@blamejs/pki 0.8.59 → 0.8.61

package/lib/lint.js

@@ -46,6 +46,13 @@ var path = require("./path-validate");
 var compositeSig = require("./composite-sig");
 var C = require("./constants");
 var ipUtils = require("./ip-utils");
+var intrinsic = require("./guard-intrinsic");
+
+/** @internal A store at an index runs a setter inherited from the prototype chain, which takes
+ * the element being appended, and this defines the index instead. The certificate, CSR and CRL
+ * signers read the findings below through `assertBuildClean` before they sign, so a finding that
+ * never lands is an artifact emitted past the check that exists to refuse it. */
+var _push = guard.list.append;
 
 var MS_PER_DAY = C.TIME.days(1);
 
@@ -72,9 +79,42 @@ function _worst(findings) {
   return w;
 }
 
+/** @internal An own-property read and an own-property write, both taken when the module loads.
+ *
+ * A record built as an object literal carries `Object.prototype`, so assigning a field it holds no
+ * own slot for runs an inherited setter with the record as the receiver, and reading a field it does
+ * not own answers from the prototype. Both decide things here. The severity the signers' producer
+ * check refuses on lives on a finding: an inherited setter handed the finding can delete that
+ * severity, and an inherited getter can then supply one, which turns a refusal into a signature.
+ * Defining the slot consults no setter, and an own read answers only from the record itself. */
+function _own(record, key) {
+  return record !== null && record !== undefined && intrinsic.hasOwn(record, key) ? record[key] : undefined;
+}
+function _define(record, key, value) {
+  intrinsic.defineProperty(record, key, { value: value, writable: true, enumerable: true, configurable: true });
+}
+
+/** @internal One of this module's own answers re-based on no prototype, so a key it does not carry
+ * reads as absent rather than from `Object.prototype`. Every consumer asks an answer for the key the
+ * other arm would have carried, and naming those keys in a list here would be one more thing to keep
+ * in step with the consumers: no prototype needs no list. These records never leave the module.
+ * Copied by own enumerable key, which is every key a literal defines. */
+function _rebase(answer) {
+  var out = intrinsic.create(null);
+  if (answer === null || answer === undefined) return out;
+  var keys = intrinsic.keys(answer);
+  for (var i = 0; i < keys.length; i++) _define(out, keys[i], answer[keys[i]]);
+  return out;
+}
+
 function _finding(rule, detail) {
   var f = { id: rule.id, severity: rule.severity, source: rule.source, citation: rule.citation, message: rule.message };
-  if (detail && detail.context) f.context = detail.context;
+  if (detail !== null && detail !== undefined) {
+    /** @internal ONE read, tested and stored: read twice, the second read is a different value when
+     * the first ran a getter. */
+    var context = _own(detail, "context");
+    if (context) _define(f, "context", context);
+  }
   return f;
 }
 
@@ -97,15 +137,22 @@ function _derivedCert(o) {
  *  since a caller can neuter the buffer between the check and the read. */
 function _derBytesOf(input) {
   if (!guard.bytes.isByteSource(input)) return null;
+  /** @internal No prototype, because the consumer asks this record for the key the other arm carries:
+   * a successful read is asked for `fatal` and a failed one for `der`. Carried on a plain literal,
+   * the key the arm does not hold answered from `Object.prototype`, so an inherited getter at `fatal`
+   * supplied a verdict for bytes that read correctly, and the producer check the signers run reads
+   * its severity off exactly that. */
+  var out = intrinsic.create(null);
   try {
-    return { der: guard.bytes.snapshotSource(input, LintError, "lint/bad-input", "pki.lint input") };
+    _define(out, "der", guard.bytes.snapshotSource(input, LintError, "lint/bad-input", "pki.lint input"));
   } catch (e) {
     /** @internal A byte source whose backing buffer was detached is still a byte source, and it
      * fails at the door rather than at the parse. The data path answers with a verdict either
      * way, or one neutered buffer aborts the scan of a whole corpus. */
-    return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint",
-      message: "input is a byte source whose bytes could not be read", context: { code: e.code } } };
+    _define(out, "fatal", { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint",
+      message: "input is a byte source whose bytes could not be read", context: { code: e.code } });
   }
+  return out;
 }
 
 function _ingest(input) {
@@ -182,13 +229,13 @@ function _runLints(rules, cert, ctx) {
   rules.forEach(function (rule) {
     if (rule.appliesTo && !rule.appliesTo(cert, ctx)) { counts.na++; return; }
     if (!_effective(rule, cert)) { counts.ne++; return; }
-    ran.push(rule.id);
+    _push(ran, rule.id);
     var res = rule.check(cert, ctx);
     if (res == null || res === false) { counts.pass++; return; }
     var details = Array.isArray(res) ? res : [res];
     details.forEach(function (d) {
       var f = _finding(rule, d === true ? null : d);
-      findings.push(f);
+      _push(findings, f);
       counts[f.severity] = (counts[f.severity] || 0) + 1;
     });
   });
@@ -233,7 +280,7 @@ function _sanDnsNames(ctx) {
 function _subjectAttributes(cert) {
   var out = [];
   ((cert.subject && cert.subject.rdns) || []).forEach(function (rdn) {
-    rdn.forEach(function (a) { out.push(a); });
+    rdn.forEach(function (a) { _push(out, a); });
   });
   return out;
 }
@@ -242,7 +289,7 @@ function _subjectValuesOf(cert, name) {
   var dotted = oid.byName(name);
   var out = [];
   _subjectAttributes(cert).forEach(function (a) {
-    if (a.type === dotted && typeof a.value === "string") out.push(a.value);
+    if (a.type === dotted && typeof a.value === "string") _push(out, a.value);
   });
   return out;
 }
@@ -387,7 +434,7 @@ var RFC5280_RULES = [
       (cert.extensions || []).forEach(function (e) {
         var fixed = CERT_FIXED_CRITICALITY[e.oid];
         if (fixed === undefined || fixed.critical !== false || e.critical !== true) return;
-        rows.push({ context: { extension: e.name || e.oid, oid: e.oid, required: "non-critical", was: "critical", scope: "extensions", citation: fixed.citation } });
+        _push(rows, { context: { extension: e.name || e.oid, oid: e.oid, required: "non-critical", was: "critical", scope: "extensions", citation: fixed.citation } });
       });
       return rows.length ? rows : null;
     },
@@ -430,7 +477,7 @@ var RFC5280_RULES = [
     check: function (cert) {
       var out = [];
       (cert.extensions || []).forEach(function (e) {
-        if (e.critical === true && _isUnknownExtension(e.oid)) out.push({ context: { oid: e.oid, name: e.name || null } });
+        if (e.critical === true && _isUnknownExtension(e.oid)) _push(out, { context: { oid: e.oid, name: e.name || null } });
       });
       return out.length ? out : null;
     },
@@ -451,7 +498,7 @@ var RFC5280_RULES = [
         if (!dec) return;
         try { dec(e.value); }
         catch (err) {
-          out.push({ context: { oid: e.oid, name: e.name || null, code: err.code } });
+          _push(out, { context: { oid: e.oid, name: e.name || null, code: err.code } });
         }
       });
       return out.length ? out : null;
@@ -502,7 +549,7 @@ var RFC5280_RULES = [
       (cert.extensions || []).forEach(function (e) {
         var row = CERT_RECOMMENDED_NON_CRITICAL[e.oid];
         if (row === undefined || e.critical !== true) return;
-        rows.push({ context: { extension: e.name || e.oid, oid: e.oid, recommended: "non-critical", was: "critical", citation: row } });
+        _push(rows, { context: { extension: e.name || e.oid, oid: e.oid, recommended: "non-critical", was: "critical", citation: row } });
       });
       return rows.length ? rows : null;
     },
@@ -523,8 +570,8 @@ var RFC5280_RULES = [
     message: "the certificate carries a unique identifier, which a conforming CA must not generate",
     check: function (cert) {
       var which = [];
-      if (cert.issuerUniqueID) which.push("issuerUniqueID");
-      if (cert.subjectUniqueID) which.push("subjectUniqueID");
+      if (cert.issuerUniqueID) _push(which, "issuerUniqueID");
+      if (cert.subjectUniqueID) _push(which, "subjectUniqueID");
       return which.length ? { context: { fields: which } } : null;
     },
   },
@@ -685,7 +732,7 @@ function _subjectIsEmpty(cert) {
 /** @internal Every policy qualifier of every PolicyInformation, as its qualifier OID. */
 function _policyQualifierIds(ctx) {
   var out = [];
-  _eachPolicyQualifier(ctx, function (qid) { out.push(qid); });
+  _eachPolicyQualifier(ctx, function (qid) { _push(out, qid); });
   return out;
 }
 
