@blamejs/pki 0.6.22 → 0.6.24

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.24 — 2026-09-02
+
+A caller option of an unexpected type now yields the module's typed error, not a native TypeError.
+
+### Fixed
+
+- An option of an unexpected type passed to a build, sign, export, or enrollment verb (a BigInt, an object with no primitive form, or one whose Symbol.toPrimitive throws) is reported as the module's typed bad-input error instead of a native TypeError leaking from a diagnostic string, a lookup-table key, a Date conversion, or a numeric coercion. This covers the timestamp, OCSP, CMP, CMC, SCEP, EST, ACME, PKCS#12, S/MIME, attribute-certificate, HPKE, Certificate Transparency, and Sigstore APIs.
+
+## v0.6.23 — 2026-09-01
+
+The SCEP client can carry a PKIOperation over HTTP GET for a CA that does not support POST.
+
+### Added
+
+- pki.scep.enroll / renew / getCert / getCrl accept httpMethod: "POST" (default) or "GET". Under "GET" the client sends the PKIOperation message as GET SCEPPATH?operation=PKIOperation&message=<base64-CMS> with no body (RFC 8894 sec. 4.1), for a CA that does not advertise POST support. POST stays the default and the recommended transport; a bad httpMethod is refused with scep/bad-input.
+
 ## v0.6.22 — 2026-09-01
 
 pki.acme.client gains scheduleRenewal, the RFC 9773 auto-sleeping certificate-renewal loop.

package/README.md

@@ -222,7 +222,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.schema.cmp` | CMP messages (RFC 9810): the header (version, sender and recipient including the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` and `bodyBytes` slices an external verifier reconstructs the protected part from. The CMP-before-OCSP dispatch order is enforced Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csrattrs` | EST CSR Attributes (`CsrAttrs`, RFC 8951 §3.5 / RFC 9908) — the `AttrOrOID` items a server sends to shape an enrollment: bare OIDs, attributes with raw values, and decoded views of the RFC 9908 meaningful types (extension requests, EC and RSA key-type conventions, the certification-request-info template). Unknown types are surfaced raw; structure and the RFC 9908 semantic MUSTs are fail-closed — `parse` |
 | `pki.est` | Enrollment over Secure Transport (RFC 7030 / 8951 / 9908 / 7616). The client verbs `cacerts`, `simpleenroll`, `simplereenroll`, `serverkeygen`, `csrattrs`, and `fullcmc` drive the RFC 7030 flow over `pki.transport` (inject your own via `opts.transport`, or take the fail-closed default): HTTPS only, an explicit trust anchor required, same-origin redirects followed while a downgrade or loop is refused, a 202 Retry-After surfaced but never slept, HTTP Basic or Digest (RFC 7616, SHA-256 / SHA-512-256; MD5 and no-qop refused by default) answered only after the server is authenticated, and the issued certificate chosen by public-key match. `serverkeygen` requests a server-generated key, cleartext or an opaque CMS EnvelopedData, with encryption bound to the CSR's key-identifier attribute over a confidentiality-bearing cipher. `csrattrs` fetches the CA's RFC 9908 attributes policy. `fullcmc` (§4.3) carries a CMC Full PKI Request and reduces the CA's answer through `pki.cmc.verify` to one terminal outcome, refusing a response that fails to echo the transaction and nonce the request carried, or that covers a key the request never asked for; a certs-only reply to a bound request is refused rather than read as an issuance. Under the verbs sit the transport-agnostic codecs they compose: the RFC 8951 base64 transfer codec (which ignores Content-Transfer-Encoding), the `multipart/mixed` splitter, the certs-only and serverkeygen response validators over CMS, the enroll-attribute builders, and the HTTP response classifier — `transferDecode`/`transferEncode`, `parseCertsOnly`, `splitMultipartMixed`, `parseServerKeygenResponse`, `findIssuedCert`, `classifyResponse`, `paths`, and the builders |
-| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a request: a `PKCSReq` or `RenewalReq` wraps a PKCS#10 certification request, whose own proof-of-possession it verifies first; a `CertPoll` wraps an IssuerAndSubject naming the issuing CA and the request subject; and a `GetCert` or `GetCRL` wraps an IssuerAndSerialNumber naming a certificate by its issuer and a positive serial of at most 20 octets. It encrypts the messageData to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `build` also issues the CA-side `CertRep` response (§3.3.2): a SUCCESS envelopes a certs-only SignedData of the issued certificate (or the CRL for a GetCRL) to the requester and signs it under the CA key, while a FAILURE (carrying a `failInfo`) or a PENDING omits the pkcsPKIEnvelope and is signed detached, each echoing the request's senderNonce as `recipientNonce`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, `CertPoll`, `GetCert`, `GetCRL`, or `CertRep` back (a messageType outside the RFC 8894 registry is refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `getNextCACert(baseUrl, opts)`, `enroll(baseUrl, opts)`, `renew(baseUrl, opts)`, `getCert(baseUrl, opts)`, and `getCrl(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, `getNextCACert` fetches the CA's next (rollover) certificate and verifies the SignedData response against the current CA certificate (`caCertificate`) before returning it, refusing a response signed by any other key, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and poll a PENDING response with CertPoll requests until the CA answers or a bounded poll-count and total-wait budget is spent. `getCert` and `getCrl` retrieve an already-issued certificate or a CA CRL by issuer and serial number, authenticated the same way; RFC 8894 §2.6, §2.7, and §3.3.4 recommend these queries only where HTTP certificate-store access (RFC 4387), LDAP, or a CRL distribution point is unavailable, so prefer those where a CA offers them. GET-carried PKIOperation and HTTP proxy authentication are not yet built — `build`, `parse`, `parseCapabilities`, `getCACaps`, `getCACert`, `getNextCACert`, `enroll`, `renew`, `getCert`, `getCrl` |
+| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a request: a `PKCSReq` or `RenewalReq` wraps a PKCS#10 certification request, whose own proof-of-possession it verifies first; a `CertPoll` wraps an IssuerAndSubject naming the issuing CA and the request subject; and a `GetCert` or `GetCRL` wraps an IssuerAndSerialNumber naming a certificate by its issuer and a positive serial of at most 20 octets. It encrypts the messageData to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `build` also issues the CA-side `CertRep` response (§3.3.2): a SUCCESS envelopes a certs-only SignedData of the issued certificate (or the CRL for a GetCRL) to the requester and signs it under the CA key, while a FAILURE (carrying a `failInfo`) or a PENDING omits the pkcsPKIEnvelope and is signed detached, each echoing the request's senderNonce as `recipientNonce`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, `CertPoll`, `GetCert`, `GetCRL`, or `CertRep` back (a messageType outside the RFC 8894 registry is refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `getNextCACert(baseUrl, opts)`, `enroll(baseUrl, opts)`, `renew(baseUrl, opts)`, `getCert(baseUrl, opts)`, and `getCrl(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, `getNextCACert` fetches the CA's next (rollover) certificate and verifies the SignedData response against the current CA certificate (`caCertificate`) before returning it, refusing a response signed by any other key, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and poll a PENDING response with CertPoll requests until the CA answers or a bounded poll-count and total-wait budget is spent. `getCert` and `getCrl` retrieve an already-issued certificate or a CA CRL by issuer and serial number, authenticated the same way; RFC 8894 §2.6, §2.7, and §3.3.4 recommend these queries only where HTTP certificate-store access (RFC 4387), LDAP, or a CRL distribution point is unavailable, so prefer those where a CA offers them. A PKIOperation goes over HTTP POST by default; `httpMethod: "GET"` carries it base64-encoded in the URL query for a legacy CA that accepts only GET (RFC 8894 §4.1). HTTP proxy authentication is not yet built — `build`, `parse`, `parseCapabilities`, `getCACaps`, `getCACert`, `getNextCACert`, `enroll`, `renew`, `getCert`, `getCrl` |
 | `pki.transport` | The shared, fail-closed `node:https` transport the enrollment clients drive. `pki.transport.https(defaults)` returns a `transport(request) → { status, headers, body, tls }`, where `tls` carries the negotiated `protocol`, `cipher`, and raw `peerCertificate`. This is the toolkit's only socket choke point: an explicit trust anchor (or an opt-in to the system store) is required, `rejectUnauthorized` is always on, TLS is floored at 1.2, the response body is capped while it streams, and a stalled socket times out. The EST, ACME, and CMP clients reuse it verbatim. If you inject your own transport, return `tls` too: `pki.est.serverkeygen` asserts the negotiated cipher can protect the delivered private key, and a transport that reports no cipher is trusted rather than refused, so omitting the field silently skips that check — `https` |
 | `pki.jose` | Flattened JWS (RFC 7515) and JWK thumbprints (RFC 7638). `sign` and `verify` run a Flattened JWS against declarative profiles (ACME outer, EAB inner, keyChange inner) that carry the required and forbidden header rules as data. `base64url` is the strict RFC 4648 §5 codec, rejecting padding, non-alphabet characters, and non-canonical trailing bits. `parseJson` is a bounded reader that refuses duplicate members at any depth. `thumbprint` is the RFC 7638 / 8037 / 9964 canonical digest. The algorithm registry binds each `alg` to its key type (ES/RS/PS/EdDSA/ML-DSA), leaving no code path for `alg:none`, an RS256→HS256 key confusion, or an all-zero ECDSA signature; `assertPublicJwk` refuses a JWK carrying private material, so an exported private key is never published. `opts.key` names the key a message must be signed under and governs: where the profile also permits an embedded header `jwk`, the two must be the same key — compared as RFC 7638 thumbprints, so member order cannot make equal keys differ — and a disagreement is refused rather than resolved in the message's favor. `keySource` reports which key answered, since a signature checked against a key you named is a different claim from one checked against the key the message carried — `sign`, `verify`, `base64url`, `parseJson`, `thumbprint`, `assertPublicJwk` |
 | `pki.acme` | ACME (RFC 8555 / 8737 / 8738 / 9773). `client(directoryUrl, opts)` is a stateful client driving a live CA directory over `pki.transport`: `newAccount`, `newOrder`, `newAuthz`, `getOrder`, `getAuthorization`, `getChallenge`, `respondToChallenge`, `finalize`, `pollOrder`, `pollAuthorization`, and `downloadCertificate` walk the issuance flow, with `newAuthz` pre-authorizing a single identifier (§7.4.1) and `downloadCertificate` binding the issued certificate to the order — its key, its identifiers, or both; at least one is required by default and the result reports `boundToKey` / `boundToIdentifiers` — before choosing among alternate chains (`Link rel="alternate"`, §7.4.2, via a `selectChain` predicate bounded by `maxAlternates`). `revokeCert` (account-key or certificate-key signed), `keyChange`, `updateAccount` (change the account contacts, §7.3.2), `listOrders` (the account's orders list, following the §7.1.2.1 `Link rel="next"` pagination bounded by a page cap and confined to the orders origin), `deactivateAccount`, `deactivateAuthorization`, `renewalInfo` (ARI), `renewalWindow` (the RFC 9773 §4.2/4.3 renewal decision), and `scheduleRenewal` (the §4.1 auto-sleeping renewal loop that sleeps until the selected instant and refetches until it is time to renew, stopping at the certificate's notAfter) complete the lifecycle. Every URL is HTTPS only, an explicit trust anchor is required, each request carries a fresh single-use nonce with a bounded badNonce retry (and, when `opts.resignKeys` supplies caller-approved alternative account-key algorithms, a bounded RFC 8555 §6.2 badSignatureAlgorithm re-sign that the CA's advertised list can only filter, never widen, so it cannot force a weaker algorithm), reads are POST-as-GET, polling is bounded and sleeps on a Retry-After via an injectable sleeper capped by a poll count and a total-wait budget, and every response body is size-capped. The transport is injectable via `opts.transport`. Over the message layer it composes resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, the request builders (newAccount with External Account Binding, newOrder with `replaces`, finalize with a CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns and ip identifier validators, and the ARI certID with serial sign-padding preserved — `client`, `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |

package/lib/acme.js

@@ -432,11 +432,11 @@ var TRANSITIONS = intrinsic.assign(intrinsic.create(null), {
  *   pki.acme.assertTransition("order", "pending", "ready");   // ok
  */
 function assertTransition(kind, from, to) {
-  var table = TRANSITIONS[kind];
-  if (!table) throw E("acme/bad-input", "unknown resource kind " + JSON.stringify(kind));
+  var table = TRANSITIONS[guard.text.keyOf(kind)];
+  if (!table) throw E("acme/bad-input", "unknown resource kind " + guard.text.showValue(kind));
   if (from === to) return;
-  var allowed = _hasOwn(table, from) ? table[from] : null;
-  if (!allowed || allowed.indexOf(to) === -1) throw E("acme/bad-transition", "illegal " + kind + " transition " + JSON.stringify(from) + " -> " + JSON.stringify(to) + " (RFC 8555 sec. 7.1.6)");
+  var allowed = _hasOwn(table, guard.text.keyOf(from)) ? table[guard.text.keyOf(from)] : null;
+  if (!allowed || allowed.indexOf(to) === -1) throw E("acme/bad-transition", "illegal " + kind + " transition " + guard.text.showValue(from) + " -> " + guard.text.showValue(to) + " (RFC 8555 sec. 7.1.6)");
 }
 
