@blamejs/pki 0.5.15 → 0.5.16

package/lib/guard-parsed.js

@@ -40,9 +40,41 @@
 
 var bytes = require("./guard-bytes");
 var time = require("./guard-time");
+// The array test, taken at load. Every shape check below asks it whether a field IS a list, and
+// one answering `false` makes each of those checks reject a well-formed parsed structure -- the
+// fail-closed direction, and still a caller deciding what this guard recognizes.
+var _isArray = require("./guard-intrinsic").isArray;
+// The copy that becomes the recorded provenance bytes. A replacement returning a buffer over the
+// caller's own memory would let those bytes change after they were recorded, which is the one
+// thing provenance exists to prevent.
+var _bufferFrom = require("./guard-intrinsic").bufferFrom;
+// The sentinel the chain walk below stops at. Reached as a property of a replaceable global, a
+// replacement makes the walk run past the top and report inherited names as the value's own.
+var _ObjectProto = require("./guard-intrinsic").ObjectProto;
+// The rest of what this module reads from the runtime, taken at load. The shape checks below ask
+// these what a value IS and how it is put together, so a replacement decides what this guard
+// recognizes as parser output. See guard-intrinsic for the whole captured set.
+var _isBuffer = require("./guard-intrinsic").isBuffer;
+var _create = require("./guard-intrinsic").create;
+var _assign = require("./guard-intrinsic").assign;
+var _getPrototypeOf = require("./guard-intrinsic").getPrototypeOf;
+var _getOwnPropertyNames = require("./guard-intrinsic").getOwnPropertyNames;
+// The array operations, uncurried. Each shape check below asks `every` whether a list's members
+// are all well formed, so one replaced to return true makes every malformed list pass.
+var _every = require("./guard-intrinsic").every;
+// The provenance store's own operations. This WeakMap is what says a value came out of this
+// toolkit's parser, so a `get` that answers for a key never stored hands the door a forged
+// provenance record, and a `has` that answers true admits an object the parser never produced.
+var _weakGet = require("./guard-intrinsic").weakGet;
+var _weakSet = require("./guard-intrinsic").weakSet;
+var _weakHas = require("./guard-intrinsic").weakHas;
+var _WeakMap = require("./guard-intrinsic").WeakMap;
+var _defineProperty = require("./guard-intrinsic").defineProperty;
+// Appended by index rather than through `push`, so the growth reads no prototype method at all.
+function _append(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
 
 // Every form the toolkit calls "bytes": a Buffer, any typed-array view, a DataView, or a bare
-// ArrayBuffer. Testing `Buffer.isBuffer(x) || x instanceof Uint8Array` is narrower than what the
+// ArrayBuffer. Testing `_isBuffer(x) || x instanceof Uint8Array` is narrower than what the
 // verbs document, and the narrowness is invisible in the good case: an ArrayBuffer would fall
 // through to the object branch and be refused as a rebuilt structure, which reads to the caller as
 // "your certificate is malformed" when what happened is that their container was not recognized.
@@ -92,15 +124,15 @@ function _isAttributeTypeAndValue(a) {
   return !!a && typeof a.type === "string" && _isOptName(a.name) && typeof a.value === "string";
 }
 function _isRdnSequence(rdns) {
-  if (!Array.isArray(rdns)) return false;
+  if (!_isArray(rdns)) return false;
   for (var i = 0; i < rdns.length; i++) {
-    if (!Array.isArray(rdns[i]) || rdns[i].length === 0) return false;
-    if (!rdns[i].every(_isAttributeTypeAndValue)) return false;
+    if (!_isArray(rdns[i]) || rdns[i].length === 0) return false;
+    if (!_every(rdns[i], _isAttributeTypeAndValue)) return false;
   }
   return true;
 }
 function _isName(n) {
-  return !!n && _isRdnSequence(n.rdns) && Buffer.isBuffer(n.bytes) && typeof n.dn === "string";
+  return !!n && _isRdnSequence(n.rdns) && _isBuffer(n.bytes) && typeof n.dn === "string";
 }
 
