@blamejs/pki 0.5.9 → 0.5.11

package/lib/guard-limits.js

@@ -90,7 +90,7 @@ function depthCap(value, key, dflt) {
 function counter(max, E, code, label) {
   // The ceiling is an authoring input: an undefined / NaN / fractional max
   // builds a counter whose `n > max` never fires, leaving a silently dead fanout
-  // defence. Reject at construction (config-time TypeError).
+  // defense. Reject at construction (config-time TypeError).
   if (!Number.isInteger(max) || max < 0) {
     throw new TypeError("guard.limits.counter: max must be a non-negative integer");
   }
@@ -117,7 +117,7 @@ function counter(max, E, code, label) {
 //   over-size RED vectors driving the composing verifiers are the guard.
 function byteCap(buf, max, E, code, label) {
   // The ceiling is an authoring input: an undefined / NaN / fractional / negative
-  // max makes `length > max` never fire, and the size defence is then silently
+  // max makes `length > max` never fire, and the size defense is then silently
   // dead. Reject at config time (TypeError), regardless of the value currency E selects.
   if (!Number.isInteger(max) || max < 0) {
     throw new TypeError("guard.limits.byteCap: max must be a non-negative integer");

package/lib/guard-parsed.js

@@ -39,15 +39,19 @@
 // changes what is checked, never what the operator reads.
 
 var bytes = require("./guard-bytes");
+var time = require("./guard-time");
 
 // Every form the toolkit calls "bytes": a Buffer, any typed-array view, a DataView, or a bare
 // ArrayBuffer. Testing `Buffer.isBuffer(x) || x instanceof Uint8Array` is narrower than what the
 // verbs document, and the narrowness is invisible in the good case: an ArrayBuffer would fall
 // through to the object branch and be refused as a rebuilt structure, which reads to the caller as
-// "your certificate is malformed" when what happened is that their container was not recognised.
+// "your certificate is malformed" when what happened is that their container was not recognized.
 // guard.bytes is what finally reads them, and it accepts all four, so the door has to as well.
+// Asked of guard.bytes rather than restated here, because a restatement is what drifts. An
+// `x instanceof ArrayBuffer` here turns away a real buffer built in another realm that guard.bytes
+// goes on to accept, so one container gets opposite answers from the two doors it passes through.
 function _isBytes(x) {
-  return Buffer.isBuffer(x) || ArrayBuffer.isView(x) || x instanceof ArrayBuffer;
+  return bytes.isByteSource(x);
 }
 
 // The shapes below assert the parser's complete output: every field
@@ -150,7 +154,7 @@ function isCert(o) {
     _isAlgorithmIdentifier(o.signatureAlgorithm) &&
     _isAlgorithmIdentifier(o.tbsSignatureAlgorithm) &&
     _isBitString(o.signatureValue) &&
-    !!o.validity && o.validity.notBefore instanceof Date && o.validity.notAfter instanceof Date &&
+    !!o.validity && time.isDate(o.validity.notBefore) && time.isDate(o.validity.notAfter) &&
     _isName(o.issuer) &&
     _isName(o.subject) &&
     !!o.subjectPublicKeyInfo && Buffer.isBuffer(o.subjectPublicKeyInfo.bytes) &&
@@ -174,13 +178,13 @@ function isCrl(o) {
     _isAlgorithmIdentifier(o.signatureAlgorithm) &&
     _isBitString(o.signatureValue) &&
     _isName(o.issuer) &&
-    o.thisUpdate instanceof Date &&
-    (o.nextUpdate === null || o.nextUpdate instanceof Date) &&
+    time.isDate(o.thisUpdate) &&
+    (o.nextUpdate === null || time.isDate(o.nextUpdate)) &&
     Array.isArray(o.crlExtensions) && o.crlExtensions.every(_isCrlExtensionEntry) &&
     Array.isArray(o.revokedCertificates) && o.revokedCertificates.every(function (e) {
       return !!e && typeof e.serialNumber === "bigint" &&
         typeof e.serialNumberHex === "string" &&
-        e.revocationDate instanceof Date &&
+        time.isDate(e.revocationDate) &&
         Array.isArray(e.crlEntryExtensions) && e.crlEntryExtensions.every(_isCrlExtensionEntry);
     });
 }

