@blamejs/pki 0.5.9 → 0.5.11

package/lib/path-validate.js

@@ -306,7 +306,7 @@ function resolveDescriptor(sigAlg) {
 // defense). For the one-shot families whose public key shares the signature OID
 // (EdDSA, ML-DSA, SLH-DSA), Node's WebCrypto imports an SPKI of a DIFFERENT type
 // under the requested name and verifies with the real key, so an Ed25519-signed
-// certificate labelled SLH-DSA would otherwise validate. Enforce structurally:
+// certificate labeled SLH-DSA would otherwise validate. Enforce structurally:
 // the issuer SPKI's algorithm OID MUST equal the signature algorithm OID. (For
 // RSA/ECDSA -- different key vs signature OIDs -- WebCrypto's import already rejects
 // a mismatched key type, so `sameKeyOid` is not set and this is a no-op.)
@@ -1170,8 +1170,28 @@ function validateCriticalExtensionStructure(cert) {
  *   });
  *   res.valid;  // boolean; res.results[0].checks carries the per-check codes
  */
+// Every option pki.path.validate reads. The anchor option here is the singular `trustAnchor`,
+// while pki.path.build in this same module spells it `trustAnchors` and takes a list. A caller
+// moving between the two verbs carries the wrong spelling without leaving the namespace, and
+// before this it bought them no anchoring and no error, just "a trustAnchor is required" about
+// an option they believed they had passed.
+// Derived from three sources, because no one of them is complete: the `opts.*` reads in this
+// function, the `params.*` reads in the RFC 5280 6.1.1 state it is passed down to, and the
+// documented prose above, which is the only place `requiredEku` and the three initial-policy
+// inputs appear together. A grep of one function would have shipped a list missing four real
+// options and rejected callers that work today.
+var _VALIDATE_OPTS = {
+  checkPurpose: 1, historicalMode: 1, initialAnyPolicyInhibit: 1, initialExcludedSubtrees: 1,
+  initialExplicitPolicy: 1, initialPermittedSubtrees: 1, initialPolicyMappingInhibit: 1,
+  maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1, requiredEku: 1, revocationChecker: 1,
+  softFail: 1, time: 1, trustAnchor: 1, userInitialPolicySet: 1, verifier: 1
+};
+
 async function validate(path, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "validate: opts");
+  guard.identifier.assertKnownKeys(opts, _VALIDATE_OPTS, E, "path/bad-input",
+    "pki.path.validate has an unknown option. The anchor here is `trustAnchor`, singular; " +
+    "pki.path.build takes `trustAnchors`. The unknown option was: ");
   if (!Array.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
   // Bound the per-cert asymmetric-verify work BEFORE parsing an untrusted bundle
   // (the policy-tree cap guards CVE-2023-0464-style blow-up; this guards linear
@@ -1288,10 +1308,15 @@ async function validate(path, opts) {
     }
 
     // 6.1.3(a)(2) validity window.
-    var t = opts.time;
+    //
+    // Instants, never the Date objects. Comparing two Dates coerces each one, and coercion runs
+    // `Symbol.toPrimitive` or `valueOf`, which a caller's subclass answers. opts.time was checked
+    // for a valid held instant at entry, and comparing the object here asked it again through a
+    // door the check never used -- so the value validated and the value compared were two reads.
+    var t = guard.time.instantOf(opts.time);
     var vOk = true, vCode;
-    if (t < cert.validity.notBefore) { vOk = false; vCode = "path/not-yet-valid"; }
-    else if (t > cert.validity.notAfter) { vOk = false; vCode = "path/expired"; }
+    if (t < guard.time.instantOf(cert.validity.notBefore)) { vOk = false; vCode = "path/not-yet-valid"; }
+    else if (t > guard.time.instantOf(cert.validity.notAfter)) { vOk = false; vCode = "path/expired"; }
     checks.push({ name: "validity", ok: vOk, code: vCode });
     if (!vOk) failed = true;
 
@@ -1435,7 +1460,7 @@ async function validate(path, opts) {
         // (Mozilla certverifier isDistrustedCertificateChain: endEntityNotBefore
         // <= distrustAfterTime -> not distrusted; the end-of-day ...235959Z
         // convention keeps the whole boundary day trusted).
-        if (cert.validity.notBefore > distrustDate) {
+        if (guard.time.instantOf(cert.validity.notBefore) > guard.time.instantOf(distrustDate)) {
           checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
         }
       }
@@ -1753,7 +1778,7 @@ function classifyCrls(parsed) {
       // sec. 5.2.4 @3447 makes deltaCRLIndicator a MUST-be-critical extension. A non-critical one
       // is non-conforming, so it does not earn the NEW capability of being merged -- merging can
       // RELEASE a certificate, and that must rest on a conforming indicator. It is still classified
-      // as a delta and still consulted for revocation, which is the shipped behaviour and the
+      // as a delta and still consulted for revocation, which is the shipped behavior and the
       // conservative direction.
       if (crlNumberWithinBound(n) && deltaCritical) { rec.baseCrlNumber = n; rec.mergeable = true; }
     } catch (_e) {
@@ -1808,7 +1833,7 @@ function selectDelta(candidates) {
   for (var i = 0; i < candidates.length; i++) {
     var c = candidates[i];
     if (best === null) { best = c; continue; }
-    var t = c.crl.thisUpdate.getTime(), bt = best.crl.thisUpdate.getTime();
+    var t = guard.time.instantOf(c.crl.thisUpdate), bt = guard.time.instantOf(best.crl.thisUpdate);
     if (t > bt) { best = c; continue; }
     if (t === bt && c.crlNumber !== null && best.crlNumber !== null && c.crlNumber > best.crlNumber) best = c;
   }
@@ -2053,11 +2078,12 @@ function crlChecker(crls, opts) {
             }
           }
         }
-        if (theCrl.thisUpdate > time) return null;            // not yet valid
+        if (guard.time.instantOf(theCrl.thisUpdate) > guard.time.instantOf(time)) return null;   // not yet valid
         // A CRL with no nextUpdate has no bounded validity -- its currency
         // cannot be confirmed (RFC 5280 sec. 5.1.2.5 requires nextUpdate), so a
         // replayed old CRL must not read "good". Treat it as unusable.
-        if (!theCrl.nextUpdate || theCrl.nextUpdate < time) return null;   // stale / no bound
+        if (!theCrl.nextUpdate ||
+          guard.time.instantOf(theCrl.nextUpdate) < guard.time.instantOf(time)) return null;   // stale / no bound
 