 // `name` is the registry lookup of the OID and is null for an OID the registry does
@@ -109,11 +141,11 @@ function _isOptName(v) { return typeof v === "string" || v === null; }
 
 function _isAlgorithmIdentifier(a) {
   return !!a && typeof a.oid === "string" && _isOptName(a.name) &&
-    (Buffer.isBuffer(a.parameters) || a.parameters === null);
+    (_isBuffer(a.parameters) || a.parameters === null);
 }
 
 function _isBitString(b) {
-  return !!b && Buffer.isBuffer(b.bytes) && typeof b.unusedBits === "number";
+  return !!b && _isBuffer(b.bytes) && typeof b.unusedBits === "number";
 }
 
 // A parsed certificate extension entry: dispatched on `.oid`, gated on `.critical`,
@@ -124,7 +156,7 @@ function _isBitString(b) {
 // skipped iteration.
 function _isExtensionEntry(e) {
   return !!e && typeof e.oid === "string" && _isOptName(e.name) &&
-    typeof e.critical === "boolean" && Buffer.isBuffer(e.value);
+    typeof e.critical === "boolean" && _isBuffer(e.value);
 }
 
 // A parsed CRL extension entry. The CRL parser decodes the values it knows (a
@@ -147,7 +179,7 @@ function _isCrlExtensionEntry(e) {
 //   testing tbsBytes and returning the object is the re-inline this replaces.
 function isCert(o) {
   return !!o && typeof o === "object" &&
-    Buffer.isBuffer(o.tbsBytes) &&
+    _isBuffer(o.tbsBytes) &&
     typeof o.version === "number" &&
     typeof o.serialNumber === "bigint" &&
     typeof o.serialNumberHex === "string" &&
@@ -157,10 +189,10 @@ function isCert(o) {
     !!o.validity && time.isDate(o.validity.notBefore) && time.isDate(o.validity.notAfter) &&
     _isName(o.issuer) &&
     _isName(o.subject) &&
-    !!o.subjectPublicKeyInfo && Buffer.isBuffer(o.subjectPublicKeyInfo.bytes) &&
+    !!o.subjectPublicKeyInfo && _isBuffer(o.subjectPublicKeyInfo.bytes) &&
     _isAlgorithmIdentifier(o.subjectPublicKeyInfo.algorithm) &&
     _isBitString(o.subjectPublicKeyInfo.publicKey) &&
-    Array.isArray(o.extensions) && o.extensions.every(_isExtensionEntry);
+    _isArray(o.extensions) && _every(o.extensions, _isExtensionEntry);
 }
 
 // isCrl(o) -- the complete parsed-CertificateList shape. `crlExtensions` and each
@@ -173,19 +205,19 @@ function isCert(o) {
 // @enforced-by guard-shape-reinlined -- shares the `accept` shape below.
 function isCrl(o) {
   return !!o && typeof o === "object" &&
-    Buffer.isBuffer(o.tbsBytes) &&
+    _isBuffer(o.tbsBytes) &&
     typeof o.version === "number" &&
     _isAlgorithmIdentifier(o.signatureAlgorithm) &&
     _isBitString(o.signatureValue) &&
     _isName(o.issuer) &&
     time.isDate(o.thisUpdate) &&
     (o.nextUpdate === null || time.isDate(o.nextUpdate)) &&
-    Array.isArray(o.crlExtensions) && o.crlExtensions.every(_isCrlExtensionEntry) &&
-    Array.isArray(o.revokedCertificates) && o.revokedCertificates.every(function (e) {
+    _isArray(o.crlExtensions) && _every(o.crlExtensions, _isCrlExtensionEntry) &&
+    _isArray(o.revokedCertificates) && _every(o.revokedCertificates, function (e) {
       return !!e && typeof e.serialNumber === "bigint" &&
         typeof e.serialNumberHex === "string" &&
         time.isDate(e.revocationDate) &&
-        Array.isArray(e.crlEntryExtensions) && e.crlEntryExtensions.every(_isCrlExtensionEntry);
+        _isArray(e.crlEntryExtensions) && _every(e.crlEntryExtensions, _isCrlExtensionEntry);
     });
 }
 