package/lib/guard-range.js

@@ -105,7 +105,7 @@ function uint64(value, E, code, label) {
 // take. Accepts a bigint, or a Number that is a safe integer (isSafeInteger, not
 // isInteger, because a Number above 2^53 has already lost precision by the time it
 // arrives), so a large identifier MUST come as a bigint and cannot be silently
-// rounded to a neighbour. Everything else is a config-time reject.
+// rounded to a neighbor. Everything else is a config-time reject.
 //
 // Distinct from int() on purpose: int() BOUNDS a value the wire decoded and narrows
 // it to Number; this one is unbounded and returns BigInt, because the field has no

package/lib/guard-secret.js

@@ -72,7 +72,7 @@ function zeroize(value, ErrorClass, code, label) {
 // @enforced-by behavioral -- this is a loop over zeroize, which carries the family's only
 // rename-proof shape (the `.fill(0)` above). It introduces no shape of its own, so a lexical
 // detector here would anchor on a renameable symbol and go silently green (drift rule sec. 3).
-// The behavioural guards are guard-secret.test.js (holes tolerated, every member cleared) and the
+// The behavioral guards are guard-secret.test.js (holes tolerated, every member cleared) and the
 // CMS vectors that assert the shared secret and KEK are wiped on both the success and failure paths.
 function zeroizeAll(list, ErrorClass, code, label) {
   if (!list) return list;

package/lib/guard-text.js

@@ -50,7 +50,7 @@ function decode(input, maxBytes, ErrorClass, spec) {
   if (Buffer.isBuffer(input)) {
     // Re-view through the byte guard first so a detached backing ArrayBuffer (a
     // transferred / structuredClone'd Buffer, which reads as zero-length) fails
-    // closed here -- the same detached-buffer defence the byte boundaries get --
+    // closed here -- the same detached-buffer defense the byte boundaries get --
     // instead of being decoded as an empty string. Then cap, then decode.
     input = bytes.view(input, ErrorClass, spec.badInput, spec.label);
     if (input.length > maxBytes) throw new ErrorClass(spec.tooLarge, spec.label + " exceeds the size cap");

package/lib/guard-time.js

@@ -27,6 +27,8 @@
 // OCSP / CRL currency callers that treat out-of-window as a `continue` skip keep
 // their control flow while a NaN operand can never slip through as a false.
 
+var util = require("util");
+
 // assertValid(value, E, code, label) -> the same Date, once proven valid.
 //   value : a Date (or an alleged one) from a caller boundary.
 //   E     : the (code, message[, cause]) typed-error FACTORY in scope at the call
@@ -34,9 +36,44 @@
 //           would crash `class cannot be invoked without new` on the error path.
 //   code  : the frozen domain/reason code this boundary rejects malformed time under.
 //   label : field phrase for the message.
+// The instant a Date holds, asked of the language rather than of the Date.
+//
+// `getTime` is an ordinary method on `Date.prototype`, so `class T extends Date { getTime() {} }`
+// and an own `getTime` on any instance both answer it. Reading it off the value let a caller throw
+// a raw exception out of a guard whose contract is a typed error, and let one return a fabricated
+// instant that passed the check while the real one did not. It also made the read repeatable: a
+// method asked twice may answer twice, so a window check could validate one instant and compare
+// another.
+//
+// The intrinsic is called against the value, which reaches the internal slot whatever the value's
+// own class says, and refuses a receiver with no slot behind it.
+//
+// The capture is of whatever `Date.prototype.getTime` holds when this module first loads, so it
+// is the language's own function only if nothing replaced it earlier in the process. Code that
+// runs before this module is inside the trust boundary already and can reach further than this
+// one method, so there is no defense here to add; what the capture buys is immunity to every
+// replacement that happens afterwards, which is the case a caller's argument can reach.
+var _dateGetTime = Date.prototype.getTime;
+
+// instantOf(value) -> the epoch milliseconds a Date holds, read through the intrinsic.
+//
+// The shape is the method call itself, wherever it appears. There is no boundary at which reading
+// `getTime` off a value is the safe spelling: a caller's Date reaches the read through an override,
+// and this toolkit's own Date reaches it through whatever `Date.prototype.getTime` has been made
+// to be, which a dependency loaded before this module gets to decide. So the rule is that lib/
+// calls no `getTime` at all, and the one capture above is where it lives.
+//
+// @enforced-by guard-shape-reinlined
+// @guard-shape \.getTime\s*\(
+function instantOf(value) { return _dateGetTime.call(value); }
+
 // @enforced-by nan-date-comparison-unguarded
 function assertValid(value, E, code, label) {
-  if (!(value instanceof Date) || isNaN(value.getTime())) {
+  // The slot, never the prototype. `instanceof Date` asks what a value inherits from, and
+  // `Object.create(Date.prototype)` inherits everything while holding no instant, so it passes
+  // that test and `getTime()` then throws a raw TypeError out of this guard. `util.types.isDate`
+  // reads the internal slot, which a caller cannot fake and which answers the same across realms.
+  if (!util.types.isDate(value) || isNaN(instantOf(value))) {
     throw E(code, (label || "value") + " must be a valid Date");
   }
   return value;
@@ -56,13 +93,37 @@ function within(instant, lower, upper, E, code, label, opts) {
   assertValid(instant, E, code, label);
   assertValid(lower, E, code, (label || "window") + " lower bound");
   assertValid(upper, E, code, (label || "window") + " upper bound");
-  var t = instant.getTime();
-  var lo = lower.getTime();
-  var hi = upper.getTime();
+  // Read through the intrinsic, so the instants compared here are the ones assertValid just
+  // proved. A caller's `getTime` override answers each call afresh, which made the value checked
+  // and the value compared two different reads of the same argument.
+  var t = instantOf(instant);
+  var lo = instantOf(lower);
+  var hi = instantOf(upper);
   return t >= lo && (opts && opts.upperInclusive ? t <= hi : t < hi);
 }
 
