@blamejs/pki 0.8.55 → 0.8.57

package/lib/composite-sig.js

@@ -24,7 +24,6 @@ var _promiseResolve = _intrinsic.uncurry(_intrinsic.promiseResolve);
 /** @internal The aggregator is the same defect one step out: the composite verdict is `ok` only when
  *  BOTH component verifications resolve true, so a replaced `all` that resolves `[true, true]` without
  *  awaiting either half reports a forged signature as verified. */
-var _promiseAll = _intrinsic.uncurry(_intrinsic.promiseAll);
 var _b = asn1.build;
 
 function _codeOf(e, fallback) {
@@ -85,7 +84,11 @@ function compositeMprime(d, phBuf, ctx) {
 function _verifyTradComponent(trad, tradPK, tradSig, mprime, E, badSig) {
   if (trad.ec) {
     if (tradPK.length < 1 || tradPK[0] !== 0x04) return _promiseResolve(_Promise, false);
-    return subtle.importKey("spki", _ecSpki(trad.ec, tradPK), { name: "ECDSA" }, false, ["verify"]).then(function (k) {
+    /** @internal Every continuation on this path comes from the capture. A continuation is read off
+     * the promise at the call, and these deliver the two component verdicts a composite signature is
+     * the conjunction of: a replacement settling either one reports a component as verified without
+     * it having been checked, and the path validator that calls this reads the conjunction. */
+    return _intrinsic.chain(subtle.importKey("spki", _ecSpki(trad.ec, tradPK), { name: "ECDSA" }, false, ["verify"]), function (k) {
       var p1363 = validator.sig.ecdsaDerToP1363(tradSig, trad.ec, E, badSig);
       return _subtleVerify(subtle, { name: "ECDSA", hash: trad.hash }, k, p1363, mprime);
     });
@@ -94,8 +97,8 @@ function _verifyTradComponent(trad, tradPK, tradSig, mprime, E, badSig) {
     if (!edwardsPoint.validate(tradPK, trad.eddsa === "Ed25519" ? 6 : 7)) {
       throw new E(badSig, "the composite EdDSA component public key is not a valid, full-order Edwards point");
     }
-    return subtle.importKey("spki", _edSpki(trad.eddsa, tradPK), { name: trad.eddsa }, false, ["verify"])
-      .then(function (k) { return _subtleVerify(subtle, { name: trad.eddsa }, k, tradSig, mprime); });
+    return _intrinsic.chain(subtle.importKey("spki", _edSpki(trad.eddsa, tradPK), { name: trad.eddsa }, false, ["verify"]),
+      function (k) { return _subtleVerify(subtle, { name: trad.eddsa }, k, tradSig, mprime); });
   }
   if (trad.rsaPss || trad.rsaPkcs1) {
     var bits;
@@ -103,11 +106,11 @@ function _verifyTradComponent(trad, tradPK, tradSig, mprime, E, badSig) {
     catch (_e) { return _promiseResolve(_Promise, false); }
     if (bits !== trad.rsaBits) return _promiseResolve(_Promise, false);
     if (trad.rsaPss) {
-      return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSA-PSS", hash: trad.hash }, false, ["verify"])
-        .then(function (k) { return _subtleVerify(subtle, { name: "RSA-PSS", saltLength: trad.salt }, k, tradSig, mprime); });
