@blamejs/core 0.18.38 → 0.18.39

package/lib/vendor/blamejs-pki.cjs

@@ -1,4 +1,4 @@
-// @blamejs/pki v0.5.10 — vendored (Apache-2.0). Zero-dep pure CJS.
+// @blamejs/pki v0.5.11 — vendored (Apache-2.0). Zero-dep pure CJS.
 // https://github.com/blamejs/pki  Exports: x509, crl, pkcs12, key, webcrypto, schema, csr, cms, ...
 // Backs lib/mtls-engine-default.js (PQC-capable CA + PKCS#12 engine).
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -141,7 +141,7 @@ var require_package = __commonJS({
   "node_modules/@blamejs/pki/package.json"(exports2, module2) {
     module2.exports = {
       name: "@blamejs/pki",
-      version: "0.5.10",
+      version: "0.5.11",
       description: "Pure-JavaScript PKI toolkit that owns its stack \u2014 X.509, ASN.1/DER, CMS, PQC-first.",
       license: "Apache-2.0",
       author: "blamejs contributors",
@@ -713,6 +713,384 @@ var require_guard_async = __commonJS({
   }
 });
 
+// node_modules/@blamejs/pki/lib/guard-identifier.js
+var require_guard_identifier = __commonJS({
+  "node_modules/@blamejs/pki/lib/guard-identifier.js"(exports2, module2) {
+    "use strict";
+    var util = require("util");
+    function _isDottedDecimal(str) {
+      if (str.length === 0) return false;
+      var arcs = 0, digits = 0, leadingZero = false;
+      for (var i = 0; i < str.length; i++) {
+        var c = str.charCodeAt(i);
+        if (c === 46) {
+          if (digits === 0 || leadingZero) return false;
+          arcs++;
+          digits = 0;
+          leadingZero = false;
+          continue;
+        }
+        if (c < 48 || c > 57) return false;
+        if (digits === 1 && str.charCodeAt(i - 1) === 48) leadingZero = true;
+        digits++;
+      }
+      if (digits === 0 || leadingZero) return false;
+      return arcs >= 1;
+    }
+    function assertCanonicalOid(str, E, code, label, boundsCode) {
+      var who = label || "OID";
+      if (typeof str !== "string" || !_isDottedDecimal(str)) {
+        throw E(code, who + " must be a canonical dotted-decimal OID string of two or more arcs with no leading-zero component");
+      }
+      if (boundsCode === null) return str;
+      var bcode = boundsCode === void 0 ? code : boundsCode;
+      var parts = str.split(".");
+      var root = BigInt(parts[0]);
+      var second = BigInt(parts[1]);
+      if (root > 2n) throw E(bcode, who + " root arc must be 0, 1, or 2 (X.660)");
+      if (root < 2n && second > 39n) throw E(bcode, who + " second arc must be 0..39 under roots 0 and 1 (X.660)");
+      return str;
+    }
+    function assertKnownKeys(obj, known, E, code, message) {
+      _refuseUnenumerable(obj, E, code, "the options");
+      var describe = typeof message === "function" ? message : function(k) {
+        return message + JSON.stringify(k);
+      };
+      _readableNames(obj).forEach(function(k) {
+        if (Object.prototype.hasOwnProperty.call(known, k)) return;
+        throw E(code, describe(typeof k === "symbol" ? String(k) : k));
+      });
+    }
+    var _PRISTINE_OBJECT_PROTO = (function() {
+      var s = /* @__PURE__ */ Object.create(null);
+      [
+        "constructor",
+        "hasOwnProperty",
+        "isPrototypeOf",
+        "propertyIsEnumerable",
+        "toLocaleString",
+        "toString",
+        "valueOf",
+        "__defineGetter__",
+        "__defineSetter__",
+        "__lookupGetter__",
+        "__lookupSetter__",
+        "__proto__"
+      ].forEach(function(k) {
+        s[k] = 1;
+      });
+      return s;
+    })();
+    function _looksBuiltIn(d) {
+      return !!d && (!!d.get || !!d.set || typeof d.value === "function");
+    }
+    function _requireFactory(E) {
+      if (typeof E !== "function") {
+        throw new TypeError("guard.identifier needs an error factory called as E(code, message); a class is not one, so adapt it at the call site");
+      }
+    }
+    function _refuseUnenumerable(v, E, code, label) {
+      _requireFactory(E);
+      if (v === null || typeof v !== "object") return;
+      var visited = /* @__PURE__ */ new Set();
+      for (var o = v; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
+        visited.add(o);
+        if (!util.types.isProxy(o)) continue;
+        throw E(code, label + (o === v ? " is" : " inherits from") + " a Proxy, whose reported keys need not match what it answers, so an option it holds cannot be found; pass a plain object");
+      }
+    }
+    function _isMethodOf(from, k, fn) {
+      var visited = /* @__PURE__ */ new Set();
+      for (var o = from; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
+        visited.add(o);
+        var d = Object.getOwnPropertyDescriptor(o, k);
+        if (!d) continue;
+        return !d.get && !d.set && d.value === fn;
+      }
+      return false;
+    }
+    function _isArrayIndex(k) {
+      var n = Number(k);
+      return Number.isInteger(n) && n >= 0 && n < 4294967295 && String(n) === k;
+    }
+    function _isIndexedKind(v) {
+      return Array.isArray(v) || ArrayBuffer.isView(v) && !util.types.isDataView(v);
+    }
+    var _ARRAY_PROTO_MEMBERS = ["length", Symbol.unscopables];
+    var _REGEXP_PROTO_MEMBERS = [
+      "source",
+      "flags",
+      "global",
+      "ignoreCase",
+      "multiline",
+      "dotAll",
+      "unicode",
+      "unicodeSets",
+      "sticky",
+      "hasIndices"
+    ];
+    var _SIZED_PROTO_MEMBERS = ["size", Symbol.toStringTag];
+    var _WEAK_PROTO_MEMBERS = [Symbol.toStringTag];
+    var _ARRAYBUFFER_PROTO_MEMBERS = [
+      "byteLength",
+      "maxByteLength",
+      "resizable",
+      "detached",
+      Symbol.toStringTag
+    ];
+    var _SHARED_PROTO_MEMBERS = ["byteLength", "maxByteLength", "growable", Symbol.toStringTag];
+    var _DATAVIEW_PROTO_MEMBERS = ["buffer", "byteLength", "byteOffset", Symbol.toStringTag];
+    var _TYPED_PROTO_MEMBERS = ["buffer", "byteLength", "byteOffset", "length", Symbol.toStringTag];
+    var _CONCRETE_TYPED_MEMBERS = ["BYTES_PER_ELEMENT"];
+    var _BUFFER_PROTO_MEMBERS = ["parent", "offset"];
+    var _ARRAY_MEMBERS = _ARRAY_PROTO_MEMBERS;
+    var _REGEXP_MEMBERS = ["lastIndex"].concat(_REGEXP_PROTO_MEMBERS);
+    var _VIEW_MEMBERS = _TYPED_PROTO_MEMBERS.concat(_CONCRETE_TYPED_MEMBERS);
+    var _BUFFER_KIND_MEMBERS = _VIEW_MEMBERS.concat(_BUFFER_PROTO_MEMBERS);
+    var _DATAVIEW_MEMBERS = _DATAVIEW_PROTO_MEMBERS;
+    var _ARRAYBUFFER_MEMBERS = _ARRAYBUFFER_PROTO_MEMBERS;
+    var _SHARED_MEMBERS = _SHARED_PROTO_MEMBERS;
+    var _TYPED_ARRAY_PROTO = Object.getPrototypeOf(Uint8Array.prototype);
+    var _INTRINSIC_HOLDERS = (function() {
+      var m = /* @__PURE__ */ new Map([[_TYPED_ARRAY_PROTO, _TYPED_PROTO_MEMBERS]]);
+      function pair(ctor, members) {
+        if (ctor && ctor.prototype) m.set(ctor.prototype, members);
+      }
+      pair(Array, _ARRAY_PROTO_MEMBERS);
+      pair(RegExp, _REGEXP_PROTO_MEMBERS);
+      [Map, Set].forEach(function(c) {
+        pair(c, _SIZED_PROTO_MEMBERS);
+      });
+      [WeakMap, WeakSet].forEach(function(c) {
+        pair(c, _WEAK_PROTO_MEMBERS);
+      });
+      pair(ArrayBuffer, _ARRAYBUFFER_PROTO_MEMBERS);
+      pair(typeof SharedArrayBuffer === "function" ? SharedArrayBuffer : null, _SHARED_PROTO_MEMBERS);
+      pair(DataView, _DATAVIEW_PROTO_MEMBERS);
+      pair(Buffer, _BUFFER_PROTO_MEMBERS);
+      Object.getOwnPropertyNames(globalThis).forEach(function(n) {
+        var C;
+        try {
+          C = globalThis[n];
+        } catch (_e) {
+          return;
+        }
+        if (typeof C !== "function" || typeof C.BYTES_PER_ELEMENT !== "number") return;
+        if (!C.prototype || Object.getPrototypeOf(C.prototype) !== _TYPED_ARRAY_PROTO) return;
+        m.set(C.prototype, _CONCRETE_TYPED_MEMBERS);
+      });
+      return m;
+    })();
+    function _holderMembers(o) {
+      return _INTRINSIC_HOLDERS.has(o) ? _INTRINSIC_HOLDERS.get(o) : null;
+    }
+    function _isNodeBuffer(v) {
+      if (!util.types.isUint8Array(v)) return false;
+      var visited = /* @__PURE__ */ new Set();
+      for (var o = v; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
+        visited.add(o);
+        if (o === Buffer.prototype) return true;
+      }
+      return false;
+    }
+    function _kindMembers(v) {
+      if (v === null || v === void 0) return [];
+      if (Array.isArray(v)) return _ARRAY_MEMBERS;
+      if (_isNodeBuffer(v)) return _BUFFER_KIND_MEMBERS;
+      if (util.types.isDataView(v)) return _DATAVIEW_MEMBERS;
+      if (ArrayBuffer.isView(v)) return _VIEW_MEMBERS;
+      if (util.types.isArrayBuffer(v)) return _ARRAYBUFFER_MEMBERS;
+      if (util.types.isSharedArrayBuffer(v)) return _SHARED_MEMBERS;
+      if (util.types.isRegExp(v)) return _REGEXP_MEMBERS;
+      if (util.types.isWeakMap(v) || util.types.isWeakSet(v)) return _WEAK_PROTO_MEMBERS;
+      if (util.types.isMap(v) || util.types.isSet(v)) return _SIZED_PROTO_MEMBERS;
+      return [];
+    }
+    function _isOwnStructuralName(v, k) {
+      return util.types.isRegExp(v) && k === "lastIndex";
+    }
+    function _looksIntrinsic(d) {
+      return !!d && (!!d.get || !!d.set || typeof d.value === "function" || d.writable === false || d.configurable === false);
+    }
+    function _shadowsAnother(v, k, holder) {
+      var visited = /* @__PURE__ */ new Set();
+      var past = false;
+      for (var o = v; o !== null && o !== void 0 && !visited.has(o); o = Object.getPrototypeOf(o)) {
+        visited.add(o);
+        if (o === holder) {
+          past = true;
+          continue;
+        }
+        if (past && Object.getOwnPropertyDescriptor(o, k)) return true;
+      }
+      return false;
+    }
+    function _readableNames(obj) {
+      var seen = /* @__PURE__ */ Object.create(null);
+      var out = [];
+      var o = obj === null || obj === void 0 ? null : Object(obj);
+      var indexedSelf = _isIndexedKind(o);
+      var members = _kindMembers(o);
+      var visited = /* @__PURE__ */ new Set();
+      while (o && !visited.has(o)) {
+        visited.add(o);
+        var inherited = o !== obj;
+        var above = Object.getPrototypeOf(o);
+        var atObjectProto = inherited && above === null;
+        Reflect.ownKeys(o).forEach(function(k) {
+          if (seen[k]) return;
+          if (indexedSelf && typeof k === "string" && _isArrayIndex(k)) return;
+          if (indexedSelf && k === "length" && !inherited) return;
+          if (_isOwnStructuralName(obj, k)) return;
+          var d = Object.getOwnPropertyDescriptor(o, k);
+          var here = _holderMembers(o);
+          if (inherited && _looksIntrinsic(d) && !_shadowsAnother(obj, k, o) && (here === null ? members.indexOf(k) !== -1 : here.indexOf(k) !== -1)) return;
+          if (atObjectProto) {
+            if (_PRISTINE_OBJECT_PROTO[k] && _looksBuiltIn(d)) return;
+            seen[k] = 1;
+            out.push(k);
+            return;
+          }
+          if (d && !d.get && !d.set && typeof d.value === "function" && (inherited || _isMethodOf(above, k, d.value))) return;
+          seen[k] = 1;
+          out.push(k);
+        });
+        o = above;
+      }
+      return out;
+    }
+    function readableNames(obj, E, code, label) {
+      _refuseUnenumerable(obj, E, code, label);
+      return _readableNames(obj);
+    }
+    function readableIndices(obj, E, code, label) {
+      _refuseUnenumerable(obj, E, code, label);
+      if (!Array.isArray(obj)) return [];
+      var own = Object.getOwnPropertyDescriptor(obj, "length");
+      var limit = own ? own.value : 0;
+      var seen = /* @__PURE__ */ Object.create(null);
+      var out = [];
+      var visited = /* @__PURE__ */ new Set();
+      for (var o = obj; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
+        visited.add(o);