         var sigOk = await crlVerify.verifyCrlSignature(theCrl, issuer.workingPublicKey);
         if (!sigOk) return null;                              // unverifiable -> not authoritative
@@ -2085,7 +2111,8 @@ function crlChecker(crls, opts) {
           // e.g. a timestamped signature -- does an entry dated AFTER the
           // validation time not yet apply.
           // allow:nan-date-comparison-unguarded -- revocationDate is codec-parsed (NaN-rejected); a NaN check time makes this FAIL CLOSED (the skip is not taken -> the entry is treated as revoked), and `time` is validated at the path.validate / crlChecker entry points.
-          if (historical && entry.revocationDate instanceof Date && entry.revocationDate.getTime() > time.getTime()) continue;
+          if (historical && guard.time.isDate(entry.revocationDate) &&
+            guard.time.instantOf(entry.revocationDate) > guard.time.instantOf(time)) continue;
           var rc = crlEntryReason(entry);
           return rc === null ? 0 : rc;
         }
@@ -2393,7 +2420,7 @@ function ocspChecker(responses) {
  * `pki.schema.ocsp.parseResponse` result. A REBUILT parsed response is refused. A
  * signature check has three parts -- the signature, the algorithm that verifies it,
  * and the bytes it covers -- and on a parsed object all three are separate properties:
- * a genuine CA signature over a certificate that CA issued, relabelled, verifies as a
+ * a genuine CA signature over a certificate that CA issued, relabeled, verifies as a
  * ResponseData signature for a response that never existed. The parser marks what it
  * returns, so those three are known to have been derived together from one byte
  * string; `Object.assign`, spread and a JSON round-trip all drop the mark, which is
@@ -2460,7 +2487,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
   opts = opts || {};
   // The currency + responder-cert validity windows compare against `time`; a missing or invalid
   // check date must fail closed (a NaN compares false against every bound), never silently pass.
-  if (!(time instanceof Date) || isNaN(time.getTime())) {
+  if (!guard.time.isDate(time) || isNaN(guard.time.instantOf(time))) {
     return Promise.reject(E("path/bad-input", "verifyOcspResponse: time must be a valid Date (the currency + responder-validity check date)"));
   }
   // Bind the supplied issuer certificate to the target: the target's issuer DN must equal the
@@ -2666,8 +2693,9 @@ function scoreCandidate(cand, childAki, anchors, time) {
   if (ku && ku.value && ku.value.keyCertSign === true) score += 10;                 // sec. 3.5.3 keyUsage keyCertSign
   var v = cand.validity;
   // allow:nan-date-comparison-unguarded -- cand.validity dates are codec-parsed (asn1 readTime rejects a NaN instant) and time is guard.time.assertValid'd at entry; the validity term is a fail-safe sort hint regardless.
-  if (v && v.notBefore instanceof Date && v.notAfter instanceof Date &&
-    v.notBefore.getTime() <= time.getTime() && time.getTime() <= v.notAfter.getTime()) score += 5;   // sec. 3.5.4 validity
+  if (v && guard.time.isDate(v.notBefore) && guard.time.isDate(v.notAfter) &&
+    guard.time.instantOf(v.notBefore) <= guard.time.instantOf(time) &&
+    guard.time.instantOf(time) <= guard.time.instantOf(v.notAfter)) score += 5;   // sec. 3.5.4 validity
   return score;
 }
 