+// isDate(value) -> boolean: does this value actually hold an instant?
+//
+// The predicate half of assertValid, for the boundaries that choose a default rather than refuse
+// (`opts.genTime instanceof Date ? opts.genTime : new Date()`). `instanceof` asks what a value
+// inherits from, so `Object.create(Date.prototype)` passes it while holding no instant, and the
+// `.getTime()` that follows throws a raw TypeError out of a verb whose contract is a typed error.
+// A caller who supplied one and got the default instead would be worse served still: the value
+// they passed would have been silently replaced. This reads the slot, which cannot be faked and
+// answers the same for a Date built in another realm.
+//
+// An Invalid Date has the slot and a NaN instant, so this says yes to one. A boundary that
+// compares instants wants assertValid, which rejects both shapes.
+// @enforced-by behavioral -- a prototype test in place of a slot test has no rename-proof code
+// shape; the RED vectors (a slot-less Date lookalike at cms.verify / cms.sign / tsp.sign) are
+// the guard.
+function isDate(value) {
+  return util.types.isDate(value);
+}
+
 module.exports = {
   assertValid: assertValid,
+  instantOf: instantOf,
+  isDate: isDate,
   within: within,
 };

package/lib/hpke.js

@@ -390,7 +390,7 @@ function _recipPrivate(suite, sk) {
 // psk / auth / auth-psk. An unknown mode must fail closed, never key-schedule
 // with an out-of-registry mode byte.
 // The sender and the recipient read the same option object from OPPOSITE ends, so each direction
-// gets its own table. A shared union recognises every name at both ends and so accepts the one that
+// gets its own table. A shared union recognizes every name at both ends and so accepts the one that
 // cannot do anything there: `senderPublicKey` handed to setupS, or
 // `senderKey` handed to setupR, is silently ignored, which is the exact silence these tables exist
 // to remove, in a wider form. An option that means nothing where it was passed is a misunderstanding

package/lib/http-digest.js

@@ -144,7 +144,7 @@ function _validateDigest(paramText, E, code) {
     ? p.domain.value.replace(/^\s+|\s+$/g, "").split(/\s+/) : null;
   // charset (RFC 7616 sec. 3.3): the one permitted value is the unquoted token "UTF-8". A quoted charset, or any
   // other value, is malformed, since answering it would hash the credentials in the wrong encoding, so it is
-  // rejected (and thus skipped during multi-offer selection in favour of a conforming offer).
+  // rejected (and thus skipped during multi-offer selection in favor of a conforming offer).
   if (p.charset && (p.charset.quoted || String(p.charset.value).toUpperCase() !== "UTF-8")) throw E(code, "the Digest charset must be the unquoted token UTF-8 (RFC 7616 sec. 3.3)");
   // stale (RFC 7616 sec. 3.3) is the unquoted token "true" or "false". A quoted or otherwise invalid value
   // (stale=maybe) is malformed and rejected (thus skipped in selection), never parsed as a false flag that