@@ -207,7 +239,10 @@ function _safe(shape) {
 var certShape = _safe(isCert);
 var crlShape = _safe(isCrl);
 
-var _SHAPES = { certificate: certShape, crl: crlShape };
+// Null-prototype: this table decides which kinds are recognized, and the lookup below is what the
+// unknown-kind refusal rests on. Built on a `{}`, a planted `Object.prototype[kind]` supplies a
+// predicate for a kind the table never carried, and an unrecognized structure is then authorized.
+var _SHAPES = _assign(_create(null), { certificate: certShape, crl: crlShape });
 
 // accept(input, kind, parse, E, code, label) -> the parsed structure | throws
 //
@@ -288,8 +323,8 @@ function accept(input, kind, parse, E, code, label) {
 //     answered for), so a Proxy could claim any mark and name any bytes. A WeakMap
 //     lookup is on identity: a Proxy is a different object from the parser's result
 //     and simply is not a key.
-//   - `Object.create(parsed)` is likewise a different object, so it inherits no
-//     record, while `Object.assign({}, parsed)` and `{...parsed}` are different
+//   - `_create(parsed)` is likewise a different object, so it inherits no
+//     record, while `_assign({}, parsed)` and `{...parsed}` are different
 //     objects too. All three, the ways a mixed structure is actually assembled,
 //     fall out of the same rule, with no need for three checks.
 //
@@ -301,7 +336,7 @@ function accept(input, kind, parse, E, code, label) {
 // This is not a signature check and does not pretend to be. It says only "verify the
 // bytes this object was parsed from", which is precisely the claim the three-part
 // check was resting on without ever asking for it.
-var PROVENANCE = new WeakMap();
+var PROVENANCE = new _WeakMap();
 
 // recordingParser(kind, parse) -> a parser that records what it parsed.
 //
@@ -340,7 +375,7 @@ function recordingParser(kind, parse, ErrorClass, code, label) {
     // re-derivation would faithfully reproduce whatever was written. A record the object can reach
     // is not a record of anything. This copy is never handed out and nothing aliases it.
     if (out && typeof out === "object") {
-      PROVENANCE.set(out, { kind: kind, source: isText ? snap : Buffer.from(snap),
+      _weakSet(PROVENANCE, out, { kind: kind, source: isText ? snap : _bufferFrom(snap),
         shape: _shapeOf(out) });
     }
     return out;
@@ -370,9 +405,9 @@ function recordingWalker(kind, walkNode, decodeBytes) {
   return function (node) {
     var out = walkNode(node);
     if (out && typeof out === "object" && node && _isBytes(node.bytes)) {
-      PROVENANCE.set(out, {
+      _weakSet(PROVENANCE, out, {
         kind: kind,
-        source: Buffer.from(node.bytes),
+        source: _bufferFrom(node.bytes),
         shape: _shapeOf(out),
         derive: function (src) { return walkNode(decodeBytes(src)); },
       });
@@ -385,7 +420,7 @@ function recordingWalker(kind, walkNode, decodeBytes) {
 // property of `obj` at all -- the lookup is on the object's identity.
 function _recordOf(obj, kind) {
   if (!obj || typeof obj !== "object") return undefined;
-  var rec = PROVENANCE.get(obj);
+  var rec = _weakGet(PROVENANCE, obj);
   return (rec && rec.kind === kind) ? rec : undefined;
 }
 
@@ -400,7 +435,7 @@ function _recordOf(obj, kind) {
 //   is the RED vector that passes a parsed certificate through a producing verb's spec and asserts
 //   the integrity door still accepts it, which fails the moment a copy is taken instead.
 function isRecorded(obj) {
-  return !!obj && typeof obj === "object" && PROVENANCE.has(obj);
+  return !!obj && typeof obj === "object" && _weakHas(PROVENANCE, obj);
 }
 