@@ -2795,7 +2823,7 @@ async function _fetchAiaIssuers(current, aia) {
     for (var c = 0; c < certs.length; c++) {
       var parsed;
       try { parsed = coerceCert(certs[c]); }
-      catch (_e3) { /* allow:swallow-unverified verified-unreachable: every cert here already passed the IDENTICAL x509.parse in _aiaParseBody (single-DER validates `body`; certs-only validates each via parseCertsOnly), so coerceCert re-parsing the same bytes cannot throw -- the guard stays as defence-in-depth */ continue; }
+      catch (_e3) { /* allow:swallow-unverified verified-unreachable: every cert here already passed the IDENTICAL x509.parse in _aiaParseBody (single-DER validates `body`; certs-only validates each via parseCertsOnly), so coerceCert re-parsing the same bytes cannot throw -- the guard stays as defense-in-depth */ continue; }
       out.push(parsed);
     }
   }
@@ -2870,9 +2898,30 @@ async function _fetchAiaIssuers(current, aia) {
  *   });
  *   result.valid;                  // true when a path to a trust anchor was found and validated
  */
+// pki.path.build takes its own options AND forwards every pki.path.validate option to each
+// internal validate() call. The documented contract above says so, and validateOpts() copies
+// them wholesale. So the accepted set is the union, derived from _VALIDATE_OPTS. Retyping it
+// would let the two lists drift the first time validate gains an option.
+//
+// `trustAnchor` is removed from the union on purpose: build assigns it per candidate anchor,
+// so a caller passing the singular would have it overwritten and silently ignored. Refusing it
+// is what makes the singular/plural message below actionable rather than trivia.
+var _BUILD_OPTS = (function () {
+  var o = {
+    aiaTimeout: 1, candidates: 1, fetchAia: 1, intermediates: 1, maxAiaFetches: 1,
+    maxAiaPerCert: 1, maxCandidatesConsidered: 1, maxDepth: 1, maxPathCerts: 1,
+    maxResponseBytes: 1, time: 1, tls: 1, transport: 1, trustAnchors: 1, validate: 1
+  };
+  Object.keys(_VALIDATE_OPTS).forEach(function (k) { o[k] = 1; });
+  delete o.trustAnchor;
+  return o;
+})();
+
 async function build(leaf, opts) {
-  opts = opts || {};
-  if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw E("path/bad-input", "build: opts must be an object");
+  opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "build: opts");
+  guard.identifier.assertKnownKeys(opts, _BUILD_OPTS, E, "path/bad-input",
+    "pki.path.build has an unknown option. The anchors here are `trustAnchors`, plural; " +
+    "pki.path.validate takes `trustAnchor`. The unknown option was: ");
   var leafCert;
   try { leafCert = coerceCert(leaf); }
   catch (e) { throw E("path/bad-input", "build: the leaf certificate did not parse", e); }
@@ -2965,10 +3014,38 @@ async function build(leaf, opts) {
   // enumerates only own enumerable properties, so no prototype-pollution belt.
   var BUILD_ONLY_OPT = { candidates: 1, intermediates: 1, trustAnchors: 1, maxDepth: 1, maxCandidatesConsidered: 1, validate: 1,
     fetchAia: 1, transport: 1, tls: 1, maxAiaFetches: 1, maxAiaPerCert: 1, aiaTimeout: 1, maxResponseBytes: 1 };
-  var forwarded = {};
-  Object.keys(opts).forEach(function (k) { if (!BUILD_ONLY_OPT[k]) forwarded[k] = opts[k]; });
+  // No prototype, so the set forwarded to each internal validate holds what was put in it and
+  // nothing a runtime carries. A plain `{}` here re-acquired a polluted name after the caller's
+  // own value had been dropped, which is how an explicit `softFail: false` became a waiver.
+  var forwarded = Object.create(null);
+  // Driven by the contract. Walk the validate options this verb forwards and take the ones the
+  // bag answers for.
+  //
+  // Enumerating the bag reads whatever a property walk chooses to report, and that walk skips a
+  // method so a caller's class keeps its own. A known option whose value were a bare function
+  // would be indistinguishable from one, and a defaults-style bag like
+  // `Object.create({ someOption: fn })` would have it dropped here, leaving each internal
+  // validate running without something the caller supplied.
+  //
+  // No option takes a bare function today. `revocationChecker` is `{ check }`, `verifier` is
+  // `{ verify }`, and `transport` is build-only and never forwarded. So this is a hardening
+  // rather than a live defect, and there is no vector that fails without it. It is here because
+  // asking the contract cannot drop a known option whatever its value, and the alternative makes
+  // the forwarded set depend on a walk whose rules exist for an unrelated question.
+  //
+  // `in` rather than an own check, because an option carried on a prototype is one the caller
+  // supplied and `opts.softFail` answers for it. Own membership decides only whether a name is
+  // build-only, which is a question about this module's own table and never about the caller.
+  Object.keys(_VALIDATE_OPTS).forEach(function (k) {
+    if (Object.prototype.hasOwnProperty.call(BUILD_ONLY_OPT, k)) return;
+    if (k in opts) forwarded[k] = opts[k];
+  });
   function validateOpts(anchor) {
-    var vo = {};
+    var vo = Object.create(null);   // same reason as `forwarded` above
+    // Every name in the forwarded set, which was built from the contract above and has no
+    // prototype, so its own keys are exactly what was put in it. A property walk here would
+    // apply the method rule a second time and drop a function-valued option all over again;
+    // forwarding less than was validated is worse than refusing the bag.
     Object.keys(forwarded).forEach(function (f) { vo[f] = forwarded[f]; });
     vo.trustAnchor = anchor;
     return vo;
@@ -3111,7 +3188,7 @@ module.exports = {
   // The set of extension OIDs whose CRITICAL semantics this validator processes (RFC 5280 sec. 6.1).
   // Exposed so a linter can distinguish "processed" from "merely decoded" and stay consistent with
   // the path-validation verdict on a critical extension -- a decoder in certExtensionDecoders is NOT
-  // by itself proof the criticality is honoured. Both sets are frozen so a caller cannot mutate them.
+  // by itself proof the criticality is honored. Both sets are frozen so a caller cannot mutate them.
   PROCESSED_EXTENSIONS: PROCESSED_EXTENSIONS,
   // Extensions that ARE processed for an intermediate CA but are unprocessed on the target/leaf, so a
   // critical instance on the target fails closed (RFC 5280 sec. 6.1.5(f)) -- policyMappings is