package/lib/inspect.js

@@ -91,8 +91,13 @@ var MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oc
 function _two(n) { return (n < 10 ? "0" : "") + n; }
 // OpenSSL date: "Jul  4 07:00:27 2026 GMT" (month, space-padded day, time, year, GMT).
 function _date(iso) {
-  var d = (iso instanceof Date) ? iso : new Date(iso);
-  if (isNaN(d.getTime())) return String(iso);
+  // Rebuilt from the instant the value holds, so every field below is read off a Date of this
+  // realm. The calendar methods are ordinary ones a subclass answers, and a parsed structure can
+  // carry a Date a caller supplied, so reading them off that value let it decide the date printed
+  // beside a certificate rather than the one the certificate carries.
+  var held = guard.time.isDate(iso) ? guard.time.instantOf(iso) : Date.parse(String(iso));
+  if (isNaN(held)) return String(iso);
+  var d = new Date(held);
   var day = d.getUTCDate(), dd = (day < 10 ? " " : "") + day;
   return MONTHS[d.getUTCMonth()] + " " + dd + " " +
     _two(d.getUTCHours()) + ":" + _two(d.getUTCMinutes()) + ":" + _two(d.getUTCSeconds()) +
@@ -745,7 +750,7 @@ function _crlExtension(ext, pad) {
   var inner = pad + "    ";
   if (ext.oid === OID_CRL_NUMBER && typeof ext.value === "bigint") return header + "\n" + inner + String(ext.value);
   if (ext.oid === OID_REASON_CODE && typeof ext.value === "number") return header + "\n" + inner + (NAMES.CRL_REASON[ext.value] || String(ext.value));
-  if (ext.oid === OID_INVALIDITY_DATE && ext.value instanceof Date) return header + "\n" + inner + _date(ext.value);
+  if (ext.oid === OID_INVALIDITY_DATE && guard.time.isDate(ext.value)) return header + "\n" + inner + _date(ext.value);
   if (ext.oid === OID_DELTA_CRL_INDICATOR && Buffer.isBuffer(ext.value)) {
     try { return header + "\n" + inner + "BaseCRLNumber: " + String(asn1.read.integer(asn1.decode(ext.value))); }
     catch (_e) { /* malformed BaseCRLNumber -> fall through to the shared _extension (hex) */ }

package/lib/jose.js

@@ -368,7 +368,7 @@ function assertPublicJwk(jwk) {
 // `key` NAMES the key this message must be signed under and `profile` selects which header rules
 // apply -- both narrow what verifies, so a misspelling of either silently widens it back to the
 // default. That is the shape this check exists for: the caller asked for something stricter and got
-// the looser behaviour, with nothing said.
+// the looser behavior, with nothing said.
 var _VERIFY_KEYS = { key: 1, profile: 1 };
 async function verify(jws, opts) {
   opts = opts || {};