@@ -746,14 +793,14 @@ function _smimeKuNamedAnywhere(modes) {
   var out = [];
   modes.forEach(function (m) {
     m.required.concat(m.optional).forEach(function (bit) {
-      if (out.indexOf(bit) === -1) out.push(bit);
+      if (out.indexOf(bit) === -1) _push(out, bit);
     });
   });
   return out;
 }
 function _smimeKuAsserted(value) {
   var out = [];
-  KU_BIT_NAMES.forEach(function (bit) { if (value[bit] === true) out.push(bit); });
+  KU_BIT_NAMES.forEach(function (bit) { if (value[bit] === true) _push(out, bit); });
   return out;
 }
 /** @internal Whether the asserted bits are exactly some mode: every bit that mode requires, and no
@@ -912,7 +959,7 @@ function _csAiaLocations(ctx) {
     var ad = d.value[i];
     if (CS_AIA_METHODS.indexOf(ad.accessMethod) === -1) continue;
     var loc = ad.accessLocation;
-    out.push(loc && loc.tag === 6 && typeof loc.value === "string" ? loc.value : null);
+    _push(out, loc && loc.tag === 6 && typeof loc.value === "string" ? loc.value : null);
   }
   return out;
 }
@@ -1046,7 +1093,7 @@ function _smimeAiaLocationsByMethod(ctx) {
     /** @internal A location that is not a uniformResourceIdentifier carries no scheme, so it is
      * kept as null rather than dropped: the method is still provided and still has no HTTP URI. */
     var loc = ad.accessLocation;
-    out[ad.accessMethod].push(loc && loc.tag === 6 && typeof loc.value === "string" ? loc.value : null);
+    _push(out[ad.accessMethod], loc && loc.tag === 6 && typeof loc.value === "string" ? loc.value : null);
   }
   return out;
 }
@@ -1059,7 +1106,7 @@ function _crldpUris(ctx) {
     if (!point || point.kind !== "fullName" || !Array.isArray(point.names)) return;
     point.names.forEach(function (raw) {
       var u = _generalNameUri(raw);
-      if (u !== null) out.push(u);
+      if (u !== null) _push(out, u);
     });
   });
   return out;
@@ -1209,11 +1256,11 @@ var CABF_SMIME_RULES = [
       var out = [];
       KU_BIT_NAMES.forEach(function (bit) {
         if (d.value[bit] === true && named.indexOf(bit) === -1) {
-          out.push({ context: { keyUsage: bit, keyAlgorithm: kind } });
+          _push(out, { context: { keyUsage: bit, keyAlgorithm: kind } });
         }
       });
       if (d.value.reservedBitsSet === true) {
-        out.push({ context: { reservedBitSet: true, keyAlgorithm: kind } });
+        _push(out, { context: { reservedBitSet: true, keyAlgorithm: kind } });
       }
       return out.length ? out : null;
     },
@@ -1263,7 +1310,7 @@ var CABF_SMIME_RULES = [
       if (!d || !Array.isArray(d.value)) return null;
       var out = [];
       SMIME_FORBIDDEN_EKU.forEach(function (e) {
-        if (d.value.indexOf(e.oid) !== -1) out.push({ context: { keyPurpose: e.name, oid: e.oid } });
+        if (d.value.indexOf(e.oid) !== -1) _push(out, { context: { keyPurpose: e.name, oid: e.oid } });
       });
       return out.length ? out : null;
     },
@@ -1375,7 +1422,7 @@ var CABF_SMIME_RULES = [
           void 0;
         }
         if (!_isHttpOrHttpsUrl(uri)) {
-          out.push({ context: { policyIdentifier: pi.policyIdentifier, cps: uri } });
+          _push(out, { context: { policyIdentifier: pi.policyIdentifier, cps: uri } });
         }
       });
       return out.length ? out : null;
@@ -1392,7 +1439,7 @@ var CABF_SMIME_RULES = [
       _eachPolicyQualifier(ctx, function (qid, value, pi) {
         if (qid !== OID_UNOTICE) return;
         var carries = pkix.userNoticeTexts(value).some(function (t) { return t.field === "explicitText"; });
-        if (!carries) out.push({ context: { policyIdentifier: pi.policyIdentifier } });
+        if (!carries) _push(out, { context: { policyIdentifier: pi.policyIdentifier } });
       });
       return out.length ? out : null;
     },
@@ -1409,7 +1456,7 @@ var CABF_SMIME_RULES = [
         /** @internal NoticeReference requires its organization DisplayText, which userNoticeTexts
          * surfaces under that field name, so the field's presence is the noticeRef's presence. */
         var carries = pkix.userNoticeTexts(value).some(function (t) { return t.field === "organization"; });
-        if (carries) out.push({ context: { policyIdentifier: pi.policyIdentifier } });
+        if (carries) _push(out, { context: { policyIdentifier: pi.policyIdentifier } });
       });
       return out.length ? out : null;
     },
@@ -1459,7 +1506,7 @@ var CABF_SMIME_RULES = [
       var gen = _smimeGeneration(ctx);
       var out = [];
       function report(method, offending) {
-        out.push({ context: { generation: gen || "strict", accessMethod: oid.name(method) || method,
+        _push(out, { context: { generation: gen || "strict", accessMethod: oid.name(method) || method,
           uris: offending.filter(function (u) { return u !== null; }),
           nonUriLocations: offending.filter(function (u) { return u === null; }).length } });
       }
@@ -1511,7 +1558,7 @@ var CABF_SMIME_RULES = [
       var out = [];
       ["authorityCertIssuer", "authorityCertSerialNumber"].forEach(function (f) {
         var v = d.value[f];
-        if (v !== null && v !== undefined) out.push({ context: { field: f } });
+        if (v !== null && v !== undefined) _push(out, { context: { field: f } });
       });
       return out.length ? out : null;
     },
@@ -1559,7 +1606,7 @@ var CABF_SMIME_RULES = [
       var out = [];
       ["identifier", "role"].forEach(function (which) {
         if (_smimeLeiAdmits(type, which)) return;
-        if (ctx.raw(SMIME_LEI_EXTS[which])) out.push({ context: { certificateType: type, extension: which } });
+        if (ctx.raw(SMIME_LEI_EXTS[which])) _push(out, { context: { certificateType: type, extension: which } });
       });
       return out.length ? out : null;
     },
@@ -1577,7 +1624,7 @@ var CABF_SMIME_RULES = [
       ["identifier", "role"].forEach(function (which) {
         if (!_smimeLeiAdmits(type, which)) return;
         var e = ctx.raw(SMIME_LEI_EXTS[which]);
-        if (e && e.critical === true) out.push({ context: { certificateType: type, extension: which } });
+        if (e && e.critical === true) _push(out, { context: { certificateType: type, extension: which } });
       });
       return out.length ? out : null;
     },
@@ -1592,7 +1639,7 @@ var CABF_SMIME_RULES = [
     check: function (cert, ctx) {
       var out = [];
       SMIME_ADOBE_EXTS.forEach(function (name) {
-        if (ctx.raw(name)) out.push({ context: { extension: name } });
+        if (ctx.raw(name)) _push(out, { context: { extension: name } });
       });
       return out.length ? out : null;
     },
@@ -1609,7 +1656,7 @@ var CABF_SMIME_RULES = [
       var out = [];
       SMIME_ADOBE_EXTS.forEach(function (name) {
         var e = ctx.raw(name);
-        if (e && e.critical === true) out.push({ context: { extension: name } });
+        if (e && e.critical === true) _push(out, { context: { extension: name } });
       });
       return out.length ? out : null;
     },
@@ -1862,7 +1909,7 @@ var MOZILLA_RULES = [
       if (!d || !Array.isArray(d.value)) return { context: { reason: "no extKeyUsage extension" } };
       var out = [];
       ["serverAuth", "anyExtendedKeyUsage"].forEach(function (name) {
-        if (d.value.indexOf(oid.byName(name)) !== -1) out.push({ context: { purpose: name } });
+        if (d.value.indexOf(oid.byName(name)) !== -1) _push(out, { context: { purpose: name } });
       });
       return out.length ? out : null;
     },
@@ -2062,7 +2109,7 @@ var CHROME_RULES = [
       var out = [];
       purposes.forEach(function (dotted) {
         if (CHROME_TLS_PURPOSES.indexOf(dotted) === -1) {
-          out.push({ context: { purpose: _chromePurposeLabel(dotted) } });
+          _push(out, { context: { purpose: _chromePurposeLabel(dotted) } });
         }
       });
       return out.length ? out : null;
@@ -2114,7 +2161,7 @@ var CHROME_RULES = [
       var out = [];
       purposes.forEach(function (dotted) {
         if (dotted !== oid.byName("serverAuth")) {
-          out.push({ context: { purpose: _chromePurposeLabel(dotted) } });
+          _push(out, { context: { purpose: _chromePurposeLabel(dotted) } });
         }
       });
       return out.length ? out : null;
@@ -2304,7 +2351,7 @@ var MICROSOFT_RULES = [
       if (!ku || !ku.value) return null;
       var out = [];
       ["keyCertSign", "cRLSign"].forEach(function (bit) {
-        if (ku.value[bit] !== true) out.push({ context: { bit: bit } });
+        if (ku.value[bit] !== true) _push(out, { context: { bit: bit } });
       });
       return out.length ? out : null;
     },
@@ -2347,7 +2394,7 @@ var MICROSOFT_RULES = [
       var out = [];
       purposes.forEach(function (dotted) {
         if (MS_ENABLED_EKUS.indexOf(dotted) === -1) {
-          out.push({ context: { purpose: oid.name(dotted) || dotted } });
+          _push(out, { context: { purpose: oid.name(dotted) || dotted } });
         }
       });
       return out.length ? out : null;
@@ -2406,7 +2453,7 @@ var MICROSOFT_RULES = [
       if (!_msNamesPurpose(ctx, "serverAuth")) return null;
       var out = [];
       ["emailProtection", "codeSigning", "timeStamping"].forEach(function (name) {
-        if (_msNamesPurpose(ctx, name)) out.push({ context: { purpose: name } });
+        if (_msNamesPurpose(ctx, name)) _push(out, { context: { purpose: name } });
       });
       return out.length ? out : null;
     },
@@ -2457,7 +2504,7 @@ var MICROSOFT_RULES = [
       var signing = oid.byName("ocspSigning");
       var out = [];
       purposes.forEach(function (dotted) {
-        if (dotted !== signing) out.push({ context: { purpose: oid.name(dotted) || dotted } });
+        if (dotted !== signing) _push(out, { context: { purpose: oid.name(dotted) || dotted } });
       });
       return out.length ? out : null;
     },
@@ -2559,7 +2606,7 @@ var APPLE_TRUST_PURPOSES = [
 var APPLE_PURPOSE_EKUS = [];
 APPLE_TRUST_PURPOSES.forEach(function (p) {
   p.ekus.forEach(function (d) {
-    if (APPLE_PURPOSE_EKUS.indexOf(d) === -1) APPLE_PURPOSE_EKUS.push(d);
+    if (APPLE_PURPOSE_EKUS.indexOf(d) === -1) _push(APPLE_PURPOSE_EKUS, d);
   });
 });
 /** @internal Sec. 1.7 and the change log: an extended key usage extension and the prohibition on
@@ -2806,7 +2853,7 @@ function _qcSemanticsAll(ctx) {
   for (var i = 0; i < d.value.length; i++) {
     var st = d.value[i];
     if (st.statementId !== v1 && st.statementId !== v2) continue;
-    if (st.info && st.info.semanticsIdentifier) out.push(st.info);
+    if (st.info && st.info.semanticsIdentifier) _push(out, st.info);
   }
   return out;
 }
@@ -2817,7 +2864,7 @@ function _qcStatementInfos(ctx, name) {
   if (!d || !Array.isArray(d.value)) return out;
   var dotted = oid.byName(name);
   for (var i = 0; i < d.value.length; i++) {
-    if (d.value[i].statementId === dotted) out.push(d.value[i].info === null ? {} : d.value[i].info);
+    if (d.value[i].statementId === dotted) _push(out, d.value[i].info === null ? {} : d.value[i].info);
   }
   return out;
 }
@@ -2905,7 +2952,7 @@ var ETSI_QC_RULES = [
       _qcStatementInfos(ctx, "qcType").forEach(function (info) {
         if (!Array.isArray(info.types)) return;
         info.types.forEach(function (d) {
-          if (QC_TYPE_PURPOSES.indexOf(d) !== -1 && named.indexOf(d) === -1) named.push(d);
+          if (QC_TYPE_PURPOSES.indexOf(d) !== -1 && named.indexOf(d) === -1) _push(named, d);
         });
       });
       return named.length > 1 ? { context: { purposes: named } } : null;
@@ -2925,7 +2972,7 @@ var ETSI_QC_RULES = [
         var https = info.locations.filter(function (l) {
           return pkiBuild.httpUrlScheme(l && l.url) === "https";
         });
-        if (!https.length) out.push({ context: { locations: info.locations.length } });
+        if (!https.length) _push(out, { context: { locations: info.locations.length } });
       });
       return out.length ? out : null;
     },
@@ -2945,7 +2992,7 @@ var ETSI_QC_RULES = [
           return typeof l.language === "string" && l.language.toLowerCase() === "en";
         });
         if (!english.length) {
-          out.push({ context: { languages: info.locations.map(function (l) { return l.language; }) } });
+          _push(out, { context: { languages: info.locations.map(function (l) { return l.language; }) } });
         }
       });
       return out.length ? out : null;
@@ -2965,7 +3012,7 @@ var ETSI_QC_RULES = [
         info.locations.forEach(function (l) {
           if (typeof l.language !== "string") return;
           var key = l.language.toLowerCase();
-          if (seen[key]) { out.push({ context: { language: l.language } }); return; }
+          if (seen[key]) { _push(out, { context: { language: l.language } }); return; }
           seen[key] = true;
         });
       });