package/lib/schema-c509.js

@@ -1650,7 +1650,7 @@ function _sdaToDer(node, isNative) {
       if (tname === undefined) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attribute type int " + ti + " has no C509 sec. 8.6 registry row");
       // countryName / serialNumber carry a CHARACTER restriction (draft sec. 3.1.4 "SHALL contain only
       // characters from the 74-character ASCII subset permitted by PrintableString"), and not a sign override --
-      // _reconAttrValue asserts the charset and honours the declared string type. Requiring the negative sign
+      // _reconAttrValue asserts the charset and honors the declared string type. Requiring the negative sign
       // here would also make these attributes unrepresentable in a NATIVE certificate, whose ints SHALL all be
       // non-negative (same sec.), so the rule is the charset, not the sign.
       for (var vi = 0; vi < valuesNode.children.length; vi++) {
@@ -1846,7 +1846,7 @@ function _reconAttrValue(rdn) {
   if (rdn.type === "emailAddress") return b.ia5(s);
   // serialNumber / countryName carry a CHARACTER restriction, not a string-type override: draft sec. 3.1.4
   // "SHALL contain only characters from the 74-character ASCII subset permitted by PrintableString". Enforce
-  // that on the CHARACTERS and still honour the sign for the string type. Coercing them to PrintableString
+  // that on the CHARACTERS and still honor the sign for the string type. Coercing them to PrintableString
   // regardless of sign would make the +N and -N encodings of one value reconstruct IDENTICAL DER, so a single
   // X.509 signature would cover two distinct C509 encodings (a malleability window in the type-3 transform).
   // b.printable IS the PrintableString charset authority -- run it for the assert even when the sign selects
@@ -2205,14 +2205,14 @@ function _requireResultShape(r) {
   if (r.serialNumber == null && r.serialNumberHex == null) throw _err("c509/bad-input", "a C509 result must carry serialNumber or serialNumberHex");
   if (!r.signatureAlgorithm || typeof r.signatureAlgorithm.name !== "string") throw _err("c509/bad-input", "a C509 result must carry signatureAlgorithm.name");
   if (!r.subjectPublicKeyAlgorithm || typeof r.subjectPublicKeyAlgorithm.name !== "string") throw _err("c509/bad-input", "a C509 result must carry subjectPublicKeyAlgorithm.name");
-  if (!r.validity || !(r.validity.notBefore instanceof Date) || (r.validity.notAfter !== null && !(r.validity.notAfter instanceof Date))) throw _err("c509/bad-input", "a C509 result must carry validity.notBefore (Date) and notAfter (Date or null)");
+  if (!r.validity || !guard.time.isDate(r.validity.notBefore) || (r.validity.notAfter !== null && !guard.time.isDate(r.validity.notAfter))) throw _err("c509/bad-input", "a C509 result must carry validity.notBefore (Date) and notAfter (Date or null)");
   if (!Array.isArray(r.extensions)) throw _err("c509/bad-input", "a C509 result must carry an extensions array");
   if (!Buffer.isBuffer(r.signatureValue)) throw _err("c509/bad-input", "a C509 result must carry a Buffer signatureValue");
 }
 // A validity Date -> its C509 ~time (a non-negative CBOR epoch uint). A pre-epoch date cannot be
 // represented (the parser accepts only an unwrapped major-type-0 integer) and fails closed here.
 function _validityUint(date, label) {
-  var secs = Math.floor(date.getTime() / 1000);
+  var secs = Math.floor(guard.time.instantOf(date) / 1000);
   if (!isFinite(secs) || secs < 0) throw _err("c509/bad-validity", label + " is before the Unix epoch or not a valid date; C509 ~time is a non-negative CBOR epoch");
   return cbor.build.uint(BigInt(secs));
 }
@@ -2433,7 +2433,7 @@ _derToType3 = function (input, opts) {
     // against a UTF8String of the same characters) would rebuild different bytes and break the
     // signature that covers them. Byte-identical is exactly the condition under which that is safe.
     issuer: c.issuer.bytes.equals(c.subject.bytes) ? null : _c509NameFromDer(c.issuer.bytes),
-    validity: { notBefore: c.validity.notBefore, notAfter: c.validity.notAfter.getTime() === _NO_EXPIRY ? null : c.validity.notAfter },
+    validity: { notBefore: c.validity.notBefore, notAfter: guard.time.instantOf(c.validity.notAfter) === _NO_EXPIRY ? null : c.validity.notAfter },
     subject: _c509NameFromDer(c.subject.bytes),
     subjectPublicKeyAlgorithm: { name: "ecPublicKey", oid: c.subjectPublicKeyInfo.algorithm.oid, curve: curve },
     subjectPublicKey: _compressEcPoint(asn1.read.bitString(spkiNode.children[1]).bytes, coordLen),   // 0x04||X||Y -> C509 compressed marker