+        Reflect.ownKeys(o).forEach(function(k) {
+          if (typeof k !== "string" || !_isArrayIndex(k) || seen[k]) return;
+          if (Number(k) >= limit) return;
+          seen[k] = 1;
+          out.push(k);
+        });
+      }
+      return out.sort(function(a, b) {
+        return Number(a) - Number(b);
+      });
+    }
+    function _notAnOptionsBag(v) {
+      if (util.types.isBoxedPrimitive(v)) return "a boxed primitive";
+      if (util.types.isNativeError(v)) return "an Error";
+      if (util.types.isPromise(v)) return "a Promise";
+      if (util.types.isArgumentsObject(v)) return "an arguments object";
+      return null;
+    }
+    function optionsObject(opts, E, code, label) {
+      if (opts === null || opts === void 0) return /* @__PURE__ */ Object.create(null);
+      if (typeof opts !== "object") throw E(code, label + " must be an object");
+      _refuseUnenumerable(opts, E, code, label);
+      if (_isNodeBuffer(opts)) throw E(code, label + " must be an object");
+      var wrong = _notAnOptionsBag(opts);
+      if (wrong) throw E(code, label + ": " + wrong + " is not an options bag; pass a plain object");
+      return _settle(opts, E, code, label);
+    }
+    function _descriptorHolder(v, k) {
+      var visited = /* @__PURE__ */ new Set();
+      for (var o = v; o !== null && o !== void 0 && !visited.has(o); o = Object.getPrototypeOf(o)) {
+        visited.add(o);
+        var d = Object.getOwnPropertyDescriptor(o, k);
+        if (d) return d;
+      }
+      return null;
+    }
+    function refuseAccessorFields(obj, names, E, code, label) {
+      for (var i = 0; i < names.length; i++) {
+        var holder = _descriptorHolder(obj, names[i]);
+        if (holder && (holder.get || holder.set)) {
+          throw E(code, label + " supplies " + JSON.stringify(typeof names[i] === "symbol" ? String(names[i]) : names[i]) + " through an accessor, whose value can differ between the check and the read; pass an object whose fields are plain values");
+        }
+      }
+    }
+    function _settle(opts, E, code, label) {
+      function readAll(names) {
+        for (var i = 0; i < names.length; i++) {
+          try {
+            void opts[names[i]];
+          } catch (_e) {
+            throw E(code, label + ": reading " + JSON.stringify(typeof names[i] === "symbol" ? String(names[i]) : names[i]) + " threw");
+          }
+        }
+      }
+      var before = _readableNames(opts);
+      refuseAccessorFields(opts, before, E, code, label);
+      readAll(before);
+      var after = _readableNames(opts);
+      var same = after.length === before.length;
+      for (var j = 0; same && j < after.length; j++) same = before.indexOf(after[j]) !== -1;
+      if (!same) {
+        throw E(code, label + " changes which options it carries while they are read, so no set of them can be checked; pass an object whose properties are plain values");
+      }
+      return opts;
+    }
+    module2.exports = {
+      assertCanonicalOid,
+      assertKnownKeys,
+      optionsObject,
+      refuseAccessorFields,
+      // Exported so a caller that forwards an options bag copies the same surface this module
+      // accepts. A narrower enumeration such as `Object.keys` admits a name here and then drops
+      // it on the way, which is worse than refusing it. The option is reported valid and then
+      // does nothing at the place it was meant to act.
+      readableNames,
+      // Exported for the same reason as its sibling: a caller copying an array has to reach the
+      // elements a read reaches, and the own keys are not that set.
+      readableIndices
+    };
+  }
+});
+
+// node_modules/@blamejs/pki/lib/guard-time.js
+var require_guard_time = __commonJS({
+  "node_modules/@blamejs/pki/lib/guard-time.js"(exports2, module2) {
+    "use strict";
+    var util = require("util");
+    var _dateGetTime = Date.prototype.getTime;
+    function instantOf(value) {
+      return _dateGetTime.call(value);
+    }
+    function assertValid(value, E, code, label) {
+      if (!util.types.isDate(value) || isNaN(instantOf(value))) {
+        throw E(code, (label || "value") + " must be a valid Date");
+      }
+      return value;
+    }
+    function within(instant, lower, upper, E, code, label, opts) {
+      assertValid(instant, E, code, label);
+      assertValid(lower, E, code, (label || "window") + " lower bound");
+      assertValid(upper, E, code, (label || "window") + " upper bound");
+      var t = instantOf(instant);
+      var lo = instantOf(lower);
+      var hi = instantOf(upper);
+      return t >= lo && (opts && opts.upperInclusive ? t <= hi : t < hi);
+    }
+    function isDate(value) {
+      return util.types.isDate(value);
+    }
+    module2.exports = {
+      assertValid,
+      instantOf,
+      isDate,
+      within
+    };
+  }
+});
+
 // node_modules/@blamejs/pki/lib/oid.js
 var require_oid = __commonJS({
   "node_modules/@blamejs/pki/lib/oid.js"(exports2, module2) {
@@ -2482,10 +2860,11 @@ var require_webcrypto = __commonJS({
       if (!ArrayBuffer.isView(typedArray) || typedArray instanceof Float32Array || typedArray instanceof Float64Array || typedArray instanceof DataView) {
         throw new WebCryptoError("webcrypto/data", "getRandomValues: expected an integer TypedArray");
       }
-      if (typedArray.byteLength > MAX_RANDOM_BYTES) {
+      var out = guard.bytes.outputView(typedArray, WebCryptoError, "webcrypto/data", "getRandomValues");
+      if (out.length > MAX_RANDOM_BYTES) {
         throw new WebCryptoError("webcrypto/data", "getRandomValues: byteLength exceeds " + MAX_RANDOM_BYTES);
       }
-      nodeCrypto.randomFillSync(guard.bytes.source(typedArray, WebCryptoError, "webcrypto/data", "getRandomValues"));
+      nodeCrypto.randomFillSync(out);
       return typedArray;
     };
     Crypto.prototype.randomUUID = function randomUUID() {
@@ -2569,8 +2948,9 @@ var require_guard_parsed = __commonJS({
   "node_modules/@blamejs/pki/lib/guard-parsed.js"(exports2, module2) {
     "use strict";
     var bytes = require_guard_bytes();
+    var time = require_guard_time();
     function _isBytes(x) {
-      return Buffer.isBuffer(x) || ArrayBuffer.isView(x) || x instanceof ArrayBuffer;
+      return bytes.isByteSource(x);
     }
     function _isAttributeTypeAndValue(a) {
       return !!a && typeof a.type === "string" && _isOptName(a.name) && typeof a.value === "string";
@@ -2602,11 +2982,11 @@ var require_guard_parsed = __commonJS({
       return !!e && typeof e.oid === "string" && _isOptName(e.name) && typeof e.critical === "boolean" && e.value !== void 0;
     }
     function isCert(o) {
-      return !!o && typeof o === "object" && Buffer.isBuffer(o.tbsBytes) && typeof o.version === "number" && typeof o.serialNumber === "bigint" && typeof o.serialNumberHex === "string" && _isAlgorithmIdentifier(o.signatureAlgorithm) && _isAlgorithmIdentifier(o.tbsSignatureAlgorithm) && _isBitString(o.signatureValue) && !!o.validity && o.validity.notBefore instanceof Date && o.validity.notAfter instanceof Date && _isName(o.issuer) && _isName(o.subject) && !!o.subjectPublicKeyInfo && Buffer.isBuffer(o.subjectPublicKeyInfo.bytes) && _isAlgorithmIdentifier(o.subjectPublicKeyInfo.algorithm) && _isBitString(o.subjectPublicKeyInfo.publicKey) && Array.isArray(o.extensions) && o.extensions.every(_isExtensionEntry);
+      return !!o && typeof o === "object" && Buffer.isBuffer(o.tbsBytes) && typeof o.version === "number" && typeof o.serialNumber === "bigint" && typeof o.serialNumberHex === "string" && _isAlgorithmIdentifier(o.signatureAlgorithm) && _isAlgorithmIdentifier(o.tbsSignatureAlgorithm) && _isBitString(o.signatureValue) && !!o.validity && time.isDate(o.validity.notBefore) && time.isDate(o.validity.notAfter) && _isName(o.issuer) && _isName(o.subject) && !!o.subjectPublicKeyInfo && Buffer.isBuffer(o.subjectPublicKeyInfo.bytes) && _isAlgorithmIdentifier(o.subjectPublicKeyInfo.algorithm) && _isBitString(o.subjectPublicKeyInfo.publicKey) && Array.isArray(o.extensions) && o.extensions.every(_isExtensionEntry);
     }
     function isCrl(o) {
-      return !!o && typeof o === "object" && Buffer.isBuffer(o.tbsBytes) && typeof o.version === "number" && _isAlgorithmIdentifier(o.signatureAlgorithm) && _isBitString(o.signatureValue) && _isName(o.issuer) && o.thisUpdate instanceof Date && (o.nextUpdate === null || o.nextUpdate instanceof Date) && Array.isArray(o.crlExtensions) && o.crlExtensions.every(_isCrlExtensionEntry) && Array.isArray(o.revokedCertificates) && o.revokedCertificates.every(function(e) {
-        return !!e && typeof e.serialNumber === "bigint" && typeof e.serialNumberHex === "string" && e.revocationDate instanceof Date && Array.isArray(e.crlEntryExtensions) && e.crlEntryExtensions.every(_isCrlExtensionEntry);
+      return !!o && typeof o === "object" && Buffer.isBuffer(o.tbsBytes) && typeof o.version === "number" && _isAlgorithmIdentifier(o.signatureAlgorithm) && _isBitString(o.signatureValue) && _isName(o.issuer) && time.isDate(o.thisUpdate) && (o.nextUpdate === null || time.isDate(o.nextUpdate)) && Array.isArray(o.crlExtensions) && o.crlExtensions.every(_isCrlExtensionEntry) && Array.isArray(o.revokedCertificates) && o.revokedCertificates.every(function(e) {
+        return !!e && typeof e.serialNumber === "bigint" && typeof e.serialNumberHex === "string" && time.isDate(e.revocationDate) && Array.isArray(e.crlEntryExtensions) && e.crlEntryExtensions.every(_isCrlExtensionEntry);
       });
     }
     function _safe(shape) {
@@ -2803,13 +3183,102 @@ var require_guard_bytes = __commonJS({
   "node_modules/@blamejs/pki/lib/guard-bytes.js"(exports2, module2) {
     "use strict";
     var async = require_guard_async();
+    var identifier = require_guard_identifier();
+    var time = require_guard_time();
+    var util = require("util");
+    function isByteSource(x) {
+      return Buffer.isBuffer(x) || ArrayBuffer.isView(x) || _isArrayBuffer(x);
+    }
+    function _isArrayBuffer(v) {
+      return util.types.isArrayBuffer(v);
+    }
+    var _TYPED_ARRAY_PROTO = Object.getPrototypeOf(Uint8Array.prototype);
+    function _intrinsicGetter(proto, name, who) {
+      var d = Object.getOwnPropertyDescriptor(proto, name);
+      if (!d || typeof d.get !== "function") {
+        throw new TypeError("guard.bytes: this runtime has no intrinsic " + who + "." + name + " accessor, so a view's backing store cannot be read without invoking the value's own");
+      }
+      return d.get;
+    }
+    var _taBuffer = _intrinsicGetter(_TYPED_ARRAY_PROTO, "buffer", "%TypedArray%.prototype");
+    var _taByteOffset = _intrinsicGetter(_TYPED_ARRAY_PROTO, "byteOffset", "%TypedArray%.prototype");
+    var _taByteLength = _intrinsicGetter(_TYPED_ARRAY_PROTO, "byteLength", "%TypedArray%.prototype");
+    var _dvBuffer = _intrinsicGetter(DataView.prototype, "buffer", "DataView.prototype");
+    var _dvByteOffset = _intrinsicGetter(DataView.prototype, "byteOffset", "DataView.prototype");
+    var _dvByteLength = _intrinsicGetter(DataView.prototype, "byteLength", "DataView.prototype");
+    function _storeOf(v) {
+      return util.types.isDataView(v) ? _dvBuffer.call(v) : _taBuffer.call(v);
+    }
+    function _offsetOf(v) {
+      return util.types.isDataView(v) ? _dvByteOffset.call(v) : _taByteOffset.call(v);
+    }
+    function _lengthOf(v) {
+      return util.types.isDataView(v) ? _dvByteLength.call(v) : _taByteLength.call(v);
+    }
+    function _reView(v) {
+      return Buffer.from(_storeOf(v), _offsetOf(v), _lengthOf(v));
+    }
+    var _CONCRETE_KINDS = Object.keys(util.types).filter(function(name) {
+      return /^is[A-Za-z0-9]+Array$/.test(name);
+    }).map(function(name) {
+      return [util.types[name], globalThis[name.slice(2)]];
