ASSERT_OPTS = Object.assign(Object.create(null), {
+var _ASSERT_OPTS = intrinsic.assign(intrinsic.create(null), {
   authenticatorData: 1, clientDataHash: 1, clientDataJSON: 1, signature: 1,
   credentialPublicKey: 1, previousSignCount: 1,
   expectedRpId: 1, requireUserPresence: 1, requireUserVerification: 1, allowedAlgorithms: 1,
@@ -1496,7 +1648,11 @@ function _snapshotAssertion(input) {
   if (!_isPlainObject(input)) throw _err("webauthn/bad-input", "pki.webauthn.verifyAssertion takes an options object");
   guard.identifier.assertKnownKeys(input, _ASSERT_OPTS, _err, "webauthn/bad-input", "verifyAssertion input has an unknown key ");
   var out = guard.identifier.ownOptions(input);
-  ["authenticatorData", "clientDataJSON", "clientDataHash", "signature", "expectedChallenge"].forEach(function (f) {
+  /** @internal The walk comes from the capture. Each pass of it SNAPSHOTS one of the byte fields the
+   *  verdict is computed over, so a walk that visits nothing leaves the caller's own buffers in place
+   *  and they can be rewritten between this call returning its promise and the verification running:
+   *  substituted authenticatorData with a signature that matches it then verifies. */
+  intrinsic.forEach(["authenticatorData", "clientDataJSON", "clientDataHash", "signature", "expectedChallenge"], function (f) {
     if (_isBufferSource(out[f])) out[f] = guard.bytes.snapshotSource(out[f], WebauthnError, "webauthn/bad-input", f);
   });
   if (_isBufferSource(out.credentialPublicKey)) {
@@ -1514,16 +1670,19 @@ function _snapshotAssertion(input) {
     }
     out.credentialPublicKey = key;
   }
-  if (Array.isArray(out.allowedAlgorithms)) out.allowedAlgorithms = guard.list.snapshot(out.allowedAlgorithms);
-  if (Array.isArray(out.expectedOrigin)) out.expectedOrigin = guard.list.snapshot(out.expectedOrigin);
-  if (Array.isArray(out.expectedTopOrigin)) out.expectedTopOrigin = guard.list.snapshot(out.expectedTopOrigin);
+  /** @internal Each classification decides whether the list is snapshotted. One answering `false`
+   *  leaves the caller's own array in place, so the allow-list the checks run against can still change
+   *  after this point. */
+  if (intrinsic.isArray(out.allowedAlgorithms)) out.allowedAlgorithms = guard.list.snapshot(out.allowedAlgorithms);
+  if (intrinsic.isArray(out.expectedOrigin)) out.expectedOrigin = guard.list.snapshot(out.expectedOrigin);
+  if (intrinsic.isArray(out.expectedTopOrigin)) out.expectedTopOrigin = guard.list.snapshot(out.expectedTopOrigin);
   return out;
 }
 
 function verifyAssertion(input) {
   var frozen;
   try { frozen = _snapshotAssertion(input); } catch (e) { return _promiseReject(_Promise, e); }
-  return _promiseResolve(_Promise, undefined).then(function () {
+  return intrinsic.chain(_promiseResolve(_Promise, undefined), function () {
     input = frozen;
     var authData = parseAuthenticatorData(input.authenticatorData);
     input.signature = _bytesArg(input.signature, "signature");
@@ -1540,7 +1699,7 @@ function verifyAssertion(input) {
         expectedOrigin: input.expectedOrigin,
         expectedTopOrigin: input.expectedTopOrigin,
       });
-      clientDataHash = _sha("sha256", Buffer.from(input.clientDataJSON));
+      clientDataHash = _sha("sha256", intrinsic.bufferFrom(input.clientDataJSON));
     } else {
       if (input.expectedChallenge !== undefined || input.expectedOrigin !== undefined ||
           input.expectedTopOrigin !== undefined) {
@@ -1561,12 +1720,14 @@ function verifyAssertion(input) {
     }
     var bindingChecked = _applyBindings(authData, coseKey, input);
     var prev = input.previousSignCount;
-    if (prev !== undefined && (typeof prev !== "number" || !Number.isSafeInteger(prev) || prev < 0 || prev > 0xFFFFFFFF)) {
+    if (prev !== undefined && (typeof prev !== "number" || !intrinsic.isSafeInteger(prev) || prev < 0 || prev > 0xFFFFFFFF)) {
       throw _err("webauthn/bad-input", "previousSignCount must be an integer in 0..4294967295");
     }
-    var message = Buffer.concat([Buffer.from(input.authenticatorData), clientDataHash]);
+    /** @internal The signed input and the signature are both assembled with captures, which is what
+     *  decides the bytes this assertion is checked over and the bytes it is checked against. */
+    var message = intrinsic.bufferConcat([intrinsic.bufferFrom(input.authenticatorData), clientDataHash]);
     var spki = _coseKeyToSpki(coseKey);
-    return _verifySig(coseKey.alg, Buffer.from(input.signature), spki, message, _err).then(function (ok) {
+    return intrinsic.chain(_verifySig(coseKey.alg, intrinsic.bufferFrom(input.signature), spki, message, _err), function (ok) {
       if (!ok) {
         throw _err("webauthn/bad-signature",
           "the assertion signature does not verify under the stored credential public key (WebAuthn sec. 7.2 step 20)");
@@ -1599,7 +1760,9 @@ function verifyAssertion(input) {
   });
 }
 
-module.exports = {
+/** @internal Frozen, so a consumer that reads one of these off this object at the call cannot be
+ *  handed a replacement in place of it. */
+module.exports = intrinsic.freeze({
   parseAttestationObject: parseAttestationObject,
   parseAuthenticatorData: parseAuthenticatorData,
   parseClientData: parseClientData,
@@ -1609,4 +1772,4 @@ module.exports = {
   verifyMetadataBlob: mds.verifyMetadataBlob,
   metadataFor: mds.metadataFor,
   metadataAnchors: mds.metadataAnchors,
-};
+});