package/lib/schema-cmp.js

@@ -460,7 +460,7 @@ var CERT_RESPONSE = schema.seq([
     // accepted (0) or grantedWithMods (1). Any other status (rejection, waiting,
     // the revocation / keyUpdate warnings) denies or defers the request, so a
     // certificate under it is a malformed response even when no explicit failInfo
-    // bit is set (a rejection is commonly signalled by status alone). Keying the
+    // bit is set (a rejection is commonly signaled by status alone). Keying the
     // rule off failInfo presence alone would let a bare-rejection status ship a
     // certificate (RFC 9810 sec. 5.3.4).
     if (certifiedKeyPair !== null && status.status.code !== 0 && status.status.code !== 1) {

package/lib/schema-crl.js

@@ -41,7 +41,7 @@ var CRL_REASONS = pkix.CRL_REASON_NAMES;
 
 // Extension-value decoding is keyed off the stable dotted OID (resolved once at
 // load from the canonical name) and not the mutable display name, so a caller's
-// pki.oid.register() display override cannot change parse behaviour.
+// pki.oid.register() display override cannot change parse behavior.
 var OID_CRL_NUMBER = oid.byName("cRLNumber");
 var OID_REASON_CODE = oid.byName("reasonCode");
 var OID_INVALIDITY_DATE = oid.byName("invalidityDate");

package/lib/schema-engine.js

@@ -40,11 +40,11 @@ function _fail(ctx, code, message) {
 }
 
 // ---- shape assertions ------------------------------------------------
-// A schema's `assert` mode is a real behaviour-preservation control: some
+// A schema's `assert` mode is a real behavior-preservation control: some
 // hand-written guards checked the universal SEQUENCE tag (algorithmIdentifier,
 // Name), others checked only that the node had children (Validity, SPKI, the
 // tbs body, an AttributeTypeAndValue). Collapsing them to one "is a SEQUENCE"
-// check would silently change behaviour on SET-wrapped input, so each is kept.
+// check would silently change behavior on SET-wrapped input, so each is kept.
 
 function _assertShape(schema, node, ctx) {
   var mode = schema.assert || "sequence";

package/lib/schema-pkix.js

@@ -1228,7 +1228,7 @@ function certExtensionDecoders(ns) {
 
   // qcStatements ::= SEQUENCE OF QCStatement (RFC 3739 sec. 3.2.6). QCStatement ::= SEQUENCE {
   // statementId OBJECT IDENTIFIER, statementInfo ANY DEFINED BY statementId OPTIONAL }. Known statementIds
-  // (RFC 3739 id-qcs + the ETSI EN 319 412-5 esi4 catalog) decode their statementInfo; an unknown statementId
+  // (RFC 3739 id-qcs + the ETSI EN 319 412-5 esi4 catalogue) decode their statementInfo; an unknown statementId
   // is preserved OPAQUE (the RFC 3739 open type), never rejected. The DEFINED-BY selection is an OID re-dispatch.
   function _qcStr(node, tag, C, what) {
     if (!node || node.tagClass !== "universal" || node.tagNumber !== tag) throw ns.E(C, what);

package/lib/sigstore.js

@@ -228,7 +228,7 @@ function _toMs(x) {
   // Coverage residual -- _inWindow gates every _toMs call behind a != null check; the null guard is dead defensive code.
   if (x == null) return null;
   if (typeof x === "number") return Number.isFinite(x) ? x : null;
-  if (x instanceof Date) { var d = x.getTime(); return isNaN(d) ? null : d; }
+  if (guard.time.isDate(x)) { var d = guard.time.instantOf(x); return isNaN(d) ? null : d; }
   if (typeof x === "string") { var t = Date.parse(x); return isNaN(t) ? null : t; }
   return null;
 }
@@ -671,7 +671,11 @@ async function verifyBundle(bundle, opts) {
   if (integratedTime === null) throw lastErr;
 
   // Leg 3 -- Fulcio chain, validated as of the (trusted) log time; then identity.
-  var checkTime = (opts.time instanceof Date) ? opts.time.getTime() : C.TIME.seconds(integratedTime);
+  // The instant comes through the time guard's intrinsic read. `getTime` is an ordinary method a
+  // subclass answers, and the slot predicate above accepts a subclass from any realm, so reading
+  // the method off the value let a caller name the moment the Fulcio chain is validated at --
+  // epoch zero, say, where every certificate in it is still unissued.
+  var checkTime = guard.time.isDate(opts.time) ? guard.time.instantOf(opts.time) : C.TIME.seconds(integratedTime);
   await _verifyChain(leaf, _chainDers(vm), fulcioRoots, checkTime);
   var identity = _identity(leaf);
   var identityChecked = _checkIdentity(identity, opts.identity);