 
@@ -500,7 +500,7 @@ function validateProblem(obj) {
 function validate(kind, obj) {
   if (kind === "problem") return validateProblem(obj);
   if (kind === "renewalInfo") return validateRenewalInfo(obj);
-  if (!SPECS[kind]) throw E("acme/bad-input", "unknown ACME object kind " + JSON.stringify(kind));
+  if (!SPECS[guard.text.keyOf(kind)]) throw E("acme/bad-input", "unknown ACME object kind " + guard.text.showValue(kind));
   return _validate(kind, obj);
 }
 
@@ -720,7 +720,7 @@ async function verifyTlsAlpn01(certDer, token, accountJwk, identifier) {
     var sanIp = _ipBytesToText(entry.value);
     if (sanIp === null || sanIp !== identifier.value) throw E("acme/bad-tlsalpn", "the iPAddress SAN does not match the ip identifier (RFC 8738 sec. 6)");
   } else {
-    throw E("acme/bad-tlsalpn", "unsupported tls-alpn-01 identifier type " + JSON.stringify(identifier.type));
+    throw E("acme/bad-tlsalpn", "unsupported tls-alpn-01 identifier type " + guard.text.showValue(identifier.type));
   }
 }
 
@@ -846,7 +846,7 @@ async function externalAccountBinding(o) {
   jose.assertPublicJwk(o.accountJwk);
   if (!_isString(o.kid)) throw E("acme/bad-input", "externalAccountBinding requires the CA-issued kid");
   var alg = o.alg || "HS256";
-  if (!_HMAC_HASH[alg]) throw E("acme/bad-input", "an EAB inner JWS must use an HS* MAC algorithm (sec. 7.3.4), not " + JSON.stringify(alg));
+  if (!_HMAC_HASH[guard.text.keyOf(alg)]) throw E("acme/bad-input", "an EAB inner JWS must use an HS* MAC algorithm (sec. 7.3.4), not " + guard.text.showValue(alg));
   var key = o.macKey;
   if (Buffer.isBuffer(key)) {
     try { key = await subtle.importKey("raw", key, { name: "HMAC", hash: _HMAC_HASH[alg] }, false, ["sign"]); }
@@ -934,7 +934,7 @@ async function _jwkToSpki(jwk) {
   else if (jwk.kty === "RSA") importAlg = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
   else if (jwk.kty === "OKP") importAlg = { name: jwk.crv };
   else if (jwk.kty === "AKP") importAlg = { name: jwk.alg };
-  else throw E("acme/bad-key", "unsupported account key type " + JSON.stringify(jwk && jwk.kty));
+  else throw E("acme/bad-key", "unsupported account key type " + guard.text.showValue(jwk && jwk.kty));
   var key;
   try { key = await subtle.importKey("jwk", jwk, importAlg, true, []); }
   catch (e) { throw E("acme/bad-key", "the account key JWK could not be imported to derive its SubjectPublicKeyInfo", e); }

package/lib/attrcert-sign.js

@@ -61,7 +61,7 @@ var EXT_META = {
 };
 var REQUIRED_CRITICALITY = {};
 Object.keys(EXT_META).forEach(function (k) { REQUIRED_CRITICALITY[O(EXT_META[k].name)] = EXT_META[k].critical; });
-var CLASSLIST_BIT = { unmarked: 0, unclassified: 1, restricted: 2, confidential: 3, secret: 4, topSecret: 5 };
+var CLASSLIST_BIT = intrinsic.assign(intrinsic.create(null), { unmarked: 0, unclassified: 1, restricted: 2, confidential: 3, secret: 4, topSecret: 5 });
 
 var _tbsNameBytes = pkiBuild.tbsNameField;
 function _parseCert(cert, what) {
@@ -92,10 +92,10 @@ function _issuerSerialContent(is) {
   }
   return Buffer.concat(parts);
 }
-var ODT_CODE = { publicKey: 0, publicKeyCert: 1 };
+var ODT_CODE = intrinsic.assign(intrinsic.create(null), { publicKey: 0, publicKeyCert: 1 });
 function _objectDigestInfoContent(odi) {
   if (!odi || typeof odi !== "object" || Buffer.isBuffer(odi)) throw _err("attrcert/bad-input", "objectDigestInfo must be an object");
-  var code = ODT_CODE[odi.digestedObjectType];
+  var code = ODT_CODE[guard.text.keyOf(odi.digestedObjectType)];
   if (code == null) throw _err("attrcert/bad-input", "objectDigestInfo.digestedObjectType must be 'publicKey' or 'publicKeyCert' (otherObjectTypes is forbidden, RFC 5755 sec. 7.3)");
   if (!Buffer.isBuffer(odi.objectDigest)) throw _err("attrcert/bad-input", "objectDigestInfo.objectDigest must be a Buffer (the whole-octet digest)");
   var algName = odi.digestAlgorithm;
@@ -152,8 +152,8 @@ function _encodeClearance(cl) {
   if (cl.classList != null) {
     if (!Array.isArray(cl.classList)) throw _err("attrcert/bad-input", "clearance.classList must be an array of class names");
     var positions = cl.classList.map(function (n) {
-      var pos = CLASSLIST_BIT[n];
-      if (pos == null) throw _err("attrcert/bad-input", "unknown clearance class " + JSON.stringify(n));
+      var pos = CLASSLIST_BIT[guard.text.keyOf(n)];
+      if (pos == null) throw _err("attrcert/bad-input", "unknown clearance class " + guard.text.showValue(n));
       return pos;
     });
     var isDefault = positions.length === 1 && positions[0] === CLASSLIST_BIT.unclassified;
@@ -219,7 +219,7 @@ function _encodeSeqOfTargets(targets) {
 function _attrSpec(names, tag, label) {
   if (!Array.isArray(names)) throw _err("attrcert/bad-input", "aaControls." + label + " must be an array of attribute-type OIDs");
   var oids = names.map(function (n) {
-    try { return b.oid(O(n) || n); } catch (e) { throw _err("attrcert/bad-input", "aaControls." + label + " contains an invalid object identifier " + JSON.stringify(n), e); }
+    try { return b.oid(O(n) || n); } catch (e) { throw _err("attrcert/bad-input", "aaControls." + label + " contains an invalid object identifier " + guard.text.showValue(n), e); }
   });
   return b.contextConstructed(tag, Buffer.concat(oids));
 }

package/lib/cmc-build.js

@@ -59,7 +59,7 @@ function makeIdAllocator() {
   var next = 1;
   function assertValid(requested, what) {
     if (typeof requested !== "number" || !Number.isInteger(requested) || requested < 0 || requested > 4294967295) {
-      throw E("cmc/bad-input", "a bodyPartID must be an integer in 0..4294967295, got " + requested + " (" + what + ")");
+      throw E("cmc/bad-input", "a bodyPartID must be an integer in 0..4294967295, got " + guard.text.showValue(requested) + " (" + what + ")");
     }
     if (requested === 0) {
       throw E("cmc/bad-input",

package/lib/cmp-build.js

@@ -145,7 +145,7 @@ function _encodeInfoValue(itav) {
 
 function _encodeInfoTypeAndValue(itav) {
   if (!itav || typeof itav !== "object" || Buffer.isBuffer(itav)) throw _err("cmp/bad-info-value", "an InfoTypeAndValue must be an object { infoType, infoValue? }");
-  if (typeof itav.infoType !== "string" || O(itav.infoType) == null) throw _err("cmp/bad-name", "unknown infoType " + JSON.stringify(itav.infoType));
+  if (typeof itav.infoType !== "string" || O(itav.infoType) == null) throw _err("cmp/bad-name", "unknown infoType " + guard.text.showValue(itav.infoType));
   var children = [b.oid(O(itav.infoType))];
   var val = _encodeInfoValue(itav);
   if (val != null) children.push(val);
@@ -192,7 +192,7 @@ function _reqIdInt(v, code, what) { return guard.range.authoredInteger(v, _err,
 function _encodeFailInfo(names, code) {
   if (!Array.isArray(names)) throw _err(code, "statusInfo.failInfo must be an array of PKIFailureInfo bit names");
   return b.namedBitString(names.map(function (n) {
-    if (typeof n !== "string" || FAIL_INFO_INDEX[n] === undefined) throw _err(code, "unknown PKIFailureInfo bit " + JSON.stringify(n));
+    if (typeof n !== "string" || FAIL_INFO_INDEX[n] === undefined) throw _err(code, "unknown PKIFailureInfo bit " + guard.text.showValue(n));
     return FAIL_INFO_INDEX[n];
   }));
 }
@@ -215,7 +215,7 @@ function _encodeCertStatus(cs, state) {
   ];
   if (cs.statusInfo != null) children.push(_encodePkiStatusInfo(cs.statusInfo, "cmp/bad-cert-status"));
   if (cs.hashAlg != null) {
-    if (typeof cs.hashAlg !== "string" || !CERT_CONF_HASH_ALGS[cs.hashAlg]) throw _err("cmp/bad-name", "certConf hashAlg must be a hash algorithm (sha256 / sha384 / sha512 / sha3-256 / sha3-512 / sha1); got " + JSON.stringify(cs.hashAlg));
+    if (typeof cs.hashAlg !== "string" || !CERT_CONF_HASH_ALGS[cs.hashAlg]) throw _err("cmp/bad-name", "certConf hashAlg must be a hash algorithm (sha256 / sha384 / sha512 / sha3-256 / sha3-512 / sha1); got " + guard.text.showValue(cs.hashAlg));
     children.push(b.explicit(0, _algIdNoParams(cs.hashAlg)));
     state.usesCmp2021 = true;
   }
@@ -266,7 +266,7 @@ function _encodeCrlEntryDetails(spec) {
   guard.identifier.assertKnownKeys(spec, KNOWN_CRL_ENTRY_DETAIL_KEYS, _err, "cmp/bad-rev-req", "unknown crlEntryDetails field ");
   var reason = spec.reason;
   if (reason != null && (typeof reason !== "string" || !_hasOwn(CRL_REASON_BY_NAME, reason))) {
-    throw _err("cmp/bad-rev-req", "unknown CRLReason " + _stringify(reason) + " (RFC 5280 sec. 5.3.1)");
+    throw _err("cmp/bad-rev-req", "unknown CRLReason " + guard.text.showValue(reason) + " (RFC 5280 sec. 5.3.1)");
   }
   var code = reason == null ? 0 : CRL_REASON_BY_NAME[reason];
   return b.sequence([_b.ext(O("reasonCode"), false, b.enumerated(_bigInt(code)))]);
@@ -300,7 +300,8 @@ function buildCrlStatusList(spec) {
   }
   var status = [source], askedInstant = null, asked = spec.thisUpdate;
   if (asked != null) {
-    askedInstant = guard.time.instantOf(asked, _err, "cmp/bad-input", "crlUpdate.thisUpdate");
+    guard.time.assertValid(asked, _err, "cmp/bad-input", "crlUpdate.thisUpdate");
+    askedInstant = guard.time.instantOf(asked);
     _push(status, b.raw(_b.timeDer(new _Date(askedInstant), "crlUpdate.thisUpdate")));
   }
   return {
@@ -484,7 +485,7 @@ function _encodeBody(bodySpec, key, opts) {
   var keys = Object.keys(bodySpec);
   if (keys.length !== 1) throw _err("cmp/bad-input", "message.body must have exactly one arm, got " + keys.length);
   var arm = keys[0];
-  if (!KNOWN_BODY_KEYS[arm]) throw _err("cmp/bad-input", "unknown body arm " + JSON.stringify(arm));
+  if (!KNOWN_BODY_KEYS[guard.text.keyOf(arm)]) throw _err("cmp/bad-input", "unknown body arm " + guard.text.showValue(arm));
   var tag = BODY_TAG[arm], state = { usesCmp2021: false };
 