@@ -2988,7 +3035,7 @@ var ETSI_QC_RULES = [
       var out = [];
       _subjectValuesOf(cert, "serialNumber").forEach(function (v) {
         var parts = _qcIdentityParts(v);
-        if (!_qcKnownReference(parts, QC_NATURAL_TYPES)) out.push({ context: { serialNumber: v } });
+        if (!_qcKnownReference(parts, QC_NATURAL_TYPES)) _push(out, { context: { serialNumber: v } });
       });
       return out.length ? out : null;
     },
@@ -3004,7 +3051,7 @@ var ETSI_QC_RULES = [
       _subjectValuesOf(cert, "serialNumber").forEach(function (v) {
         var parts = _qcIdentityParts(v);
         if (parts && !parts.local && parts.reference === QC_DEPRECATED_NATURAL_TYPE) {
-          out.push({ context: { serialNumber: v } });
+          _push(out, { context: { serialNumber: v } });
         }
       });
       return out.length ? out : null;
@@ -3021,7 +3068,7 @@ var ETSI_QC_RULES = [
       var out = [];
       _subjectValuesOf(cert, "organizationIdentifier").forEach(function (v) {
         var parts = _qcIdentityParts(v);
-        if (!_qcKnownReference(parts, QC_LEGAL_TYPES)) out.push({ context: { organizationIdentifier: v } });
+        if (!_qcKnownReference(parts, QC_LEGAL_TYPES)) _push(out, { context: { organizationIdentifier: v } });
       });
       return out.length ? out : null;
     },
@@ -3040,7 +3087,7 @@ var ETSI_QC_RULES = [
       _subjectValuesOf(cert, "organizationIdentifier").forEach(function (v) {
         var parts = _qcIdentityParts(v);
         if (!parts || parts.local || parts.reference !== "LEI") return;
-        if (parts.country !== QC_LEI_COUNTRY) out.push({ context: { country: parts.country } });
+        if (parts.country !== QC_LEI_COUNTRY) _push(out, { context: { country: parts.country } });
       });
       return out.length ? out : null;
     },
@@ -3060,7 +3107,7 @@ var ETSI_QC_RULES = [
           ? "organizationIdentifier" : "serialNumber";
         if (!_qcHasLocalReference(cert, attr)) return;
         var list = info.nameRegistrationAuthorities;
-        if (!Array.isArray(list) || !list.length) out.push({ context: { attribute: attr } });
+        if (!Array.isArray(list) || !list.length) _push(out, { context: { attribute: attr } });
       });
       return out.length ? out : null;
     },
@@ -3083,7 +3130,7 @@ var ETSI_QC_RULES = [
         var natural = info.semanticsIdentifier === oid.byName("semanticsId-Natural");
         if (!natural && !_qcHasLocalReference(cert, "organizationIdentifier")) return;
         if (!_qcHasUriAuthority(info)) {
-          out.push({ context: { semanticsIdentifier: oid.name(info.semanticsIdentifier) } });
+          _push(out, { context: { semanticsIdentifier: oid.name(info.semanticsIdentifier) } });
         }
       });
       return out.length ? out : null;
@@ -3144,7 +3191,7 @@ var CABF_CS_RULES = [
           void 0;
         }
         if (pkiBuild.httpUrlScheme(uri) !== "http") {
-          out.push({ context: { policyIdentifier: pi.policyIdentifier, cps: uri } });
+          _push(out, { context: { policyIdentifier: pi.policyIdentifier, cps: uri } });
         }
       });
       return out.length ? out : null;
@@ -3270,7 +3317,7 @@ var CABF_CS_RULES = [
       if (!d || !d.value) return null;
       var out = [];
       CS_FORBIDDEN_KU.forEach(function (bit) {
-        if (d.value[bit] === true) out.push({ context: { keyUsage: bit } });
+        if (d.value[bit] === true) _push(out, { context: { keyUsage: bit } });
       });
       return out.length ? out : null;
     },
@@ -3288,9 +3335,9 @@ var CABF_CS_RULES = [
       var out = [];
       KU_BIT_NAMES.forEach(function (bit) {
         if (bit === "digitalSignature" || CS_FORBIDDEN_KU.indexOf(bit) !== -1) return;
-        if (d.value[bit] === true) out.push({ context: { keyUsage: bit } });
+        if (d.value[bit] === true) _push(out, { context: { keyUsage: bit } });
       });
-      if (d.value.reservedBitsSet === true) out.push({ context: { reservedBitSet: true } });
+      if (d.value.reservedBitsSet === true) _push(out, { context: { reservedBitSet: true } });
       return out.length ? out : null;
     },
   },
@@ -3335,7 +3382,7 @@ var CABF_CS_RULES = [
       var out = [];
       CS_FORBIDDEN_EKU.forEach(function (dotted) {
         if (d.value.indexOf(dotted) !== -1) {
-          out.push({ context: { purpose: dotted, name: oid.name(dotted) || null } });
+          _push(out, { context: { purpose: dotted, name: oid.name(dotted) || null } });
         }
       });
       return out.length ? out : null;
@@ -3354,14 +3401,14 @@ var CABF_CS_RULES = [
       var d = ctx.decode("extKeyUsage");
       if (!d || !Array.isArray(d.value)) return null;
       var required = [];
-      if (_isCsTimestamp(cert, ctx)) required.push(oid.byName("timeStamping"));
-      if (_isCsCodeSigning(cert, ctx)) required.push(oid.byName("codeSigning"));
+      if (_isCsTimestamp(cert, ctx)) _push(required, oid.byName("timeStamping"));
+      if (_isCsCodeSigning(cert, ctx)) _push(required, oid.byName("codeSigning"));
       var out = [];
       d.value.forEach(function (dotted) {
         if (required.indexOf(dotted) !== -1) return;
         if (CS_PERMITTED_EXTRA_EKU.indexOf(dotted) !== -1) return;
         if (CS_FORBIDDEN_EKU.indexOf(dotted) !== -1) return;
-        out.push({ context: { purpose: dotted, name: oid.name(dotted) || null } });
+        _push(out, { context: { purpose: dotted, name: oid.name(dotted) || null } });
       });
       return out.length ? out : null;
     },
@@ -3461,7 +3508,7 @@ var CABF_CS_RULES = [
       var out = [];
       _subjectAttributes(cert).forEach(function (a) {
         if (typeof a.value !== "string" || !_isMetadataOnlyValue(a.value)) return;
-        out.push({ context: { attribute: oid.name(a.type) || a.type, value: a.value } });
+        _push(out, { context: { attribute: oid.name(a.type) || a.type, value: a.value } });
       });
       return out.length ? out : null;
     },
@@ -3501,7 +3548,7 @@ var CABF_CS_RULES = [
     check: function (cert) {
       var out = [];
       _subjectValuesOf(cert, "countryName").forEach(function (v) {
-        if (!_isTwoLetterCountry(v)) out.push({ context: { countryName: v } });
+        if (!_isTwoLetterCountry(v)) _push(out, { context: { countryName: v } });
       });
       return out.length ? out : null;
     },
@@ -3519,7 +3566,7 @@ var CABF_CS_RULES = [
     check: function (cert) {
       var out = [];
       _subjectValuesOf(cert, "businessCategory").forEach(function (v) {
-        if (CS_BUSINESS_CATEGORIES.indexOf(v) === -1) out.push({ context: { businessCategory: v } });
+        if (CS_BUSINESS_CATEGORIES.indexOf(v) === -1) _push(out, { context: { businessCategory: v } });
       });
       return out.length ? out : null;
     },
@@ -3568,7 +3615,7 @@ var CABF_TLS_RULES = [
       var out = [];
       d.value.forEach(function (ad) {
         if (CABF_AIA_METHODS.indexOf(ad.accessMethod) === -1) {
-          out.push({ context: { accessMethod: ad.accessMethod, name: oid.name(ad.accessMethod) || null } });
+          _push(out, { context: { accessMethod: ad.accessMethod, name: oid.name(ad.accessMethod) || null } });
         }
       });
       return out.length ? out : null;
@@ -3588,7 +3635,7 @@ var CABF_TLS_RULES = [
         if (CABF_AIA_METHODS.indexOf(ad.accessMethod) === -1) return;
         var loc = ad.accessLocation;
         if (!loc || loc.tag !== 6) {
-          out.push({ context: { accessMethod: oid.name(ad.accessMethod) || ad.accessMethod,
+          _push(out, { context: { accessMethod: oid.name(ad.accessMethod) || ad.accessMethod,
             generalNameTag: loc ? loc.tag : null } });
         }
       });
@@ -3638,7 +3685,7 @@ var CABF_TLS_RULES = [
     check: function (cert, ctx) {
       var out = [];
       _policyQualifierIds(ctx).forEach(function (qid) {
-        if (qid !== OID_CPS) out.push({ context: { qualifier: qid, name: oid.name(qid) || null } });
+        if (qid !== OID_CPS) _push(out, { context: { qualifier: qid, name: oid.name(qid) || null } });
       });
       return out.length ? out : null;
     },
@@ -3652,7 +3699,7 @@ var CABF_TLS_RULES = [
       if (!d || !Array.isArray(d.value)) return null;
       var out = [];
       CABF_FORBIDDEN_EKU.forEach(function (e) {
-        if (d.value.indexOf(e.oid) !== -1) out.push({ context: { keyPurpose: e.name, oid: e.oid } });
+        if (d.value.indexOf(e.oid) !== -1) _push(out, { context: { keyPurpose: e.name, oid: e.oid } });
       });
       return out.length ? out : null;
     },
@@ -3696,7 +3743,7 @@ var CABF_TLS_RULES = [
       var forbidden = table === "ecc" ? CABF_KU_FORBIDDEN_ECC : CABF_KU_FORBIDDEN_RSA;
       var out = [];
       forbidden.forEach(function (bit) {
-        if (d.value[bit] === true) out.push({ context: { keyUsage: bit, keyType: table } });
+        if (d.value[bit] === true) _push(out, { context: { keyUsage: bit, keyType: table } });
       });
       return out.length ? out : null;
     },
@@ -3738,7 +3785,7 @@ var CABF_TLS_RULES = [
       var out = [];
       d.value.names.forEach(function (gn) {
         if (CABF_SAN_PERMITTED_TAGS.indexOf(gn.tagNumber) === -1) {
-          out.push({ context: { generalName: CABF_SAN_TAG_NAMES[gn.tagNumber] || null, tag: gn.tagNumber } });
+          _push(out, { context: { generalName: CABF_SAN_TAG_NAMES[gn.tagNumber] || null, tag: gn.tagNumber } });
         }
       });
       return out.length ? out : null;
@@ -3771,7 +3818,7 @@ var CABF_TLS_RULES = [
       var out = [];
       _sanDnsNames(ctx).forEach(function (name) {
         if (typeof name === "string" && name.length > 0 && name.charAt(name.length - 1) === ".") {
-          out.push({ context: { dnsName: name } });
+          _push(out, { context: { dnsName: name } });
         }
       });
       return out.length ? out : null;
@@ -3801,7 +3848,7 @@ var CABF_TLS_RULES = [
       var sans = _sanDnsNames(ctx).map(function (s) { return typeof s === "string" ? s.toLowerCase() : s; }), out = [];
       _subjectCNs(cert).forEach(function (cn) {
         if (_looksLikeIp(cn)) return;
-        if (sans.indexOf(cn.toLowerCase()) === -1) out.push({ context: { cn: cn } });
+        if (sans.indexOf(cn.toLowerCase()) === -1) _push(out, { context: { cn: cn } });
       });
       return out.length ? out : null;
     },
@@ -3812,7 +3859,7 @@ var CABF_TLS_RULES = [
     appliesTo: _isTls,
     check: function (cert, ctx) {
       var out = [];
-      _sanDnsNames(ctx).forEach(function (name) { var p = _dnsNameProblem(name); if (p) out.push({ context: { dnsName: name, problem: p } }); });
+      _sanDnsNames(ctx).forEach(function (name) { var p = _dnsNameProblem(name); if (p) _push(out, { context: { dnsName: name, problem: p } }); });
       return out.length ? out : null;
     },
   },
@@ -4035,7 +4082,7 @@ var X509_ALTSIG_RULES = [
       (cert.extensions || []).forEach(function (e) {
         if (e.critical !== true) return;
         if (e.oid !== OID_SAPKI && e.oid !== OID_ALT_ALG && e.oid !== OID_ALT_VAL) return;
-        rows.push({ context: { extension: e.name || e.oid, recommended: "non-critical", was: "critical" } });
+        _push(rows, { context: { extension: e.name || e.oid, recommended: "non-critical", was: "critical" } });
       });
       return rows.length ? rows : null;
     },
@@ -4100,7 +4147,7 @@ var RFC7633_RULES = [
       var rows = [];
       for (var i = 0; i < features.length; i++) {
         var f = features[i];
-        if (f < 0n || f > 65535n) rows.push({ context: { feature: String(f), width: "0..65535" } });
+        if (f < 0n || f > 65535n) _push(rows, { context: { feature: String(f), width: "0..65535" } });
       }
       return rows.length ? rows : null;
     },
@@ -4119,7 +4166,7 @@ var RFC7633_RULES = [
       var seen = new Set();
       var rows = [];
       for (var i = 0; i < features.length; i++) {
-        if (seen.has(features[i])) rows.push({ context: { feature: String(features[i]) } });
+        if (seen.has(features[i])) _push(rows, { context: { feature: String(features[i]) } });
         else seen.add(features[i]);
       }
       return rows.length ? rows : null;
@@ -4385,7 +4432,7 @@ function _criticalityRows(list, table, what) {
     var want = table[e.oid];
     if (want === undefined) return;
     if ((e.critical === true) !== want) {
-      out.push({ context: { extension: e.name || e.oid, required: want ? "critical" : "non-critical", was: e.critical === true ? "critical" : "non-critical", scope: what } });
+      _push(out, { context: { extension: e.name || e.oid, required: want ? "critical" : "non-critical", was: e.critical === true ? "critical" : "non-critical", scope: what } });
     }
   });
   return out;
@@ -4434,7 +4481,7 @@ var RFC5280_CRL_RULES = [
         var e = _crlExtByName(crl, carrier.name);