package/lib/key.js

@@ -106,8 +106,16 @@ async function _toPrivateKeyDer(input) {
  *   var enc = await pki.key.encrypt(der, "s3cr3t", { pem: true });
  *   var back = await pki.key.decrypt(enc, "s3cr3t");
  */
+// Every option pki.key.encrypt reads. `iterations` here answers a different question from
+// `maxIterations` on decrypt. This side chooses a PBKDF2 count, and that side caps the one it
+// will honor. Passing either name to the other verb is silently nothing, so both are refused.
+var _ENCRYPT_OPTS = { cipher: 1, iterations: 1, pem: 1, prf: 1, salt: 1 };
+
 async function encrypt(privateKey, password, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.encrypt options");
+  guard.identifier.assertKnownKeys(opts, _ENCRYPT_OPTS, _err, "key/bad-input",
+    "pki.key.encrypt has an unknown option (the PBKDF2 count here is `iterations`; " +
+    "`maxIterations` is the decrypt-side cap): ");
   var der = await _toPrivateKeyDer(privateKey);
   // RFC 5958 sec. 3: the plaintext is the DER PrivateKeyInfo -- validate it IS one (the strict parser
   // rejects BER / non-canonical / trailing bytes) before encrypting, so we never wrap opaque input.
@@ -166,8 +174,15 @@ async function encrypt(privateKey, password, opts) {
  *   var enc = await pki.key.encrypt(await pki.key.export(pair.privateKey), "s3cr3t", { pem: true });
  *   var der = await pki.key.decrypt(enc, "s3cr3t");
  */
+// Every option pki.key.decrypt reads. `maxIterations` is the cap this side honors, not the
+// `iterations` the encrypt side chooses; see the note above _ENCRYPT_OPTS.
+var _DECRYPT_OPTS = { maxIterations: 1, pem: 1 };
+
 async function decrypt(encrypted, password, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.decrypt options");
+  guard.identifier.assertKnownKeys(opts, _DECRYPT_OPTS, _err, "key/bad-input",
+    "pki.key.decrypt has an unknown option (the PBKDF2 cap here is `maxIterations`; " +
+    "`iterations` is the encrypt-side count): ");
   // opts.maxIterations is a CALLER authoring bound (a downward-only cap): validate it config-time so an
   // invalid value is a key/bad-input, never a NaN that silently disables the DoS cap and never mis-coded as
   // a fault in the attacker-controlled input parameters.
@@ -226,8 +241,19 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
  *   var pair = await pki.key.generate("Ed25519");
  *   var spkiPem = await pki.key.export(pair.publicKey, { format: "pem" });
  */
+// Every option pki.key.export reads. Adding one here is the only way to make it accepted.
+var _EXPORT_OPTS = { format: 1, label: 1 };
+
 async function export_(key, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.export options");
+  // This verb does NOT encrypt, and `password` is the option a caller reaches for when they
+  // think it does. Ignoring it writes the private key in the clear while the call site reads
+  // as though it were protected. Every other unknown option here costs a setting that does
+  // nothing; this one costs a plaintext key on disk. `pki.key.encrypt(key, password, opts)`
+  // is the verb that encrypts; export serializes whatever it is handed.
+  guard.identifier.assertKnownKeys(opts, _EXPORT_OPTS, _err, "key/bad-input",
+    "pki.key.export has an unknown option. It serializes only. To protect a private key, call " +
+    "pki.key.encrypt(key, password) first and export its result. The unknown option was: ");
   if (!_isCryptoKey(key)) throw _err("key/bad-input", "export expects a WebCrypto CryptoKey");
   var defaultLabel;
   if (key.type === "private") defaultLabel = "PRIVATE KEY";
@@ -264,8 +290,13 @@ async function export_(key, opts) {
  *   var spki = await pki.key.export(pair.publicKey);
  *   var pub = await pki.key.import(spki);                       // Ed25519 -- algorithm inferred
  */
+// Every option pki.key.import reads.
+var _IMPORT_OPTS = { algorithm: 1, extractable: 1, password: 1, usages: 1 };
+
 async function import_(input, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.import options");
+  guard.identifier.assertKnownKeys(opts, _IMPORT_OPTS, _err, "key/bad-input",
+    "pki.key.import has an unknown option: ");
   var detected = _detectKeyInput(input);
   if (detected.format === "encrypted") {
     if (opts.password == null) throw _err("key/bad-input", "an ENCRYPTED PRIVATE KEY requires opts.password to import");
@@ -303,8 +334,14 @@ async function import_(input, opts) {
  *   var pair = await pki.key.generate("Ed25519");
  *   var pkcs8 = await pki.key.export(pair.privateKey);
  */
+// Every option pki.key.generate reads. `extractable` follows the WebCrypto spelling; a
+// misspelling would leave a key extractable by default, which is the permissive direction.
+var _GENERATE_OPTS = { extractable: 1, usages: 1 };
+
 async function generate(algorithm, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.generate options");
+  guard.identifier.assertKnownKeys(opts, _GENERATE_OPTS, _err, "key/bad-input",
+    "pki.key.generate has an unknown option (the WebCrypto spelling is `extractable`): ");
   var extractable = opts.extractable != null ? opts.extractable : true;
   var usages = opts.usages || _generateUsages(_algName(algorithm));
   var pair;
@@ -333,8 +370,13 @@ async function generate(algorithm, opts) {
  *   var pair = await pki.key.generate("Ed25519");
  *   var spki = await pki.key.publicFromPrivate(await pki.key.export(pair.privateKey));
  */
+// Every option pki.key.publicFromPrivate reads.
+var _PUBLIC_FROM_PRIVATE_OPTS = { pem: 1 };
+
 async function publicFromPrivate(privateKey, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.publicFromPrivate options");
+  guard.identifier.assertKnownKeys(opts, _PUBLIC_FROM_PRIVATE_OPTS, _err, "key/bad-input",
+    "pki.key.publicFromPrivate has an unknown option: ");
   var der = await _toPrivateKeyDer(privateKey);
   var spki;
   try {

package/lib/lint.js

@@ -174,7 +174,7 @@ function _effective(rule, cert) {
   if (!rule.effectiveDate) return true;
   var nb = cert.validity && cert.validity.notBefore;
   // allow:nan-date-comparison-unguarded -- nb is a codec-parsed cert notBefore (asn1 readTime rejects a NaN instant); effectiveDate is a Date literal.
-  return (nb instanceof Date) && nb.getTime() >= rule.effectiveDate.getTime();
+  return guard.time.isDate(nb) && guard.time.instantOf(nb) >= guard.time.instantOf(rule.effectiveDate);
 }
 
 function _runLints(rules, cert, ctx) {
@@ -231,7 +231,7 @@ function _subjectCNs(cert) {
   return out;
 }
 