 // isRecordedAsProduced(obj) -> whether this is a recorded structure that still has the field set
@@ -423,7 +458,7 @@ function isRecorded(obj) {
 //   asserts the value the verb used is the one that was there at entry.
 function isRecordedAsProduced(obj) {
   if (!isRecorded(obj)) return false;
-  var shape = PROVENANCE.get(obj).shape;
+  var shape = _weakGet(PROVENANCE, obj).shape;
   var keys = _allNames(obj);
   for (var i = 0; i < keys.length; i++) {
     if (!shape[keys[i]]) return false;
@@ -432,7 +467,7 @@ function isRecordedAsProduced(obj) {
 }
 
 function _shapeOf(obj) {
-  var shape = Object.create(null);
+  var shape = _create(null);
   var keys = _allNames(obj);
   for (var i = 0; i < keys.length; i++) shape[keys[i]] = true;
   return shape;
@@ -443,13 +478,13 @@ function _shapeOf(obj) {
 // `Object.keys` would miss a field added with defineProperty and call the object unchanged.
 function _allNames(obj) {
   var names = [];
-  var seen = Object.create(null);
-  for (var o = obj; o && o !== Object.prototype; o = Object.getPrototypeOf(o)) {
-    var own = Object.getOwnPropertyNames(o);
+  var seen = _create(null);
+  for (var o = obj; o && o !== _ObjectProto; o = _getPrototypeOf(o)) {
+    var own = _getOwnPropertyNames(o);
     for (var i = 0; i < own.length; i++) {
       if (seen[own[i]]) continue;
       seen[own[i]] = true;
-      names.push(own[i]);
+      _append(names, own[i]);
     }
   }
   return names;
@@ -516,22 +551,24 @@ function fromTrustedSource(input, kind, claimFields, parse, E, code, why) {
 // security-relevant field would therefore change no verdict. What the list decides is narrower: it
 // separates "an object claiming to be a parse result" from "bytes", so the first gets this domain's
 // typed refusal instead of being handed to a byte parser.
-var _CLAIMS = {
+// Null-prototype, for the same reason as _SHAPES: an inherited entry standing in for an absent one
+// makes an unrecognized kind look recognized, and the refusal keyed on its absence never fires.
+var _CLAIMS = _assign(_create(null), {
   certificate: ["tbsBytes", "subjectPublicKeyInfo", "serialNumberHex"],
   crl: ["tbsBytes", "revokedCertificates", "crlExtensions"],
   cms: ["signerInfos", "encapContentInfo"],
   csr: ["certificationRequestInfoBytes", "subjectPublicKeyInfo", "attributes"],
   crmf: ["messages"],
   attributeCertificate: ["tbsBytes", "holder", "attributes"],
-};
-var _WHY = {
+});
+var _WHY = _assign(_create(null), {
   certificate: "the signed byte range, the signature and the fields that range encodes are separate properties of a parsed object, so a rebuilt certificate (Object.assign, spread, a JSON round-trip) could have them describe different certificates: keep a real CA certificate's signed bytes and signature, replace only its public key, and every field is still well-formed",
   crl: "the signed byte range, the revocation list and the scope extensions are separate properties of a parsed object, so a rebuilt CRL could have them describe different CRLs: empty the revocation list and a correctly signed CRL reports a revoked certificate as good",
   cms: "the signed attribute bytes, the signature, the encapsulated content and the certificates that verify it are separate properties of a parsed object, so a rebuilt SignedData could have them describe different messages: keep a genuine signer's signature and signed attributes, put other content beside them, and every part of the check passes for content that signer never signed",
   csr: "the signed byte range, the key it proves possession of and the subject and requested extensions that range encodes are separate properties of a parsed object, so a rebuilt request could have them describe different requests: keep a genuine requester's signed bytes and signature, replace only the subject or the extensionRequest, and the proof of possession still verifies while the certificate a CA issues from those fields is for a name and a set of extensions nobody signed",
   crmf: "the byte range a proof of possession covers, the key that possession is proven for and the subject a CA will issue to are separate properties of a parsed object, so a rebuilt message set could have them describe different requests: keep a genuine requester's signed range and signature, replace only the certTemplate subject or public key, and the proof still verifies while the certificate is issued for a name and a key nobody proved anything about",
   attributeCertificate: "the signed byte range, the holder the privileges attach to and the attributes granting them are separate properties of a parsed object, so a rebuilt attribute certificate could have them describe different grants: keep a genuine issuer's signed bytes and signature, replace only the holder or an attribute, and the signature still verifies while the privileges are read for someone the issuer never granted them to",
-};
+});
 // @enforced-by guard-shape-reinlined -- shares the fromTrustedSource shape it composes: a door that
 //   tests the claim fields itself, instead of routing here, is the re-inline both replace.
 function acceptDerived(input, kind, parse, E, code, label) {