         if (!e) return;
         var octets = _integerOctets(carrier.read(e));
-        if (octets !== null && octets > 20) out.push({ context: { extension: carrier.name, octets: octets } });
+        if (octets !== null && octets > 20) _push(out, { context: { extension: carrier.name, octets: octets } });
       });
       return out.length ? out : null;
     },
@@ -4483,7 +4530,7 @@ var RFC5280_CRL_RULES = [
       var rows = [];
       (crl.revokedCertificates || []).forEach(function (r, i) {
         _criticalityRows(r.crlEntryExtensions, CRL_ENTRY_CRITICALITY, "crlEntryExtensions")
-          .forEach(function (row) { row.context.entry = i; rows.push(row); });
+          .forEach(function (row) { row.context.entry = i; _push(rows, row); });
       });
       return rows.length ? rows : null;
     },
@@ -4510,7 +4557,7 @@ var RFC5280_CRL_RULES = [
       (crl.revokedCertificates || []).forEach(function (row, i) {
         if (typeof row.serialNumber !== "bigint") return;
         var key = row.serialNumber.toString(16);
-        if (seen[key] !== undefined) out.push({ context: { entry: i, firstSeenAt: seen[key], serialNumber: String(row.serialNumber) } });
+        if (seen[key] !== undefined) _push(out, { context: { entry: i, firstSeenAt: seen[key], serialNumber: String(row.serialNumber) } });
         else seen[key] = i;
       });
       return out.length ? out : null;
@@ -4528,7 +4575,7 @@ var RFC5280_CRL_RULES = [
       var out = [];
       (crl.revokedCertificates || []).forEach(function (row, i) {
         (row.crlEntryExtensions || []).forEach(function (e) {
-          if (e.oid === oid.byName("certificateIssuer")) out.push({ context: { entry: i } });
+          if (e.oid === oid.byName("certificateIssuer")) _push(out, { context: { entry: i } });
         });
       });
       return out.length ? out : null;
@@ -4556,7 +4603,7 @@ var RFC5280_CRL_RULES = [
           names.forEach(function (n) {
             if (n.tagNumber === 4 && n.value && (n.value.rdns || []).length > 0) hasDn = true;
           });
-          if (!hasDn) out.push({ context: { entry: i } });
+          if (!hasDn) _push(out, { context: { entry: i } });
         });
       });
       return out.length ? out : null;
@@ -4576,7 +4623,7 @@ var RFC5280_CRL_RULES = [
       var out = [];
       (crl.revokedCertificates || []).forEach(function (row, i) {
         (row.crlEntryExtensions || []).forEach(function (e) {
-          if (e.oid === oid.byName("reasonCode") && Number(e.value) === 0) out.push({ context: { entry: i } });
+          if (e.oid === oid.byName("reasonCode") && Number(e.value) === 0) _push(out, { context: { entry: i } });
         });
       });
       return out.length ? out : null;
@@ -4597,7 +4644,7 @@ var RFC5280_CRL_RULES = [
           if (e.oid !== oid.byName("reasonCode")) return;
           var bit = REASON_TO_FLAG_BIT[Number(e.value)];
           if (bit === undefined) return;
-          if (!_reasonBitSet(scope, bit)) out.push({ context: { entry: i, reasonCode: Number(e.value) } });
+          if (!_reasonBitSet(scope, bit)) _push(out, { context: { entry: i, reasonCode: Number(e.value) } });
         });
       });
       return out.length ? out : null;
@@ -4615,7 +4662,7 @@ var RFC5280_CRL_RULES = [
       var out = [];
       (crl.revokedCertificates || []).forEach(function (row, i) {
         (row.crlEntryExtensions || []).forEach(function (e) {
-          if (e.oid === oid.byName("reasonCode") && Number(e.value) === 0) out.push({ context: { entry: i } });
+          if (e.oid === oid.byName("reasonCode") && Number(e.value) === 0) _push(out, { context: { entry: i } });
         });
       });
       return out.length ? out : null;
@@ -4630,7 +4677,7 @@ var RFC5280_CRL_RULES = [
       var out = [];
       (crl.revokedCertificates || []).forEach(function (row, i) {
         if (typeof row.serialNumber === "bigint" && row.serialNumber <= 0n) {
-          out.push({ context: { entry: i, serialNumber: String(row.serialNumber) } });
+          _push(out, { context: { entry: i, serialNumber: String(row.serialNumber) } });
         }
       });
       return out.length ? out : null;
@@ -4643,7 +4690,7 @@ var RFC5280_CRL_RULES = [
       var out = [];
       (crl.revokedCertificates || []).forEach(function (row, i) {
         var octets = _integerOctets(row.serialNumber);
-        if (octets !== null && octets > 20) out.push({ context: { entry: i, octets: octets } });
+        if (octets !== null && octets > 20) _push(out, { context: { entry: i, octets: octets } });
       });
       return out.length ? out : null;
     },
@@ -4660,12 +4707,12 @@ var RFC5280_CRL_RULES = [
       if (idp.malformed) return null;
       var out = [];
       if (!idp.hasDistributionPoint && !idp.onlyUser && !idp.onlyCa && !idp.onlySomeReasonsPresent && !idp.indirect && !idp.onlyAttr) {
-        out.push({ context: { reason: "states no scope at all" } });
+        _push(out, { context: { reason: "states no scope at all" } });
       }
-      if (idp.onlyUser && idp.onlyCa) out.push({ context: { reason: "sets both onlyContainsUserCerts and onlyContainsCACerts" } });
-      if (idp.onlyAttr) out.push({ context: { reason: "sets onlyContainsAttributeCerts" } });
+      if (idp.onlyUser && idp.onlyCa) _push(out, { context: { reason: "sets both onlyContainsUserCerts and onlyContainsCACerts" } });
+      if (idp.onlyAttr) _push(out, { context: { reason: "sets onlyContainsAttributeCerts" } });
       if (idp.onlySomeReasonsPresent && !_scopeNamesAnyReason(idp.onlySomeReasonsValue)) {
-        out.push({ context: { reason: "sets onlySomeReasons to a mask naming no reason code" } });
+        _push(out, { context: { reason: "sets onlySomeReasons to a mask naming no reason code" } });
       }
       return out.length ? out : null;
     },
@@ -4683,8 +4730,8 @@ var RFC5280_CRL_RULES = [
       if (dps === null) return null;
       var out = [];
       dps.forEach(function (dp, i) {
-        if (dp.reasons) out.push({ context: { index: i, field: "reasons" } });
-        if (dp.cRLIssuer) out.push({ context: { index: i, field: "cRLIssuer" } });
+        if (dp.reasons) _push(out, { context: { index: i, field: "reasons" } });
+        if (dp.cRLIssuer) _push(out, { context: { index: i, field: "cRLIssuer" } });
       });
       return out.length ? out : null;
     },
@@ -4714,7 +4761,7 @@ var RFC5280_CRL_RULES = [
       var out = [];
       descs.forEach(function (d, i) {
         if (d.accessMethod === CA_ISSUERS_OID) return;
-        out.push({ context: { index: i, method: oid.name(d.accessMethod) || d.accessMethod } });
+        _push(out, { context: { index: i, method: oid.name(d.accessMethod) || d.accessMethod } });
       });
       return out.length ? out : null;
     },
@@ -4755,14 +4802,14 @@ var RFC5280_CRL_RULES = [
       if (e && Buffer.isBuffer(e.value)) {
         var idp = pkix.decodeIssuingDistributionPointValue(NS, e.value, _LINT_VALUE_CODE);
         if (!idp.malformed && idp.distributionPoint && idp.distributionPoint.kind === "rdn") {
-          out.push({ context: { extension: "issuingDistributionPoint", form: "nameRelativeToCRLIssuer" } });
+          _push(out, { context: { extension: "issuingDistributionPoint", form: "nameRelativeToCRLIssuer" } });
         }
       }
       var dps = _crlDecodedExtension(crl, "freshestCRL");
       if (dps) {
         dps.forEach(function (dp, i) {
           if (!dp.distributionPoint || dp.distributionPoint.kind !== "rdn") return;
-          out.push({ context: { extension: "freshestCRL", index: i, form: "nameRelativeToCRLIssuer" } });
+          _push(out, { context: { extension: "freshestCRL", index: i, form: "nameRelativeToCRLIssuer" } });
         });
       }
       return out.length ? out : null;
@@ -4787,7 +4834,7 @@ var RFC5280_CRL_RULES = [
       var out = [];
       (crl.revokedCertificates || []).forEach(function (row, i) {
         (row.crlEntryExtensions || []).forEach(function (e) {
-          if (e.oid === oid.byName("reasonCode") && Number(e.value) === 8) out.push({ context: { entry: i } });
+          if (e.oid === oid.byName("reasonCode") && Number(e.value) === 8) _push(out, { context: { entry: i } });
         });
       });
       return out.length ? out : null;
@@ -4810,12 +4857,12 @@ var RFC5280_CRL_RULES = [
       var out = [];
       _crlExtList(crl).forEach(function (e) {
         var why = _valueSyntaxFault(e, CRL_KNOWN_EXTENSIONS, CRL_VALUE_READER);
-        if (why) out.push({ context: { extension: e.name || e.oid, scope: "crlExtensions", reason: why } });
+        if (why) _push(out, { context: { extension: e.name || e.oid, scope: "crlExtensions", reason: why } });
       });
       (crl.revokedCertificates || []).forEach(function (row, i) {
         (row.crlEntryExtensions || []).forEach(function (e) {
           var why = _valueSyntaxFault(e, CRL_ENTRY_CRITICALITY, CRL_ENTRY_VALUE_READER);
-          if (why) out.push({ context: { extension: e.name || e.oid, scope: "crlEntryExtensions", entry: i, reason: why } });
+          if (why) _push(out, { context: { extension: e.name || e.oid, scope: "crlEntryExtensions", entry: i, reason: why } });
         });
       });
       return out.length ? out : null;
@@ -4834,13 +4881,13 @@ var RFC5280_CRL_RULES = [
       var out = [];
       _crlExtList(crl).forEach(function (e) {
         if (e.critical === true && CRL_KNOWN_EXTENSIONS[e.oid] === undefined) {
-          out.push({ context: { oid: e.oid, name: e.name || null, scope: "crlExtensions" } });
+          _push(out, { context: { oid: e.oid, name: e.name || null, scope: "crlExtensions" } });
         }
       });
       (crl.revokedCertificates || []).forEach(function (row, i) {
         (row.crlEntryExtensions || []).forEach(function (e) {
           if (e.critical === true && CRL_ENTRY_CRITICALITY[e.oid] === undefined) {
-            out.push({ context: { oid: e.oid, name: e.name || null, scope: "crlEntryExtensions", entry: i } });
+            _push(out, { context: { oid: e.oid, name: e.name || null, scope: "crlEntryExtensions", entry: i } });
           }
         });
       });
@@ -4961,7 +5008,7 @@ function _cmsAllSignerInfos(cms) {
     if (!Array.isArray(signerInfos) || depth > C.LIMITS.CMS_MAX_COUNTERSIGNATURE_DEPTH) return;
     signerInfos.forEach(function (si, i) {
       var index = isCounter ? signerIndex : i;
-      out.push({ signerInfo: si, signerIndex: index, countersignature: isCounter });
+      _push(out, { signerInfo: si, signerIndex: index, countersignature: isCounter });
       (Array.isArray(si.unsignedAttrs) ? si.unsignedAttrs : []).forEach(function (attr) {
         if (attr.type !== OID_COUNTERSIGNATURE) return;
         if (!Array.isArray(attr.values)) return;
@@ -5017,7 +5064,7 @@ var RFC5652_CMS_RULES = [
         try { when = asn1.read.time(asn1.decode(value)); } catch (_e) { return; }
         var year = when.getUTCFullYear();
         if (year >= 1950 && year <= 2049) {
-          out.push({ context: { signerIndex: entry.signerIndex,
+          _push(out, { context: { signerIndex: entry.signerIndex,
             countersignature: entry.countersignature, year: year } });
         }
       });
@@ -5043,7 +5090,7 @@ var RFC5652_CMS_RULES = [
         if (!mine) return;
         var found = listed.some(function (alg) { return _cmsSameAlgorithm(alg, mine); });
         if (!found) {
-          out.push({ context: { signerIndex: entry.signerIndex, countersignature: entry.countersignature,
+          _push(out, { context: { signerIndex: entry.signerIndex, countersignature: entry.countersignature,
             digestAlgorithm: mine.name || mine.oid } });
         }
       });
@@ -5122,7 +5169,7 @@ var RFC5652_CMS_RULES = [
           var resp = entry.ocspResponse;
           if (resp && resp.basicResponse) return;
           var rb = resp && resp.responseBytes;
-          out.push({ context: { placement: bucket.where, index: index,
+          _push(out, { context: { placement: bucket.where, index: index,
             otherRevInfoFormat: entry.otherRevInfoFormat,
             otherRevInfoFormatName: entry.otherRevInfoFormatName,
             responseType: (rb && rb.responseType) || null,
@@ -5166,7 +5213,7 @@ var RFC8933_CMS_RULES = [
         if (!Array.isArray(entry.signerInfo.signedAttrs) || !entry.signerInfo.signedAttrs.length) return;
         if (_cmsSignedAttr(entry.signerInfo, OID_ALG_PROTECTION) ||
             _cmsSignedAttr(entry.signerInfo, OID_ALG_PROTECTION_AA)) return;
-        out.push({ context: { signerIndex: entry.signerIndex, countersignature: entry.countersignature } });
+        _push(out, { context: { signerIndex: entry.signerIndex, countersignature: entry.countersignature } });
       });
       return out.length ? out : null;
     },
@@ -5345,7 +5392,7 @@ var RFC5755_AC_RULES = [