   if (CRMF_BODY[arm]) {
@@ -574,7 +575,7 @@ function _resolveProtection(opts) {
   var m = opts.mac;
   if (!m || typeof m !== "object" || Buffer.isBuffer(m)) throw _err("cmp/bad-input", "opts.mac must be an object { secret, salt?, iterationCount?, prf?, keyLength? }");
   guard.identifier.assertKnownKeys(m, KNOWN_MAC_KEYS, _err, "cmp/bad-input", "unknown opts.mac field ");
-  if (m.algorithm != null && m.algorithm !== "pbmac1") throw _err("cmp/unsupported-algorithm", "opts.mac.algorithm " + JSON.stringify(m.algorithm) + " is not supported (v1 ships pbmac1; passwordBasedMac is deferred)");
+  if (m.algorithm != null && m.algorithm !== "pbmac1") throw _err("cmp/unsupported-algorithm", "opts.mac.algorithm " + guard.text.showValue(m.algorithm) + " is not supported (v1 ships pbmac1; passwordBasedMac is deferred)");
   var secret = m.secret;
   if (typeof secret !== "string" || !secret) {
     if (!Buffer.isBuffer(secret) || !secret.length) throw _err("cmp/bad-input", "opts.mac.secret must be a non-empty string or Buffer");
@@ -788,7 +789,7 @@ function _transfer(url, message, opts) {
   var der = _cmpMessageDer(message);
   var parsedUrl;
   try { parsedUrl = new URL(String(url)); }
-  catch (e) { throw _err("cmp/bad-url", "the CMP URL did not parse: " + String(url), e); }
+  catch (e) { throw _err("cmp/bad-url", "the CMP URL did not parse: " + guard.text.showValue(url), e); }
   var transport = opts.transport;
   if (!transport) {
     var t = opts.tls || {};
@@ -854,7 +855,7 @@ function wellKnownUrl(base, opts) {
   });
   var u;
   try { u = new URL(String(base)); }
-  catch (e) { throw _err("cmp/bad-url", "the CMP base URL did not parse: " + String(base), e); }
+  catch (e) { throw _err("cmp/bad-url", "the CMP base URL did not parse: " + guard.text.showValue(base), e); }
   if (u.protocol !== "https:" && u.protocol !== "http:") throw _err("cmp/bad-url", "the CMP base URL must be http or https (a well-known URI is authority-rooted over HTTP), got " + u.protocol + ": " + JSON.stringify(String(base)));
   if (u.search || u.hash) throw _err("cmp/bad-url", "the CMP base URL must not carry a query or fragment component (RFC 9811 sec. 3.4)");
   if (_strIndexOf(String(base), "\\") !== -1) throw _err("cmp/bad-url", "the CMP base URL must not contain a backslash (WHATWG rewrites it to a path separator): " + JSON.stringify(String(base)));

package/lib/cmp-session.js

@@ -752,7 +752,7 @@ function session(opts) {
       throw _err("cmp/bad-input", "an ir / cr / kur enrollment must submit certTemplate.publicKey -- a session enrolls a client-generated key (a raVerified keyless request or central key generation is not supported)");
     }
     if (arms[0] !== "p10cr" && armSpec != null && armSpec.pop != null && armSpec.pop.type != null && armSpec.pop.type !== "signature") {
-      throw _err("cmp/bad-input", "a session ir / cr / kur proves possession by signing the CRMF proof of possession; a non-signature POP mode (" + JSON.stringify(armSpec.pop.type) + ") is not supported (RFC 4211 sec. 4)");
+      throw _err("cmp/bad-input", "a session ir / cr / kur proves possession by signing the CRMF proof of possession; a non-signature POP mode (" + guard.text.showValue(armSpec.pop.type) + ") is not supported (RFC 4211 sec. 4)");
     }
     if (isMac && arms[0] !== "p10cr" && (armSpec == null || armSpec.key == null)) {
       throw _err("cmp/bad-input", "a MAC-protected ir / cr / kur must carry the requested key's private half as `key` for the CRMF proof of possession -- a signature session reuses opts.key, but a PBMAC1 session has no signing key, so the request would carry no proof of possession (RFC 4211 sec. 4)");
@@ -829,7 +829,7 @@ function session(opts) {
       throw _err("cmp/bad-input", "revoke(request) names the certificate by EXACTLY ONE of certificate (the certificate itself) or certDetails ({ issuer, serialNumber })");
     }
     if (reasonArg != null && (typeof reasonArg !== "string" || !CRL_REASON_NAMES[reasonArg])) {
-      throw _err("cmp/bad-input", "revoke request.reason must be a CRLReason name (RFC 5280 sec. 5.3.1); got " + JSON.stringify(reasonArg));
+      throw _err("cmp/bad-input", "revoke request.reason must be a CRLReason name (RFC 5280 sec. 5.3.1); got " + guard.text.showValue(reasonArg));
     }
     if (certificateArg != null) {
       var target;

package/lib/cms-encrypt.js

@@ -58,7 +58,7 @@ function _gcmParams(nonce, icvLen) {
 
 function _assertKeyIdentifier(form) {
   if (form != null && form !== "issuerAndSerial" && form !== "issuerAndSerialNumber" && form !== "subjectKeyIdentifier") {
-    throw _err("cms/bad-input", "unsupported keyIdentifier " + JSON.stringify(form) + " (use \"issuerAndSerial\" or \"subjectKeyIdentifier\")");
+    throw _err("cms/bad-input", "unsupported keyIdentifier " + guard.text.showValue(form) + " (use \"issuerAndSerial\" or \"subjectKeyIdentifier\")");
   }
 }
 function _rid(cert, form) {
@@ -92,7 +92,7 @@ function _oaepParams(hashName) {
 async function _buildKtri(cek, cert, opts) {
   _assertKeyUsage(cert, "keyEncipherment", "ktri");
   var hashName = opts.oaepHash || "sha256";
-  if (!OAEP_HASH[hashName]) throw _err("cms/bad-input", "unsupported oaepHash " + JSON.stringify(hashName));
+  if (!OAEP_HASH[guard.text.keyOf(hashName)]) throw _err("cms/bad-input", "unsupported oaepHash " + guard.text.showValue(hashName));
   var pub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: "RSA-OAEP", hash: OAEP_HASH[hashName] }, false, ["encrypt"]);
   var encryptedKey = Buffer.from(await subtle.encrypt({ name: "RSA-OAEP" }, pub, cek));
   var rid = _rid(cert, opts.keyIdentifier);
@@ -283,7 +283,7 @@ function _pwriWrapIv(kek, cek, iv) {
 }
 
 var PRF_HASH = intrinsic.assign(intrinsic.create(null), { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" });
-function _prfHash(prf) { if (!PRF_HASH[prf]) throw _err("cms/bad-input", "unsupported pwri prf " + JSON.stringify(prf)); return PRF_HASH[prf]; }
+function _prfHash(prf) { if (!PRF_HASH[guard.text.keyOf(prf)]) throw _err("cms/bad-input", "unsupported pwri prf " + guard.text.showValue(prf)); return PRF_HASH[guard.text.keyOf(prf)]; }
 
 var _PWRI_KEYS = { password: 1, iterations: 1, prf: 1, salt: 1 };
 var _KEKRI_KEYS = { kek: 1, kekId: 1 };
@@ -385,8 +385,8 @@ function encrypt(content, recipients, opts) {
 async function _encryptImpl(content, recipients, opts) {
   opts = opts || {};
   var algName = opts.contentEncryptionAlgorithm || "aes-256-gcm";
-  var ca = CONTENT_ALGS[algName];
-  if (!ca) throw _err("cms/bad-input", "unsupported contentEncryptionAlgorithm " + JSON.stringify(algName));
+  var ca = CONTENT_ALGS[guard.text.keyOf(algName)];
+  if (!ca) throw _err("cms/bad-input", "unsupported contentEncryptionAlgorithm " + guard.text.showValue(algName));
   guard.identifier.assertKnownKeys(opts, ca.aead ? _ENCRYPT_OPTS_AEAD : _ENCRYPT_OPTS_CBC, _err, "cms/bad-input",
     function (k) {
       return "pki.cms.encrypt has an unknown option " + JSON.stringify(k) +
@@ -577,8 +577,8 @@ async function authenticate(content, recipients, opts) {
     });
   var contentBytes = guard.bytes.view(content, CmsError, "cms/bad-input", "content");
   var macName = opts.macAlgorithm || "hmac-sha256";
-  var mac = MAC_ALGS[macName];
-  if (!mac) throw _err("cms/bad-input", "unsupported macAlgorithm " + JSON.stringify(macName) + " (hmac-sha256/384/512)");
+  var mac = MAC_ALGS[guard.text.keyOf(macName)];
+  if (!mac) throw _err("cms/bad-input", "unsupported macAlgorithm " + guard.text.showValue(macName) + " (hmac-sha256/384/512)");
   if (!Array.isArray(recipients) || !recipients.length) throw _err("cms/bad-input", "at least one recipient is required (RFC 5652 sec. 9.1)");
   var contentType = opts.contentType || "data";
   if (contentType !== "data" && !withAttrs) throw _err("cms/bad-input", "AuthenticatedData with a non-data contentType requires authenticated attributes (RFC 5652 sec. 9.1)");
@@ -594,7 +594,7 @@ async function authenticate(content, recipients, opts) {
     var digestAlgTagged = null, authAttrsDer = null, preimage;
     if (withAttrs) {
       var digestName = opts.digestAlgorithm || mac.node;
-      if (!SUPPORTED_DIGEST[digestName]) throw _err("cms/bad-input", "unsupported digestAlgorithm " + JSON.stringify(digestName) + " (sha256/384/512)");
+      if (!SUPPORTED_DIGEST[guard.text.keyOf(digestName)]) throw _err("cms/bad-input", "unsupported digestAlgorithm " + guard.text.showValue(digestName) + " (sha256/384/512)");
       var mdDigest = nodeCrypto.createHash(digestName).update(contentBytes).digest();
       var pairs = [
         b.sequence([b.oid(O("contentType")), b.setOf([b.oid(O(contentType))])]),

package/lib/crl-sign.js

@@ -55,7 +55,7 @@ var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 var OID_SKI = O("subjectKeyIdentifier");
 
 var CRL_REASON = constants.NAMES.CRL_REASON;
-var REASON_BY_NAME = {};
+var REASON_BY_NAME = intrinsic.create(null);
 Object.keys(CRL_REASON).forEach(function (v) { REASON_BY_NAME[CRL_REASON[v]] = Number(v); });
 
 var KNOWN_CRL_EXT_KEYS = { authorityKeyIdentifier: 1, issuingDistributionPoint: 1, deltaCRLIndicator: 1, freshestCRL: 1, authorityInfoAccess: 1 };
@@ -115,7 +115,7 @@ function _resolveReason(reason, isDelta) {
   var codeNum;
   if (typeof reason === "number") codeNum = reason;
   else if (typeof reason === "string") {
-    if (!_hasOwn(REASON_BY_NAME, reason)) throw _err("crl/bad-reason-code", "unknown CRLReason " + JSON.stringify(reason));
+    if (!_hasOwn(REASON_BY_NAME, guard.text.keyOf(reason))) throw _err("crl/bad-reason-code", "unknown CRLReason " + guard.text.showValue(reason));
     codeNum = REASON_BY_NAME[reason];
   } else throw _err("crl/bad-reason-code", "reason must be a CRLReason name or number");
   if (!_hasOwn(CRL_REASON, String(codeNum))) throw _err("crl/bad-reason-code", "undefined or reserved CRLReason " + codeNum + " (RFC 5280 sec. 5.3.1)");

package/lib/crmf-sign.js

@@ -146,9 +146,9 @@ function _encodeCertId(id) {
   return b.sequence([_b.encodeGeneralName(id.issuer), _b.serialInteger(id.serialNumber)]);
 }
 