+    }).filter(function(row) {
+      return typeof row[0] === "function" && typeof row[1] === "function" && typeof row[1].BYTES_PER_ELEMENT === "number" && row[1].BYTES_PER_ELEMENT > 0;
+    });
+    function _concreteKindOf(v) {
+      for (var i = 0; i < _CONCRETE_KINDS.length; i++) {
+        if (_CONCRETE_KINDS[i][0](v)) return _CONCRETE_KINDS[i][1];
+      }
+      return null;
+    }
+    var _NAMED_KINDS = [
+      ["isNativeError", "Error"],
+      ["isRegExp", "RegExp"],
+      ["isPromise", "Promise"],
+      ["isWeakMap", "WeakMap"],
+      ["isWeakSet", "WeakSet"],
+      ["isMap", "Map"],
+      ["isSet", "Set"],
+      ["isDate", "Date"],
+      ["isProxy", "Proxy"]
+    ].filter(function(row) {
+      return typeof util.types[row[0]] === "function";
+    });
+    function _kindName(v) {
+      for (var i = 0; i < _NAMED_KINDS.length; i++) {
+        if (util.types[_NAMED_KINDS[i][0]](v)) return _NAMED_KINDS[i][1];
+      }
+      return typeof v === "function" ? "function" : "value";
+    }
+    function _article(name) {
+      return /^[AEIOU]/i.test(name) ? "an" : "a";
+    }
+    function outputView(input, ErrorClass, code, label) {
+      if (!util.types.isUint8Array(input) && !ArrayBuffer.isView(input)) {
+        throw _raise(ErrorClass, code, label + ": expected a Buffer / TypedArray to write into");
+      }
+      try {
+        return _reView(input);
+      } catch (e) {
+        throw _raise(ErrorClass, code, label + ": output is not a usable byte view (detached backing buffer?)", e);
+      }
+    }
+    function lengthOf(view2) {
+      return _lengthOf(view2);
+    }
+    function _refuseShared(v, ErrorClass, code, label) {
+      if (util.types.isSharedArrayBuffer(v) || ArrayBuffer.isView(v) && util.types.isSharedArrayBuffer(_storeOf(v))) {
+        throw _raise(ErrorClass, code, label + ": shared memory cannot be used here, because another thread can rewrite it after it has been checked; pass a Buffer or a Uint8Array over memory this process owns");
+      }
+    }
     function _raise(E, code, message, cause) {
       return E.prototype instanceof Error ? new E(code, message, cause) : E(code, message, cause);
     }
     function view(input, ErrorClass, code, label) {
-      if (Buffer.isBuffer(input) || input instanceof Uint8Array) {
+      _refuseShared(input, ErrorClass, code, label);
+      if (util.types.isUint8Array(input)) {
         try {
-          return Buffer.from(input.buffer, input.byteOffset, input.byteLength);
+          return _reView(input);
         } catch (e) {
           throw _raise(ErrorClass, code, label + ": input is not a usable byte view (detached backing buffer?)", e);
         }
@@ -2817,10 +3286,11 @@ var require_guard_bytes = __commonJS({
       throw _raise(ErrorClass, code, label + ": expected a Buffer / Uint8Array");
     }
     function source(input, ErrorClass, code, label) {
-      var isAb = input instanceof ArrayBuffer;
+      _refuseShared(input, ErrorClass, code, label);
+      var isAb = _isArrayBuffer(input);
       if (isAb || ArrayBuffer.isView(input)) {
         try {
-          return isAb ? Buffer.from(input) : Buffer.from(input.buffer, input.byteOffset, input.byteLength);
+          return isAb ? Buffer.from(input) : _reView(input);
         } catch (e) {
           throw _raise(ErrorClass, code, label + ": input is not a usable byte source (detached backing buffer?)", e);
         }
@@ -2838,29 +3308,52 @@ var require_guard_bytes = __commonJS({
       var cap = o.maxDepth == null ? 64 : o.maxDepth;
       return _deep(value, ErrorClass, code, label, cap, 0, o.collect || null);
     }
-    var _CRYPTO_KEY_SURFACE = { type: 1, extractable: 1, algorithm: 1, usages: 1 };
-    var _ERROR_SURFACE = { message: 1, stack: 1, name: 1, cause: 1 };
-    var _REGEXP_SURFACE = {
-      lastIndex: 1,
-      source: 1,
-      flags: 1,
-      global: 1,
-      ignoreCase: 1,
-      multiline: 1,
-      sticky: 1,
-      unicode: 1,
-      unicodeSets: 1,
-      hasIndices: 1,
-      dotAll: 1
-    };
-    var _THENABLE_SURFACE = { then: 1, catch: 1, finally: 1 };
+    function _surface(names) {
+      var t = /* @__PURE__ */ Object.create(null);
+      names.forEach(function(n) {
+        t[n] = 1;
+      });
+      t[Symbol.toStringTag] = 1;
+      return t;
+    }
+    var _CRYPTO_KEY_SURFACE = _surface([
+      "type",
+      "extractable",
+      "algorithm",
+      "usages",
+      "asymmetricKeyType",
+      "asymmetricKeyDetails",
+      "_handle"
+    ]);
+    var _ERROR_SURFACE = _surface(["message", "stack", "name", "cause"]);
+    var _REGEXP_SURFACE = _surface([
+      "lastIndex",
+      "source",
+      "flags",
+      "global",
+      "ignoreCase",
+      "multiline",
+      "sticky",
+      "unicode",
+      "unicodeSets",
+      "hasIndices",
+      "dotAll"
+    ]);
+    var _THENABLE_SURFACE = _surface(["then", "catch", "finally"]);
     function _opaqueSurface(v, ErrorClass, code, label) {
       var proto = Object.getPrototypeOf(v);
       if (proto === Object.prototype || proto === null) return null;
-      if (v instanceof WeakMap || v instanceof WeakSet) return {};
+      if (util.types.isWeakMap(v) || util.types.isWeakSet(v)) return {};
       if (v instanceof Error) return _ERROR_SURFACE;
-      if (v instanceof RegExp) return _REGEXP_SURFACE;
-      if (require_webcrypto().isCryptoKeyLike(v)) return _CRYPTO_KEY_SURFACE;
+      if (util.types.isRegExp(v)) return _REGEXP_SURFACE;
+      if (util.types.isKeyObject(v)) return _CRYPTO_KEY_SURFACE;
+      var keyLike;
+      try {
+        keyLike = require_webcrypto().isCryptoKeyLike(v);
+      } catch (e) {
+        throw _raise(ErrorClass, code, label + ": reading the key surface threw", e);
+      }
+      if (keyLike) return _CRYPTO_KEY_SURFACE;
       var then;
       try {
         then = v.then;
@@ -2870,27 +3363,35 @@ var require_guard_bytes = __commonJS({
       if (typeof then === "function") return _THENABLE_SURFACE;
       return null;
     }
-    function _opaqueIsSafeToPass(v, surface) {
-      var keys = _reachableKeys(v);
-      for (var i = 0; i < keys.length; i++) {
-        if (surface[keys[i]]) continue;
-        if (!_wasEnumerable(v, keys[i])) continue;
-        return false;
+    function _canChangeAfterTheCheck(v, name) {
+      var visited = /* @__PURE__ */ new Set();
+      for (var o = v; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
+        visited.add(o);
+        var d = Object.getOwnPropertyDescriptor(o, name);
+        if (!d) continue;
+        if (d.get || d.set || d.writable || d.configurable) return true;
+        return o !== v && Object.isExtensible(v);
       }
-      return true;
+      return false;
     }
-    function _reachableKeys(v) {
-      var names = [];
-      var seen = /* @__PURE__ */ Object.create(null);
-      for (var o = v; o && o !== Object.prototype; o = Object.getPrototypeOf(o)) {
-        var own = Object.getOwnPropertyNames(o);
-        for (var i = 0; i < own.length; i++) {
-          if (own[i] === "constructor" || seen[own[i]]) continue;
-          seen[own[i]] = true;
-          names.push(own[i]);
-        }
+    var _SETTLED_DEPTH = 4;
+    function _settledValueIsFixed(value, ErrorClass, code, label, depth) {
+      if (value === null || typeof value !== "object" && typeof value !== "function") return true;
+      if (depth >= _SETTLED_DEPTH) return false;
+      if (util.types.isProxy(value)) return false;
+      var surface = _opaqueSurface(value, ErrorClass, code, label);
+      if (!surface) return false;
+      return _opaqueFieldOutsideSurface(value, surface, ErrorClass, code, label, depth + 1) === null;
+    }
+    function _opaqueFieldOutsideSurface(v, surface, ErrorClass, code, label, depth) {
+      var keys = _namesToCopy(v, ErrorClass, code, label);
+      for (var i = 0; i < keys.length; i++) {
+        if (surface[keys[i]]) continue;
+        if (typeof keys[i] === "symbol") continue;
+        if (!_canChangeAfterTheCheck(v, keys[i]) && _settledValueIsFixed(v[keys[i]], ErrorClass, code, label, depth || 0)) continue;
+        return keys[i];
       }
-      return names;
+      return null;
     }
     function _copyBytesSameKind(v, ErrorClass, code, label, collect) {
       var src = source(v, ErrorClass, code, label);
@@ -2898,60 +3399,117 @@ var require_guard_bytes = __commonJS({
       new Uint8Array(owned).set(src);
       if (collect) collect.push(Buffer.from(owned, 0, src.length));
       if (Buffer.isBuffer(v)) return Buffer.from(owned, 0, src.length);
-      if (v instanceof ArrayBuffer) return owned;
-      if (v instanceof DataView) return new DataView(owned);
-      return new v.constructor(owned, 0, src.length / v.BYTES_PER_ELEMENT);
+      if (_isArrayBuffer(v)) return owned;
+      if (util.types.isDataView(v)) return new DataView(owned);
+      var Ctor = _concreteKindOf(v);
+      if (!Ctor) {
+        throw _raise(ErrorClass, code, label + ": a " + (util.types.isTypedArray(v) ? "typed array of a kind this runtime added" : "byte view") + " cannot be copied while keeping its kind; pass a Buffer or a Uint8Array");
+      }
+      return new Ctor(owned, 0, src.length / Ctor.BYTES_PER_ELEMENT);
+    }
+    function _protoChainIsCyclic(v) {
+      var visited = /* @__PURE__ */ new Set();
+      for (var o = v; o; o = Object.getPrototypeOf(o)) {
+        if (visited.has(o)) return true;
+        visited.add(o);
+      }
+      return false;
+    }
+    function _protoChainHasProxy(v) {
+      var visited = /* @__PURE__ */ new Set();
+      for (var o = v; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
+        visited.add(o);
+        if (util.types.isProxy(o)) return true;
+      }
+      return false;
+    }
+    function _plainCopy(copy) {
+      return copy;
     }
     function _deep(v, ErrorClass, code, label, cap, depth, collect) {
       if (depth > cap) throw _raise(ErrorClass, code, label + " is nested too deeply to copy");
       if (v == null || typeof v !== "object") return v;
-      if (Buffer.isBuffer(v) || ArrayBuffer.isView(v) || v instanceof ArrayBuffer) {
+      _refuseShared(v, ErrorClass, code, label);
+      if (_protoChainHasProxy(v)) {
+        throw _raise(ErrorClass, code, label + ": a Proxy cannot be copied faithfully, because the keys it reports need not be the ones it answers; pass a plain object");
+      }
+      if (_protoChainIsCyclic(v)) {
+        throw _raise(ErrorClass, code, label + ": its prototype chain is a cycle, so it cannot be read or copied; pass a plain object");
+      }
+      if (Buffer.isBuffer(v) || ArrayBuffer.isView(v) || _isArrayBuffer(v)) {
         var bytesCopy = _copyBytesSameKind(v, ErrorClass, code, label, collect);
         _copyNamed(v, bytesCopy, ErrorClass, code, label, cap, depth, collect);
         return bytesCopy;
       }
       if (require_guard_parsed().isRecordedAsProduced(v)) return v;
-      if (v instanceof Date) return new Date(v.getTime());
+      if (util.types.isDate(v)) {
+        var dateCopy = new Date(time.instantOf(v));
+        _copyNamed(v, dateCopy, ErrorClass, code, label, cap, depth, collect, _DATE_BEHAVIOR);
+        return _plainCopy(dateCopy);
+      }
       if (Array.isArray(v)) {
         var arr = [];
-        for (var i = 0; i < v.length; i++) arr.push(_deep(v[i], ErrorClass, code, label, cap, depth + 1, collect));
+        var indexE = function(c, m) {
+          return _raise(ErrorClass, c, m);
+        };
+        var indices = identifier.readableIndices(v, indexE, code, label);
+        if (depth === 0) identifier.refuseAccessorFields(v, indices, indexE, code, label);
+        indices.forEach(function(k) {
+          var element;
+          try {
+            element = v[k];
+          } catch (e) {