+      return _intrinsic.chain(subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSA-PSS", hash: trad.hash }, false, ["verify"]),
+        function (k) { return _subtleVerify(subtle, { name: "RSA-PSS", saltLength: trad.salt }, k, tradSig, mprime); });
     }
-    return subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSASSA-PKCS1-v1_5", hash: trad.hash }, false, ["verify"])
-      .then(function (k) { return _subtleVerify(subtle, { name: "RSASSA-PKCS1-v1_5" }, k, tradSig, mprime); });
+    return _intrinsic.chain(subtle.importKey("spki", _rsaSpki(tradPK), { name: "RSASSA-PKCS1-v1_5", hash: trad.hash }, false, ["verify"]),
+      function (k) { return _subtleVerify(subtle, { name: "RSASSA-PKCS1-v1_5" }, k, tradSig, mprime); });
   }
   return _promiseResolve(_Promise, false);
 }
@@ -132,13 +135,21 @@ function compositeVerify(spkiBytes, sigBytes, message, d, E, unsupported, badSig
   }
   var mldsaPK = rawKey.subarray(0, d.mldsaPk), tradPK = rawKey.subarray(d.mldsaPk);
   var mldsaSig = sigBytes.subarray(0, d.mldsaSig), tradSig = sigBytes.subarray(d.mldsaSig);
-  return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
+  var combined = _intrinsic.chain(subtle.digest({ name: d.ph }, message), function (phBuf) {
     var mprime = compositeMprime(d, phBuf);
-    var mldsaP = subtle.importKey("spki", _mldsaSpki(d.mldsaOid, mldsaPK), { name: d.mldsa }, false, ["verify"])
-      .then(function (mk) { return _subtleVerify(subtle, { name: d.mldsa, context: d.label }, mk, mldsaSig, mprime); });
+    var mldsaP = _intrinsic.chain(subtle.importKey("spki", _mldsaSpki(d.mldsaOid, mldsaPK), { name: d.mldsa }, false, ["verify"]),
+      function (mk) { return _subtleVerify(subtle, { name: d.mldsa, context: d.label }, mk, mldsaSig, mprime); });
     var tradP = _verifyTradComponent(d.trad, tradPK, tradSig, mprime, E, badSig);
-    return _promiseAll(_Promise, [mldsaP, tradP]).then(function (r) { return _verdictOf({ ok: r[0] === true && r[1] === true }); });
-  }).catch(function (e) { return _verdictOf({ ok: false, code: _codeOf(e, badSig), error: e }); });
+    /** @internal The conjunction is read from an aggregate that consults nothing replaceable: both
+     * components must answer `true`, so a settled value in place of either is a composite signature
+     * reported as verified on one half or on neither. A captured `Promise.all` is not enough, since
+     * it reads `resolve` off the constructor at each call and a replacement there answers for every
+     * member without any component being awaited. */
+    return _intrinsic.chain(_intrinsic.allOf([mldsaP, tradP]),
+      function (r) { return _verdictOf({ ok: r[0] === true && r[1] === true }); });
+  });
+  return _intrinsic.chain(combined, undefined,
+    function (e) { return _verdictOf({ ok: false, code: _codeOf(e, badSig), error: e }); });
 }
 