-var POPO_PRIVKEY_TAGS = { keyEncipherment: 2, keyAgreement: 3 };
+var POPO_PRIVKEY_TAGS = intrinsic.assign(intrinsic.create(null), { keyEncipherment: 2, keyAgreement: 3 });
 var SUBSEQUENT_MESSAGE = { encrCert: 0n, challengeResp: 1n };
-var DEPRECATED_POPO_METHOD = { thisMessage: "encryptedKey", dhMAC: "agreeMAC" };
+var DEPRECATED_POPO_METHOD = intrinsic.assign(intrinsic.create(null), { thisMessage: "encryptedKey", dhMAC: "agreeMAC" });
 
 function _encKeyWithID(privateKeyDer, identifier) {
   var idNode;
@@ -158,12 +158,12 @@ function _encKeyWithID(privateKeyDer, identifier) {
 }
 
 function _buildPopoPrivKey(pop, mode, template) {
-  var outerTag = POPO_PRIVKEY_TAGS[mode];
+  var outerTag = POPO_PRIVKEY_TAGS[guard.text.keyOf(mode)];
   var method = pop && pop.method;
   if (typeof method !== "string") {
     throw _err("crmf/bad-popo", "a " + mode + " proof of possession requires pop.method ('subsequentMessage' or 'encryptedKey')");
   }
-  if (_hasOwn(DEPRECATED_POPO_METHOD, method)) {
+  if (_hasOwn(DEPRECATED_POPO_METHOD, guard.text.keyOf(method))) {
     throw _err("crmf/bad-popo", "the " + method + " proof of possession is deprecated by RFC 4211 sec. 4.2 in favor of " +
       DEPRECATED_POPO_METHOD[method] + "; a reader still accepts it, a new message should not carry it");
   }
@@ -185,7 +185,7 @@ function _buildPopoPrivKey(pop, mode, template) {
     return b.explicit(outerTag, b.implicit(1, b.integer(SUBSEQUENT_MESSAGE[which])));
   }
   if (method !== "encryptedKey") {
-    throw _err("crmf/bad-popo", "unsupported POPOPrivKey method " + JSON.stringify(method) +
+    throw _err("crmf/bad-popo", "unsupported POPOPrivKey method " + guard.text.showValue(method) +
       " (supported: 'subsequentMessage', 'encryptedKey')");
   }
   return _buildEncryptedKeyPop(pop, outerTag, template);
@@ -287,7 +287,7 @@ function _bareEnvelopedData(contentInfoDer) {
 }
 
 function _assertPopArmKeys(pop, mode) {
-  var arm = _hasOwn(POPO_PRIVKEY_TAGS, mode) ? pop.method : mode;
+  var arm = _hasOwn(POPO_PRIVKEY_TAGS, guard.text.keyOf(mode)) ? pop.method : mode;
   var allowed = (typeof arm === "string" && _hasOwn(POP_KEYS_BY_ARM, arm))
     ? POP_KEYS_BY_ARM[arm]
     : { type: 1, method: 1 };
@@ -306,9 +306,9 @@ function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts) {
     if (!(pop && pop.raVerified === true)) throw _err("crmf/bad-popo", "raVerified must be explicitly opted into (pop: { type: 'raVerified', raVerified: true }) -- a requester does not normally assert it (RFC 4211 sec. 4)");
     return b.implicit(0, b.nullValue());
   }
-  if (_hasOwn(POPO_PRIVKEY_TAGS, mode)) return _buildPopoPrivKey(pop, mode, template);
+  if (_hasOwn(POPO_PRIVKEY_TAGS, guard.text.keyOf(mode))) return _buildPopoPrivKey(pop, mode, template);
   if (mode !== "signature") {
-    throw _err("crmf/bad-popo", "unsupported proof-of-possession type " + JSON.stringify(mode) +
+    throw _err("crmf/bad-popo", "unsupported proof-of-possession type " + guard.text.showValue(mode) +
       " (supported: 'signature', 'raVerified', 'keyEncipherment', 'keyAgreement')");
   }
   if (signingKey == null) throw _err("crmf/bad-input", "a signature proof of possession requires the requester's private key");

package/lib/ct.js

@@ -259,7 +259,7 @@ function reconstructSignedData(entry, sct) {
   entry = entry || {};
   var entryType = entry.entryType;
   if (entryType !== 0 && entryType !== 1) {
-    throw new CtError("ct/bad-entry-type", "entryType must be x509_entry(0) or precert_entry(1), got " + entryType + " (RFC 6962 sec. 3.1)");
+    throw new CtError("ct/bad-entry-type", "entryType must be x509_entry(0) or precert_entry(1), got " + guard.text.showValue(entryType) + " (RFC 6962 sec. 3.1)");
   }
   if (!sct || typeof sct.timestamp !== "bigint" || sct.version !== 0) {
     throw new CtError("ct/bad-input", "reconstructSignedData expects a decoded v1 SCT from parseSctList().scts[]");

package/lib/est.js

@@ -552,7 +552,7 @@ function classifyResponse(status, headers, body, opts) {
   opts = opts || {};
   _knownOpts(opts, CLASSIFY_OPTS, "classifyResponse");
   var op = opts.op;
-  if (op !== undefined && op !== null && CLASSIFIABLE_OPS.indexOf(op) === -1) throw E("est/unsupported-operation", "unrecognized EST operation " + JSON.stringify(op));
+  if (op !== undefined && op !== null && CLASSIFIABLE_OPS.indexOf(op) === -1) throw E("est/unsupported-operation", "unrecognized EST operation " + guard.text.showValue(op));
   var h = {
     "content-type": _ciHeader(headers, "content-type"),
     "retry-after": _ciHeader(headers, "retry-after"),
@@ -912,7 +912,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
 function _client(op, method, baseUrl, body, headers, opts) {
   var base;
   try { base = new URL(String(baseUrl)); }
-  catch (e) { throw E("est/bad-url", "the EST base URL did not parse: " + String(baseUrl), e); }
+  catch (e) { throw E("est/bad-url", "the EST base URL did not parse: " + guard.text.showValue(baseUrl), e); }
   if (base.search || base.hash) throw E("est/bad-url", "the EST base URL must not carry a query or fragment component (RFC 7030 sec. 3.2.2)");
   var url = _parseUrl(paths(baseUrl, { label: opts.label })[op]);
   var transport = opts.transport;

package/lib/guard-text.js

@@ -37,4 +37,17 @@ function decode(input, maxBytes, ErrorClass, spec) {
   throw new ErrorClass(spec.badInput, spec.label + " expects a string or a byte source (Buffer / TypedArray / DataView / ArrayBuffer)");
 }
 
-module.exports = intrinsic.freeze({ decode: decode });
+// @enforced-by behavioral -- a safe error-message formatter has no rename-proof code shape; the RED vector (a BigInt or cyclic caller value renders to a typed error, never a native TypeError out of a raw JSON.stringify) is the guard.
+function showValue(v) {
+  if (typeof v === "string") return intrinsic.stringify(v);
+  if (typeof v === "number" || typeof v === "boolean" || typeof v === "bigint") return intrinsic.String(v);
+  if (v === null) return "null";
+  return "a value of type " + typeof v;
+}
+
+// @enforced-by behavioral -- a coercion-safe property-key narrowing has no rename-proof code shape; the RED vector (a caller value with no primitive coercion, an Object.create(null) or a throwing Symbol.toPrimitive, reaches a table lookup as the typed error, never a native TypeError from the key coercion) is the guard. A string or number passes through; anything else becomes undefined so the lookup misses without coercing the value.
+function keyOf(v) {
+  return typeof v === "string" || typeof v === "number" ? v : undefined;
+}
+
+module.exports = intrinsic.freeze({ decode: decode, showValue: showValue, keyOf: keyOf });

package/lib/guard-time.js

@@ -6,6 +6,7 @@
 var util = { types: require("./guard-intrinsic").types };
 var _freeze = require("./guard-intrinsic").freeze;
 var _isNaN = Number.isNaN;
+var _Date = Date;
 
 var _dateGetTime = require("./guard-intrinsic").uncurry(Date.prototype.getTime);
 
@@ -37,9 +38,17 @@ function isDate(value) {
   return util.types.isDate(value);
 }
 
+// @enforced-by behavioral -- a coercion-safe Date converter has no rename-proof code shape; the RED vector (a caller value with no numeric or string form, a BigInt or a throwing Symbol.toPrimitive, becomes an invalid Date the downstream isNaN check rejects, never a native TypeError out of the Date constructor) is the guard.
+function toDate(value) {
+  if (util.types.isDate(value)) return value;
+  if (typeof value === "string" || typeof value === "number") return new _Date(value);
+  return new _Date(NaN);
+}
+
 module.exports = _freeze({
   assertValid: assertValid,
   instantOf: instantOf,
   isDate: isDate,
+  toDate: toDate,
   within: within,
 });

package/lib/hpke.js

@@ -47,29 +47,29 @@ var HPKE_V1 = Buffer.from("HPKE-v1", "ascii");
 function L(s) { return Buffer.from(s, "ascii"); }
 
 
-var KDFS = {
+var KDFS = intrinsic.assign(intrinsic.create(null), {
   0x0001: { hash: "sha256", Nh: 32 },
   0x0003: { hash: "sha512", Nh: 64 },
-};
-var AEADS = {
+});
+var AEADS = intrinsic.assign(intrinsic.create(null), {
   0x0001: { cipher: "aes-128-gcm", Nk: 16, Nn: 12, Nt: 16 },
   0x0002: { cipher: "aes-256-gcm", Nk: 32, Nn: 12, Nt: 16 },
   0x0003: { cipher: "chacha20-poly1305", Nk: 32, Nn: 12, Nt: 16 },
   0xFFFF: { exportOnly: true, Nn: 12 },
-};
-var KEMS = {
+});
+var KEMS = intrinsic.assign(intrinsic.create(null), {
   0x0010: { kind: "ec", curve: "P-256", nodeCurve: "prime256v1", kdf: 0x0001, Nsecret: 32, Npub: 65 },
   0x0012: { kind: "ec", curve: "P-521", nodeCurve: "secp521r1", kdf: 0x0003, Nsecret: 64, Npub: 133 },
   0x0020: { kind: "okp", curve: "X25519", oid: "2b656e", kdf: 0x0001, Nsecret: 32, Npub: 32 },
   0x0021: { kind: "okp", curve: "X448", oid: "2b656f", kdf: 0x0003, Nsecret: 64, Npub: 56 },
-};
+});
 
 var MODE_BASE = 0x00, MODE_PSK = 0x01, MODE_AUTH = 0x02, MODE_AUTH_PSK = 0x03;
 