+            throw _raise(ErrorClass, code, label + ": reading element " + k + " threw", e);
+          }
+          arr[k] = _deep(element, ErrorClass, code, label, cap, depth + 1, collect);
+        });
+        arr.length = v.length;
         _copyNamed(v, arr, ErrorClass, code, label, cap, depth, collect);
-        return arr;
+        return _plainCopy(arr);
       }
       var surface = _opaqueSurface(v, ErrorClass, code, label);
       if (surface) {
-        if (_opaqueIsSafeToPass(v, surface)) return v;
-        throw _raise(ErrorClass, code, label + ": a " + (v.constructor && v.constructor.name || "value") + " carrying its own fields cannot be used here -- its state cannot be copied, so those fields would stay changeable after they were checked; pass the fields as a plain object");
+        var carried = _opaqueFieldOutsideSurface(v, surface, ErrorClass, code, label);
+        if (carried === null) return v;
+        throw _raise(ErrorClass, code, label + ": " + _article(_kindName(v)) + " " + _kindName(v) + " carrying its own field " + JSON.stringify(String(carried)) + " cannot be used here -- its state cannot be copied, so that field would stay changeable after it was checked; pass the fields as a plain object");
+      }
+      if (util.types.isMap(v)) {
+        return _plainCopy(_copyEntries(v, /* @__PURE__ */ new Map(), ErrorClass, code, label, cap, depth, collect));
+      }
+      if (util.types.isSet(v)) {
+        return _plainCopy(_copyEntries(v, /* @__PURE__ */ new Set(), ErrorClass, code, label, cap, depth, collect));
       }
-      if (v instanceof Map) return _copyEntries(v, /* @__PURE__ */ new Map(), ErrorClass, code, label, cap, depth, collect);
-      if (v instanceof Set) return _copyEntries(v, /* @__PURE__ */ new Set(), ErrorClass, code, label, cap, depth, collect);
-      var out = Object.create(Object.getPrototypeOf(v));
+      var out = Object.create(Object.getPrototypeOf(v) === null ? null : Object.prototype);
       _copyNamed(v, out, ErrorClass, code, label, cap, depth, collect);
       return out;
     }
-    function _namesToCopy(src, dst) {
-      var indexed = Array.isArray(dst) || ArrayBuffer.isView(dst);
-      var kind = indexed || dst instanceof Map || dst instanceof Set || dst instanceof ArrayBuffer;
-      if (!kind) return _reachableKeys(src);
-      var own = Object.getOwnPropertyNames(src);
-      var out = [];
-      for (var i = 0; i < own.length; i++) {
-        if (own[i] === "length" || indexed && String(Number(own[i])) === own[i]) continue;
-        out.push(own[i]);
-      }
-      return out;
+    function _namesToCopy(src, ErrorClass, code, label, atArgument) {
+      var E = function(c, m) {
+        return _raise(ErrorClass, c, m);
+      };
+      var names = identifier.readableNames(src, E, code, label);
+      if (atArgument) identifier.refuseAccessorFields(src, names, E, code, label);
+      return names;
     }
     function _copyEntries(src, dst, ErrorClass, code, label, cap, depth, collect) {
-      src.forEach(function(value, key) {
+      var walk = util.types.isSet(src) ? Set.prototype.forEach : Map.prototype.forEach;
+      walk.call(src, function(value, key) {
         var copiedValue = _deep(value, ErrorClass, code, label, cap, depth + 1, collect);
-        if (dst instanceof Set) dst.add(copiedValue);
+        if (util.types.isSet(dst)) dst.add(copiedValue);
         else dst.set(_deep(key, ErrorClass, code, label, cap, depth + 1, collect), copiedValue);
       });
       _copyNamed(src, dst, ErrorClass, code, label, cap, depth, collect);
       return dst;
     }
-    function _copyNamed(src, dst, ErrorClass, code, label, cap, depth, collect) {
-      var keys = _namesToCopy(src, dst);
+    var _DATE_BEHAVIOR = (function() {
+      var t = /* @__PURE__ */ Object.create(null);
+      Reflect.ownKeys(Date.prototype).forEach(function(n) {
+        t[n] = 1;
+      });
+      return t;
+    })();
+    function _copyNamed(src, dst, ErrorClass, code, label, cap, depth, collect, behavior) {
+      var keys = _namesToCopy(src, ErrorClass, code, label, depth === 0);
       for (var k = 0; k < keys.length; k++) {
         var value;
         try {
@@ -2959,6 +3517,7 @@ var require_guard_bytes = __commonJS({
         } catch (e) {
           throw _raise(ErrorClass, code, label + ": reading " + JSON.stringify(keys[k]) + " threw", e);
         }
+        if (behavior && behavior[keys[k]] && typeof value === "function") continue;
         Object.defineProperty(dst, keys[k], {
           value: typeof value === "function" ? value : _deep(value, ErrorClass, code, label, cap, depth + 1, collect),
           writable: true,
@@ -3010,6 +3569,9 @@ var require_guard_bytes = __commonJS({
       source,
       snapshot,
       snapshotSource,
+      isByteSource,
+      lengthOf,
+      outputView,
       snapshotDeep,
       fixArguments,
       fixedCall
@@ -3182,32 +3744,6 @@ var require_guard_range = __commonJS({
   }
 });
 
-// node_modules/@blamejs/pki/lib/guard-time.js
-var require_guard_time = __commonJS({
-  "node_modules/@blamejs/pki/lib/guard-time.js"(exports2, module2) {
-    "use strict";
-    function assertValid(value, E, code, label) {
-      if (!(value instanceof Date) || isNaN(value.getTime())) {
-        throw E(code, (label || "value") + " must be a valid Date");
-      }
-      return value;
-    }
-    function within(instant, lower, upper, E, code, label, opts) {
-      assertValid(instant, E, code, label);
-      assertValid(lower, E, code, (label || "window") + " lower bound");
-      assertValid(upper, E, code, (label || "window") + " upper bound");
-      var t = instant.getTime();
-      var lo = lower.getTime();
-      var hi = upper.getTime();
-      return t >= lo && (opts && opts.upperInclusive ? t <= hi : t < hi);
-    }
-    module2.exports = {
-      assertValid,
-      within
-    };
-  }
-});
-
 // node_modules/@blamejs/pki/lib/guard-name.js
 var require_guard_name = __commonJS({
   "node_modules/@blamejs/pki/lib/guard-name.js"(exports2, module2) {
@@ -3679,55 +4215,6 @@ var require_guard_json = __commonJS({
   }
 });
 
-// node_modules/@blamejs/pki/lib/guard-identifier.js
-var require_guard_identifier = __commonJS({
-  "node_modules/@blamejs/pki/lib/guard-identifier.js"(exports2, module2) {
-    "use strict";
-    function _isDottedDecimal(str) {
-      if (str.length === 0) return false;
-      var arcs = 0, digits = 0, leadingZero = false;
-      for (var i = 0; i < str.length; i++) {
-        var c = str.charCodeAt(i);
-        if (c === 46) {
-          if (digits === 0 || leadingZero) return false;
-          arcs++;
-          digits = 0;
-          leadingZero = false;
-          continue;
-        }
-        if (c < 48 || c > 57) return false;
-        if (digits === 1 && str.charCodeAt(i - 1) === 48) leadingZero = true;
-        digits++;
-      }
-      if (digits === 0 || leadingZero) return false;
-      return arcs >= 1;
-    }
-    function assertCanonicalOid(str, E, code, label, boundsCode) {
-      var who = label || "OID";
-      if (typeof str !== "string" || !_isDottedDecimal(str)) {
-        throw E(code, who + " must be a canonical dotted-decimal OID string of two or more arcs with no leading-zero component");
-      }
-      if (boundsCode === null) return str;
-      var bcode = boundsCode === void 0 ? code : boundsCode;
-      var parts = str.split(".");
-      var root = BigInt(parts[0]);
-      var second = BigInt(parts[1]);
-      if (root > 2n) throw E(bcode, who + " root arc must be 0, 1, or 2 (X.660)");
-      if (root < 2n && second > 39n) throw E(bcode, who + " second arc must be 0..39 under roots 0 and 1 (X.660)");
-      return str;
-    }
-    function assertKnownKeys(obj, known, E, code, message) {
-      var describe = typeof message === "function" ? message : function(k) {
-        return message + JSON.stringify(k);
-      };
-      Object.keys(obj).forEach(function(k) {
-        if (!Object.prototype.hasOwnProperty.call(known, k)) throw E(code, describe(k));
-      });
-    }
-    module2.exports = { assertCanonicalOid, assertKnownKeys };
-  }
-});
-
 // node_modules/@blamejs/pki/lib/guard-header.js
 var require_guard_header = __commonJS({
   "node_modules/@blamejs/pki/lib/guard-header.js"(exports2, module2) {
@@ -4363,7 +4850,7 @@ var require_asn1_der = __commonJS({
       var d = /* @__PURE__ */ new Date(0);
       d.setUTCFullYear(year, month - 1, day);
       d.setUTCHours(hour, min, sec, ms);
-      if (isNaN(d.getTime())) throw new Asn1Error("asn1/bad-time", "unparseable time " + JSON.stringify(s));
+      if (isNaN(guard.time.instantOf(d))) throw new Asn1Error("asn1/bad-time", "unparseable time " + JSON.stringify(s));
       if (d.getUTCFullYear() !== year || d.getUTCMonth() !== month - 1 || d.getUTCDate() !== day || d.getUTCHours() !== hour || d.getUTCMinutes() !== min || d.getUTCSeconds() !== sec) {
         throw new Asn1Error("asn1/bad-time", "time component out of range " + JSON.stringify(s));
       }
@@ -4938,7 +5425,7 @@ var require_cbor_det = __commonJS({
       }
       var ns = Number(secs);
       var d = new Date(ns < 0 ? -constants.TIME.seconds(-ns) : constants.TIME.seconds(ns));
-      if (isNaN(d.getTime())) throw new CborError("cbor/bad-time", "epoch time out of range");
+      if (isNaN(guard.time.instantOf(d))) throw new CborError("cbor/bad-time", "epoch time out of range");
       return d;
     }
     function readOid(node) {
@@ -5071,12 +5558,12 @@ var require_cbor_det = __commonJS({
       },
       time: function(v) {
         var ms;
-        if (v instanceof Date) {
-          ms = v.getTime();
+        if (guard.time.isDate(v)) {
+          ms = guard.time.instantOf(v);
           if (Number.isNaN(ms)) throw new CborError("cbor/bad-time", "build.time: an Invalid Date has no epoch value");
           if (ms % 1e3 !== 0) throw new CborError("cbor/bad-time", "build.time: a Date with sub-second precision cannot be a second-granularity CBOR epoch; round to whole seconds");
         }
-        var secs = v instanceof Date ? BigInt(Math.floor(ms / 1e3)) : typeof v === "bigint" ? v : BigInt(v);
+        var secs = guard.time.isDate(v) ? BigInt(Math.floor(ms / 1e3)) : typeof v === "bigint" ? v : BigInt(v);
         if (secs < -_MAX_EPOCH_SECONDS || secs > _MAX_EPOCH_SECONDS) throw new CborError("cbor/bad-time", "build.time: epoch seconds " + secs + " are outside the representable Date range");
         return build.tag(1, build.int(secs));
       },
@@ -7476,7 +7963,7 @@ var require_ct = __commonJS({
       if (typeof ti !== "object") throw _ctErr("ct/bad-log-list", "a CT log temporal_interval must be an object");
       var start = rfc3339.parse(ti.start_inclusive, _ctErr, "ct/bad-date", "temporal_interval.start_inclusive");
       var end = rfc3339.parse(ti.end_exclusive, _ctErr, "ct/bad-date", "temporal_interval.end_exclusive");
-      if (start.getTime() >= end.getTime()) throw _ctErr("ct/bad-log-list", "a CT log temporal_interval start_inclusive must be strictly before end_exclusive");
+      if (guard.time.instantOf(start) >= guard.time.instantOf(end)) throw _ctErr("ct/bad-log-list", "a CT log temporal_interval start_inclusive must be strictly before end_exclusive");
       return { startInclusive: start, endExclusive: end };
     }
     function _parseLog(log, operatorName) {
@@ -7505,10 +7992,10 @@ var require_ct = __commonJS({
     function _sameTemporal(a, b) {
       if (a == null && b == null) return true;
       if (a == null || b == null) return false;
-      return a.startInclusive.getTime() === b.startInclusive.getTime() && a.endExclusive.getTime() === b.endExclusive.getTime();
+      return guard.time.instantOf(a.startInclusive) === guard.time.instantOf(b.startInclusive) && guard.time.instantOf(a.endExclusive) === guard.time.instantOf(b.endExclusive);