 function resolveCompositeDescriptor(sigAlg, E, unsupported) {
@@ -151,27 +162,35 @@ function resolveCompositeDescriptor(sigAlg, E, unsupported) {
 }
 
 function compositeSign(d, keys, message, ctx) {
-  return subtle.digest({ name: d.ph }, message).then(function (phBuf) {
+  /** @internal The signing half is continued through the captures too. Its output is the signature a
+   * verifier is then held to, so a replacement settling a component hands back bytes neither key
+   * produced and the signature does not verify anywhere. */
+  return _intrinsic.chain(subtle.digest({ name: d.ph }, message), function (phBuf) {
     var mprime = compositeMprime(d, phBuf, ctx);
-    var mldsaP = subtle.importKey("pkcs8", keys.mldsa, { name: d.mldsa }, false, ["sign"])
-      .then(function (k) { return subtle.sign({ name: d.mldsa, context: d.label }, k, mprime); });
+    var mldsaP = _intrinsic.chain(subtle.importKey("pkcs8", keys.mldsa, { name: d.mldsa }, false, ["sign"]),
+      function (k) { return subtle.sign({ name: d.mldsa, context: d.label }, k, mprime); });
     var tradP = _signTradComponent(d.trad, keys.trad, mprime);
-    return _promiseAll(_Promise, [mldsaP, tradP]).then(function (s) { return Buffer.concat([Buffer.from(s[0]), Buffer.from(s[1])]); });
+    return _intrinsic.chain(_intrinsic.allOf([mldsaP, tradP]),
+      function (s) { return Buffer.concat([Buffer.from(s[0]), Buffer.from(s[1])]); });
   });
 }
 function _signTradComponent(trad, pkcs8, mprime) {
   if (trad.ec) {
-    return subtle.importKey("pkcs8", pkcs8, { name: "ECDSA", namedCurve: trad.ec }, false, ["sign"])
-      .then(function (k) { return subtle.sign({ name: "ECDSA", hash: trad.hash }, k, mprime); })
-      .then(function (raw) { var r = Buffer.from(raw); return validator.sig.rawToEcdsaDer(r, r.length / 2); });
+    var ecSigned = _intrinsic.chain(subtle.importKey("pkcs8", pkcs8, { name: "ECDSA", namedCurve: trad.ec }, false, ["sign"]),
+      function (k) { return subtle.sign({ name: "ECDSA", hash: trad.hash }, k, mprime); });
+    return _intrinsic.chain(ecSigned,
+      function (raw) { var r = Buffer.from(raw); return validator.sig.rawToEcdsaDer(r, r.length / 2); });
   }
   if (trad.eddsa) {
-    return subtle.importKey("pkcs8", pkcs8, { name: trad.eddsa }, false, ["sign"])
-      .then(function (k) { return subtle.sign({ name: trad.eddsa }, k, mprime); }).then(function (s) { return Buffer.from(s); });
+    var edSigned = _intrinsic.chain(subtle.importKey("pkcs8", pkcs8, { name: trad.eddsa }, false, ["sign"]),
+      function (k) { return subtle.sign({ name: trad.eddsa }, k, mprime); });
+    return _intrinsic.chain(edSigned, function (s) { return Buffer.from(s); });
   }
   var imp = trad.rsaPss ? { name: "RSA-PSS", hash: trad.hash } : { name: "RSASSA-PKCS1-v1_5", hash: trad.hash };
   var alg = trad.rsaPss ? { name: "RSA-PSS", saltLength: trad.salt } : { name: "RSASSA-PKCS1-v1_5" };
-  return subtle.importKey("pkcs8", pkcs8, imp, false, ["sign"]).then(function (k) { return subtle.sign(alg, k, mprime); }).then(function (s) { return Buffer.from(s); });
+  var rsaSigned = _intrinsic.chain(subtle.importKey("pkcs8", pkcs8, imp, false, ["sign"]),
+    function (k) { return subtle.sign(alg, k, mprime); });
+  return _intrinsic.chain(rsaSigned, function (s) { return Buffer.from(s); });
 }
 
 module.exports = {

package/lib/constants.js

@@ -319,10 +319,15 @@ Object.freeze(NAMES);
 
 var VERSION = require("../package.json").version;
 
-module.exports = {
+/** @internal Frozen, because these tables are read BY NAME at call time to decide an admission.
+ *  `cms.sign` asks `NAMES.WEAK_DIGESTS` whether a digest is weak and `NAMES.TIMESTAMP_IMPRINT_DIGESTS`
+ *  whether one is permitted at all, so a caller able to assign `constants.NAMES` a copy with an empty
+ *  weak list turns the refusal off and a SHA-1 timestamp imprint is accepted. Freezing the tables
+ *  alone left the PROPERTIES naming them writable, which is the same hole one level out. */
+module.exports = Object.freeze({
   TIME:    TIME,
   BYTES:   BYTES,
   LIMITS:  LIMITS,
   NAMES:   NAMES,
   version: VERSION,
-};
+});

package/lib/crl-verify.js

@@ -12,4 +12,4 @@ function verifyCrlSignature(crl, spkiBytes) {
   return _seam.verify(crl.signatureAlgorithm, crl.signatureValue, spkiBytes, crl.tbsBytes);
 }
 
-module.exports = { setEngine: _seam.setEngine, verifyCrlSignature: verifyCrlSignature };
+module.exports = Object.freeze({ setEngine: _seam.setEngine, verifyCrlSignature: verifyCrlSignature });