package/lib/guard-range.js

@@ -21,6 +21,19 @@
 // 2^31 - 1, the shared skip-cert / path-length / salt / iteration ceiling.
 // This literal lives only here (a re-inline anywhere else is flagged: the
 // guard-shape walk anchors on the literal). 2^53 - 1 is the safe-narrow ceiling.
+// The safe-integer test, taken at load. It decides whether a decoded value may be narrowed to a
+// Number at all, so one answering true for an unsafe magnitude reopens the precision loss this
+// guard exists to prevent. See guard-intrinsic for the whole captured set.
+var _isSafeInteger = require("./guard-intrinsic").isSafeInteger;
+// The narrow itself. This module exists to turn a bounded BigInt into a Number without losing the
+// bound, and `Number` is a writable property of globalThis, so a replacement returns whatever it
+// likes from a value this function has just certified as in range.
+var _Number = require("./guard-intrinsic").Number;
+// The widening half of the same job. A replacement returns a value the bound below is then applied
+// to instead of the caller's, so the number that passes the range test is not the number that came
+// in and is not the number handed back.
+var _BigInt = require("./guard-intrinsic").BigInt;
+
 var UINT31_MAX = 2147483647n;
 var SAFE_MAX   = 9007199254740991n;
 var SAFE_MIN   = -9007199254740991n;
@@ -61,7 +74,7 @@ function int(value, min, max, E, code, label) {
   if (typeof value !== "bigint" || value < min || value > max) {
     throw E(code, label + " must be an integer within " + min + ".." + max);
   }
-  return Number(value);
+  return _Number(value);
 }
 
 // uint31(value, E, code, label) -> Number in [0, 2^31-1]. The DER-INTEGER
@@ -88,8 +101,8 @@ function uint64(value, E, code, label) {
   var v;
   if (typeof value === "bigint") {
     v = value;
-  } else if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) {
-    v = BigInt(value);
+  } else if (typeof value === "number" && _isSafeInteger(value) && value >= 0) {
+    v = _BigInt(value);
   } else {
     throw E(code, label + " must be a non-negative safe-integer Number or a BigInt (a uint64)");
   }
@@ -114,7 +127,7 @@ function uint64(value, E, code, label) {
 // @guard-shape Number\.isSafeInteger\(\s*[A-Za-z_$][\w$]*\s*\)\s*\)\s*return BigInt
 function authoredInteger(value, E, code, label) {
   if (typeof value === "bigint") return value;
-  if (typeof value === "number" && Number.isSafeInteger(value)) return BigInt(value);
+  if (typeof value === "number" && _isSafeInteger(value)) return _BigInt(value);
   throw E(code, label + " must be an integer (a safe-integer number, or a bigint for a large value)");
 }
 

package/lib/guard-secret.js

@@ -30,6 +30,14 @@
 // reaches for first, so the call sites pass only their own intermediates.
 
 var bytes = require("./guard-bytes");
+var intrinsic = require("./guard-intrinsic");
+
+// The fill this guard performs, taken from the typed-array prototype at module load and uncurried
+// so the wipe site reads no property at all. Buffer overrides the fill with a writable
+// `Buffer.prototype.fill`, so reading the method off the value would let a caller decide what
+// wiping means; reading `call` off the captured function would let them decide it again, since
+// that function is still the one sitting on the prototype (see guard-intrinsic).
+var _fill = intrinsic.uncurry(Uint8Array.prototype.fill);
 