     }
     function _logsAgree(a, b) {
-      return a.state.name === b.state.name && a.state.since.getTime() === b.state.since.getTime() && _sameTemporal(a.temporalInterval, b.temporalInterval);
+      return a.state.name === b.state.name && guard.time.instantOf(a.state.since) === guard.time.instantOf(b.state.since) && _sameTemporal(a.temporalInterval, b.temporalInterval);
     }
     function parseLogList(json, opts) {
       void opts;
@@ -7550,7 +8037,7 @@ var require_ct = __commonJS({
       return { logs, byLogId, version, timestamp };
     }
     function _resolveNotAfter(entry, opts) {
-      if (opts.certNotAfter instanceof Date) return opts.certNotAfter;
+      if (guard.time.isDate(opts.certNotAfter)) return opts.certNotAfter;
       if (entry && entry.entryType === 0 && entry.leafCert != null) {
         var x509 = require_schema_x509();
         try {
@@ -7570,7 +8057,7 @@ var require_ct = __commonJS({
       if (!log.state.trusted) {
         if (!log.state.conditional) throw _ctErr("ct/log-untrusted", "the CT log state '" + log.state.name + "' is not trusted");
         var ts = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp");
-        if (ts >= BigInt(log.state.since.getTime())) throw _ctErr("ct/log-untrusted", "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")");
+        if (ts >= BigInt(guard.time.instantOf(log.state.since))) throw _ctErr("ct/log-untrusted", "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")");
       }
       if (log.temporalInterval) {
         var notAfter = _resolveNotAfter(entry, opts);
@@ -10716,12 +11203,12 @@ var require_schema_c509 = __commonJS({
       if (r.serialNumber == null && r.serialNumberHex == null) throw _err("c509/bad-input", "a C509 result must carry serialNumber or serialNumberHex");
       if (!r.signatureAlgorithm || typeof r.signatureAlgorithm.name !== "string") throw _err("c509/bad-input", "a C509 result must carry signatureAlgorithm.name");
       if (!r.subjectPublicKeyAlgorithm || typeof r.subjectPublicKeyAlgorithm.name !== "string") throw _err("c509/bad-input", "a C509 result must carry subjectPublicKeyAlgorithm.name");
-      if (!r.validity || !(r.validity.notBefore instanceof Date) || r.validity.notAfter !== null && !(r.validity.notAfter instanceof Date)) throw _err("c509/bad-input", "a C509 result must carry validity.notBefore (Date) and notAfter (Date or null)");
+      if (!r.validity || !guard.time.isDate(r.validity.notBefore) || r.validity.notAfter !== null && !guard.time.isDate(r.validity.notAfter)) throw _err("c509/bad-input", "a C509 result must carry validity.notBefore (Date) and notAfter (Date or null)");
       if (!Array.isArray(r.extensions)) throw _err("c509/bad-input", "a C509 result must carry an extensions array");
       if (!Buffer.isBuffer(r.signatureValue)) throw _err("c509/bad-input", "a C509 result must carry a Buffer signatureValue");
     }
     function _validityUint(date, label) {
-      var secs = Math.floor(date.getTime() / 1e3);
+      var secs = Math.floor(guard.time.instantOf(date) / 1e3);
       if (!isFinite(secs) || secs < 0) throw _err("c509/bad-validity", label + " is before the Unix epoch or not a valid date; C509 ~time is a non-negative CBOR epoch");
       return cbor.build.uint(BigInt(secs));
     }
@@ -10869,7 +11356,7 @@ var require_schema_c509 = __commonJS({
         // against a UTF8String of the same characters) would rebuild different bytes and break the
         // signature that covers them. Byte-identical is exactly the condition under which that is safe.
         issuer: c.issuer.bytes.equals(c.subject.bytes) ? null : _c509NameFromDer(c.issuer.bytes),
-        validity: { notBefore: c.validity.notBefore, notAfter: c.validity.notAfter.getTime() === _NO_EXPIRY ? null : c.validity.notAfter },
+        validity: { notBefore: c.validity.notBefore, notAfter: guard.time.instantOf(c.validity.notAfter) === _NO_EXPIRY ? null : c.validity.notAfter },
         subject: _c509NameFromDer(c.subject.bytes),
         subjectPublicKeyAlgorithm: { name: "ecPublicKey", oid: c.subjectPublicKeyInfo.algorithm.oid, curve },
         subjectPublicKey: _compressEcPoint(asn1.read.bitString(spkiNode.children[1]).bytes, coordLen),
@@ -16683,6 +17170,7 @@ var require_ocsp_verify = __commonJS({
   "node_modules/@blamejs/pki/lib/ocsp-verify.js"(exports2, module2) {
     "use strict";
     var asn1 = require_asn1_der();
+    var guard = require_guard_all();
     var oid = require_oid();
     var x509 = require_schema_x509();
     var compositeSig = require_composite_sig();
@@ -16781,7 +17269,7 @@ var require_ocsp_verify = __commonJS({
           if (!issuedByCa) continue;
           if (!isOctetAligned(rc.signatureValue)) continue;
           if (!await verifyWithSpki(rc.signatureAlgorithm, rc.signatureValue.bytes, issuer.workingPublicKey, rc.tbsBytes)) continue;
-          if (time < rc.validity.notBefore || time > rc.validity.notAfter) continue;
+          if (guard.time.instantOf(time) < guard.time.instantOf(rc.validity.notBefore) || guard.time.instantOf(time) > guard.time.instantOf(rc.validity.notAfter)) continue;
           var eku;
           try {
             eku = decodeExt(rc, OID_EKU);
@@ -16824,14 +17312,14 @@ var require_ocsp_verify = __commonJS({
           var sr = br.responses[s];
           if (!await ocspCertIdMatches(sr.certID, cert, issuerNameCandidates, issuerKeyBits)) continue;
           if (ocspHasCriticalExtension(sr.singleExtensions)) continue;
-          if (sr.thisUpdate > time) continue;
-          if (!sr.nextUpdate || sr.nextUpdate < time) continue;
+          if (guard.time.instantOf(sr.thisUpdate) > guard.time.instantOf(time)) continue;
+          if (!sr.nextUpdate || guard.time.instantOf(sr.nextUpdate) < guard.time.instantOf(time)) continue;
           out.matched = true;
           out.thisUpdate = sr.thisUpdate;
           out.nextUpdate = sr.nextUpdate;
           var st = sr.certStatus;
           if (st.type === "revoked") {
-            if (historical && st.revocationTime instanceof Date && st.revocationTime.getTime() > time.getTime()) {
+            if (historical && guard.time.isDate(st.revocationTime) && guard.time.instantOf(st.revocationTime) > guard.time.instantOf(time)) {
               out.sawGood = true;
             } else if (!out.revoked) {
               out.revoked = { revocationReason: st.revocationReason || null, reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : "") };
@@ -17647,7 +18135,7 @@ var require_crmf_sign = __commonJS({
       var parts = [];
       if (nb != null) parts.push(b.explicit(0, _b.timeDer(nb, "validity notBefore")));
       if (na != null) parts.push(b.explicit(1, _b.timeDer(na, "validity notAfter")));
-      if (nb != null && na != null && nb.getTime() > na.getTime()) throw _err("crmf/bad-validity", "notBefore must not be after notAfter");
+      if (nb != null && na != null && guard.time.instantOf(nb) > guard.time.instantOf(na)) throw _err("crmf/bad-validity", "notBefore must not be after notAfter");
       return b.implicit(4, b.sequence(parts));
     }
     function _encodeCertTemplate(tpl, opts) {
@@ -19466,7 +19954,7 @@ var require_cms_sign = __commonJS({
       });
     }
     function _timeValue(when) {
-      var d = when instanceof Date ? when : /* @__PURE__ */ new Date();
+      var d = guard.time.isDate(when) ? when : /* @__PURE__ */ new Date();
       return d.getUTCFullYear() < 2050 ? b.utcTime(d) : b.generalizedTime(d);
     }
     function _keyOnlyCertStandIn(spkiDer) {
@@ -19537,8 +20025,7 @@ var require_cms_sign = __commonJS({
       ], _sign);
     }
     function _sign(content, signers, opts) {
-      opts = opts || {};
-      if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.sign options must be an object");
+      opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.sign options");
       guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "cms/bad-input", "unknown opts field ");
       var contentBuf = _toBuf(content, "content");
       var list = Array.isArray(signers) ? signers : [signers];
@@ -19734,8 +20221,7 @@ var require_cms_sign = __commonJS({
       ], _countersign);
     }
     function _countersign(cmsInput, signers, opts) {
-      opts = opts || {};
-      if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.countersign options must be an object");
+      opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.countersign options");
       guard.identifier.assertKnownKeys(opts, KNOWN_COUNTERSIGN_OPTS, _err, "cms/bad-input", "unknown opts field ");
       var list = Array.isArray(signers) ? signers : [signers];
       if (!list.length) throw _err("cms/bad-input", "pki.cms.countersign requires at least one countersigner");
@@ -21476,8 +21962,7 @@ var require_cms_verify = __commonJS({
       });
     }
     function _verify(input, opts) {
-      opts = opts || {};
-      if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cms/bad-input", "pki.cms.verify options must be an object");
+      opts = guard.identifier.optionsObject(opts, _err, "cms/bad-input", "pki.cms.verify options");
       guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "cms/bad-input", "pki.cms.verify has an unknown option ");
       var parsed = guard.parsed.acceptDerived(input, "cms", function(bytes) {
         return cms.parse(_snapshotIfBytes(bytes, "pki.cms.verify"));
@@ -21533,7 +22018,7 @@ var require_cms_verify = __commonJS({
         return _snapshotIfBytes(v, "opts.trustAnchors[]");
       }
       if (v === null || typeof v !== "object") return v;
-      if (v instanceof Date) return new Date(v.getTime());
+      if (guard.time.isDate(v)) return new Date(guard.time.instantOf(v));
       if (depth >= _ANCHOR_CLONE_DEPTH) {
         throw _err("cms/bad-input", "an opts.trustAnchors entry nests deeper than " + _ANCHOR_CLONE_DEPTH + " levels, so it cannot be copied before the chain is walked; pass the anchor as certificate DER or a { name, publicKey, algorithm } tuple");
       }
@@ -21557,7 +22042,7 @@ var require_cms_verify = __commonJS({
       }
       return {
         trustAnchors: anchors,
-        time: opts.time instanceof Date ? new Date(opts.time.getTime()) : opts.time,
+        time: guard.time.isDate(opts.time) ? new Date(guard.time.instantOf(opts.time)) : opts.time,
         requiredEku: Array.isArray(opts.requiredEku) ? opts.requiredEku.slice() : opts.requiredEku,
         checkPurpose: opts.checkPurpose
       };
@@ -23326,8 +23811,34 @@ var require_path_validate = __commonJS({
       }
       return null;
     }
+    var _VALIDATE_OPTS = {
+      checkPurpose: 1,
+      historicalMode: 1,
+      initialAnyPolicyInhibit: 1,
+      initialExcludedSubtrees: 1,
+      initialExplicitPolicy: 1,
+      initialPermittedSubtrees: 1,
+      initialPolicyMappingInhibit: 1,
+      maxPathCerts: 1,
+      maxPolicyNodes: 1,
+      requireRevocation: 1,
+      requiredEku: 1,
+      revocationChecker: 1,
+      softFail: 1,
+      time: 1,
+      trustAnchor: 1,
+      userInitialPolicySet: 1,
+      verifier: 1
+    };
     async function validate(path, opts) {
-      opts = opts || {};
+      opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "validate: opts");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _VALIDATE_OPTS,
+        E,
+        "path/bad-input",
+        "pki.path.validate has an unknown option. The anchor here is `trustAnchor`, singular; pki.path.build takes `trustAnchors`. The unknown option was: "
+      );
       if (!Array.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
       var maxCerts = guard.limits.cap(opts.maxPathCerts, "validate: opts.maxPathCerts", constants.LIMITS.PATH_MAX_CERTS, { E, code: "path/bad-input", min: 1 });