package/lib/crmf-sign.js

@@ -43,10 +43,9 @@ var _Promise = intrinsic.Promise;
 var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 /** @internal `verifyPop`'s verdict is the aggregate of the per-message results, so a replaced `all`
  *  that resolves a fabricated array reports an unverified proof of possession as verified. */
-var _promiseAll = intrinsic.uncurry(intrinsic.promiseAll);
 var _hasOwn = intrinsic.hasOwn;
 var _isBuffer = intrinsic.isBuffer;
-var _push = intrinsic.push, _String = intrinsic.String;
+var _String = intrinsic.String;
 var _stringify = intrinsic.stringify;
 var cms = require("./schema-cms");
 var possession = require("./possession");
@@ -108,7 +107,7 @@ function _ctlPossession(v) {
     b.raw(_b.reqDer(issuerRaw, "statementOfPossession signer.issuer (the signature certificate's issuer Name DER)")),
     b.integer(guard.range.authoredInteger(signer.serialNumber, _err, "crmf/bad-controls", "statementOfPossession signer.serialNumber")),
   ])];
-  if (v.certificate != null) _push(fields, b.raw(_b.reqDer(v.certificate, "statementOfPossession certificate")));
+  if (v.certificate != null) guard.list.append(fields, b.raw(_b.reqDer(v.certificate, "statementOfPossession certificate")));
   var der = b.sequence(fields);
   try { possession.parse(der); }
   catch (e) { throw _err("crmf/bad-controls", "statementOfPossession: " + ((e && e.message) || _String(e)), e); }
@@ -177,8 +176,8 @@ function _encodeOptionalValidity(validity) {
   var nb = validity.notBefore, na = validity.notAfter;
   if (nb == null && na == null) throw _err("crmf/bad-validity", "validity must contain notBefore or notAfter (RFC 4211 sec. 5)");
   var parts = [];
-  if (nb != null) parts.push(b.explicit(0, _b.timeDer(nb, "validity notBefore")));
-  if (na != null) parts.push(b.explicit(1, _b.timeDer(na, "validity notAfter")));
+  if (nb != null) guard.list.append(parts, b.explicit(0, _b.timeDer(nb, "validity notBefore")));
+  if (na != null) guard.list.append(parts, b.explicit(1, _b.timeDer(na, "validity notAfter")));
   // allow:nan-date-comparison-unguarded -- both instants passed timeDer's guard.time.assertEncodable above.
   if (nb != null && na != null && guard.time.instantOf(nb) > guard.time.instantOf(na)) throw _err("crmf/bad-validity", "notBefore must not be after notAfter");
   return b.implicit(4, b.sequence(parts));
@@ -190,19 +189,22 @@ function _encodeCertTemplate(tpl, opts) {
   var fields = [];
   if (tpl.version != null) {
     if (tpl.version !== 2) throw _err("crmf/bad-version", "certTemplate version MUST be 2 (v3) if supplied (RFC 4211 sec. 5)");
-    fields.push(b.implicit(0, b.integer(2n)));
+    guard.list.append(fields, b.implicit(0, b.integer(2n)));
   }
-  if (tpl.serialNumber != null) fields.push(b.implicit(1, _b.serialInteger(tpl.serialNumber)));
-  if (tpl.issuer != null) fields.push(b.explicit(3, _b.encodeName(tpl.issuer)));
-  if (tpl.validity != null) fields.push(_encodeOptionalValidity(tpl.validity));
-  if (tpl.subject != null) fields.push(b.explicit(5, _b.encodeName(tpl.subject)));
+  /** @internal Appended through the guard. These members are the template a proof of possession is
+   * computed over and a CA issues from, so a replaced append that drops or substitutes one changes
+   * what was requested from what was proven. */
+  if (tpl.serialNumber != null) guard.list.append(fields, b.implicit(1, _b.serialInteger(tpl.serialNumber)));
+  if (tpl.issuer != null) guard.list.append(fields, b.explicit(3, _b.encodeName(tpl.issuer)));
+  if (tpl.validity != null) guard.list.append(fields, _encodeOptionalValidity(tpl.validity));
+  if (tpl.subject != null) guard.list.append(fields, b.explicit(5, _b.encodeName(tpl.subject)));
   var spki = null;
   if (tpl.publicKey != null) {
     spki = _b.reqDer(tpl.publicKey, "certTemplate.publicKey (the SPKI DER of the requested key)");
     _b.assertValidSpki(spki, "certTemplate.publicKey");
-    fields.push(b.implicit(6, spki));
+    guard.list.append(fields, b.implicit(6, spki));
   }
-  if (tpl.extensions != null) fields.push(b.implicit(9, _b.requestedExtensions(tpl.extensions, spki)));
+  if (tpl.extensions != null) guard.list.append(fields, b.implicit(9, _b.requestedExtensions(tpl.extensions, spki)));
   return { der: b.sequence(fields), spki: spki, complete: tpl.subject != null && tpl.publicKey != null };
 }
 
