@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/vendor/blamejs/lib/vendor/blamejs-pki.cjs

@@ -1,4 +1,4 @@
-// @blamejs/pki v0.4.3 — vendored (Apache-2.0). Zero-dep pure CJS.
+// @blamejs/pki v0.4.13 — vendored (Apache-2.0). Zero-dep pure CJS.
 // https://github.com/blamejs/pki  Exports: x509, crl, pkcs12, key, webcrypto, schema, csr, cms, ...
 // Backs lib/mtls-engine-default.js (PQC-capable CA + PKCS#12 engine).
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -139,7 +139,7 @@ var require_package = __commonJS({
   "node_modules/@blamejs/pki/package.json"(exports2, module2) {
     module2.exports = {
       name: "@blamejs/pki",
-      version: "0.4.3",
+      version: "0.4.13",
       description: "Pure-JavaScript PKI toolkit that owns its stack \u2014 X.509, ASN.1/DER, CMS, PQC-first.",
       license: "Apache-2.0",
       author: "blamejs contributors",
@@ -454,6 +454,51 @@ var require_constants = __commonJS({
       // terminates but exhausts memory. This matches PATH_MAX_CERTS: a chain longer than the path
       // validator will ever accept has nothing to offer, so refusing it at the decoder is free.
       TLS_CERT_MAX_ENTRIES: 100,
+      // A FIDO Metadata Service BLOB is a JWS whose payload carries every registered authenticator's
+      // metadata; the live one runs about 10 MB across ~500 entries. The byte cap bounds the decode
+      // before the payload is materialized, and the entry and anchor caps bound the per-entry work
+      // (each anchor is a DER certificate parse), since a byte ceiling alone does not bound how many
+      // items are declared inside it (CWE-770).
+      MDS_BLOB_MAX_BYTES: BYTES.mib(32),
+      // The BLOB's JWS protected header is read BEFORE the signature is checked, so it carries its own,
+      // far smaller ceiling: a header is a few hundred bytes plus the x5c chain, and the envelope cap
+      // would otherwise let unauthenticated input buy heap ahead of every authentication step.
+      MDS_BLOB_HEADER_MAX_BYTES: BYTES.kib(256),
+      // The JWS signature, likewise read before anything is authenticated. Every algorithm this reader
+      // supports has a tightly bounded signature: 64/96/132 bytes for ECDSA P-256/384/521, and the
+      // modulus size for RSA. 2 KiB covers an RSA-16384 key with room to spare, and refuses a segment
+      // whose only purpose is to make the verifier allocate.
+      MDS_BLOB_SIG_MAX_BYTES: BYTES.kib(2),
+      MDS_MAX_ENTRIES: 4096,
+      // A model's certification history: bounded like the other repeated per-entry structures, because
+      // the status gate walks the whole array on every verification.
+      MDS_MAX_STATUS_REPORTS_PER_ENTRY: 256,
+      MDS_MAX_ANCHORS_PER_ENTRY: 16,
+      // A U2F authenticator carries no AAGUID, so its entry is keyed by the key identifiers of its
+      // attestation certificates instead -- a batch-attested product line legitimately registers dozens.
+      MDS_MAX_KEY_IDS_PER_ENTRY: 64,
+      // The most nested statements a WebAuthn compound attestation (sec. 8.9) may carry. The syntax
+      // says "2*" -- unbounded -- so this is a resource bound this toolkit chooses, NOT a spec MUST.
+      // The CBOR parse caps bound the decode; they do not bound the crypto, and each element costs a
+      // signature verification plus, for some formats, a full certificate-path validation. Seven
+      // non-compound formats are registered, so a conforming statement carrying one of each is 7.
+      WEBAUTHN_COMPOUND_MAX_STATEMENTS: 16,
+      // The most certificates a WebAuthn attestation chain may carry, in an attStmt x5c array or a JWS
+      // x5c header. A real attestation chain is one to four; the byte ceiling on a single entry does
+      // not bound the COUNT, so an array of thousands of small certificates is an unbounded parse and
+      // signature-check fanout (CWE-770) that terminates but costs far more CPU than wire. This is a
+      // resource bound this toolkit chooses -- no specification states it -- and it is far tighter than
+      // PATH_MAX_CERTS because an attestation chain is not a general PKI path.
+      WEBAUTHN_X5C_MAX_CERTS: 10,
+      // A WebAuthn android-safetynet attestation statement carries the SafetyNet response as a JWS
+      // compact serialization: two small JSON objects plus a signature, with the certificate chain
+      // inline in the header. Real ones run a few kilobytes. The cap bounds the text decode before the
+      // string is materialized, so an oversized statement is refused rather than allocated (CWE-770).
+      SAFETYNET_JWS_MAX_BYTES: BYTES.kib(64),
+      // One x5c entry is a single DER certificate; PATH_MAX_CERT_BYTES is the ceiling the path
+      // validator already applies to any certificate it will accept, and an entry above it could not
+      // chain even if it decoded.
+      SAFETYNET_CERT_MAX_BYTES: BYTES.kib(64),
       // ACME challenge token entropy floor (RFC 8555 sec. 8, errata 6950): >= 128
       // bits of base64url is >= 22 characters. A shorter token is refused before use.
       ACME_TOKEN_MIN_CHARS: 22,
@@ -1160,7 +1205,15 @@ var require_guard_identifier = __commonJS({
       if (root < 2n && second > 39n) throw E(bcode, who + " second arc must be 0..39 under roots 0 and 1 (X.660)");
       return str;
     }
-    module2.exports = { assertCanonicalOid };
+    function assertKnownKeys(obj, known, E, code, message) {
+      var describe = typeof message === "function" ? message : function(k) {
+        return message + JSON.stringify(k);
+      };
+      Object.keys(obj).forEach(function(k) {
+        if (!Object.prototype.hasOwnProperty.call(known, k)) throw E(code, describe(k));
+      });
+    }
+    module2.exports = { assertCanonicalOid, assertKnownKeys };
   }
 });
 