       if (path.length > maxCerts) throw E("path/bad-input", "validate: the certification path has " + path.length + " certificates, exceeding the maxPathCerts limit (" + maxCerts + ")");
@@ -23401,12 +23912,12 @@ var require_path_validate = __commonJS({
           checks.push({ name: "kemKeyUsage", ok: kku.ok, code: kku.ok ? void 0 : kku.code });
           if (!kku.ok) failed = true;
         }
-        var t = opts.time;
+        var t = guard.time.instantOf(opts.time);
         var vOk = true, vCode;
-        if (t < cert.validity.notBefore) {
+        if (t < guard.time.instantOf(cert.validity.notBefore)) {
           vOk = false;
           vCode = "path/not-yet-valid";
-        } else if (t > cert.validity.notAfter) {
+        } else if (t > guard.time.instantOf(cert.validity.notAfter)) {
           vOk = false;
           vCode = "path/expired";
         }
@@ -23528,7 +24039,7 @@ var require_path_validate = __commonJS({
           var distrustDate = assertAnchorConstraints(ta, checkPurpose);
           if (distrustDate != null) {
             anchorDistrustApplied = true;
-            if (cert.validity.notBefore > distrustDate) {
+            if (guard.time.instantOf(cert.validity.notBefore) > guard.time.instantOf(distrustDate)) {
               checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" });
               failed = true;
             }
@@ -23789,7 +24300,7 @@ var require_path_validate = __commonJS({
           best = c;
           continue;
         }
-        var t = c.crl.thisUpdate.getTime(), bt = best.crl.thisUpdate.getTime();
+        var t = guard.time.instantOf(c.crl.thisUpdate), bt = guard.time.instantOf(best.crl.thisUpdate);
         if (t > bt) {
           best = c;
           continue;
@@ -23903,8 +24414,8 @@ var require_path_validate = __commonJS({
                 }
               }
             }
-            if (theCrl.thisUpdate > time) return null;
-            if (!theCrl.nextUpdate || theCrl.nextUpdate < time) return null;
+            if (guard.time.instantOf(theCrl.thisUpdate) > guard.time.instantOf(time)) return null;
+            if (!theCrl.nextUpdate || guard.time.instantOf(theCrl.nextUpdate) < guard.time.instantOf(time)) return null;
             var sigOk = await crlVerify.verifyCrlSignature(theCrl, issuer.workingPublicKey);
             if (!sigOk) return null;
             void sawIdp;
@@ -23914,7 +24425,7 @@ var require_path_validate = __commonJS({
             for (var r = 0; r < theCrl.revokedCertificates.length; r++) {
               var entry = theCrl.revokedCertificates[r];
               if (entry.serialNumberHex !== cert.serialNumberHex) continue;
-              if (historical && entry.revocationDate instanceof Date && entry.revocationDate.getTime() > time.getTime()) continue;
+              if (historical && guard.time.isDate(entry.revocationDate) && guard.time.instantOf(entry.revocationDate) > guard.time.instantOf(time)) continue;
               var rc = crlEntryReason(entry);
               return rc === null ? 0 : rc;
             }
@@ -24105,7 +24616,7 @@ var require_path_validate = __commonJS({
     }
     function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
       opts = opts || {};
-      if (!(time instanceof Date) || isNaN(time.getTime())) {
+      if (!guard.time.isDate(time) || isNaN(guard.time.instantOf(time))) {
         return Promise.reject(E("path/bad-input", "verifyOcspResponse: time must be a valid Date (the currency + responder-validity check date)"));
       }
       function unbound(reason) {
@@ -24252,7 +24763,7 @@ var require_path_validate = __commonJS({
       var ku = softDecode(cand, OID.keyUsage);
       if (ku && ku.value && ku.value.keyCertSign === true) score += 10;
       var v = cand.validity;
-      if (v && v.notBefore instanceof Date && v.notAfter instanceof Date && v.notBefore.getTime() <= time.getTime() && time.getTime() <= v.notAfter.getTime()) score += 5;
+      if (v && guard.time.isDate(v.notBefore) && guard.time.isDate(v.notAfter) && guard.time.instantOf(v.notBefore) <= guard.time.instantOf(time) && guard.time.instantOf(time) <= guard.time.instantOf(v.notAfter)) score += 5;
       return score;
     }
     function _pushCandidates(frame, scored, stack, counter) {
@@ -24352,9 +24863,39 @@ var require_path_validate = __commonJS({
       }
       return out;
     }
+    var _BUILD_OPTS = (function() {
+      var o = {
+        aiaTimeout: 1,
+        candidates: 1,
+        fetchAia: 1,
+        intermediates: 1,
+        maxAiaFetches: 1,
+        maxAiaPerCert: 1,
+        maxCandidatesConsidered: 1,
+        maxDepth: 1,
+        maxPathCerts: 1,
+        maxResponseBytes: 1,
+        time: 1,
+        tls: 1,
+        transport: 1,
+        trustAnchors: 1,
+        validate: 1
+      };
+      Object.keys(_VALIDATE_OPTS).forEach(function(k) {
+        o[k] = 1;
+      });
+      delete o.trustAnchor;
+      return o;
+    })();
     async function build(leaf, opts) {
-      opts = opts || {};
-      if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw E("path/bad-input", "build: opts must be an object");
+      opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "build: opts");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _BUILD_OPTS,
+        E,
+        "path/bad-input",
+        "pki.path.build has an unknown option. The anchors here are `trustAnchors`, plural; pki.path.validate takes `trustAnchor`. The unknown option was: "
+      );
       var leafCert;
       try {
         leafCert = coerceCert(leaf);
@@ -24429,12 +24970,13 @@ var require_path_validate = __commonJS({
         aiaTimeout: 1,
         maxResponseBytes: 1
       };
-      var forwarded = {};
-      Object.keys(opts).forEach(function(k) {
-        if (!BUILD_ONLY_OPT[k]) forwarded[k] = opts[k];
+      var forwarded = /* @__PURE__ */ Object.create(null);
+      Object.keys(_VALIDATE_OPTS).forEach(function(k) {
+        if (Object.prototype.hasOwnProperty.call(BUILD_ONLY_OPT, k)) return;
+        if (k in opts) forwarded[k] = opts[k];
       });
       function validateOpts(anchor) {
-        var vo = {};
+        var vo = /* @__PURE__ */ Object.create(null);
         Object.keys(forwarded).forEach(function(f) {
           vo[f] = forwarded[f];
         });
@@ -26351,10 +26893,8 @@ var require_cmc_verify = __commonJS({
       return input;
     }
     function _copyAnyBytes(v) {
-      if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, CmcError, "cmc/bad-input", "a byte field of the request");
-      if (ArrayBuffer.isView(v)) return Buffer.from(new Uint8Array(v.buffer, v.byteOffset, v.byteLength));
-      if (v instanceof ArrayBuffer) return Buffer.from(new Uint8Array(v));
-      return v;
+      if (!guard.bytes.isByteSource(v)) return v;
+      return guard.bytes.snapshotSource(v, CmcError, "cmc/bad-input", "a byte field of the request");
     }
     function _snapshotSent(sent) {
       var out = {}, k;
@@ -26616,7 +27156,7 @@ var require_tsp_sign = __commonJS({
       if (!NODE_DIGEST[certHashAlg]) throw _err("tsp/unsupported-algorithm", "unsupported certHashAlgorithm " + JSON.stringify(certHashAlg));
       var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(Buffer.from(mi.hashedMessage))]);
       if (opts.genTime != null) guard.time.assertValid(opts.genTime, _err, "tsp/bad-input", "genTime");
-      var genTime = opts.genTime instanceof Date ? opts.genTime : /* @__PURE__ */ new Date();
+      var genTime = guard.time.isDate(opts.genTime) ? opts.genTime : /* @__PURE__ */ new Date();
       var serial = guard.range.authoredInteger(opts.serialNumber, _err, "tsp/bad-input", "serialNumber");
       var fields = [b.integer(1n), _policy(opts.policy), imprint, b.integer(serial), b.generalizedTime(genTime)];
       if (opts.accuracy) fields.push(_accuracy(opts.accuracy));
@@ -26947,7 +27487,7 @@ var require_tsp_sign = __commonJS({
       if (opts.trustAnchor) {
         var pathRes = null;
         var floorT = tst.genTime;
-        var ceilT = tst.genTimeFraction != null && /[1-9]/.test(tst.genTimeFraction.slice(3)) ? new Date(floorT.getTime() + 1) : floorT;
+        var ceilT = tst.genTimeFraction != null && /[1-9]/.test(tst.genTimeFraction.slice(3)) ? new Date(guard.time.instantOf(floorT) + 1) : floorT;
         try {
           var pool = (parsed.certificates || []).filter(function(c) {
             return c.tagClass === "universal";
@@ -27120,8 +27660,23 @@ var require_ocsp = __commonJS({
         [opts, "pki.ocsp.buildRequest options"]
       ], _buildRequest);
     }
+    var _BUILD_REQUEST_OPTS = {
+      hashAlgorithm: 1,
+      nonce: 1,
+      pem: 1,
+      profile: 1,
+      requestorName: 1,
+      signer: 1
+    };
     function _buildRequest(query, opts) {
-      opts = opts || {};
+      opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.buildRequest options");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _BUILD_REQUEST_OPTS,
+        _err,
+        "ocsp/bad-input",
+        "pki.ocsp.buildRequest has an unknown option (the anti-replay nonce is `nonce`): "
+      );
       var lightweight = opts.profile === "lightweight";
       var hashName = opts.hashAlgorithm || "sha1";
       if (lightweight && hashName !== "sha1") throw _err("ocsp/bad-input", "the lightweight profile requires a SHA-1 CertID (RFC 5019 sec. 2.1.1)");
@@ -27195,8 +27750,16 @@ var require_ocsp = __commonJS({
         [opts, "pki.ocsp.sign options"]
       ], _sign);
     }
+    var _SIGN_OPTS = { embedCert: 1, extendedRevoke: 1, nonce: 1, pem: 1 };
     function _sign(responseData, responder, opts) {
-      opts = opts || {};
+      opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.sign options");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _SIGN_OPTS,
+        _err,
+        "ocsp/bad-input",
+        "pki.ocsp.sign has an unknown option (the nonce to echo back is `nonce`): "
+      );
       responseData = responseData || {};
       if (!responder || responder.cert == null || responder.key == null) throw _err("ocsp/bad-input", "a responder must be { cert, key }");
       var respCertDer = _normCertDer(responder.cert, "the responder certificate");
@@ -27254,8 +27817,8 @@ var require_ocsp = __commonJS({
     }
     function _asDate(d) {
       if (d == null) return null;
-      var dt = d instanceof Date ? d : new Date(d);
-      if (isNaN(dt.getTime())) throw _err("ocsp/bad-input", "an invalid date value " + JSON.stringify(d));
+      var dt = guard.time.isDate(d) ? d : new Date(d);
+      if (isNaN(guard.time.instantOf(dt))) throw _err("ocsp/bad-input", "an invalid date value " + JSON.stringify(d));
       return dt;
     }
     function _snapshotSignerKey(key, owned) {
@@ -27313,8 +27876,20 @@ var require_ocsp = __commonJS({
       if (code == null) throw _err("ocsp/bad-input", "an error responseStatus must be one of " + Object.keys(ERROR_STATUS).join(" / "));
       return b.sequence([b.enumerated(BigInt(code))]);
     }
+    var _VERIFY_OPTS = { cert: 1, historicalMode: 1, issuer: 1, requestNonce: 1, time: 1 };
     function verify(response, opts) {
-      opts = opts || {};
+      try {
+        opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.verify options");
+        guard.identifier.assertKnownKeys(
+          opts,
+          _VERIFY_OPTS,
+          _err,
+          "ocsp/bad-input",
+          "pki.ocsp.verify has an unknown option (the request nonce to bind against is `requestNonce`): "
+        );
+      } catch (e) {
+        return Promise.reject(e);
+      }
       if (opts.cert == null || opts.issuer == null) return Promise.reject(_err("ocsp/bad-input", "verify requires opts.cert and opts.issuer"));
       var parsed, cert, issuerCert, time;
       try {
@@ -27592,7 +28167,7 @@ var require_x509_sign = __commonJS({