-function _idStr(id) { return typeof id === "number" ? "0x" + id.toString(16) : String(id); }
-function _kem(id) { var s = KEMS[id]; if (!s) throw _err("hpke/unknown-suite", "unsupported KEM id " + _idStr(id)); return s; }
-function _kdf(id) { var s = KDFS[id]; if (!s) throw _err("hpke/unknown-suite", "unsupported KDF id " + _idStr(id)); return s; }
-function _aead(id) { var s = AEADS[id]; if (!s) throw _err("hpke/unknown-suite", "unsupported AEAD id " + _idStr(id)); return s; }
+function _idStr(id) { return typeof id === "number" ? "0x" + id.toString(16) : guard.text.showValue(id); }
+function _kem(id) { var s = KEMS[guard.text.keyOf(id)]; if (!s) throw _err("hpke/unknown-suite", "unsupported KEM id " + _idStr(id)); return s; }
+function _kdf(id) { var s = KDFS[guard.text.keyOf(id)]; if (!s) throw _err("hpke/unknown-suite", "unsupported KDF id " + _idStr(id)); return s; }
+function _aead(id) { var s = AEADS[guard.text.keyOf(id)]; if (!s) throw _err("hpke/unknown-suite", "unsupported AEAD id " + _idStr(id)); return s; }
 
 
 function _extract(hash, Nh, salt, ikm) {
@@ -342,7 +342,7 @@ function _mode(opts, keys, who) {
   });
   var mode = (opts.mode == null) ? MODE_BASE : opts.mode;
   if (mode !== MODE_BASE && mode !== MODE_PSK && mode !== MODE_AUTH && mode !== MODE_AUTH_PSK) {
-    throw _err("hpke/unknown-mode", "unsupported HPKE mode " + JSON.stringify(mode) + " (RFC 9180 sec. 5.1 defines base / psk / auth / auth-psk)");
+    throw _err("hpke/unknown-mode", "unsupported HPKE mode " + guard.text.showValue(mode) + " (RFC 9180 sec. 5.1 defines base / psk / auth / auth-psk)");
   }
   return mode;
 }

package/lib/key.js

@@ -97,8 +97,9 @@ async function encrypt(privateKey, password, opts) {
     "`maxIterations` is the decrypt-side cap): ");
   var der = await _toPrivateKeyDer(privateKey);
   try { pkcs8.parse(der); } catch (e) { throw _err("key/bad-input", "the private key is not a well-formed PKCS#8 PrivateKeyInfo", e); }
+  if (opts.cipher != null && typeof opts.cipher !== "string") throw _err("key/bad-input", "unsupported cipher " + guard.text.showValue(opts.cipher) + " (aes-128-cbc / aes-192-cbc / aes-256-cbc)");
   var cipherName = CIPHER_NAME[opts.cipher || "aes-256-cbc"];
-  if (!cipherName) throw _err("key/bad-input", "unsupported cipher " + JSON.stringify(opts.cipher) + " (aes-128-cbc / aes-192-cbc / aes-256-cbc)");
+  if (!cipherName) throw _err("key/bad-input", "unsupported cipher " + guard.text.showValue(opts.cipher) + " (aes-128-cbc / aes-192-cbc / aes-256-cbc)");
   var keyBits = pbes2.CONTENT_KEYBITS[O(cipherName)];
   var prf = opts.prf || "hmacWithSHA256";
   var prfNode = pbes2.prfNodeByName(prf, _err, "key");
@@ -218,7 +219,7 @@ async function export_(key, opts) {
   var fmt = opts.format || "der";
   if (fmt === "der") return der;
   if (fmt === "pem") return pkix.pemEncode(der, opts.label || defaultLabel, PemError);
-  throw _err("key/bad-input", "unsupported format " + JSON.stringify(opts.format) + " (der / pem)");
+  throw _err("key/bad-input", "unsupported format " + guard.text.showValue(opts.format) + " (der / pem)");
 }
 
 /**

package/lib/ocsp.js

@@ -45,8 +45,8 @@ function O(name) { return oid.byName(name); }
 function _err(code, message, cause) { return new OcspError(code, message, cause); }
 function _signE(kind, message, cause) { return new OcspError("ocsp/" + kind, message, cause); }
 
-var HASH_WC = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
-var REASON_CODE = {};
+var HASH_WC = Object.assign(Object.create(null), { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
+var REASON_CODE = Object.create(null);
 Object.keys(constants.NAMES.CRL_REASON).forEach(function (k) { REASON_CODE[constants.NAMES.CRL_REASON[k]] = parseInt(k, 10); });
 var OID_OCSP_NONCE = O("ocspNonce");
 var OID_OCSP_BASIC = O("ocspBasic");
@@ -84,8 +84,8 @@ function _assertNonce(nonceBytes) {
   }
 }
 function _buildCertID(cert, issuer, hashName) {
-  var wc = HASH_WC[hashName];
-  if (!wc) throw _err("ocsp/bad-input", "unsupported CertID hashAlgorithm " + JSON.stringify(hashName) + " (sha1 / sha256 / sha384 / sha512)");
+  var wc = HASH_WC[guard.text.keyOf(hashName)];
+  if (!wc) throw _err("ocsp/bad-input", "unsupported CertID hashAlgorithm " + guard.text.showValue(hashName) + " (sha1 / sha256 / sha384 / sha512)");
   return Promise.all([
     _digest(wc, issuer.subject.bytes),
     _digest(wc, _keyValue(issuer.subjectPublicKeyInfo.bytes)),
@@ -299,8 +299,8 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
 }
 function _asDate(d) {
   if (d == null) return null;
-  var dt = guard.time.isDate(d) ? d : new Date(d);
-  if (isNaN(guard.time.instantOf(dt))) throw _err("ocsp/bad-input", "an invalid date value " + JSON.stringify(d));
+  var dt = guard.time.toDate(d);
+  if (isNaN(guard.time.instantOf(dt))) throw _err("ocsp/bad-input", "an invalid date value " + guard.text.showValue(d));
   return dt;
 }
 function _snapshotSignerKey(key, owned) {
@@ -341,8 +341,8 @@ function _certStatusNode(status, opts) {
   if (typeof status === "object" && status.revoked != null) {
     var ri = [b.generalizedTime(_asDate(status.revoked))];
     if (status.revocationReason != null) {
-      var code = typeof status.revocationReason === "number" ? status.revocationReason : REASON_CODE[status.revocationReason];
-      if (code == null) throw _err("ocsp/bad-input", "unknown revocationReason " + JSON.stringify(status.revocationReason));
+      var code = typeof status.revocationReason === "number" ? status.revocationReason : REASON_CODE[guard.text.keyOf(status.revocationReason)];
+      if (code == null) throw _err("ocsp/bad-input", "unknown revocationReason " + guard.text.showValue(status.revocationReason));
       ri.push(b.explicit(0, b.enumerated(BigInt(code))));
     }
     return b.contextConstructed(1, Buffer.concat(ri));
@@ -365,9 +365,9 @@ function _certStatusNode(status, opts) {
  * @example
  *   var der = pki.ocsp.buildErrorResponse("tryLater");
  */
-var ERROR_STATUS = { malformedRequest: 1, internalError: 2, tryLater: 3, sigRequired: 5, unauthorized: 6 };
+var ERROR_STATUS = Object.assign(Object.create(null), { malformedRequest: 1, internalError: 2, tryLater: 3, sigRequired: 5, unauthorized: 6 });
 function buildErrorResponse(status) {
-  var code = ERROR_STATUS[status];
+  var code = ERROR_STATUS[guard.text.keyOf(status)];
   if (code == null) throw _err("ocsp/bad-input", "an error responseStatus must be one of " + Object.keys(ERROR_STATUS).join(" / "));
   return b.sequence([b.enumerated(BigInt(code))]);
 }

package/lib/path-validate.js

@@ -1851,7 +1851,7 @@ function resolvePurposeOpts(opts) {
       if (typeof p !== "string" || p.length === 0) throw E("path/bad-input", "validate: opts.requiredEku entries must be non-empty strings");
       if (_startsWithDigit(p)) return guard.identifier.assertCanonicalOid(p, E, "path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p));
       var dotted = oid.byName(p);
-      if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
+      if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + guard.text.showValue(p) + " is not a registered OID name");
       return dotted;
     });
   }
@@ -1864,7 +1864,7 @@ function resolvePurposeOpts(opts) {
       var cpDotted = guard.identifier.assertCanonicalOid(opts.checkPurpose, E, "path/bad-input", "validate: opts.checkPurpose");
       checkPurpose = oid.name(cpDotted) || cpDotted;
     } else {
-      if (typeof oid.byName(opts.checkPurpose) !== "string") throw E("path/bad-input", "validate: opts.checkPurpose " + JSON.stringify(opts.checkPurpose) + " is not a registered OID name");
+      if (typeof oid.byName(opts.checkPurpose) !== "string") throw E("path/bad-input", "validate: opts.checkPurpose " + guard.text.showValue(opts.checkPurpose) + " is not a registered OID name");
       checkPurpose = opts.checkPurpose;
     }
   }

package/lib/pbes2.js

@@ -43,7 +43,7 @@ function assertSalt(salt, E, prefix) {
   return salt;
 }
 
-function prfNodeByName(prf, E, prefix) { if (!PRF_NODE_BY_NAME[prf]) throw E(prefix + "/bad-input", "unsupported prf " + JSON.stringify(prf)); return PRF_NODE_BY_NAME[prf]; }
+function prfNodeByName(prf, E, prefix) { if (typeof prf !== "string" || !PRF_NODE_BY_NAME[prf]) throw E(prefix + "/bad-input", "unsupported prf " + guard.text.showValue(prf)); return PRF_NODE_BY_NAME[prf]; }
 function prfNodeByOid(oidStr, E, prefix) { if (!PRF_NODE_BY_OID[oidStr]) throw E(prefix + "/unsupported-algorithm", "unsupported PBKDF2 prf " + oidStr); return PRF_NODE_BY_OID[oidStr]; }
 
 function pbkdf2ParamsSeq(salt, iterations, prf) {

package/lib/pkcs12-build.js

@@ -210,9 +210,9 @@ function _safeBag(bagName, bagValueDer, bag) {
 
 function _buildBag(bag, opts, depth) {
   if (!bag || typeof bag !== "object") throw _err("pkcs12/bad-input", "each bag must be an object with a type");
-  if (intrinsic.hasOwn(_BAG_KEYS_BY_TYPE, bag.type)) {
+  if (intrinsic.hasOwn(_BAG_KEYS_BY_TYPE, guard.text.keyOf(bag.type))) {
     guard.identifier.assertKnownKeys(bag, _BAG_KEYS_BY_TYPE[bag.type], _err, "pkcs12/bad-input", function (k) {
-      return "unknown field " + JSON.stringify(k) + " on a " + JSON.stringify(bag.type) +
+      return "unknown field " + JSON.stringify(k) + " on a " + guard.text.showValue(bag.type) +
         " bag; that field is not read for this bag type";
     });
   }
@@ -253,7 +253,7 @@ function _buildBag(bag, opts, depth) {
       return _safeBag("safeContentsBag", _buildSafeContents(bag.nested || [], opts, depth + 1), bag);
     }
     default:
-      throw _err("pkcs12/bad-input", "unknown bag type " + JSON.stringify(bag.type) + " (key / shroudedKey / cert / crl / secret / safeContents)");
+      throw _err("pkcs12/bad-input", "unknown bag type " + guard.text.showValue(bag.type) + " (key / shroudedKey / cert / crl / secret / safeContents)");
   }
 }
 
@@ -279,8 +279,9 @@ function _pbeOpts(enc) {
     return "unknown encrypt field " + JSON.stringify(k) +
       "; the PBE descriptor is { password?, cipher?, salt?, iterations?, prf? }";
   });
+  if (enc.cipher != null && typeof enc.cipher !== "string") throw _err("pkcs12/bad-input", "unsupported PBES2 cipher " + guard.text.showValue(enc.cipher) + " (aes-128-cbc / aes-192-cbc / aes-256-cbc)");
   var cipher = CIPHER_NAME[enc.cipher || "aes-256-cbc"];
-  if (!cipher) throw _err("pkcs12/bad-input", "unsupported PBES2 cipher " + JSON.stringify(enc.cipher) + " (aes-128-cbc / aes-192-cbc / aes-256-cbc)");
+  if (!cipher) throw _err("pkcs12/bad-input", "unsupported PBES2 cipher " + guard.text.showValue(enc.cipher) + " (aes-128-cbc / aes-192-cbc / aes-256-cbc)");
   return {
     cipher: cipher,
     salt: enc.salt != null ? _bytes(enc.salt, "encrypt salt") : undefined,
@@ -314,7 +315,7 @@ async function _buildAuthSafeElement(sc, opts) {
       if (!r || typeof r !== "object" || r.cert == null) throw _err("pkcs12/bad-input", "a public-key privacy recipient must be a certificate recipient { cert } (a password or KEK recipient is not public-key privacy and cannot be reopened by pkcs12.open)");
     });
     var alg = sc.contentEncryptionAlgorithm || "aes-256-cbc";
-    if (alg !== "aes-128-cbc" && alg !== "aes-192-cbc" && alg !== "aes-256-cbc") throw _err("pkcs12/bad-input", "a public-key privacy safe requires an AES-CBC content cipher (aes-128|192|256-cbc), not " + JSON.stringify(alg) + " -- RFC 7292 sec. 4.1 admits only id-envelopedData, not GCM/AuthEnvelopedData");
+    if (alg !== "aes-128-cbc" && alg !== "aes-192-cbc" && alg !== "aes-256-cbc") throw _err("pkcs12/bad-input", "a public-key privacy safe requires an AES-CBC content cipher (aes-128|192|256-cbc), not " + guard.text.showValue(alg) + " -- RFC 7292 sec. 4.1 admits only id-envelopedData, not GCM/AuthEnvelopedData");
     var envCi = await cms.encrypt(safeContentsDer, sc.recipients, { contentEncryptionAlgorithm: alg, contentType: "data" });
     return b.raw(envCi);
   }
@@ -342,8 +343,8 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
   if (salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw _err("pkcs12/bad-input", "the MAC salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
 