-// An extension's criticality is honoured (RFC 5280 4.2: a consumer MUST reject a critical extension
+// An extension's criticality is honored (RFC 5280 4.2: a consumer MUST reject a critical extension
 // it cannot process) only when this toolkit actually processes its semantics. That authority is
 // path-validate's PROCESSED_EXTENSIONS (the RFC 5280 sec. 6.1 path-processing set), never the decoder
 // table: certExtensionDecoders also decodes many extensions purely for display (qcStatements, the MS
@@ -374,7 +374,8 @@ var RFC5280_RULES = [
     check: function (cert) {
       var v = cert.validity;
       // allow:nan-date-comparison-unguarded -- notBefore/notAfter are codec-parsed cert dates (asn1 readTime rejects a NaN instant).
-      return (v.notBefore instanceof Date && v.notAfter instanceof Date && v.notBefore.getTime() > v.notAfter.getTime()) ? true : null;
+      return (guard.time.isDate(v.notBefore) && guard.time.isDate(v.notAfter) &&
+        guard.time.instantOf(v.notBefore) > guard.time.instantOf(v.notAfter)) ? true : null;
     },
   },
   {
@@ -558,7 +559,7 @@ var VALIDITY_SCHEDULE_START = VALIDITY_SCHEDULE[VALIDITY_SCHEDULE.length - 1].fr
 function _validityCeilingDays(notBefore) {
   for (var i = 0; i < VALIDITY_SCHEDULE.length; i++) {
     // allow:nan-date-comparison-unguarded -- notBefore is a codec-parsed cert date (NaN-rejected); the schedule bounds are Date literals.
-    if (notBefore.getTime() >= VALIDITY_SCHEDULE[i].from.getTime()) return VALIDITY_SCHEDULE[i].maxDays;
+    if (guard.time.instantOf(notBefore) >= guard.time.instantOf(VALIDITY_SCHEDULE[i].from)) return VALIDITY_SCHEDULE[i].maxDays;
   }
   // Unreachable: the rule's effectiveDate (VALIDITY_SCHEDULE_START) reports NE for any cert
   // whose notBefore predates the schedule, so the loop always matches the last entry.
@@ -634,9 +635,9 @@ var CABF_TLS_RULES = [
     effectiveDate: VALIDITY_SCHEDULE_START,
     check: function (cert) {
       var v = cert.validity;
-      if (!(v.notBefore instanceof Date) || !(v.notAfter instanceof Date)) return null;
+      if (!guard.time.isDate(v.notBefore) || !guard.time.isDate(v.notAfter)) return null;
       var maxDays = _validityCeilingDays(v.notBefore);
-      var days = (v.notAfter.getTime() - v.notBefore.getTime()) / MS_PER_DAY;
+      var days = (guard.time.instantOf(v.notAfter) - guard.time.instantOf(v.notBefore)) / MS_PER_DAY;
       return days > maxDays ? { context: { days: Math.round(days), maxDays: maxDays } } : null;
     },
   },
@@ -739,9 +740,15 @@ function _applyThreshold(report, severity) {
  *   report.worst;                              // "notice" | "error" | ...
  *   report.findings.map(function (f) { return f.id; });
  */
+// Every option pki.lint.certificate reads. The values of both are already validated below;
+// this refuses a key that is not one of them, so a misspelled `profile` cannot silently lint
+// against the default profile while the call site reads as though it named one.
+var _CERTIFICATE_OPTS = { profile: 1, severity: 1 };
+
 function certificate(input, opts) {
-  opts = opts || {};
-  if (typeof opts !== "object") throw _cfg("lint/bad-input", "pki.lint options must be an object");
+  opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
+  guard.identifier.assertKnownKeys(opts, _CERTIFICATE_OPTS, _cfg, "lint/bad-input",
+    "pki.lint.certificate has an unknown option: ");
   // Validate BOTH config options up front so a config error fails fast, before any work.
   if (opts.severity != null && VALID_SEVERITY.indexOf(opts.severity) === -1) {
     throw _cfg("lint/bad-severity", "unknown severity threshold \"" + opts.severity + "\" (known: " + VALID_SEVERITY.join(", ") + ")");

package/lib/ocsp-verify.js

@@ -28,6 +28,7 @@
 //     unusable per the lightweight profile).
 