       var serialTlv = _serialInteger(spec.serialNumber);
       guard.time.assertValid(spec.notBefore, _err, "x509/bad-input", "notBefore");
       guard.time.assertValid(spec.notAfter, _err, "x509/bad-input", "notAfter");
-      if (spec.notBefore.getTime() > spec.notAfter.getTime()) throw _err("x509/bad-input", "notBefore must not be after notAfter (RFC 5280 sec. 4.1.2.5)");
+      if (guard.time.instantOf(spec.notBefore) > guard.time.instantOf(spec.notAfter)) throw _err("x509/bad-input", "notBefore must not be after notAfter (RFC 5280 sec. 4.1.2.5)");
       var validityDer = b.sequence([_timeDer(spec.notBefore, "notBefore"), _timeDer(spec.notAfter, "notAfter")]);
       var exts = _buildExtensions(spec.extensions, { spki, issuerSpki, issuerCert, subjectEmpty });
       if (subjectEmpty && !_hasCriticalSan(spec.extensions)) {
@@ -27886,7 +28461,7 @@ var require_attrcert_sign = __commonJS({
     function _encodeValidity(notBefore, notAfter) {
       guard.time.assertValid(notBefore, _err, "attrcert/bad-input", "notBeforeTime");
       guard.time.assertValid(notAfter, _err, "attrcert/bad-input", "notAfterTime");
-      if (notBefore.getTime() > notAfter.getTime()) throw _err("attrcert/bad-input", "notBeforeTime must not be after notAfterTime (RFC 5755 sec. 4.2.6)");
+      if (guard.time.instantOf(notBefore) > guard.time.instantOf(notAfter)) throw _err("attrcert/bad-input", "notBeforeTime must not be after notAfterTime (RFC 5755 sec. 4.2.6)");
       return b.sequence([b.generalizedTime(notBefore), b.generalizedTime(notAfter)]);
     }
     function _encodeRole(role) {
@@ -28550,7 +29125,7 @@ var require_crl_sign = __commonJS({
       var nextU = null;
       if (spec.nextUpdate != null) {
         nextU = _timeDer(spec.nextUpdate, "nextUpdate");
-        if (spec.nextUpdate.getTime() < spec.thisUpdate.getTime()) throw _err("crl/bad-input", "nextUpdate must not be before thisUpdate (RFC 5280 sec. 5.1.2.5)");
+        if (guard.time.instantOf(spec.nextUpdate) < guard.time.instantOf(spec.thisUpdate)) throw _err("crl/bad-input", "nextUpdate must not be before thisUpdate (RFC 5280 sec. 5.1.2.5)");
       }
       var extResult = _buildCrlExtensions(spec, { issuerCert, issuerSpki });
       var crlExts = extResult.exts;
@@ -28751,8 +29326,16 @@ var require_key = __commonJS({
       }
       return pkix.coerceToDer(input, { pemLabel: "PRIVATE KEY", PemError, ErrorClass: KeyError, prefix: "key" });
     }
+    var _ENCRYPT_OPTS = { cipher: 1, iterations: 1, pem: 1, prf: 1, salt: 1 };
     async function encrypt(privateKey, password, opts) {
-      opts = opts || {};
+      opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.encrypt options");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _ENCRYPT_OPTS,
+        _err,
+        "key/bad-input",
+        "pki.key.encrypt has an unknown option (the PBKDF2 count here is `iterations`; `maxIterations` is the decrypt-side cap): "
+      );
       var der = await _toPrivateKeyDer(privateKey);
       try {
         pkcs8.parse(der);
@@ -28783,8 +29366,16 @@ var require_key = __commonJS({
         guard.secret.zeroize(dk, KeyError, "key/bad-input", "the password-derived encryption key");
       }
     }
+    var _DECRYPT_OPTS = { maxIterations: 1, pem: 1 };
     async function decrypt(encrypted, password, opts) {
-      opts = opts || {};
+      opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.decrypt options");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _DECRYPT_OPTS,
+        _err,
+        "key/bad-input",
+        "pki.key.decrypt has an unknown option (the PBKDF2 cap here is `maxIterations`; `iterations` is the encrypt-side count): "
+      );
       if (opts.maxIterations != null && (typeof opts.maxIterations !== "number" || !isFinite(opts.maxIterations) || opts.maxIterations < 1 || Math.floor(opts.maxIterations) !== opts.maxIterations)) {
         throw _err("key/bad-input", "maxIterations must be a positive integer");
       }
@@ -28815,8 +29406,16 @@ var require_key = __commonJS({
       }
       return plaintext;
     }
+    var _EXPORT_OPTS = { format: 1, label: 1 };
     async function export_(key, opts) {
-      opts = opts || {};
+      opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.export options");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _EXPORT_OPTS,
+        _err,
+        "key/bad-input",
+        "pki.key.export has an unknown option. It serializes only. To protect a private key, call pki.key.encrypt(key, password) first and export its result. The unknown option was: "
+      );
       if (!_isCryptoKey(key)) throw _err("key/bad-input", "export expects a WebCrypto CryptoKey");
       var defaultLabel;
       if (key.type === "private") defaultLabel = "PRIVATE KEY";
@@ -28828,8 +29427,16 @@ var require_key = __commonJS({
       if (fmt === "pem") return pkix.pemEncode(der, opts.label || defaultLabel, PemError);
       throw _err("key/bad-input", "unsupported format " + JSON.stringify(opts.format) + " (der / pem)");
     }
+    var _IMPORT_OPTS = { algorithm: 1, extractable: 1, password: 1, usages: 1 };
     async function import_(input, opts) {
-      opts = opts || {};
+      opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.import options");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _IMPORT_OPTS,
+        _err,
+        "key/bad-input",
+        "pki.key.import has an unknown option: "
+      );
       var detected = _detectKeyInput(input);
       if (detected.format === "encrypted") {
         if (opts.password == null) throw _err("key/bad-input", "an ENCRYPTED PRIVATE KEY requires opts.password to import");
@@ -28846,8 +29453,16 @@ var require_key = __commonJS({
         throw _err("key/bad-input", "importKey failed", e);
       }
     }
+    var _GENERATE_OPTS = { extractable: 1, usages: 1 };
     async function generate(algorithm, opts) {
-      opts = opts || {};
+      opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.generate options");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _GENERATE_OPTS,
+        _err,
+        "key/bad-input",
+        "pki.key.generate has an unknown option (the WebCrypto spelling is `extractable`): "
+      );
       var extractable = opts.extractable != null ? opts.extractable : true;
       var usages = opts.usages || _generateUsages(_algName(algorithm));
       var pair;
@@ -28860,8 +29475,16 @@ var require_key = __commonJS({
       if (!pair || !pair.privateKey || !pair.publicKey) throw _err("key/bad-input", "the algorithm does not generate an asymmetric key pair");
       return { privateKey: pair.privateKey, publicKey: pair.publicKey };
     }
+    var _PUBLIC_FROM_PRIVATE_OPTS = { pem: 1 };
     async function publicFromPrivate(privateKey, opts) {
-      opts = opts || {};
+      opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.publicFromPrivate options");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _PUBLIC_FROM_PRIVATE_OPTS,
+        _err,
+        "key/bad-input",
+        "pki.key.publicFromPrivate has an unknown option: "
+      );
       var der = await _toPrivateKeyDer(privateKey);
       var spki;
       try {
@@ -30884,8 +31507,8 @@ var require_sigstore = __commonJS({
     function _toMs(x) {
       if (x == null) return null;
       if (typeof x === "number") return Number.isFinite(x) ? x : null;
-      if (x instanceof Date) {
-        var d = x.getTime();
+      if (guard.time.isDate(x)) {
+        var d = guard.time.instantOf(x);
         return isNaN(d) ? null : d;
       }
       if (typeof x === "string") {
@@ -31198,7 +31821,7 @@ var require_sigstore = __commonJS({
         }
       }
       if (integratedTime === null) throw lastErr;
-      var checkTime = opts.time instanceof Date ? opts.time.getTime() : C.TIME.seconds(integratedTime);
+      var checkTime = guard.time.isDate(opts.time) ? guard.time.instantOf(opts.time) : C.TIME.seconds(integratedTime);
       await _verifyChain(leaf, _chainDers(vm), fulcioRoots, checkTime);
       var identity = _identity(leaf);
       var identityChecked = _checkIdentity(identity, opts.identity);
@@ -31944,8 +32567,8 @@ var require_est = __commonJS({
       return asn1.build.sequence([asn1.build.oid(typeOid), asn1.build.set(valueNodes)]);
     }
     function challengePasswordFromTlsUnique(channelBinding) {
-      if (!Buffer.isBuffer(channelBinding) || channelBinding.length === 0) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
-      var b64 = channelBinding.toString("base64");
+      if (!Buffer.isBuffer(channelBinding) || guard.bytes.lengthOf(channelBinding) === 0) throw E("est/bad-input", "challengePasswordFromTlsUnique requires the channel-binding bytes");
+      var b64 = guard.bytes.view(channelBinding, EstError, "est/bad-input", "the channel-binding bytes").toString("base64");
       if (b64.length > 255) throw E("est/tls-unique-too-long", "the base64 tls-unique value exceeds 255 octets (RFC 7030 sec. 3.5)");
       return _attr(OID_CHALLENGE_PASSWORD, [asn1.build.printable(b64)]);
     }
@@ -32125,7 +32748,7 @@ var require_est = __commonJS({
       function step() {
         return transport({ method, url: url.href, headers: _headersFor(url), body, tls: _tlsFor(url), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function(res) {
           res = res || {};
-          var blen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+          var blen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
           if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
           var h = {
             location: _ciHeader(res.headers, "location"),
@@ -32221,7 +32844,7 @@ var require_est = __commonJS({
         return { retry: true, retryAfterSeconds: verdict.retryAfterSeconds, retryAfterDate: verdict.retryAfterDate };
       }
       if (verdict.status !== "ok") throw E("est/http-error", "an EST " + op + " response must be HTTP 200 or 202 (RFC 7030 sec. 4.1.3 / 4.2.3), got " + res.status);
-      var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+      var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
       if (bodyLen === 0) throw E("est/empty-body", "a 200 " + op + " response carried an empty body (RFC 7030 sec. 4.1.3 / 4.2.3)");
       var parsed = parseCertsOnly(transferDecode(res.body));
       if (op === "cacerts") return { certificates: parsed.certificates, crls: parsed.crls };
@@ -32381,10 +33004,8 @@ var require_est = __commonJS({
       };
     }
     function _copyBytes(v) {
-      if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, EstError, "est/bad-input", "a byte field of the request");
-      if (ArrayBuffer.isView(v)) return Buffer.from(new Uint8Array(v.buffer, v.byteOffset, v.byteLength));
-      if (v instanceof ArrayBuffer) return Buffer.from(new Uint8Array(v));
-      return v;
+      if (!guard.bytes.isByteSource(v)) return v;
+      return guard.bytes.snapshotSource(v, EstError, "est/bad-input", "a byte field of the request");
     }
     function _requestBinding(der) {
       var out = {
@@ -32526,7 +33147,7 @@ var require_est = __commonJS({
           "an EST /fullcmc response must be HTTP 200 or 202 (RFC 7030 sec. 4.3.2), got " + res.status
         );
       }
-      var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+      var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
       if (bodyLen === 0) throw E("est/empty-body", "a 200 /fullcmc response carried an empty body (RFC 7030 sec. 4.3.2)");
       var der = transferDecode(res.body);
       var pt200 = _partMediaType(_ciHeader(res.headers, "content-type"));
@@ -32694,7 +33315,7 @@ var require_est = __commonJS({
       var verdict = classifyResponse(res.status, res.headers, res.body, { op: "serverkeygen", now: opts.now });