 // zeroize(value, ErrorClass, code, label) -> the same object, cleared.
 //   value      : a Buffer / TypedArray the TOOLKIT allocated, or null / undefined
@@ -62,7 +70,13 @@ function zeroize(value, ErrorClass, code, label) {
   // Re-view through the shared bytes guard: it is the single place that decides
   // what counts as a writable BufferSource and rejects a detached one typed.
   var view = bytes.view(value, ErrorClass, code, label);
-  view.fill(0);
+  // Through the fill captured at module load, never `view.fill(0)`. Buffer overrides the typed-array
+  // fill with its own, and that property is writable, so a caller who replaces it with a no-op turns
+  // every wipe in the toolkit into a silent nothing -- and nothing observable changes, because the
+  // wipe still runs, still walks the right buffer, and still returns. A secret that survives a call
+  // whose whole purpose was to clear it is the failure this guard exists to prevent, so the one
+  // operation it performs is the one operation a caller must not be able to reach.
+  _fill(view, 0);
   return value;
 }
 

package/lib/guard-text.js

@@ -20,6 +20,31 @@
 // no boundary re-derives it (and drifts to cap-after, as some had).
 
 var bytes = require("./guard-bytes");
+var intrinsic = require("./guard-intrinsic");
+
+// Everything this guard does to a caller's input, taken at module load. Each name below is an
+// ordinary writable property of a global, so reading it at call time would let a caller decide what
+// the guard does at the moment it does it. Between them these four cover both of the guard's
+// contracts, and both of its input arms:
+//
+//   _toString / _decode  produce the guard's entire output on the Buffer arm. Replaced with a
+//                        function returning a constant, they hand a PEM header, a JOSE segment or a
+//                        DN attribute value a string the caller chose in place of the bytes that
+//                        were checked -- while the cap, the detached-view refusal and the strict
+//                        UTF-8 rule all still run and all still pass.
+//   _byteLength          measures the string arm against the cap. One returning 0 admits a string
+//                        of any size, which is the allocation-DoS this guard exists to bound.
+//   _isInteger           decides whether the cap itself is usable, and _isBuffer decides which arm
+//                        an input takes.
+// The two method captures are uncurried, so their call sites read no property of them; see
+// guard-intrinsic for why capturing a method and then reading `.call` on it reopens the hole.
+var _toString = intrinsic.uncurry(Buffer.prototype.toString);
+var _decode = intrinsic.uncurry(TextDecoder.prototype.decode);
+// Already plain functions rather than methods, so these are invoked directly.
+var _byteLength = Buffer.byteLength;
+var _isBuffer = Buffer.isBuffer;
+var _isInteger = Number.isInteger;
+var _TextDecoder = TextDecoder;
 
 var LATIN1 = "latin1";
 
@@ -43,27 +68,31 @@ function decode(input, maxBytes, ErrorClass, spec) {
   // the `length > maxBytes` comparison always false, silently disabling the size
   // cap on the guard whose whole contract is cap-before-copy. Config-time
   // TypeError (every composing boundary passes a C.LIMITS constant).
-  if (!Number.isInteger(maxBytes) || maxBytes < 0) {
+  if (!_isInteger(maxBytes) || maxBytes < 0) {
     throw new TypeError("guard.text.decode: maxBytes must be a non-negative integer");
   }
   var charset = spec.charset || LATIN1;
-  if (Buffer.isBuffer(input)) {
+  if (_isBuffer(input)) {
     // Re-view through the byte guard first so a detached backing ArrayBuffer (a
     // transferred / structuredClone'd Buffer, which reads as zero-length) fails
     // closed here -- the same detached-buffer defense the byte boundaries get --
     // instead of being decoded as an empty string. Then cap, then decode.
     input = bytes.view(input, ErrorClass, spec.badInput, spec.label);
-    if (input.length > maxBytes) throw new ErrorClass(spec.tooLarge, spec.label + " exceeds the size cap");
+    // Measured through the byte guard's captured intrinsic getter, never `input.length`. On a typed
+    // array `length` is an accessor on the prototype and it is configurable, so a replacement
+    // returning 0 lets a buffer of any size past the cap and straight into the decode -- the
+    // allocation this guard exists to bound, defeated by the one read that bounds it.
+    if (bytes.lengthOf(input) > maxBytes) throw new ErrorClass(spec.tooLarge, spec.label + " exceeds the size cap");
     if (spec.fatal) {
-      try { return new TextDecoder(charset, { fatal: true }).decode(input); }
+      try { return _decode(new _TextDecoder(charset, { fatal: true }), input); }
       catch (e) { throw new ErrorClass(spec.badDecode, spec.label + " is not valid " + charset, e); }
     }
-    return input.toString(charset);
+    return _toString(input, charset);
   }
   if (typeof input === "string") {
     // A latin1 string's char length equals its byte length; a UTF-8 string's
     // does not, so bound the encoded byte length.
-    var byteLen = charset === LATIN1 ? input.length : Buffer.byteLength(input, "utf8");
+    var byteLen = charset === LATIN1 ? input.length : _byteLength(input, "utf8");
     if (byteLen > maxBytes) throw new ErrorClass(spec.tooLarge, spec.label + " exceeds the size cap");
     return input;
   }