         var row = AC_FIXED_CRITICALITY[x.oid];
         if (!row) return;
         if (x.critical !== row.critical) {
-          out.push({ context: { extension: row.name, clause: row.clause, critical: x.critical === true } });
+          _push(out, { context: { extension: row.name, clause: row.clause, critical: x.critical === true } });
         }
       });
       return out.length ? out : null;
@@ -5366,7 +5413,7 @@ var RFC5755_AC_RULES = [
       (ac.extensions || []).forEach(function (x) {
         if (x.critical !== true) return;
         if (AC_FIXED_CRITICALITY[x.oid]) return;
-        out.push({ context: { oid: x.oid, name: x.name || null } });
+        _push(out, { context: { oid: x.oid, name: x.name || null } });
       });
       return out.length ? out : null;
     },
@@ -5382,7 +5429,7 @@ var RFC5755_AC_RULES = [
       if (!holder) return null;
       var named = [];
       ["baseCertificateID", "entityName", "objectDigestInfo"].forEach(function (k) {
-        if (holder[k] !== null && holder[k] !== undefined) named.push(k);
+        if (holder[k] !== null && holder[k] !== undefined) _push(named, k);
       });
       return named.length > 1 ? { context: { options: named } } : null;
     },
@@ -5508,7 +5555,7 @@ function _perResponse(resp, fn) {
   _ocspResponses(resp).forEach(function (sr, i) {
     var out = fn(sr, i);
     if (out == null) return;
-    (Array.isArray(out) ? out : [out]).forEach(function (row) { row.context.response = i; rows.push(row); });
+    (Array.isArray(out) ? out : [out]).forEach(function (row) { row.context.response = i; _push(rows, row); });
   });
   return rows.length ? rows : null;
 }
@@ -5626,7 +5673,7 @@ var RFC6960_OCSP_RULES = [
         if (!_isNonIssuedShape(sr)) return null;
         var rows = [];
         _ocspSingleExts(sr).forEach(function (e) {
-          if (e.oid === OID_OCSP_CRL || CRL_ENTRY_CRITICALITY[e.oid] !== undefined) rows.push({ context: { extension: e.name } });
+          if (e.oid === OID_OCSP_CRL || CRL_ENTRY_CRITICALITY[e.oid] !== undefined) _push(rows, { context: { extension: e.name } });
         });
         return rows.length ? rows : null;
       });
@@ -5661,16 +5708,16 @@ var RFC6960_OCSP_RULES = [
     check: function (resp) {
       var rows = [];
       _ocspResponseExts(resp).forEach(function (e) {
-        if (OCSP_REQUEST_ONLY[e.oid] !== undefined) rows.push({ context: { extension: e.name, defined: OCSP_REQUEST_ONLY[e.oid], was: "responseExtensions" } });
+        if (OCSP_REQUEST_ONLY[e.oid] !== undefined) _push(rows, { context: { extension: e.name, defined: OCSP_REQUEST_ONLY[e.oid], was: "responseExtensions" } });
       });
       var per = _perResponse(resp, function (sr) {
         var out = [];
         _ocspSingleExts(sr).forEach(function (e) {
-          if (OCSP_REQUEST_ONLY[e.oid] !== undefined) out.push({ context: { extension: e.name, defined: OCSP_REQUEST_ONLY[e.oid], was: "singleExtensions" } });
+          if (OCSP_REQUEST_ONLY[e.oid] !== undefined) _push(out, { context: { extension: e.name, defined: OCSP_REQUEST_ONLY[e.oid], was: "singleExtensions" } });
         });
         return out.length ? out : null;
       });
-      if (per) per.forEach(function (row) { rows.push(row); });
+      if (per) per.forEach(function (row) { _push(rows, row); });
       return rows.length ? rows : null;
     },
   },
@@ -5697,17 +5744,17 @@ var RFC6960_OCSP_RULES = [
       var rows = [];
       _ocspResponseExts(resp).forEach(function (e) {
         var why = _valueSyntaxFault(e, OCSP_RESPONSE_KNOWN, OCSP_RESPONSE_VALUE_READER);
-        if (why !== null) rows.push({ context: { extension: e.name, scope: "responseExtensions", problem: why } });
+        if (why !== null) _push(rows, { context: { extension: e.name, scope: "responseExtensions", problem: why } });
       });
       var per = _perResponse(resp, function (sr) {
         var out = [];
         _ocspSingleExts(sr).forEach(function (e) {
           var why = _valueSyntaxFault(e, OCSP_SINGLE_KNOWN, OCSP_SINGLE_VALUE_READER);
-          if (why !== null) out.push({ context: { extension: e.name, scope: "singleExtensions", problem: why } });
+          if (why !== null) _push(out, { context: { extension: e.name, scope: "singleExtensions", problem: why } });
         });
         return out.length ? out : null;
       });
-      if (per) per.forEach(function (row) { rows.push(row); });
+      if (per) per.forEach(function (row) { _push(rows, row); });
       return rows.length ? rows : null;
     },
   },
@@ -5721,16 +5768,16 @@ var RFC6960_OCSP_RULES = [
     check: function (resp) {
       var rows = [];
       _ocspResponseExts(resp).forEach(function (e) {
-        if (e.critical === true && OCSP_RESPONSE_KNOWN[e.oid] === undefined) rows.push({ context: { extension: e.name || e.oid, scope: "responseExtensions" } });
+        if (e.critical === true && OCSP_RESPONSE_KNOWN[e.oid] === undefined) _push(rows, { context: { extension: e.name || e.oid, scope: "responseExtensions" } });
       });
       var per = _perResponse(resp, function (sr) {
         var out = [];
         _ocspSingleExts(sr).forEach(function (e) {
-          if (e.critical === true && OCSP_SINGLE_KNOWN[e.oid] === undefined) out.push({ context: { extension: e.name || e.oid, scope: "singleExtensions" } });
+          if (e.critical === true && OCSP_SINGLE_KNOWN[e.oid] === undefined) _push(out, { context: { extension: e.name || e.oid, scope: "singleExtensions" } });
         });
         return out.length ? out : null;
       });
-      if (per) per.forEach(function (row) { rows.push(row); });
+      if (per) per.forEach(function (row) { _push(rows, row); });
       return rows.length ? rows : null;
     },
   },
@@ -5777,7 +5824,7 @@ var RFC6960_OCSP_RULES = [
       _ocspResponses(resp).forEach(function (sr, i) {
         var key = _certIdKey(sr.certID), seen = first[key];
         if (seen === undefined) { first[key] = { index: i, status: _statusKey(sr.certStatus) }; return; }
-        rows.push({ context: { response: i, first: seen.index, conflicting: seen.status !== _statusKey(sr.certStatus) } });
+        _push(rows, { context: { response: i, first: seen.index, conflicting: seen.status !== _statusKey(sr.certStatus) } });
       });
       return rows.length ? rows : null;
     },
@@ -5927,7 +5974,7 @@ var RFC2986_CSR_RULES = [
     check: function (csr, ctx) {
       var out = [];
       CA_DETERMINED_EXTENSIONS.forEach(function (name) {
-        if (ctx.raw(name)) out.push({ context: { extension: name } });
+        if (ctx.raw(name)) _push(out, { context: { extension: name } });
       });
       return out.length ? out : null;
     },
@@ -6080,12 +6127,12 @@ function _nistClassicalDeclarations(cert) {
   var keyAlg = (cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.algorithm) || null;
   var keyKind = _nistKindOf(keyAlg);
   if (_nistIsClassical(keyKind)) {
-    out.push({ field: "subjectPublicKey", kind: keyKind, name: _spkiAlgName(cert) || (keyAlg && keyAlg.oid) });
+    _push(out, { field: "subjectPublicKey", kind: keyKind, name: _spkiAlgName(cert) || (keyAlg && keyAlg.oid) });
   }
   var sigAlg = cert.signatureAlgorithm || null;
   var sigKind = _nistKindOf(sigAlg);
   if (_nistIsClassical(sigKind)) {
-    out.push({ field: "signature", kind: sigKind, name: (sigAlg && (sigAlg.name || sigAlg.oid)) });
+    _push(out, { field: "signature", kind: sigKind, name: (sigAlg && (sigAlg.name || sigAlg.oid)) });
   }
   return out;
 }
@@ -6233,7 +6280,7 @@ var NIST_TRANSITION_RULES = [
       _nistClassicalDeclarations(cert).forEach(function (d) {
         if (d.field !== "subjectPublicKey") return;
         var at = _nistAt112OrBelow(cert, d);
-        if (at) out.push({ context: Object.assign({ family: d.kind, algorithm: d.name }, at) });
+        if (at) _push(out, { context: Object.assign({ family: d.kind, algorithm: d.name }, at) });
       });
       return out.length ? out : null;
     },
@@ -6341,19 +6388,19 @@ function _cnsaKeyUsageFindings(ctx, setName) {
   if (!set || !ku || !ku.value) return null;
   var v = ku.value, out = [];
   set.required.forEach(function (bit) {
-    if (v[bit] !== true) out.push({ context: { bit: bit, fault: "required bit not set", set: setName } });
+    if (v[bit] !== true) _push(out, { context: { bit: bit, fault: "required bit not set", set: setName } });
   });
   CNSA_KEY_USAGE_BITS.forEach(function (bit) {
     if (v[bit] !== true) return;
     if (set.required.indexOf(bit) !== -1 || set.optional.indexOf(bit) !== -1) return;
-    out.push({ context: { bit: bit, fault: "bit outside the set this profile fixes", set: setName } });
+    _push(out, { context: { bit: bit, fault: "bit outside the set this profile fixes", set: setName } });
   });
   /** @internal "All other bits MUST NOT be set" reaches past the nine RFC 5280 sec. 4.2.1.3 names: a
    * bit beyond them is one of the others. The decoder reports those as one flag rather than by
    * position, so they are one finding. Reading only the nine left a certificate asserting them
    * conforming under a clause that closes the set. */
   if (v.reservedBitsSet === true) {
-    out.push({ context: { bit: "beyond the nine named positions", fault: "bit outside the set this profile fixes", set: setName } });
+    _push(out, { context: { bit: "beyond the nine named positions", fault: "bit outside the set this profile fixes", set: setName } });
   }
   return out.length ? out : null;
 }
@@ -6364,7 +6411,7 @@ function _cnsaKeyUsageFindings(ctx, setName) {
 function _cnsaMissingExtensions(ctx, names) {
   var out = [];
   names.forEach(function (name) {
-    if (!ctx.raw(name)) out.push({ context: { extension: name } });
+    if (!ctx.raw(name)) _push(out, { context: { extension: name } });
   });
   return out.length ? out : null;
 }
@@ -6699,7 +6746,7 @@ var RFC9883_CSR_RULES = [
       (csr.attributes || []).forEach(function (a) {
         if (a.type !== OID_SOP_ATTR) return;
         if (a.privateKeyPossessionStatement === undefined) {
-          rows.push({ context: { attribute: a.name || a.type } });
+          _push(rows, { context: { attribute: a.name || a.type } });
         }
       });
       return rows.length ? rows : null;
@@ -6738,7 +6785,7 @@ function _csrAttributesOf(csr, name) {
   var dotted = oid.byName(name);
   var list = csr.attributes || [];
   var out = [];
-  for (var i = 0; i < list.length; i++) { if (list[i].type === dotted) out.push(list[i]); }
+  for (var i = 0; i < list.length; i++) { if (list[i].type === dotted) _push(out, list[i]); }
   return out;
 }
 function _csrHasAttribute(csr, name) { return _csrAttributesOf(csr, name).length > 0; }
@@ -6777,12 +6824,16 @@ function _mergeCsrReports(reports) {
   var findings = [], ran = [], seen = Object.create(null), ranSeen = Object.create(null);
   reports.forEach(function (r) {
     r.findings.forEach(function (f) {
-      var key = f.id + "\u0000" + JSON.stringify(f.context === undefined ? null : f.context);
+      /** @internal ONE own read. A finding carries `context` only when its rule supplied one, so the
+       * read answered from `Object.prototype` otherwise, and a getter there runs with the finding as
+       * its receiver while the severity the gate reads is still on it. */
+      var context = _own(f, "context");
+      var key = f.id + "\u0000" + JSON.stringify(context === undefined ? null : context);
       if (seen[key]) return;
       seen[key] = true;
-      findings.push(f);
+      _push(findings, f);
     });
-    r.ran.forEach(function (id) { if (!ranSeen[id]) { ranSeen[id] = true; ran.push(id); } });
+    r.ran.forEach(function (id) { if (!ranSeen[id]) { ranSeen[id] = true; _push(ran, id); } });
   });
   var counts = Object.assign(Object.create(null), { fatal: 0, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 });
   var failed = Object.create(null), failedCount = 0;
@@ -6947,7 +6998,7 @@ function certificate(input, opts) {
     throw _cfg("lint/bad-severity", "unknown severity threshold \"" + opts.severity + "\" (known: " + VALID_SEVERITY.join(", ") + ")");
   }
   var rules = _selectRules(opts.profile);
-  var ingested = _ingest(input);
+  var ingested = _rebase(_ingest(input));
   var report;
   if (ingested.fatal) {
     report = { findings: [ingested.fatal], ran: [],
@@ -6956,7 +7007,7 @@ function certificate(input, opts) {
     var ctx = _makeCtx(ingested.cert, opts.profile);
     report = _runLints(rules, ingested.cert, ctx);
   }
-  report.worst = _worst(report.findings);
+  _define(report, "worst", _worst(report.findings));
   report.findings = _applyThreshold(report, opts.severity);
   return report;
 }
@@ -7103,7 +7154,7 @@ function csr(input, opts) {
   else if (CSR_PROFILES[profile]) rules_ = CSR_PROFILES[profile];
   else throw _profileRefusal(profile, "csr");
 