 var asn1 = require("./asn1-der");
+var guard = require("./guard-all");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var compositeSig = require("./composite-sig");
@@ -144,7 +145,11 @@ function makeOcspVerify(deps) {
       if (!isOctetAligned(rc.signatureValue)) continue;
       if (!(await verifyWithSpki(rc.signatureAlgorithm, rc.signatureValue.bytes, issuer.workingPublicKey, rc.tbsBytes))) continue;
       // The delegate cert MUST itself be valid at the validation instant.
-      if (time < rc.validity.notBefore || time > rc.validity.notAfter) continue;
+      // Instants, never the Date objects: comparing two Dates coerces each through `valueOf`,
+      // which a caller's subclass answers, so the delegate would be checked at whatever moment
+      // the caller's `time` chose to report rather than the one it holds.
+      if (guard.time.instantOf(time) < guard.time.instantOf(rc.validity.notBefore) ||
+        guard.time.instantOf(time) > guard.time.instantOf(rc.validity.notAfter)) continue;
       // The delegate MUST assert id-kp-OCSPSigning; anyEKU / an absent EKU do not.
       var eku;
       try { eku = decodeExt(rc, OID_EKU); }
@@ -199,15 +204,16 @@ function makeOcspVerify(deps) {
       var sr = br.responses[s];
       if (!(await ocspCertIdMatches(sr.certID, cert, issuerNameCandidates, issuerKeyBits))) continue;
       if (ocspHasCriticalExtension(sr.singleExtensions)) continue;
-      if (sr.thisUpdate > time) continue;
-      if (!sr.nextUpdate || sr.nextUpdate < time) continue;
+      if (guard.time.instantOf(sr.thisUpdate) > guard.time.instantOf(time)) continue;
+      if (!sr.nextUpdate || guard.time.instantOf(sr.nextUpdate) < guard.time.instantOf(time)) continue;
       out.matched = true; out.thisUpdate = sr.thisUpdate; out.nextUpdate = sr.nextUpdate;
       var st = sr.certStatus;
       if (st.type === "revoked") {
         // Present-time validation revokes regardless of a future revocationTime (skew/post-dating);
         // only explicit historical validation defers a strictly-future revocation (reports good).
         // allow:nan-date-comparison-unguarded -- revocationTime is codec-parsed (NaN-rejected); a NaN check time makes this FAIL CLOSED (sawGood stays unset -> not treated good), and `time` is validated at the pki.ocsp.verify / path.verifyOcspResponse entry points.
-        if (historical && st.revocationTime instanceof Date && st.revocationTime.getTime() > time.getTime()) { out.sawGood = true; }
+        if (historical && guard.time.isDate(st.revocationTime) &&
+          guard.time.instantOf(st.revocationTime) > guard.time.instantOf(time)) { out.sawGood = true; }
         else if (!out.revoked) { out.revoked = { revocationReason: st.revocationReason || null, reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : "") }; }
       } else if (st.type === "good") { out.sawGood = true; }
       else { out.sawUnknownStatus = true; }

package/lib/ocsp.js

@@ -159,8 +159,19 @@ function buildRequest(query, opts) {
   ], _buildRequest);
 }
 
+// Every option pki.ocsp.buildRequest reads. `nonce` earns the named refusal: it is the
+// anti-replay binding, and a misspelling ships a request with no nonce at all, which the
+// responder answers happily and the caller cannot later bind to.
+// Taken from this verb's own @opts block, which is the published contract; a grep of the
+// function body misses `pem`, read by the shared emitter rather than here.
+var _BUILD_REQUEST_OPTS = {
+  hashAlgorithm: 1, nonce: 1, pem: 1, profile: 1, requestorName: 1, signer: 1
+};
+
 function _buildRequest(query, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.buildRequest options");
+  guard.identifier.assertKnownKeys(opts, _BUILD_REQUEST_OPTS, _err, "ocsp/bad-input",
+    "pki.ocsp.buildRequest has an unknown option (the anti-replay nonce is `nonce`): ");
   var lightweight = opts.profile === "lightweight";
   var hashName = opts.hashAlgorithm || "sha1";
   if (lightweight && hashName !== "sha1") throw _err("ocsp/bad-input", "the lightweight profile requires a SHA-1 CertID (RFC 5019 sec. 2.1.1)");
@@ -273,8 +284,15 @@ function sign(responseData, responder, opts) {
   ], _sign);
 }
 