@@ -237,7 +239,7 @@ function _buildAttrTypeAndValues(spec, code, label, valueMap, collect) {
     var typeOid = O(k);
     if (seen[typeOid]) throw _err(code, "duplicate " + label + " type " + k);
     seen[typeOid] = true;
-    out.push(b.sequence([b.oid(typeOid), enc(spec[k])]));
+    guard.list.append(out, b.sequence([b.oid(typeOid), enc(spec[k])]));
   });
   if (!out.length) throw _err(code, label + " must carry at least one entry");
   return b.sequence(out);
@@ -916,19 +918,23 @@ function _buildEncryptedKeyPop(pop, outerTag, template) {
       "the proof is that the enclosed private key is the one being certified (RFC 4211 sec. 4.2)");
   }
   encKeyWithIdDer = _encKeyWithID(privateKeyDer, pop.identifier);
-  return _assertEnclosedKeyMatches(privateKeyDer, template.spki).then(function () {
-    return cmsEncrypt.encrypt(encKeyWithIdDer, recipients, { contentType: "encKeyWithID", contentEncryptionAlgorithm: cea })
-      .then(null, function (e) {
-        if (e instanceof CrmfError) throw e;
-        throw _err("crmf/bad-input", "the encryptedKey proof of possession could not envelope the private key to " +
-          "pop.recipients: " + ((e && e.message) || e), e);
-      });
-  })
-    .then(function (contentInfo) {
-      var inner = _bareEnvelopedData(contentInfo);
-      return b.explicit(outerTag, b.implicit(4, inner));
-    })
-    .then(function (out) { wipe(); return out; }, function (e) { wipe(); throw e; });
+  /** @internal Each step is continued through the capture. The first decides whether the enclosed
+   * private key IS the one being certified, which is the whole proof, and the last is what wipes the
+   * key material whichever way the chain settles. */
+  var enveloped = intrinsic.chain(_assertEnclosedKeyMatches(privateKeyDer, template.spki), function () {
+    var encrypted = cmsEncrypt.encrypt(encKeyWithIdDer, recipients,
+      { contentType: "encKeyWithID", contentEncryptionAlgorithm: cea });
+    return intrinsic.chain(encrypted, null, function (e) {
+      if (e instanceof CrmfError) throw e;
+      throw _err("crmf/bad-input", "the encryptedKey proof of possession could not envelope the private key to " +
+        "pop.recipients: " + ((e && e.message) || e), e);
+    });
+  });
+  var wrapped = intrinsic.chain(enveloped, function (contentInfo) {
+    var inner = _bareEnvelopedData(contentInfo);
+    return b.explicit(outerTag, b.implicit(4, inner));
+  });
+  return intrinsic.chain(wrapped, function (out) { wipe(); return out; }, function (e) { wipe(); throw e; });
   }
 }
 
@@ -964,9 +970,9 @@ function _assertEnclosedKeyMatches(privateKeyDer, templateSpki) {
    * cannot use it, so those are proven by USING the key against the template. */
   var enclosedAlg = key.algorithmOidAt(privateKeyDer, 1);
   if (enclosedAlg !== null && !key.isDhOid(enclosedAlg)) return _assertEnclosedKeyCorresponds(privateKeyDer, templateSpki);
-  return _promiseResolve(_Promise, undefined)
-    .then(function () { return key.publicFromPrivate(privateKeyDer); })
-    .then(function (derivedSpki) {
+  var derivedP = intrinsic.chain(_promiseResolve(_Promise, undefined),
+    function () { return key.publicFromPrivate(privateKeyDer); });
+  return intrinsic.chain(derivedP, function (derivedSpki) {
       var derived = guard.bytes.view(derivedSpki, CrmfError, "crmf/bad-input", "the derived public key");
       var wanted = guard.bytes.view(templateSpki, CrmfError, "crmf/bad-input", "certTemplate.publicKey");
       /** @internal A finite-field key names itself in either encoding here too, and an enclosed key
@@ -1074,12 +1080,20 @@ function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts, po
     signedRegion = poposkSeq;
     poposkInputField = b.implicit(0, poposkSeq);
   }
-  return signScheme.signOverTbs(scheme, signingKey, signedRegion, _signE).then(function (sig) {
-    return _promiseResolve(_Promise, _b.assertSignatureVerifies(signedRegion, sig, provingSpki, scheme)).then(function () {
+  /** @internal Both continuations are captured. The inner one runs after the proof's own signature
+   * has been verified against the key being certified, so a replacement settling it emits a proof
+   * whose signature was never checked against that key. */
+  return intrinsic.chain(signScheme.signOverTbs(scheme, signingKey, signedRegion, _signE), function (sig) {
+    var selfChecked = _promiseResolve(_Promise, _b.assertSignatureVerifies(signedRegion, sig, provingSpki, scheme));
+    return intrinsic.chain(selfChecked, function () {
       var popoChildren = [];
-      if (poposkInputField) popoChildren.push(poposkInputField);
-      popoChildren.push(scheme.sigAlgId);
-      popoChildren.push(b.bitString(sig, 0));
+      /** @internal Appended through the guard, which defines the index rather than calling a method
+       * the prototype answers for. These three members ARE the proof: the signature value is added
+       * AFTER it has been verified against the key being certified, so a replaced append that alters
+       * it emits a proof whose bytes nothing checked. */
+      if (poposkInputField) guard.list.append(popoChildren, poposkInputField);
+      guard.list.append(popoChildren, scheme.sigAlgId);
+      guard.list.append(popoChildren, b.bitString(sig, 0));
       return b.implicit(1, b.sequence(popoChildren));
     });
   }, function (e) {
@@ -1171,7 +1185,7 @@ function _buildCertReqMsg(spec, key, opts) {
   var template = _encodeCertTemplate(spec.certTemplate);
   var certReqChildren = [b.integer(_certReqId(spec.certReqId)), template.der];
   var encodedControls = [];
-  if (spec.controls != null) certReqChildren.push(_buildAttrTypeAndValues(spec.controls, "crmf/bad-controls", "controls", CONTROL_VALUE, encodedControls));
+  if (spec.controls != null) guard.list.append(certReqChildren, _buildAttrTypeAndValues(spec.controls, "crmf/bad-controls", "controls", CONTROL_VALUE, encodedControls));
   var certReqDer = b.sequence(certReqChildren);
 