-  var ingested = _ingestCsr(input);
+  var ingested = _rebase(_ingestCsr(input));
   var report;
   if (ingested.fatal) {
     report = { findings: [ingested.fatal], ran: [],
@@ -7113,7 +7164,7 @@ function csr(input, opts) {
       return _runLints(rules_, view, _makeCsrCtx(view, profile));
     }));
   }
-  report.worst = _worst(report.findings);
+  _define(report, "worst", _worst(report.findings));
   report.findings = _applyThreshold(report, opts.severity);
   return report;
 }
@@ -7131,7 +7182,7 @@ function crl(input, opts) {
   else if (CRL_PROFILES[profile]) rules_ = CRL_PROFILES[profile];
   else throw _profileRefusal(profile, "crl");
 
-  var ingested = _ingestCrl(input);
+  var ingested = _rebase(_ingestCrl(input));
   var report;
   if (ingested.fatal) {
     report = { findings: [ingested.fatal], ran: [],
@@ -7139,7 +7190,7 @@ function crl(input, opts) {
   } else {
     report = _runLints(rules_, ingested.crl, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
   }
-  report.worst = _worst(report.findings);
+  _define(report, "worst", _worst(report.findings));
   report.findings = _applyThreshold(report, opts.severity);
   return report;
 }
@@ -7244,7 +7295,7 @@ function ocsp(input, opts) {
   else if (OCSP_PROFILES[profile]) rules_ = OCSP_PROFILES[profile];
   else throw _profileRefusal(profile, "ocsp");
 