package/lib/smime.js

@@ -846,7 +846,7 @@ function _capped(msg) {
  * compared under RFC 5280 sec. 7.5: the local-part exactly, the host-part case-insensitively. The
  * address is read from the `subjectAltName` `rfc822Name` entries (RFC 8550 sec. 4.4.3) and, where the
  * extension carries none, from the subject DN's PKCS #9 `emailAddress` attribute, which RFC 8550 sec. 3
- * requires a receiving agent to recognise. Where both are present the extension wins. Only a signer
+ * requires a receiving agent to recognize. Where both are present the extension wins. Only a signer
  * whose signature verified contributes an identity, so a tampered message cannot report a binding. `match` is THREE-valued and a caller enforcing sender binding tests
  * `match === true` -- `false` means every identity was comparable and none matched, and `null` means the
  * question was not answered (no `expectedSender` and no single outer `From`, a signer certificate

package/lib/trust.js

@@ -347,7 +347,7 @@ function _copyDistrustAfter(src) {
   var out = {};
   if (!src || typeof src !== "object") return out;
   Object.keys(src).forEach(function (k) {
-    out[k] = src[k] instanceof Date ? new Date(src[k].getTime()) : src[k];
+    out[k] = guard.time.isDate(src[k]) ? new Date(guard.time.instantOf(src[k])) : src[k];
   });
   return out;
 }
@@ -375,7 +375,7 @@ function _copyName(name) {
 function _datesEqual(x, y) {
   var kx = Object.keys(x).sort(), ky = Object.keys(y).sort();
   if (kx.join(",") !== ky.join(",")) return false;
-  return kx.every(function (k) { return x[k].getTime() === y[k].getTime(); });
+  return kx.every(function (k) { return guard.time.instantOf(x[k]) === guard.time.instantOf(y[k]); });
 }
 
 function _purposesEqual(x, y) {

package/lib/tsp-sign.js

@@ -161,7 +161,7 @@ function _sign(messageImprint, tsa, opts) {
   // genTime defaults to now; a supplied value MUST be a valid Date (never a silently-ignored
   // non-Date or an Invalid Date that would encode a garbage GeneralizedTime).
   if (opts.genTime != null) guard.time.assertValid(opts.genTime, _err, "tsp/bad-input", "genTime");
-  var genTime = opts.genTime instanceof Date ? opts.genTime : new Date();
+  var genTime = guard.time.isDate(opts.genTime) ? opts.genTime : new Date();
   // A caller-authored INTEGER is coerced through the shared guard, so a value that is not one is a
   // typed tsp/bad-input rather than a raw SyntaxError or RangeError out of BigInt() -- an untyped
   // fault escaping a public verb, which a caller cannot catch by code.
@@ -761,7 +761,7 @@ async function verify(token, data, opts) {
     // notBefore is rejected at the floor (ceil >= notBefore but floor < notBefore). Certificate
     // validity is seconds-precise (RFC 5280 sec. 4.1.2.5), so this never over-rejects a valid token.
     var floorT = tst.genTime;
-    var ceilT = (tst.genTimeFraction != null && /[1-9]/.test(tst.genTimeFraction.slice(3))) ? new Date(floorT.getTime() + 1) : floorT;
+    var ceilT = (tst.genTimeFraction != null && /[1-9]/.test(tst.genTimeFraction.slice(3))) ? new Date(guard.time.instantOf(floorT) + 1) : floorT;
     try {
       // parseToken surfaces each embedded cert as { bytes, tagClass, ... }; take the X.509 certs
       // (universal SEQUENCE), skipping any attribute-certificate choices, and parse their raw bytes.

package/lib/validator-attcert.js

@@ -7,9 +7,9 @@
 //
 // validator-attcert -- the SINGLE home for "does this X.509 leaf meet the WebAuthn
 // attestation-certificate profile" (WebAuthn sec. 8.2.1 packed, sec. 8.3.1 TPM AIK).
-// Sibling to the guard family: a validator owns a decoded TYPE's COMPLETE conformance rule
-// set once, so the packed and AIK profiles cannot drift apart or lose a gate (e.g. the v3
-// check that previously lived split out in the tpm verifier, away from the profile).
+// Sibling to the guard family: a validator owns a decoded type's complete conformance rule
+// set once, so the packed and AIK profiles cannot drift apart or lose a gate. The version
+// check belongs to the profile, not to whichever verifier reaches it first.
 //
 // The caller supplies its parsed certificate + an extension-accessor object `exts`
 // { find(cert, oidName) -> rawExt|null, decode(cert, oidName) -> {critical, value}|null }

package/lib/validator-cose.js

@@ -8,7 +8,7 @@
 // validator-cose -- the SINGLE home for "is this a conformant WebAuthn credential
 // COSE_Key" (RFC 9052 sec. 7 structure + RFC 9053 EC2/OKP/RSA key parameters + the
 // CTAP2 canonical-CBOR profile WebAuthn sec. 6.5.1 imposes). Sibling to the guard
-// family: where a guard owns a CVE-class fail-closed defence once, a validator owns a
+// family: where a guard owns a CVE-class fail-closed defense once, a validator owns a
 // decoded TYPE's COMPLETE conformance rule set once, so a format module composes the
 // family instead of re-deriving a partial subset inline (the drift that leaks MUSTs
 // out one review round at a time). Enforced by the validator-shape-reinlined
@@ -242,10 +242,10 @@ function assertKeyMaterial(key, E, code, unsupportedCode) {
   // PROFILE: the declared alg must match the key type (and, for EC2, the curve).
   var prof = ALG_PROFILE[String(key.alg)];
   // An algorithm this verifier does not implement is not a malformed key. The key can be perfectly
-  // well-formed (the same bytes may parse under a neighbouring algorithm id), and a relying
+  // well-formed (the same bytes may parse under a neighboring algorithm id), and a relying
   // party migrating credential rows written elsewhere needs to tell "I cannot check this
   // algorithm" from "these bytes are wrong", since only one of those is fixable by re-registering.
-  // Callers that do not distinguish the two pass one code and keep the previous behaviour.
+  // Callers that do not distinguish the two pass one code and keep the previous behavior.
   if (!prof) throw new E(unsupportedCode || code, "unsupported credential key algorithm " + key.alg);
   if (prof.kty !== key.kty) throw bad("credential key algorithm " + key.alg + " is inconsistent with key type " + key.kty);
   if (prof.crv != null && prof.crv !== key.crv) throw bad("credential key algorithm " + key.alg + " requires a different curve");