   /** @internal The key the RFC 9883 control names, when the request carries one: that key makes the
@@ -1196,10 +1210,12 @@ function _buildCertReqMsg(spec, key, opts) {
     possessionSpki = _encodedPossessionSpki(encodedControls);
   }
 
-  return _promiseResolve(_Promise, _buildProofOfPossession(spec.pop, certReqDer, template, signingKey, opts, possessionSpki)).then(function (popoDer) {
+  var popoP = _promiseResolve(_Promise,
+    _buildProofOfPossession(spec.pop, certReqDer, template, signingKey, opts, possessionSpki));
+  return intrinsic.chain(popoP, function (popoDer) {
     var msgChildren = [certReqDer];
-    if (popoDer) msgChildren.push(popoDer);
-    if (spec.regInfo != null) msgChildren.push(_buildAttrTypeAndValues(spec.regInfo, "crmf/bad-reg-info", "regInfo", REGINFO_VALUE));
+    if (popoDer) guard.list.append(msgChildren, popoDer);
+    if (spec.regInfo != null) guard.list.append(msgChildren, _buildAttrTypeAndValues(spec.regInfo, "crmf/bad-reg-info", "regInfo", REGINFO_VALUE));
     return b.sequence(msgChildren);
   });
 }
@@ -1218,7 +1234,9 @@ function _build(spec, key, opts) {
     specs = [spec];
   }
   if (!specs.length) throw _err("crmf/bad-input", "at least one certificate request message is required (RFC 4211 sec. 3)");
-  return _promiseAll(_Promise, specs.map(function (s) { return _buildCertReqMsg(s, key, opts); })).then(function (msgs) {
+  return intrinsic.chain(intrinsic.allOf(intrinsic.mapList(specs, function (s) {
+    return _buildCertReqMsg(s, key, opts);
+  })), function (msgs) {
     var der = b.sequence(msgs);
     if (opts.pem != null) {
       if (typeof opts.pem !== "string" || !opts.pem) throw _err("crmf/bad-input", "opts.pem must be a non-empty PEM label string");
@@ -1310,7 +1328,10 @@ function _verifyOne(msg) {
     spki = sopSpki;
     bound = false;
   }
-  return crmfVerify.verifyPopSignature(popo, spki, preimage).then(function (ok) {
+  /** @internal The continuation comes from the capture. It is where the signature answer becomes this
+   * message's verdict, so a replacement settling it hands back a record stating `verified: true` for
+   * a proof nothing checked, and the aggregate above then reports the whole set as verified. */
+  return intrinsic.chain(crmfVerify.verifyPopSignature(popo, spki, preimage), function (ok) {
     return guard.verdict.of(base, {
       valid: ok === true, verified: ok === true, method: "signature", cryptographicallyVerified: ok === true,
       subject: bound ? base.subject : null,
@@ -1368,9 +1389,17 @@ function _verifyOne(msg) {
 function verifyPop(messages) { return guard.async.deferred(function () { return _verifyPop(messages); }); }
 function _verifyPop(messages) {
   var parsed = _coerceMessages(messages);
-  return _promiseAll(_Promise, parsed.messages.map(_verifyOne)).then(function (out) {
-    var allVerified = out.length > 0 && out.every(function (m) { return m.verified === true; });
-    return guard.verdict.of({ valid: allVerified, verified: allVerified, messages: out });
+  /** @internal The aggregate, the projection into it and the universal test over its results all come
+   * from the captures. This IS the proof-of-possession verdict for a set of requests: the aggregate's
+   * static form reads `resolve` off the constructor at each call, so a replacement answers for every
+   * message without one being verified, and the test below is what requires all of them to have
+   * verified. */
+  return intrinsic.chain(intrinsic.allOf(intrinsic.mapList(parsed.messages, _verifyOne)), function (out) {
+    var allVerified = out.length > 0 && intrinsic.everyOwn(out, function (m) { return m && m.verified === true; });
+    /** @internal Copied before it is handed back. The aggregate's own list carries no prototype, so
+     * that a `then` installed on `Array.prototype` cannot settle the aggregate with something else;
+     * a caller reading `result.messages` expects an ordinary array it can iterate and map. */
+    return guard.verdict.of({ valid: allVerified, verified: allVerified, messages: intrinsic.copyList(out) });
   });
 }
 