   if (algorithm === "hmac") {
-    var node = DIGEST_NAME[hash];
-    if (!node || !P12_KDF_UV[node]) throw _err("pkcs12/unsupported-algorithm", "unsupported classic MAC hash " + JSON.stringify(hash) + " (sha1 / sha256 / sha384 / sha512)");
+    var node = DIGEST_NAME[guard.text.keyOf(hash)];
+    if (!node || !P12_KDF_UV[node]) throw _err("pkcs12/unsupported-algorithm", "unsupported classic MAC hash " + guard.text.showValue(hash) + " (sha1 / sha256 / sha384 / sha512)");
     var iter = _assertMacIter(macOpts.iterations == null ? DEFAULT_MAC_ITER : macOpts.iterations, CLASSIC_MAC_MAX_ITERATIONS);
     var macPw = _p12PasswordOwned(password);
     var macKey = _p12Kdf(node, 3, macPw.bytes, salt, iter, P12_KDF_UV[node].u);
@@ -357,7 +358,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
     }
   }
   if (algorithm === "pbmac1") {
-    var prf = PBMAC1_PRF[hash];
+    var prf = PBMAC1_PRF[guard.text.keyOf(hash)];
     if (!prf) throw _err("pkcs12/unsupported-algorithm", "PBMAC1 requires a SHA-256/384/512 digest (RFC 9579 sec. 5/7 forbids a <= 160-bit digest, e.g. SHA-1)");
     var iter2 = _assertMacIter(macOpts.iterations == null ? DEFAULT_PBMAC1_ITER : macOpts.iterations, C.LIMITS.PBKDF2_MAX_ITERATIONS);
     var keyLen = macOpts.keyLength != null ? macOpts.keyLength : prf.keyLen;
@@ -370,7 +371,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
     var digestInfo2 = b.sequence([pbes2.pbmac1AlgId(desc), b.octetString(mac)]);
     return b.sequence([digestInfo2, b.octetString(salt), b.integer(BigInt(iter2))]);
   }
-  throw _err("pkcs12/bad-input", "opts.mac.algorithm must be 'hmac' or 'pbmac1', got " + JSON.stringify(algorithm));
+  throw _err("pkcs12/bad-input", "opts.mac.algorithm must be 'hmac' or 'pbmac1', got " + guard.text.showValue(algorithm));
 }
 
 
@@ -468,7 +469,7 @@ async function _build(spec, opts) {
     if (typeof opts.integrity !== "object" || Array.isArray(opts.integrity)) throw _err("pkcs12/bad-input", "opts.integrity must be an object { mode, signer|signers, ... }");
     guard.identifier.assertKnownKeys(opts.integrity, _INTEGRITY_OPTS, _err, "pkcs12/bad-input", "opts.integrity has an unknown option ");
     if (opts.integrity.mode !== "public-key") {
-      throw _err("pkcs12/bad-integrity-mode", "opts.integrity.mode must be \"public-key\" (the only mode it selects); omit opts.integrity for password integrity, got " + JSON.stringify(opts.integrity.mode));
+      throw _err("pkcs12/bad-integrity-mode", "opts.integrity.mode must be \"public-key\" (the only mode it selects); omit opts.integrity for password integrity, got " + guard.text.showValue(opts.integrity.mode));
     }
   }
   var pubKey = opts.integrity != null;

package/lib/pki-build.js

@@ -242,10 +242,10 @@ function _isDottedOid(s) {
 
 var b = asn1.build;
 
-var KU_BIT = {
+var KU_BIT = intrinsic.assign(intrinsic.create(null), {
   digitalSignature: 0, nonRepudiation: 1, contentCommitment: 1, keyEncipherment: 2,
   dataEncipherment: 3, keyAgreement: 4, keyCertSign: 5, cRLSign: 6, encipherOnly: 7, decipherOnly: 8,
-};
+});
 
 function reqDenseArrayImpl(list, what, E, code) {
   if (!_isArray(list)) throw E(code, what + " must be an array");
@@ -284,7 +284,7 @@ function makeBuilder(ctx) {
   function encodeAtv(attrName, value) {
     if (value == null || value === "") throw E("bad-name", "the " + attrName + " attribute value must be a non-empty string");
     var typeOid = O(attrName);
-    if (typeOid == null) throw E("bad-name", "unknown distinguished-name attribute " + JSON.stringify(attrName));
+    if (typeOid == null) throw E("bad-name", "unknown distinguished-name attribute " + guard.text.showValue(attrName));
     var valueTlv;
     try { valueTlv = atvString(attrName, value); }
     catch (e) { if (e instanceof ErrorClass) throw e; throw E("bad-name", "the " + attrName + " value has characters invalid for its string type", e); }
@@ -365,7 +365,7 @@ function makeBuilder(ctx) {
         guard.der.tlv(v.value, E, "bad-input", "otherName `value`");
         var typeIdDer;
         try { typeIdDer = b.oid(v.typeId); }
-        catch (e) { throw E("bad-input", "invalid otherName type-id OID " + JSON.stringify(v.typeId) + " (violates the X.660 arc bounds)", e); }
+        catch (e) { throw E("bad-input", "invalid otherName type-id OID " + guard.text.showValue(v.typeId) + " (violates the X.660 arc bounds)", e); }
         return b.contextConstructed(0, Buffer.concat([typeIdDer, b.explicit(0, v.value)]));
       default: throw E("bad-input", "unsupported GeneralName form " + JSON.stringify(k) + " (supported: rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, directoryName, otherName)");
     }
@@ -374,8 +374,8 @@ function makeBuilder(ctx) {
   function extKeyUsage(names) {
     if (!_isArray(names) || !names.length) throw E("bad-input", "keyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
     var positions = names.map(function (n) {
-      var pos = KU_BIT[n];
-      if (pos == null) throw E("bad-input", "unknown keyUsage bit " + JSON.stringify(n));
+      var pos = KU_BIT[guard.text.keyOf(n)];
+      if (pos == null) throw E("bad-input", "unknown keyUsage bit " + guard.text.showValue(n));
       return pos;
     });
     return b.namedBitString(positions);
@@ -385,10 +385,10 @@ function makeBuilder(ctx) {
     if (dotted != null) return dotted;
     if (typeof n === "string" && _isDottedOid(n)) {
       try { b.oid(n); }
-      catch (e) { throw E("bad-input", "invalid " + label + " OID " + JSON.stringify(n) + " (violates the X.660 arc bounds)", e); }
+      catch (e) { throw E("bad-input", "invalid " + label + " OID " + guard.text.showValue(n) + " (violates the X.660 arc bounds)", e); }
       return n;
     }
-    throw E("bad-input", "unknown " + label + " " + JSON.stringify(n) + " (expected a registered name or a dotted-decimal OID)");
+    throw E("bad-input", "unknown " + label + " " + guard.text.showValue(n) + " (expected a registered name or a dotted-decimal OID)");
   }
   function extExtKeyUsage(names) {
     if (!_isArray(names) || !names.length) throw E("bad-input", "extendedKeyUsage must list at least one KeyPurposeId");
@@ -424,7 +424,7 @@ function makeBuilder(ctx) {
     var seen = {};
     return b.sequence(names.map(function (n) {
       var pOid = _resolveOid(n, "certificate policy");
-      if (seen[pOid]) throw E("bad-input", "duplicate certificate policy " + JSON.stringify(n) + " (RFC 5280 sec. 4.2.1.4)");
+      if (seen[pOid]) throw E("bad-input", "duplicate certificate policy " + guard.text.showValue(n) + " (RFC 5280 sec. 4.2.1.4)");
       seen[pOid] = true;
       return b.sequence([b.oid(pOid)]);
     }));

package/lib/scep.js

@@ -60,6 +60,7 @@ var _defaultSleep = require("./sleep").sleep;
 var nodeCrypto = require("node:crypto");
 
 function _err(code, msg, cause) { return new ScepError(code, msg, cause); }
+function _showValue(v) { return guard.text.showValue(v); }
 
 var _KU_NS = pkix.makeNS("scep", ScepError, oid);
 
@@ -256,8 +257,8 @@ function _captureRecipientKey(rk) {
  */
 async function build(spec) {
   spec = guard.identifier.optionsObject(spec, _err, "scep/bad-input", "pki.scep.build spec");
-  var mtCode = MESSAGE_TYPE[spec.messageType];
-  if (mtCode == null) throw _err("scep/bad-message-type", "unknown messageType " + JSON.stringify(spec.messageType) + " (RFC 8894 sec. 3.2.1.2)");
+  var mtCode = MESSAGE_TYPE[guard.text.keyOf(spec.messageType)];
+  if (mtCode == null) throw _err("scep/bad-message-type", "unknown messageType " + _showValue(spec.messageType) + " (RFC 8894 sec. 3.2.1.2)");
   if (spec.messageType === "CertRep") {
     guard.identifier.assertKnownKeys(spec, _CERTREP_KEYS, _err, "scep/bad-input", "pki.scep.build (CertRep) has an unknown option: ");
     return await _buildCertRep(spec);
@@ -312,9 +313,9 @@ var _CERTREP_KEYS = { messageType: 1, signer: 1, transactionId: 1, senderNonce:
 