       if (verdict.status === "retry") return { retry: true, retryAfterSeconds: verdict.retryAfterSeconds, retryAfterDate: verdict.retryAfterDate };
       if (verdict.status !== "ok") throw E("est/http-error", "an EST serverkeygen response must be HTTP 200 or 202 (RFC 7030 sec. 4.4.2), got " + res.status);
-      var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+      var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
       if (bodyLen === 0) throw E("est/empty-body", "a 200 serverkeygen response carried an empty body (RFC 7030 sec. 4.4.2)");
       _assertConfidentialCipher(res);
       var out = parseServerKeygenResponse(res.body, _ciHeader(res.headers, "content-type"), {
@@ -32749,7 +33370,7 @@ var require_est = __commonJS({
       if (verdict.status === "none-available") return { available: false, attrs: null };
       if (verdict.status === "retry") throw E("est/http-error", "a /csrattrs response must be HTTP 200, 204, or 404, not 202 (RFC 7030 sec. 4.5.2)");
       if (verdict.status !== "ok") throw E("est/http-error", "an EST csrattrs response must be HTTP 200 / 204 / 404 (RFC 7030 sec. 4.5.2), got " + res.status);
-      var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+      var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
       if (bodyLen === 0) throw E("est/empty-body", "a 200 csrattrs response carried an empty body (RFC 7030 sec. 4.5.2)");
       var attrs = csrattrsFmt.parse(transferDecode(res.body));
       return { available: true, attrs, plan: buildEnrollAttributes(attrs) };
@@ -34191,7 +34812,7 @@ var require_acme = __commonJS({
           Object.keys(res.headers || {}).forEach(function(k) {
             h[k.toLowerCase()] = res.headers[k];
           });
-          var blen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+          var blen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
           if (blen > budgets.maxResponseBytes) throw E("acme/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");
           if ((method === "GET" || method === "HEAD") && res.status >= 300 && res.status < 400) {
             if (redirects >= budgets.maxRedirects) throw E("acme/too-many-redirects", "the redirect budget of " + budgets.maxRedirects + " was exceeded");
@@ -34517,7 +35138,7 @@ var require_acme = __commonJS({
           if (typeof t !== "number" || !isFinite(t)) throw E("acme/bad-input", "the renewalInfo clock returned a non-finite value");
           return t;
         }
-        var notAfterMs = x509.parse(certDer).validity.notAfter.getTime();
+        var notAfterMs = guard.time.instantOf(x509.parse(certDer).validity.notAfter);
         if (clk() > notAfterMs) throw E("acme/certificate-expired", "the certificate is already past its notAfter; a client MUST NOT check RenewalInfo after it has expired (RFC 9773 sec. 4.3)");
         var certId = ariCertId(certDer);
         return _resource("renewalInfo").then(function(base) {
@@ -34558,12 +35179,12 @@ var require_acme = __commonJS({
           }
           var notAfter = x509.parse(certDer).validity.notAfter;
           var now = clk();
-          if (now > notAfter.getTime()) throw E("acme/certificate-expired", "the certificate is already past its notAfter; there is nothing to renew (RFC 9773 sec. 4.3)");
+          if (now > guard.time.instantOf(notAfter)) throw E("acme/certificate-expired", "the certificate is already past its notAfter; there is nothing to renew (RFC 9773 sec. 4.3)");
           if (o.replaced === true) throw E("acme/certificate-replaced", "the caller asserts this certificate has already been replaced (RFC 9773 sec. 4.3)");
           return _renewalInfo(certDer, clk, RENEWAL_RETRY_MAX_SECONDS).then(function(ri) {
             var w = ri.renewalInfo.suggestedWindow;
             var startMs = Date.parse(w.start), endMs = Date.parse(w.end);
-            var notAfterMs = notAfter.getTime();
+            var notAfterMs = guard.time.instantOf(notAfter);
             var effEnd = Math.min(endMs, notAfterMs), effStart = Math.min(startMs, effEnd);
             var pw = o.previous && _isObject(o.previous.suggestedWindow) ? o.previous.suggestedWindow : null;
             var selectedMs;
@@ -34904,7 +35525,7 @@ var require_trust = __commonJS({
       var out = {};
       if (!src || typeof src !== "object") return out;
       Object.keys(src).forEach(function(k) {
-        out[k] = src[k] instanceof Date ? new Date(src[k].getTime()) : src[k];
+        out[k] = guard.time.isDate(src[k]) ? new Date(guard.time.instantOf(src[k])) : src[k];
       });
       return out;
     }
@@ -34923,7 +35544,7 @@ var require_trust = __commonJS({
       var kx = Object.keys(x).sort(), ky = Object.keys(y).sort();
       if (kx.join(",") !== ky.join(",")) return false;
       return kx.every(function(k) {
-        return x[k].getTime() === y[k].getTime();
+        return guard.time.instantOf(x[k]) === guard.time.instantOf(y[k]);
       });
     }
     function _purposesEqual(x, y) {
@@ -35276,8 +35897,9 @@ var require_inspect = __commonJS({
       return (n < 10 ? "0" : "") + n;
     }
     function _date(iso) {
-      var d = iso instanceof Date ? iso : new Date(iso);
-      if (isNaN(d.getTime())) return String(iso);
+      var held = guard.time.isDate(iso) ? guard.time.instantOf(iso) : Date.parse(String(iso));
+      if (isNaN(held)) return String(iso);
+      var d = new Date(held);
       var day = d.getUTCDate(), dd = (day < 10 ? " " : "") + day;
       return MONTHS[d.getUTCMonth()] + " " + dd + " " + _two(d.getUTCHours()) + ":" + _two(d.getUTCMinutes()) + ":" + _two(d.getUTCSeconds()) + " " + d.getUTCFullYear() + " GMT";
     }
@@ -35756,7 +36378,7 @@ var require_inspect = __commonJS({
       var inner = pad + "    ";
       if (ext.oid === OID_CRL_NUMBER && typeof ext.value === "bigint") return header + "\n" + inner + String(ext.value);
       if (ext.oid === OID_REASON_CODE && typeof ext.value === "number") return header + "\n" + inner + (NAMES.CRL_REASON[ext.value] || String(ext.value));
-      if (ext.oid === OID_INVALIDITY_DATE && ext.value instanceof Date) return header + "\n" + inner + _date(ext.value);
+      if (ext.oid === OID_INVALIDITY_DATE && guard.time.isDate(ext.value)) return header + "\n" + inner + _date(ext.value);
       if (ext.oid === OID_DELTA_CRL_INDICATOR && Buffer.isBuffer(ext.value)) {
         try {
           return header + "\n" + inner + "BaseCRLNumber: " + String(asn1.read.integer(asn1.decode(ext.value)));
@@ -36098,7 +36720,7 @@ var require_lint = __commonJS({
     function _effective(rule, cert) {
       if (!rule.effectiveDate) return true;
       var nb = cert.validity && cert.validity.notBefore;
-      return nb instanceof Date && nb.getTime() >= rule.effectiveDate.getTime();
+      return guard.time.isDate(nb) && guard.time.instantOf(nb) >= guard.time.instantOf(rule.effectiveDate);
     }
     function _runLints(rules2, cert, ctx) {
       var findings = [], counts = { fatal: 0, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }, ran = [];
@@ -36275,7 +36897,7 @@ var require_lint = __commonJS({
         message: "the certificate notBefore must not be later than notAfter",
         check: function(cert) {
           var v = cert.validity;
-          return v.notBefore instanceof Date && v.notAfter instanceof Date && v.notBefore.getTime() > v.notAfter.getTime() ? true : null;
+          return guard.time.isDate(v.notBefore) && guard.time.isDate(v.notAfter) && guard.time.instantOf(v.notBefore) > guard.time.instantOf(v.notAfter) ? true : null;
         }
       },
       {
@@ -36567,7 +37189,7 @@ var require_lint = __commonJS({
     var VALIDITY_SCHEDULE_START = VALIDITY_SCHEDULE[VALIDITY_SCHEDULE.length - 1].from;
     function _validityCeilingDays(notBefore) {
       for (var i = 0; i < VALIDITY_SCHEDULE.length; i++) {
-        if (notBefore.getTime() >= VALIDITY_SCHEDULE[i].from.getTime()) return VALIDITY_SCHEDULE[i].maxDays;
+        if (guard.time.instantOf(notBefore) >= guard.time.instantOf(VALIDITY_SCHEDULE[i].from)) return VALIDITY_SCHEDULE[i].maxDays;
       }
       return VALIDITY_SCHEDULE[VALIDITY_SCHEDULE.length - 1].maxDays;
     }
@@ -36666,9 +37288,9 @@ var require_lint = __commonJS({
         effectiveDate: VALIDITY_SCHEDULE_START,
         check: function(cert) {
           var v = cert.validity;
-          if (!(v.notBefore instanceof Date) || !(v.notAfter instanceof Date)) return null;
+          if (!guard.time.isDate(v.notBefore) || !guard.time.isDate(v.notAfter)) return null;
           var maxDays = _validityCeilingDays(v.notBefore);
-          var days = (v.notAfter.getTime() - v.notBefore.getTime()) / MS_PER_DAY;
+          var days = (guard.time.instantOf(v.notAfter) - guard.time.instantOf(v.notBefore)) / MS_PER_DAY;
           return days > maxDays ? { context: { days: Math.round(days), maxDays } } : null;
         }
       }
@@ -36729,9 +37351,16 @@ var require_lint = __commonJS({
         return (SEVERITY[f.severity] || 0) >= floor;
       });
     }
+    var _CERTIFICATE_OPTS = { profile: 1, severity: 1 };
     function certificate(input, opts) {
-      opts = opts || {};
-      if (typeof opts !== "object") throw _cfg("lint/bad-input", "pki.lint options must be an object");
+      opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
+      guard.identifier.assertKnownKeys(
+        opts,
+        _CERTIFICATE_OPTS,
+        _cfg,
+        "lint/bad-input",
+        "pki.lint.certificate has an unknown option: "
+      );
       if (opts.severity != null && VALID_SEVERITY.indexOf(opts.severity) === -1) {
         throw _cfg("lint/bad-severity", 'unknown severity threshold "' + opts.severity + '" (known: ' + VALID_SEVERITY.join(", ") + ")");
       }
@@ -37116,11 +37745,11 @@ var require_webauthn_mds = __commonJS({
         "webauthn/bad-metadata-blob",
         "the metadata BLOB nextUpdate"
       );
-      return d.getTime() + constants.TIME.days(1);
+      return guard.time.instantOf(d) + constants.TIME.days(1);
     }
     function assertFresh(metadata, at, label) {
       if (!metadata || metadata.allowStale === true || typeof metadata.nextUpdate !== "string") return;
-      var atMs = at instanceof Date ? at.getTime() : NaN;
+      var atMs = guard.time.isDate(at) ? guard.time.instantOf(at) : NaN;
       var limit = _staleAfter(metadata.nextUpdate);
       if (!isFinite(atMs) || !isFinite(limit)) return;
       if (atMs >= limit) {
@@ -37151,7 +37780,7 @@ var require_webauthn_mds = __commonJS({
         throw _err("webauthn/metadata-rollback", "the metadata BLOB no " + payload.no + " does not exceed the previously held " + opts.previousNo);
       }
       var staleAfter = _staleAfter(payload.nextUpdate);
-      var atMs = at.getTime();
+      var atMs = guard.time.instantOf(at);
       if (!isFinite(atMs) || !isFinite(staleAfter)) {
         throw _err("webauthn/bad-input", "the metadata freshness comparison has no usable instant");
       }
@@ -37323,7 +37952,7 @@ var require_webauthn_mds = __commonJS({
         "webauthn/bad-metadata-blob",
         "a status report effectiveDate"
       );
-      return d.getTime() <= atMs;
+      return guard.time.instantOf(d) <= atMs;
     }
     function statusDenied(entry, metadata, leaf, at) {
       var policy = metadata && metadata.statusPolicy || "any";
@@ -37335,7 +37964,7 @@ var require_webauthn_mds = __commonJS({
       var isDated = function(r) {
         return r && typeof r.effectiveDate === "string" && rfc3339.isValidDate(r.effectiveDate);
       };
-      var atMs = at instanceof Date && isFinite(at.getTime()) ? at.getTime() : null;
+      var atMs = guard.time.isDate(at) && isFinite(guard.time.instantOf(at)) ? guard.time.instantOf(at) : null;
       if (atMs !== null) {
         reports = reports.filter(function(r) {
           return !isDated(r) || _reportInForceAt(r, atMs);