-  var ingested = _ingestOcsp(input);
+  var ingested = _rebase(_ingestOcsp(input));
   var report;
   if (ingested.fatal) {
     report = { findings: [ingested.fatal], ran: [],
@@ -7258,7 +7309,7 @@ function ocsp(input, opts) {
   } else {
     report = _runLints(rules_, ingested.response, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
   }
-  report.worst = _worst(report.findings);
+  _define(report, "worst", _worst(report.findings));
   report.findings = _applyThreshold(report, opts.severity);
   return report;
 }
@@ -7348,7 +7399,7 @@ function cms(input, opts) {
   else if (CMS_PROFILES[profile]) rules_ = CMS_PROFILES[profile];
   else throw _profileRefusal(profile, "cms");
 
-  var ingested = _ingestCms(input);
+  var ingested = _rebase(_ingestCms(input));
   var report;
   if (ingested.fatal) {
     report = { findings: [ingested.fatal], ran: [],
@@ -7356,7 +7407,7 @@ function cms(input, opts) {
   } else {
     report = _runLints(rules_, ingested.cms, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
   }
-  report.worst = _worst(report.findings);
+  _define(report, "worst", _worst(report.findings));
   report.findings = _applyThreshold(report, opts.severity);
   return report;
 }
@@ -7435,7 +7486,7 @@ function tsp(input, opts) {
   else if (TSP_PROFILES[profile]) rules_ = TSP_PROFILES[profile];
   else throw _profileRefusal(profile, "tsp");
 