 async function _buildCertRep(spec) {
   if (spec.signer == null || typeof spec.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
-  if (typeof spec.pkiStatus !== "string") throw _err("scep/bad-input", "a CertRep pkiStatus must be SUCCESS, FAILURE, or PENDING (RFC 8894 sec. 3.2.1.3), got " + JSON.stringify(spec.pkiStatus));
+  if (typeof spec.pkiStatus !== "string") throw _err("scep/bad-input", "a CertRep pkiStatus must be SUCCESS, FAILURE, or PENDING (RFC 8894 sec. 3.2.1.3), got " + _showValue(spec.pkiStatus));
   var statusCode = PKI_STATUS[spec.pkiStatus];
-  if (statusCode == null) throw _err("scep/bad-input", "a CertRep pkiStatus must be SUCCESS, FAILURE, or PENDING (RFC 8894 sec. 3.2.1.3), got " + JSON.stringify(spec.pkiStatus));
+  if (statusCode == null) throw _err("scep/bad-input", "a CertRep pkiStatus must be SUCCESS, FAILURE, or PENDING (RFC 8894 sec. 3.2.1.3), got " + _showValue(spec.pkiStatus));
   var txnId = _transactionId(spec.transactionId);
   if (spec.recipientNonce == null) throw _err("scep/bad-input", "a CertRep must echo the request's senderNonce as recipientNonce (RFC 8894 sec. 3.2.1.5)");
   var recipientNonce = _nonce(spec.recipientNonce, "recipientNonce");
@@ -354,8 +355,8 @@ async function _buildCertRep(spec) {
       throw _err("scep/bad-input", "a " + spec.pkiStatus + " CertRep must omit certificates, crls, and recipient: the pkcsPKIEnvelope is omitted (RFC 8894 sec. 3.3.2." + (spec.pkiStatus === "FAILURE" ? "2" : "3") + ")");
     }
     if (spec.pkiStatus === "FAILURE") {
-      var failCode = FAIL_INFO[spec.failInfo];
-      if (failCode == null) throw _err("scep/bad-input", "a FAILURE CertRep must carry a failInfo of badAlg / badMessageCheck / badRequest / badTime / badCertId (RFC 8894 sec. 3.2.1.4), got " + JSON.stringify(spec.failInfo));
+      var failCode = FAIL_INFO[guard.text.keyOf(spec.failInfo)];
+      if (failCode == null) throw _err("scep/bad-input", "a FAILURE CertRep must carry a failInfo of badAlg / badMessageCheck / badRequest / badTime / badCertId (RFC 8894 sec. 3.2.1.4), got " + _showValue(spec.failInfo));
       attrs.push(_attr("scepFailInfo", b.printable(failCode)));
       if (spec.failInfoText != null) attrs.push(_attr("scepFailInfoText", b.utf8(String(spec.failInfoText))));
     }
@@ -395,7 +396,7 @@ function _serialToInteger(s) {
   else if (typeof s === "number") { if (!Number.isSafeInteger(s)) throw _err("scep/bad-input", "serialNumber as a number must be a safe integer"); n = BigInt(s); }
   else if (typeof s === "string" && s.length > 0) {
     var t = (s.slice(0, 2) === "0x" || s.slice(0, 2) === "0X") ? s.slice(2) : s;
-    try { n = BigInt("0x" + t); } catch (_e) { throw _err("scep/bad-input", "serialNumber must be a hex string, a non-negative safe integer, or a BigInt: " + JSON.stringify(s)); }
+    try { n = BigInt("0x" + t); } catch (_e) { throw _err("scep/bad-input", "serialNumber must be a hex string, a non-negative safe integer, or a BigInt: " + _showValue(s)); }
   } else {
     throw _err("scep/bad-input", "serialNumber must be a hex string, a non-negative safe integer, or a BigInt");
   }
@@ -662,12 +663,26 @@ function _redirectTarget(current, location, method, allowCrossOrigin) {
 function _scepUrl(baseUrl, operation) {
   var url;
   try { url = new URL(String(baseUrl)); }
-  catch (e) { throw _err("scep/bad-url", "the SCEP base URL did not parse: " + String(baseUrl), e); }
+  catch (e) { throw _err("scep/bad-url", "the SCEP base URL did not parse: " + _showValue(baseUrl), e); }
   if (url.protocol !== "http:" && url.protocol !== "https:") throw _err("scep/bad-url", "the SCEP base URL must be http or https, got " + url.protocol);
   if (url.hash) throw _err("scep/bad-url", "the SCEP base URL must not carry a fragment");
   url.searchParams.set("operation", operation);
   return url;
 }
+function _pkiMethod(opts) {
+  var m = opts.httpMethod;
+  if (m == null) return "POST";
+  if (m !== "POST" && m !== "GET") throw _err("scep/bad-input", "httpMethod must be \"POST\" or \"GET\" (RFC 8894 sec. 4.1), got " + _showValue(m));
+  return m;
+}
+function _pkiRequest(method, opUrl, reqMsg, clientOpts) {
+  if (method === "GET") {
+    var getUrl = new URL(opUrl.href);
+    getUrl.searchParams.set("message", Buffer.from(reqMsg).toString("base64"));
+    return _client("GET", getUrl, null, {}, clientOpts);
+  }
+  return _client("POST", opUrl, reqMsg, { "content-type": CT_PKI_MESSAGE }, clientOpts);
+}
 function _drive(method, url, body, headers, opts, transport, budgets) {
   var redirects = 0, curMethod = method, curBody = body, initialOrigin = url.origin;
   var tlsBase = _tlsForRequest(opts);
@@ -816,7 +831,7 @@ function findIssuedCert(certs, wantSpki) {
 function _normalizeFingerprint(fp, algName) {
   var algorithm = _foldLower(String(algName == null ? "sha256" : algName));
   try { nodeCrypto.createHash(algorithm); }
-  catch (_e) { throw _err("scep/bad-input", "fingerprintAlgorithm " + JSON.stringify(algorithm) + " is not an available hash"); }
+  catch (_e) { throw _err("scep/bad-input", "fingerprintAlgorithm " + _showValue(algorithm) + " is not an available hash"); }
   var value;
   if (Buffer.isBuffer(fp)) value = Buffer.from(fp);
   else if (typeof fp === "string") {
@@ -991,7 +1006,7 @@ async function _pollForIssuance(ctx) {
     var sn = nodeCrypto.randomBytes(16);
     lastNonce = sn;
     var certPoll = await build({ messageType: "CertPoll", requestSubject: ctx.csrSubject, issuer: issuerName, recipient: ctx.caCert, signer: ctx.signer, transactionId: ctx.transactionId, senderNonce: sn });
-    res = await _client("POST", ctx.postUrl, certPoll, { "content-type": CT_PKI_MESSAGE }, ctx.clientOpts);
+    res = await _pkiRequest(ctx.httpMethod, ctx.postUrl, certPoll, ctx.clientOpts);
     var body = _requireOk(res, [CT_PKI_MESSAGE], "PKIOperation");
     var rep = await parse(body, { signerCert: ctx.signerCert, expectedSenderNonce: sn, recipientKey: ctx.recipientKey });
     var d = _dispatchCertRep(rep, ctx.transactionId, ctx.spki);
@@ -1019,6 +1034,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
     maxResponseBytes: opts.maxResponseBytes,
   };
   var postUrl = _scepUrl(baseUrl, "PKIOperation");
+  var httpMethod = _pkiMethod(opts);
   var csrView = guard.bytes.snapshotSource(opts.csr, ScepError, "scep/bad-input", "the csr");
   var spki, csrSubject;
   try { var _pcsr = schemaCsr.parse(csrView); spki = _pcsr.subjectPublicKeyInfo; csrSubject = _pcsr.subject.bytes; }
@@ -1030,14 +1046,14 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var senderNonce = nodeCrypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
   var reqMsg = await build({ messageType: messageType, messageData: csrView, recipient: caCert, signer: signer, transactionId: transactionId, senderNonce: senderNonce });
-  var res = await _client("POST", postUrl, reqMsg, { "content-type": CT_PKI_MESSAGE }, clientOpts);
+  var res = await _pkiRequest(httpMethod, postUrl, reqMsg, clientOpts);
   var body = _requireOk(res, [CT_PKI_MESSAGE], "PKIOperation");
   var rep = await parse(body, { signerCert: signerCert, expectedSenderNonce: senderNonce, recipientKey: recipientKey });
   var d = _dispatchCertRep(rep, transactionId, spki);
   if (!d.pending) return d.result;
   if (pollCount <= 0) return { status: "PENDING", transactionId: rep.transactionId, senderNonce: senderNonce };
   return _pollForIssuance({
-    firstResponse: res, firstSenderNonce: senderNonce, postUrl: postUrl, clientOpts: clientOpts,
+    firstResponse: res, firstSenderNonce: senderNonce, postUrl: postUrl, httpMethod: httpMethod, clientOpts: clientOpts,
     caCert: caCert, csrSubject: csrSubject, issuerCert: issuerCert, signer: signer, signerCert: signerCert, recipientKey: recipientKey,
     spki: spki, transactionId: transactionId, pollCount: pollCount, maxTotalWait: maxTotalWait,
     sleep: sleep, onRetryAfter: onRetryAfter,
@@ -1079,6 +1095,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
  *   - `maxTotalWait` -- the total Retry-After sleep budget in seconds across all polls (default the Retry-After horizon).
  *   - `sleep` -- an injectable sleeper `(ms) -> Promise` for the Retry-After wait (default a real timer).
  *   - `onRetryAfter` -- an optional observer `(delaySeconds) -> void` called before each poll sleep.
+ *   - `httpMethod` -- `"POST"` (default) or `"GET"`. RFC 8894 sec. 4.1 sends the PKIOperation message over POST; `"GET"` carries it base64-encoded in the URL `message` query for a legacy CA that lacks POST.
  *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
  * @example
  *   // requires: scepCsr, caCertDer, clientCertDer, clientKeyPkcs8, scepTransport
@@ -1158,8 +1175,9 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
   var clientOpts = { transport: opts.transport, tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes };
   var senderNonce = nodeCrypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
+  var httpMethod = _pkiMethod(opts);
   var reqMsg = await build(Object.assign({ messageType: messageType, recipient: caCert, signer: signer, transactionId: transactionId, senderNonce: senderNonce }, want.buildSpec));
-  var res = await _client("POST", _scepUrl(baseUrl, "PKIOperation"), reqMsg, { "content-type": CT_PKI_MESSAGE }, clientOpts);
+  var res = await _pkiRequest(httpMethod, _scepUrl(baseUrl, "PKIOperation"), reqMsg, clientOpts);
   var body = _requireOk(res, [CT_PKI_MESSAGE], "PKIOperation");
   var rep = await parse(body, { signerCert: signerCert, expectedSenderNonce: senderNonce, recipientKey: recipientKey });
   _dispatchQueryRep(rep, transactionId);
@@ -1192,6 +1210,7 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
  *   - `recipientKey` -- `{ cert, key }`, the RSA key the CA encrypts the response to, to decrypt the CertRep.
  *   - `responderCert` -- the certificate to authenticate the CA response signature against (defaults to `caCert`).
  *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded).
+ *   - `httpMethod` -- `"POST"` (default) or `"GET"`. RFC 8894 sec. 4.1 sends the PKIOperation message over POST; `"GET"` carries it base64-encoded in the URL `message` query for a legacy CA that lacks POST.
  *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
  * @example
  *   // requires: clientCertDer, caCertDer, clientKeyPkcs8, scepTransport
@@ -1240,6 +1259,7 @@ async function getCert(baseUrl, opts) {
  *   - `recipientKey` -- `{ cert, key }`, the RSA key the CA encrypts the response to.
  *   - `responderCert` -- the certificate to authenticate the CA response against (defaults to `caCert`).
  *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded).
+ *   - `httpMethod` -- `"POST"` (default) or `"GET"`. RFC 8894 sec. 4.1 sends the PKIOperation message over POST; `"GET"` carries it base64-encoded in the URL `message` query for a legacy CA that lacks POST.
  *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
  * @example
  *   // requires: clientCertDer, caCertDer, clientKeyPkcs8, scepTransport
@@ -1268,8 +1288,8 @@ function _withKeys(extra) { var o = {}, k; for (k in _TRANSPORT_KEYS) o[k] = 1;
 var _CACAPS_KEYS = _withKeys({ expectSCEPStandard: 1, requireStrongProfile: 1 });
 var _CACERT_KEYS = _withKeys({ expectedFingerprint: 1, fingerprintAlgorithm: 1 });
 var _NEXTCACERT_KEYS = _withKeys({ caCertificate: 1 });
-var _ENROLL_KEYS = _withKeys({ csr: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, issuerCert: 1, transactionId: 1, pollCount: 1, maxTotalWait: 1, sleep: 1, onRetryAfter: 1 });
-var _QUERY_KEYS = _withKeys({ certificate: 1, issuer: 1, serialNumber: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, transactionId: 1 });
+var _ENROLL_KEYS = _withKeys({ csr: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, issuerCert: 1, transactionId: 1, pollCount: 1, maxTotalWait: 1, sleep: 1, onRetryAfter: 1, httpMethod: 1 });
+var _QUERY_KEYS = _withKeys({ certificate: 1, issuer: 1, serialNumber: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, transactionId: 1, httpMethod: 1 });
 
 module.exports = {
   build: build,

package/lib/sigstore.js

@@ -164,7 +164,7 @@ function parseBundle(input) {
   if (!obj || typeof obj !== "object" || Array.isArray(obj)) throw _err("sigstore/bad-bundle", "bundle must be a JSON object");
   var mt = obj.mediaType;
   if (!_isBundleMediaType(mt)) {
-    throw _err("sigstore/bad-bundle-version", "unsupported or unknown bundle media type: " + (mt === undefined ? "(none)" : mt));
+    throw _err("sigstore/bad-bundle-version", "unsupported or unknown bundle media type: " + (mt === undefined ? "(none)" : guard.text.showValue(mt)));
   }
   if (!obj.verificationMaterial || typeof obj.verificationMaterial !== "object") {
     throw _err("sigstore/bad-bundle", "bundle is missing verificationMaterial");