package/lib/webauthn-mds.js

@@ -85,7 +85,7 @@ function _schemeE(kind, message, cause) { return new WebauthnError("webauthn/" +
 // WebCrypto algorithms.
 //
 // Null-prototype: `alg` is attacker-supplied, and an inherited Object member would otherwise
-// resolve to a truthy non-row and read as a recognised algorithm.
+// resolve to a truthy non-row and read as a recognized algorithm.
 function _deriveBlobAlgs() {
   var out = Object.create(null);
   jose.sigAlgs().forEach(function (row) {
@@ -120,7 +120,7 @@ function _blobAlgParams(algRow, leafAlgName) {
 
 // The status values that deny trust (MDS v3.0 sec. 3.1.4). An unknown status is IGNORED for the
 // gate and surfaced raw -- the specification requires that a verifier not fail on a status it does
-// not recognise -- unless the caller opts into refusing them.
+// not recognize -- unless the caller opts into refusing them.
 var DISQUALIFYING = Object.assign(Object.create(null), {
   REVOKED: 1, ATTESTATION_KEY_COMPROMISE: 1, USER_KEY_REMOTE_COMPROMISE: 1,
   USER_KEY_PHYSICAL_COMPROMISE: 1, USER_VERIFICATION_BYPASS: 1,
@@ -140,7 +140,7 @@ var _BLOB_OPTS = Object.assign(Object.create(null), {
 function _isPlainObject(v) { return !!v && typeof v === "object" && !Array.isArray(v); }
 
 // The results this module actually produced. Membership is the PROVENANCE check: a metadata object
-// is only allowed to decide trust if verifyMetadataBlob made it. Recognising it by shape instead
+// is only allowed to decide trust if verifyMetadataBlob made it. Recognizing it by shape instead
 // would accept anything carrying the right property names, including a catalogue deserialized
 // from a cache, where nothing establishes that the signature and chain were ever checked, and an
 // attacker who can write that cache chooses which roots an authenticator is allowed to chain to.
@@ -207,7 +207,7 @@ function _isAnchorItself(cert, anchor) {
 //
 // An already-parsed certificate is taken as-is, never re-encoded and re-parsed, but the
 // recognition test names every field the anchor is later read for: the subject name, the public
-// key bytes, and the signature algorithm OID. Recognising an object on a looser test lets something
+// key bytes, and the signature algorithm OID. Recognizing an object on a looser test lets something
 // that is merely certificate-SHAPED through: a parsed CSR satisfies "has a subject and an SPKI", and
 // a hand-built object literal satisfies it too and then raises a raw TypeError from deep inside the
 // path validator, which is an untyped throw escaping a public verb.
@@ -250,8 +250,8 @@ function _verifyMetadataBlob(blob, opts) {
     throw _err("webauthn/bad-input", "opts.previousNo must be a non-negative safe integer");
   }
   // The boolean options are checked for TYPE, not merely compared against true. A caller who wrote
-  // `rejectUnknownStatus: "true"` from a config file is asking for the stricter behaviour; comparing
-  // against `true` silently records the policy as off and the authenticator carrying an unrecognised
+  // `rejectUnknownStatus: "true"` from a config file is asking for the stricter behavior; comparing
+  // against `true` silently records the policy as off and the authenticator carrying an unrecognized
   // status is then accepted -- the fail-open the option exists to prevent.
   ["requireRollbackCheck", "allowStale", "rejectUnknownStatus"].forEach(function (k) {
     if (opts[k] !== undefined && typeof opts[k] !== "boolean") {
@@ -326,7 +326,7 @@ function _verifyMetadataBlob(blob, opts) {
       maxBytes: C.MDS_BLOB_HEADER_MAX_BYTES, maxDepth: C.JSON_MAX_DEPTH,
       tooLarge: "webauthn/too-large", badJson: "webauthn/bad-metadata-blob",
       // Every code the guard can raise is named. An omitted one falls back to the framework default
-      // and the module's own defences -- duplicate-member smuggling, the depth cap -- surface under
+      // and the module's own defenses -- duplicate-member smuggling, the depth cap -- surface under
       // a generic code no webauthn/* consumer can switch on.
       tooDeep: "webauthn/bad-metadata-blob", duplicateMember: "webauthn/bad-metadata-blob",
       badInput: "webauthn/bad-metadata-blob", label: "the metadata BLOB header",
@@ -449,7 +449,7 @@ function _verifyMetadataBlob(blob, opts) {
 // anchors through this same walk while keeping the verdict its own callers already handle. A second copy
 // of the walk is not merely duplication: the anchor-stripping rule is subtle (a terminal
 // certificate that IS the anchor is identified by subject name AND public key, which is what
-// recognises a cross-signed root), and a copy that got it slightly differently would refuse a valid
+// recognizes a cross-signed root), and a copy that got it slightly differently would refuse a valid
 // chain in one place and accept a self-validated one in another.
 function _chainToAnchor(chain, anchors, at, what, code) {
   var subject = what || "metadata BLOB certificate chain";
@@ -502,18 +502,18 @@ function _chainToAnchor(chain, anchors, at, what, code) {
 function _staleAfter(nextUpdate) {
   var d = rfc3339.parseDate(nextUpdate, function (c, m) { return _err("webauthn/bad-metadata-blob", m); },
     "webauthn/bad-metadata-blob", "the metadata BLOB nextUpdate");
-  return d.getTime() + constants.TIME.days(1);
+  return guard.time.instantOf(d) + constants.TIME.days(1);
 }
 