+// Every option pki.ocsp.sign reads. `nonce` here is the request nonce this response echoes back.
+// A misspelling emits a response that answers nobody's request, and the client that sent a nonce
+// then reads it as unbound.
+var _SIGN_OPTS = { embedCert: 1, extendedRevoke: 1, nonce: 1, pem: 1 };
+
 function _sign(responseData, responder, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.sign options");
+  guard.identifier.assertKnownKeys(opts, _SIGN_OPTS, _err, "ocsp/bad-input",
+    "pki.ocsp.sign has an unknown option (the nonce to echo back is `nonce`): ");
   responseData = responseData || {};
   if (!responder || responder.cert == null || responder.key == null) throw _err("ocsp/bad-input", "a responder must be { cert, key }");
   var respCertDer = _normCertDer(responder.cert, "the responder certificate");
@@ -343,8 +361,8 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
 // GeneralizedTime in a SIGNED response, and compare false against every currency bound on verify.
 function _asDate(d) {
   if (d == null) return null;
-  var dt = d instanceof Date ? d : new Date(d);
-  if (isNaN(dt.getTime())) throw _err("ocsp/bad-input", "an invalid date value " + JSON.stringify(d));
+  var dt = guard.time.isDate(d) ? d : new Date(d);
+  if (isNaN(guard.time.instantOf(dt))) throw _err("ocsp/bad-input", "an invalid date value " + JSON.stringify(d));
   return dt;
 }
 // A private copy of whatever signer-key material the caller owns, taken at the entry
@@ -485,8 +503,19 @@ function buildErrorResponse(status) {
  *   var res = await pki.ocsp.verify(responseDer, { cert: leafDer, issuer: caDer });
  *   res.status;   // "good" | "revoked" | "unknown"
  */
+// Every option pki.ocsp.verify reads. `requestNonce` is the one worth refusing by name: it is
+// what binds the response to this request. A misspelling leaves nonceMatched null on a call
+// that did ask, and null is the value meaning "the client never asked".
+var _VERIFY_OPTS = { cert: 1, historicalMode: 1, issuer: 1, requestNonce: 1, time: 1 };
+
 function verify(response, opts) {
-  opts = opts || {};
+  // This verb reports faults by rejecting, not throwing, so both entry guards run inside the
+  // same try and surface as a rejection like every other fault on this path.
+  try {
+    opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.verify options");
+    guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "ocsp/bad-input",
+      "pki.ocsp.verify has an unknown option (the request nonce to bind against is `requestNonce`): ");
+  } catch (e) { return Promise.reject(e); }
   if (opts.cert == null || opts.issuer == null) return Promise.reject(_err("ocsp/bad-input", "verify requires opts.cert and opts.issuer"));
   var parsed, cert, issuerCert, time;
   try {
@@ -530,7 +559,7 @@ function verify(response, opts) {
     // the closed direction for `revoked`: revocation does not expire the way
     // non-revocation does, so discarding a signed, current, authorized revoked
     // verdict because it was replayed would hand a soft-fail caller the certificate
-    // the responder just refused -- turning the anti-replay defence into the thing
+    // the responder just refused -- turning the anti-replay defense into the thing
     // that accepts a revoked certificate. `nonceMatched: false` still reports that
     // this response was not bound to this request.
     if (!matched && verdict.status === "good") {

package/lib/oid.js

@@ -22,7 +22,7 @@
  *   attribute types, `2.5.29` for the extensions, `2.16.840.1.101.3.4` for
  *   the NIST algorithms), and each member names only its trailing arc. The
  *   full OID is derived from base + leaf at load, so the arc hierarchy that
- *   IS the OID namespace is modelled directly instead of re-spelled per
+ *   IS the OID namespace is modeled directly instead of re-spelled per
  *   entry. It covers the RFC 5280 attribute types and extensions, the
  *   classical signature / public-key / digest algorithms, and the
  *   NIST-assigned post-quantum arcs (ML-DSA, ML-KEM, SLH-DSA). Operators