-  var ingested = _ingestTsp(input);
+  var ingested = _rebase(_ingestTsp(input));
   var report;
   if (ingested.fatal) {
     report = { findings: [ingested.fatal], ran: [],
@@ -7443,7 +7494,7 @@ function tsp(input, opts) {
   } else {
     report = _runLints(rules_, ingested.token, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
   }
-  report.worst = _worst(report.findings);
+  _define(report, "worst", _worst(report.findings));
   report.findings = _applyThreshold(report, opts.severity);
   return report;
 }
@@ -7524,7 +7575,7 @@ function attrcert(input, opts) {
   else if (AC_PROFILES[profile]) rules_ = AC_PROFILES[profile];
   else throw _profileRefusal(profile, "attrcert");
 
-  var ingested = _ingestAttrCert(input);
+  var ingested = _rebase(_ingestAttrCert(input));
   var report;
   if (ingested.fatal) {
     report = { findings: [ingested.fatal], ran: [],
@@ -7532,7 +7583,7 @@ function attrcert(input, opts) {
   } else {
     report = _runLints(rules_, ingested.ac, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
   }
-  report.worst = _worst(report.findings);
+  _define(report, "worst", _worst(report.findings));
   report.findings = _applyThreshold(report, opts.severity);
   return report;
 }
@@ -7565,6 +7616,36 @@ var BY_ARTIFACT = Object.assign(Object.create(null), {
   cms: CMS_PROFILES, tsp: TSP_PROFILES, attrcert: AC_PROFILES,
 });
 
+/** @internal Every rule row re-based on NO prototype, once, when the module loads.
+ *
+ * A row carries an optional field only when its rule needs one, so `rule.appliesTo`,
+ * `rule.effectiveDate` and `rule.readsSignatureValue` were read off `Object.prototype` for every row
+ * that omits it. An inherited `appliesTo` returning a function that answers false SKIPS the rule, so
+ * the rule that would have refused the artifact never runs and the signers' producer check has
+ * nothing to refuse on. Naming the optional fields here instead would be a list to keep in step with
+ * every rule added afterwards, and the field the next rule makes optional is the one the list would
+ * be missing. No prototype needs no list.
+ *
+ * Done in place, so a row keeps its identity, and `rules()` hands operators fresh projections rather
+ * than these rows. Walked with plain loops, which dispatch through no prototype of their own, and
+ * idempotent, so a row reached twice through two profiles is re-based once in effect. */
+(function () {
+  var tables = [PROFILES, CSR_PROFILES, CRL_PROFILES, OCSP_PROFILES, CMS_PROFILES, TSP_PROFILES, AC_PROFILES];
+  var bare = function (rows) {
+    if (!intrinsic.isArray(rows)) return;
+    for (var r = 0; r < rows.length; r++) {
+      if (rows[r] !== null && typeof rows[r] === "object") intrinsic.setPrototypeOf(rows[r], null);
+    }
+  };
+  for (var t = 0; t < tables.length; t++) {
+    var names = intrinsic.keys(tables[t]);
+    for (var n = 0; n < names.length; n++) bare(tables[t][names[n]]);
+  }
+  var aggregates = [ALL_RULES, ALL_CRL_RULES, ALL_OCSP_RULES, ALL_CSR_RULES,
+    ALL_CMS_RULES, ALL_TSP_RULES, ALL_AC_RULES];
+  for (var g = 0; g < aggregates.length; g++) bare(aggregates[g]);
+})();
+
 function rules(profile, artifact) {
   /** @internal Every lint verb reads "all" and "default" as naming no profile, so the enumerator
    * reads them the same way: a caller who linted under one of those names and then asked which
@@ -7581,7 +7662,7 @@ function rules(profile, artifact) {
      * rows and the CRL and OCSP sets, none of which a request or a response is ever held to. */
     set = [];
     Object.keys(BY_ARTIFACT[artifact]).forEach(function (name) {
-      BY_ARTIFACT[artifact][name].forEach(function (r) { set.push(r); });
+      BY_ARTIFACT[artifact][name].forEach(function (r) { _push(set, r); });
     });
   } else if (profile == null) {
     set = ALL_RULES.concat(ALL_CRL_RULES).concat(ALL_OCSP_RULES).concat(ALL_CSR_RULES)
@@ -7604,7 +7685,7 @@ function rules(profile, artifact) {
   set.forEach(function (r) {
     if (seen[r.id]) return;
     seen[r.id] = true;
-    out.push({ id: r.id, severity: r.severity, source: r.source, citation: r.citation });
+    _push(out, { id: r.id, severity: r.severity, source: r.source, citation: r.citation });
   });
   return out;
 }
@@ -7638,7 +7719,7 @@ function profiles() {
   var out = [];
   Object.keys(BY_ARTIFACT).forEach(function (artifact) {
     Object.keys(BY_ARTIFACT[artifact]).forEach(function (name) {
-      if (out.indexOf(name) === -1) out.push(name);
+      if (out.indexOf(name) === -1) _push(out, name);
     });
   });
   return out;
@@ -7667,7 +7748,10 @@ var SIGNATURE_VALUE_RULES = (function () {
   Object.keys(BY_ARTIFACT).forEach(function (artifact) {
     Object.keys(BY_ARTIFACT[artifact]).forEach(function (name) {
       BY_ARTIFACT[artifact][name].forEach(function (r) {
-        if (r.readsSignatureValue === true) out[r.id] = true;
+        /** @internal An own read: the flag is optional, so a rule row that does not carry it answered
+         * from `Object.prototype`, and a getter there returning true at load exempted every such rule
+         * from the gate permanently. */
+        if (_own(r, "readsSignatureValue") === true) out[r.id] = true;
       });
     });
   });
@@ -7749,7 +7833,7 @@ function assertBuildClean(artifact, der, profile, E, code) {
   var verb = BUILD_GATE_VERB[artifact];
   var reports = [verb(der, { profile: BUILD_GATE_ALWAYS[artifact] })];
   if (profile != null && profile !== BUILD_GATE_ALWAYS[artifact]) {
-    reports.push(verb(der, { profile: profile }));
+    _push(reports, verb(der, { profile: profile }));
   }
   for (var r = 0; r < reports.length; r++) {
     var found = reports[r].findings;