 // A verified result is a plain object the caller may hold for as long as it likes, so its freshness
 // has to be re-established every time it decides something, not only when it was parsed. A
 // catalogue fetched before its nextUpdate and reused a month later would otherwise keep authorizing
 // an authenticator whose status reports have since revoked it, which is precisely what nextUpdate
-// exists to prevent. The caller's original allowStale decision is carried on the result and honoured
+// exists to prevent. The caller's original allowStale decision is carried on the result and honored
 // here, so opting out stays opted out and never silently reappears at the point of use.
 function assertFresh(metadata, at, label) {
   if (!metadata || metadata.allowStale === true || typeof metadata.nextUpdate !== "string") return;
-  var atMs = at instanceof Date ? at.getTime() : NaN;
+  var atMs = guard.time.isDate(at) ? guard.time.instantOf(at) : NaN;
   var limit = _staleAfter(metadata.nextUpdate);
   if (!isFinite(atMs) || !isFinite(limit)) return;
   if (atMs >= limit) {
@@ -547,7 +547,7 @@ function _parsePayload(seg, at, opts) {
     throw _err("webauthn/metadata-rollback", "the metadata BLOB no " + payload.no + " does not exceed the previously held " + opts.previousNo);
   }
   var staleAfter = _staleAfter(payload.nextUpdate);
-  var atMs = at.getTime();
+  var atMs = guard.time.instantOf(at);
   // An unusable comparison instant must not read as "fresh": without this, a NaN date makes every
   // comparison false and the staleness check silently passes.
   //
@@ -696,7 +696,7 @@ function metadataFor(metadata, identifier) {
   return null;
 }
 
-// The options metadataAnchors recognises. Null-prototype for the same reason every other
+// The options metadataAnchors recognizes. Null-prototype for the same reason every other
 // caller-keyed table in this namespace is: a supplied key must not resolve to an inherited member.
 var _ANCHOR_OPTS = Object.assign(Object.create(null), { metadata: 1, time: 1, certificate: 1 });
 
@@ -791,7 +791,7 @@ function _reportInForceAt(report, atMs) {
   // parseDate throws and never returns an Invalid Date, so d is finite; atMs was isFinite-
   // checked by the caller before this runs.
   // allow:nan-date-comparison-unguarded -- both operands are source-validated, as described above.
-  return d.getTime() <= atMs;
+  return guard.time.instantOf(d) <= atMs;
 }
 
 function statusDenied(entry, metadata, leaf, at) {
@@ -817,7 +817,7 @@ function statusDenied(entry, metadata, leaf, at) {
   // after the time it asks about. When every dated report is still in the future, the answer is
   // that none of them is in force, not that all of them are.
   var isDated = function (r) { return r && typeof r.effectiveDate === "string" && rfc3339.isValidDate(r.effectiveDate); };
-  var atMs = (at instanceof Date && isFinite(at.getTime())) ? at.getTime() : null;
+  var atMs = (guard.time.isDate(at) && isFinite(guard.time.instantOf(at))) ? guard.time.instantOf(at) : null;
   if (atMs !== null) {
     reports = reports.filter(function (r) { return !isDated(r) || _reportInForceAt(r, atMs); });
   }
@@ -846,13 +846,13 @@ function statusDenied(entry, metadata, leaf, at) {
     if (s === null) return false;
     // Scope was settled above, so anything still here applies to this authenticator.
     if (DISQUALIFYING[s]) return true;
-    // An unrecognised status is IGNORED for the gate unless the caller opted in: the specification
+    // An unrecognized status is IGNORED for the gate unless the caller opted in: the specification
     // requires a verifier not to fail on a status value it does not know.
     return rejectUnknown && !_KNOWN_STATUS[s];
   });
 }
 
-// Status values this library recognises as non-disqualifying, so `rejectUnknownStatus` can tell an
+// Status values this library recognizes as non-disqualifying, so `rejectUnknownStatus` can tell an
 // unknown value from a known-good one.
 var _KNOWN_STATUS = Object.assign(Object.create(null), {
   NOT_FIDO_CERTIFIED: 1, SELF_ASSERTION_SUBMITTED: 1, FIDO_CERTIFIED: 1, FIDO_CERTIFIED_L1: 1,