package/lib/crmf-verify.js

@@ -12,4 +12,4 @@ function verifyPopSignature(popo, spkiBytes, preimage) {
   return _seam.verify(popo.algorithmIdentifier, popo.signature, spkiBytes, preimage);
 }
 
-module.exports = { setEngine: _seam.setEngine, verifyPopSignature: verifyPopSignature };
+module.exports = Object.freeze({ setEngine: _seam.setEngine, verifyPopSignature: verifyPopSignature });

package/lib/csr-verify.js

@@ -13,4 +13,4 @@ function verifyCsrSignature(parsed) {
     parsed.subjectPublicKeyInfo.bytes, parsed.certificationRequestInfoBytes);
 }
 
-module.exports = { setEngine: _seam.setEngine, verifyCsrSignature: verifyCsrSignature };
+module.exports = Object.freeze({ setEngine: _seam.setEngine, verifyCsrSignature: verifyCsrSignature });

package/lib/ct.js

@@ -2253,7 +2253,7 @@ async function fetchLogList(opts) {
   });
 }
 
-module.exports = {
+module.exports = intrinsic.freeze({
   parseSctList: parseSctList,
   reconstructSignedData: reconstructSignedData,
   verifySct: verifySct,
@@ -2276,4 +2276,4 @@ module.exports = {
   addPreChain: addPreChain,
   HASH_ALGORITHMS: HASH_ALGORITHMS,
   SIGNATURE_ALGORITHMS: SIGNATURE_ALGORITHMS,
-};
+});

package/lib/edwards-point.js

@@ -73,4 +73,4 @@ function validateSpki(spkiBytes, crv, E, code) {
   }
 }
 
-module.exports = { validate: validate, validateSpki: validateSpki };
+module.exports = Object.freeze({ validate: validate, validateSpki: validateSpki });

package/lib/est.js

@@ -287,7 +287,7 @@ function _findMultipartMarks(text, boundary) {
       if (lsN !== -1) { var r1 = _matchDelimAt(text, lsN, boundary); if (r1) { found = r1; foundAt = p; break; } }
     }
     if (!found) break;
-    marks[marks.length] = { at: foundAt, bodyStart: found.end, close: found.close };
+    guard.list.append(marks, { at: foundAt, bodyStart: found.end, close: found.close });
     searchStart = found.end === foundAt ? found.end + 1 : found.end;
   }
   return marks;
@@ -328,9 +328,9 @@ function _splitCrlf(s) {
     var nlLen = 0;
     if (_charCodeAt(s, i) === 0x0d && i + 1 < n && _charCodeAt(s, i + 1) === 0x0a) nlLen = 2;
     else if (_charCodeAt(s, i) === 0x0a) nlLen = 1;
-    if (nlLen > 0) { out[out.length] = _strSlice(s, last, i); i += nlLen; last = i; } else i += 1;
+    if (nlLen > 0) { guard.list.append(out, _strSlice(s, last, i)); i += nlLen; last = i; } else i += 1;
   }
-  out[out.length] = _strSlice(s, last, n);
+  guard.list.append(out, _strSlice(s, last, n));
   return out;
 }
 