package/lib/guard-time.js

@@ -27,7 +27,12 @@
 // OCSP / CRL currency callers that treat out-of-window as a `continue` skip keep
 // their control flow while a NaN operand can never slip through as a false.
 
-var util = require("util");
+// The slot predicates and the NaN test, snapshotted at load. `util.types` is an ordinary object,
+// so a later `util.types.isDate = () => true` would otherwise decide what this guard calls a Date;
+// the global `isNaN` is writable, and one returning false makes an invalid Date pass the check
+// below, which is the fail-open direction.
+var util = { types: require("./guard-intrinsic").types };
+var _isNaN = Number.isNaN;
 
 // assertValid(value, E, code, label) -> the same Date, once proven valid.
 //   value : a Date (or an alleged one) from a caller boundary.
@@ -53,7 +58,11 @@ var util = require("util");
 // runs before this module is inside the trust boundary already and can reach further than this
 // one method, so there is no defense here to add; what the capture buys is immunity to every
 // replacement that happens afterwards, which is the case a caller's argument can reach.
-var _dateGetTime = Date.prototype.getTime;
+//
+// The capture is uncurried through guard-intrinsic, so `instantOf` reads no property of it either.
+// The captured function is still the one on `Date.prototype`, and an own `call` assigned to it
+// would shadow `Function.prototype.call` and decide every instant this toolkit evaluates against.
+var _dateGetTime = require("./guard-intrinsic").uncurry(Date.prototype.getTime);
 
 // instantOf(value) -> the epoch milliseconds a Date holds, read through the intrinsic.
 //
@@ -65,7 +74,7 @@ var _dateGetTime = Date.prototype.getTime;
 //
 // @enforced-by guard-shape-reinlined
 // @guard-shape \.getTime\s*\(
-function instantOf(value) { return _dateGetTime.call(value); }
+function instantOf(value) { return _dateGetTime(value); }
 
 // @enforced-by nan-date-comparison-unguarded
 function assertValid(value, E, code, label) {
@@ -73,7 +82,7 @@ function assertValid(value, E, code, label) {
   // `Object.create(Date.prototype)` inherits everything while holding no instant, so it passes
   // that test and `getTime()` then throws a raw TypeError out of this guard. `util.types.isDate`
   // reads the internal slot, which a caller cannot fake and which answers the same across realms.
-  if (!util.types.isDate(value) || isNaN(instantOf(value))) {
+  if (!util.types.isDate(value) || _isNaN(instantOf(value))) {
     throw E(code, (label || "value") + " must be a valid Date");
   }
   return value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.15",
+  "version": "0.5.16",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:75f14a7c-3b79-4cbc-8db6-fb4987becceb",
+  "serialNumber": "urn:uuid:4977fc76-9318-4187-883f-52d642638d7f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-19T13:58:32.723Z",
+    "timestamp": "2026-08-20T03:58:27.675Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.15",
+      "bom-ref": "@blamejs/pki@0.5.16",
       "type": "application",
       "name": "pki",
-      "version": "0.5.15",
+      "version": "0.5.16",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.15",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.16",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.15",
+      "ref": "@blamejs/pki@0.5.16",
       "dependsOn": []
     }
   ]