package/lib/smime.js

@@ -127,7 +127,7 @@ function _applyHcp(name, value, hcp) {
 
 function _outerHeaderList(list, mode, hcp) {
   var policy = hcp == null ? "hcp_baseline" : hcp;
-  if (policy !== "hcp_baseline" && policy !== "hcp_no_confidentiality") throw _err("smime/bad-input", "unknown opts.hcp policy " + JSON.stringify(hcp) + " (only \"hcp_baseline\" or \"hcp_no_confidentiality\")");
+  if (policy !== "hcp_baseline" && policy !== "hcp_no_confidentiality") throw _err("smime/bad-input", "unknown opts.hcp policy " + guard.text.showValue(hcp) + " (only \"hcp_baseline\" or \"hcp_no_confidentiality\")");
   var out = [];
   list.forEach(function (h) {
     if (mode === "cipher") {
@@ -143,8 +143,10 @@ function _outerHeaderList(list, mode, hcp) {
 function _protectedInnerEntity(content, opts, mode, hpList, outerList) {
   if (opts.entity) throw _err("smime/bad-input", "opts.entity is not supported with protectHeaders -- pass raw content + opts.contentType");
   var raw = guard.bytes.view(content, SmimeError, "smime/bad-input", "content");
-  if (opts.contentType != null && mime.hasParam(String(opts.contentType), "hp")) throw _err("smime/bad-input", "opts.contentType must not set the hp parameter -- header protection sets it (hp=" + JSON.stringify(mode) + ")");
-  var ct = (opts.contentType || "text/plain; charset=utf-8") + "; hp=\"" + mode + "\"";
+  var cty = opts.contentType;
+  if (cty != null && typeof cty !== "string") throw _err("smime/bad-input", "opts.contentType must be a string, got " + guard.text.showValue(cty));
+  if (cty != null && mime.hasParam(cty, "hp")) throw _err("smime/bad-input", "opts.contentType must not set the hp parameter -- header protection sets it (hp=" + guard.text.showValue(mode) + ")");
+  var ct = (cty || "text/plain; charset=utf-8") + "; hp=\"" + mode + "\"";
   var fields = [{ name: "Content-Type", value: ct }, { name: "Content-Transfer-Encoding", value: _is7bit(raw) ? "7bit" : "8bit" }];
   hpList.forEach(function (h) { fields.push(h); });
   if (mode === "cipher") {

package/lib/tls-cert-compress.js

@@ -104,7 +104,7 @@ function _resolveAllowed(opts) {
   return list.map(function (a) {
     var name = (typeof a === "number") ? ALG_BY_NUMBER[a] : a;
     if (typeof name !== "string" || SUPPORTED.indexOf(name) === -1) {
-      throw _err("tls/bad-input", "opts.allowedAlgorithms names an algorithm this toolkit cannot decompress: " + JSON.stringify(a));
+      throw _err("tls/bad-input", "opts.allowedAlgorithms names an algorithm this toolkit cannot decompress: " + guard.text.showValue(a));
     }
     return name;
   });

package/lib/tsp-sign.js

@@ -60,7 +60,7 @@ function _moreEstablished(candidate, current) {
 }
 
 function _hashAlgId(name) {
-  if (!NODE_DIGEST[name]) throw _err("tsp/unsupported-algorithm", "unsupported hash algorithm " + JSON.stringify(name));
+  if (!NODE_DIGEST[guard.text.keyOf(name)]) throw _err("tsp/unsupported-algorithm", "unsupported hash algorithm " + guard.text.showValue(name));
   return b.sequence([b.oid(O(name)), b.nullValue()]);
 }
 function _policy(p) {
@@ -153,7 +153,7 @@ function _sign(messageImprint, tsa, opts) {
     });
   }
   var mi = messageImprint || {};
-  if (!mi.hashAlgorithm || !NODE_DIGEST[mi.hashAlgorithm]) throw _err("tsp/unsupported-algorithm", "messageImprint.hashAlgorithm must be a supported hash name");
+  if (!mi.hashAlgorithm || !NODE_DIGEST[guard.text.keyOf(mi.hashAlgorithm)]) throw _err("tsp/unsupported-algorithm", "messageImprint.hashAlgorithm must be a supported hash name");
   if (!guard.bytes.isByteSource(mi.hashedMessage)) throw _err("tsp/bad-input", "messageImprint.hashedMessage must be a BufferSource");
   var _signHmLen = guard.bytes.source(mi.hashedMessage, TspError, "tsp/bad-input", "messageImprint.hashedMessage").length;
   if (_signHmLen !== HASH_LEN[mi.hashAlgorithm]) throw _err("tsp/bad-input", "messageImprint.hashedMessage length (" + _signHmLen + ") does not match the " + mi.hashAlgorithm + " digest length (" + HASH_LEN[mi.hashAlgorithm] + ")");
@@ -162,7 +162,7 @@ function _sign(messageImprint, tsa, opts) {
 
   var certDer = _certDer(tsa && tsa.cert);
   var certHashAlg = opts.certHashAlgorithm || "sha256";
-  if (!NODE_DIGEST[certHashAlg]) throw _err("tsp/unsupported-algorithm", "unsupported certHashAlgorithm " + JSON.stringify(certHashAlg));
+  if (!NODE_DIGEST[guard.text.keyOf(certHashAlg)]) throw _err("tsp/unsupported-algorithm", "unsupported certHashAlgorithm " + guard.text.showValue(certHashAlg));
 
   var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(guard.bytes.source(mi.hashedMessage, TspError, "tsp/bad-input", "messageImprint.hashedMessage"))]);
   if (opts.genTime != null) guard.time.assertValid(opts.genTime, _err, "tsp/bad-input", "genTime");
@@ -192,29 +192,32 @@ function _accuracy(a) {
     return "unknown accuracy field " + JSON.stringify(k) + "; Accuracy is { seconds?, millis?, micros? }";
   });
   var f = [];
-  if (a.seconds != null) {
-    var s = Number(a.seconds);
+  var sec = a.seconds, mil = a.millis, mic = a.micros;
+  if (sec != null) {
+    if (typeof sec !== "number" && typeof sec !== "bigint") throw _err("tsp/bad-input", "Accuracy seconds must be a non-negative integer, got " + guard.text.showValue(sec));
+    var s = intrinsic.Number(sec);
     if (!Number.isInteger(s) || s < 0 || s > 0x7fffffff) throw _err("tsp/bad-input", "Accuracy seconds must be a non-negative integer");
     f.push(b.integer(BigInt(s)));
   }
-  if (a.millis != null) f.push(b.contextPrimitive(0, _subMilliBytes(a.millis, "millis")));
-  if (a.micros != null) f.push(b.contextPrimitive(1, _subMilliBytes(a.micros, "micros")));
+  if (mil != null) f.push(b.contextPrimitive(0, _subMilliBytes(mil, "millis")));
+  if (mic != null) f.push(b.contextPrimitive(1, _subMilliBytes(mic, "micros")));
   return b.sequence(f);
 }
 function _subMilliBytes(n, label) {
-  var v = Number(n);
+  if (typeof n !== "number" && typeof n !== "bigint") throw _err("tsp/bad-input", "Accuracy " + label + " must be an integer in 1..999 (RFC 3161 sec. 2.4.2), got " + guard.text.showValue(n));
+  var v = intrinsic.Number(n);
   if (!Number.isInteger(v) || v < 1 || v > 999) throw _err("tsp/bad-input", "Accuracy " + label + " must be an integer in 1..999 (RFC 3161 sec. 2.4.2)");
   return b.integer(BigInt(v)).subarray(2);
 }
 
 
-var FAILINFO_BIT = { badAlg: 0, badRequest: 2, badDataFormat: 5, timeNotAvailable: 14, unacceptedPolicy: 15, unacceptedExtension: 16, addInfoNotAvailable: 17, systemFailure: 25 };
+var FAILINFO_BIT = intrinsic.assign(intrinsic.create(null), { badAlg: 0, badRequest: 2, badDataFormat: 5, timeNotAvailable: 14, unacceptedPolicy: 15, unacceptedExtension: 16, addInfoNotAvailable: 17, systemFailure: 25 });
 
 function _failInfoBits(names) {
   if (!Array.isArray(names)) throw _err("tsp/bad-input", "failInfo must be an array of PKIFailureInfo names");
   var idxs = names.map(function (n) {
-    var i = FAILINFO_BIT[n];
-    if (i == null) throw _err("tsp/bad-input", "unknown PKIFailureInfo name " + JSON.stringify(n) + " (RFC 3161 sec. 2.4.2)");
+    var i = FAILINFO_BIT[guard.text.keyOf(n)];
+    if (i == null) throw _err("tsp/bad-input", "unknown PKIFailureInfo name " + guard.text.showValue(n) + " (RFC 3161 sec. 2.4.2)");
     return i;
   });
   return b.namedBitString(idxs);
@@ -227,7 +230,7 @@ function _tokenDer(t) {
 }
 
 function _assertImprint(mi) {
-  if (!mi.hashAlgorithm || !NODE_DIGEST[mi.hashAlgorithm]) throw _err("tsp/unsupported-algorithm", "messageImprint.hashAlgorithm must be a supported hash name");
+  if (!mi.hashAlgorithm || !NODE_DIGEST[guard.text.keyOf(mi.hashAlgorithm)]) throw _err("tsp/unsupported-algorithm", "messageImprint.hashAlgorithm must be a supported hash name");
   if (!guard.bytes.isByteSource(mi.hashedMessage)) throw _err("tsp/bad-input", "messageImprint.hashedMessage must be a BufferSource");
   var hmLen = guard.bytes.source(mi.hashedMessage, TspError, "tsp/bad-input", "messageImprint.hashedMessage").length;
   if (hmLen !== HASH_LEN[mi.hashAlgorithm]) throw _err("tsp/bad-input", "messageImprint.hashedMessage length (" + hmLen + ") does not match the " + mi.hashAlgorithm + " digest length (" + HASH_LEN[mi.hashAlgorithm] + ")");
@@ -348,7 +351,9 @@ function response(token, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.response options must be an object");
   guard.identifier.assertKnownKeys(opts, _RESPONSE_OPTS, _err, "tsp/bad-input", "pki.tsp.response has an unknown option ");
-  var status = opts.status == null ? 0 : Number(opts.status);
+  var st = opts.status;
+  if (st != null && typeof st !== "number" && typeof st !== "bigint") throw _err("tsp/bad-input", "PKIStatus must be an integer in 0..5 (RFC 3161 sec. 2.4.2), got " + guard.text.showValue(st));
+  var status = st == null ? 0 : intrinsic.Number(st);
   if (!Number.isInteger(status) || status < 0 || status > 5) throw _err("tsp/bad-input", "PKIStatus must be an integer in 0..5 (RFC 3161 sec. 2.4.2)");
   var granted = status === 0 || status === 1;
   if (granted && token == null) throw _err("tsp/missing-token", "a granted TimeStampResp requires a timeStampToken (RFC 3161 sec. 2.4.2)");

package/lib/validator-tpm.js

@@ -114,8 +114,8 @@ function normalizeObjectAttributePolicy(policy, E, code) {
   guard.identifier.assertKnownKeys(policy, _TPM_POLICY_KEYS, function (c, m) { return new E(c, m); }, code, "opts.tpmPolicy has an unknown key ");
   var want = {};
   if (policy.profile !== undefined) {
-    var preset = TPM_POLICY_PROFILES[policy.profile];
-    if (!preset) throw new E(code, "opts.tpmPolicy.profile " + JSON.stringify(policy.profile) + " is not a defined profile");
+    var preset = TPM_POLICY_PROFILES[guard.text.keyOf(policy.profile)];
+    if (!preset) throw new E(code, "opts.tpmPolicy.profile " + guard.text.showValue(policy.profile) + " is not a defined profile");
     Object.keys(preset).forEach(function (n) { want[n] = preset[n]; });
   }
   var explicit = policy.objectAttributes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.22",
+  "version": "0.6.24",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:79647de9-cba8-48fb-9af1-d6ec9bebf2be",
+  "serialNumber": "urn:uuid:1037cbc5-0592-4848-bd2e-b05cbc135e0a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-02T01:10:34.456Z",
+    "timestamp": "2026-09-02T08:11:54.685Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.22",
+      "bom-ref": "@blamejs/pki@0.6.24",
       "type": "application",
       "name": "pki",
-      "version": "0.6.22",
+      "version": "0.6.24",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.22",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.24",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.22",
+      "ref": "@blamejs/pki@0.6.24",
       "dependsOn": []
     }
   ]