package/lib/guard-async.js

@@ -22,6 +22,26 @@ function deferred(body) {
   catch (e) { return _reject(_Promise, e); }
 }
 
+// @internal
+/** @internal A continuation taken from the capture, for a module that holds the guards rather than
+ * the intrinsic captures directly. `p.then(f)` reads `then` off the promise at the call, so a
+ * replacement settles the chain without running `f`, and `f` is where a step's result becomes the
+ * next step's input. */
+// @enforced-by behavioral -- the RED vectors live with each consumer's own verdict
+function chain(p, onOk, onFail) {
+  return _intrinsic.chain(p, onOk, onFail);
+}
+
+// @internal
+/** @internal Run `body` once the work settles, either way, and pass the outcome through unchanged.
+ * `Promise.prototype.finally` is not this: it calls the receiver's own `then`, which is the live
+ * method, so a replacement there settles the chain with a value of its own AND skips the callback.
+ * Cleanup that wipes key material is exactly the callback that must not be skipped. */
+// @enforced-by behavioral -- each consumer's RED vector drives its own cleanup
+function cleanup(p, body) {
+  return _intrinsic.chain(p, function (out) { body(); return out; }, function (e) { body(); throw e; });
+}
+
 // @internal
 // @enforced-by behavioral -- a RED vector in each client suite refuses a transport yielding no thenable
 function awaited(value, E, code, label) {
@@ -96,4 +116,5 @@ function bounded(value, ms, E, code, label) {
   });
 }
 
-module.exports = _intrinsic.freeze({ deferred: deferred, awaited: awaited, invoked: invoked, bounded: bounded });
+module.exports = _intrinsic.freeze({ deferred: deferred, awaited: awaited, invoked: invoked, bounded: bounded,
+  chain: chain, cleanup: cleanup });

package/lib/guard-bytes.js

@@ -34,7 +34,6 @@ var _mapForEach = intrinsic.uncurry(Map.prototype.forEach);
 var _String = intrinsic.String;
 var _Date = intrinsic.Date;
 var _apply = intrinsic.apply;
-var _promiseFinally = intrinsic.promiseFinally;
 var _ArrayBuffer = intrinsic.ArrayBuffer;
 var _Uint8Array = intrinsic.Uint8Array;
 var _DataView = intrinsic.DataView;
@@ -559,10 +558,14 @@ function fixArguments(ErrorClass, code, args) {
 // @enforced-by behavioral -- an arrangement of two calls has no rename-proof shape to detect. The
 function fixedCall(ErrorClass, code, args, body) {
   var handle = null;
-  return _promiseFinally(async.deferred(function () {
+  /** @internal The release is attached on BOTH outcomes rather than through `finally`, which calls
+   * the receiver's own `then` and so reads the live method: a replacement there settles the chain
+   * with a value of its own AND skips this callback, so the fixed views stay pinned. */
+  var ran = async.deferred(function () {
     handle = fixArguments(ErrorClass, code, args);
     return _apply(body, null, handle.values);
-  }), function () { if (handle) handle.release(); });
+  });
+  return async.cleanup(ran, function () { if (handle) handle.release(); });
 }
 
 /**

package/lib/guard-identifier.js

@@ -69,7 +69,7 @@ function assertCanonicalOid(str, E, code, label, boundsCode, countCode) {
   }
   if (boundsCode === null) return str;
   var bcode = boundsCode === undefined ? code : boundsCode;
-  var parts = _strSplit(str, ".");
+  var parts = intrinsic.splitChar(str, 46);
   if (parts.length - 1 > constants.LIMITS.OID_MAX_SUBIDENTIFIERS) {
     throw E(countCode || bcode, who + " carries more than " + constants.LIMITS.OID_MAX_SUBIDENTIFIERS + " sub-identifiers");
   }