@@ -1271,6 +1324,26 @@ var require_guard_compress = __commonJS({
   }
 });
 
+// node_modules/@blamejs/pki/lib/guard-secret.js
+var require_guard_secret = __commonJS({
+  "node_modules/@blamejs/pki/lib/guard-secret.js"(exports2, module2) {
+    "use strict";
+    var bytes = require_guard_bytes();
+    function zeroize(value, ErrorClass, code, label) {
+      if (value === null || value === void 0) return value;
+      var view = bytes.view(value, ErrorClass, code, label);
+      view.fill(0);
+      return value;
+    }
+    function zeroizeAll(list, ErrorClass, code, label) {
+      if (!list) return list;
+      for (var i = 0; i < list.length; i++) zeroize(list[i], ErrorClass, code, label);
+      return list;
+    }
+    module2.exports = { zeroize, zeroizeAll };
+  }
+});
+
 // node_modules/@blamejs/pki/lib/guard-all.js
 var require_guard_all = __commonJS({
   "node_modules/@blamejs/pki/lib/guard-all.js"(exports2, module2) {
@@ -1287,6 +1360,7 @@ var require_guard_all = __commonJS({
     var identifier = require_guard_identifier();
     var header = require_guard_header();
     var compress = require_guard_compress();
+    var secret = require_guard_secret();
     module2.exports = {
       bytes,
       text,
@@ -1299,7 +1373,8 @@ var require_guard_all = __commonJS({
       json,
       identifier,
       header,
-      compress
+      compress,
+      secret
     };
   }
 });
@@ -2612,7 +2687,14 @@ var require_oid = __commonJS({
         // id-pe-tlsfeature (RFC 7633) -- the TLS Feature (formerly "must-staple") extension.
         tlsFeature: 24,
         // id-pe-qcStatements (RFC 3739 sec. 3.2.6) -- the qualified-certificate-statements extension.
-        qcStatements: 3
+        qcStatements: 3,
+        // RFC 3779 -- the IP-address and AS-number delegation extensions that carry a resource
+        // certificate's authority (RPKI). Each has an RFC 8360 "v2" twin with identical syntax and
+        // stricter path-validation semantics, so both are registered here.
+        ipAddrBlocks: 7,
+        autonomousSysIds: 8,
+        ipAddrBlocksV2: 28,
+        autonomousSysIdsV2: 29
       } },
       // RFC 3739 sec. 3.2.6.1 id-qcs -- the PKIX QCStatement statementIds carrying SemanticsInformation.
       pkixQcSyntax: { base: [1, 3, 6, 1, 5, 5, 7, 11], of: { qcsPkixQCSyntaxV1: 1, qcsPkixQCSyntaxV2: 2 } },
@@ -3282,11 +3364,26 @@ var require_oid = __commonJS({
     function paramsMustBeAbsent(dotted) {
       return _PARAMS_ABSENT.has(dotted);
     }
+    var KEM_PARAMS = /* @__PURE__ */ Object.create(null);
+    [
+      ["id-ml-kem-512", 800, 1632, 768, 32],
+      ["id-ml-kem-768", 1184, 2400, 1088, 32],
+      ["id-ml-kem-1024", 1568, 3168, 1568, 32]
+    ].forEach(function(r) {
+      var row = Object.freeze({ ek: r[1], dk: r[2], ct: r[3], ss: r[4] });
+      KEM_PARAMS[byName(r[0])] = row;
+      KEM_PARAMS[r[0]] = row;
+    });
+    Object.freeze(KEM_PARAMS);
+    function kemParams(oidOrName) {
+      return KEM_PARAMS[oidOrName];
+    }
     module2.exports = {
       name,
       byName,
       has,
       paramsMustBeAbsent,
+      kemParams,
       register,
       registerFamily,
       all,
@@ -3415,7 +3512,15 @@ var require_webcrypto = __commonJS({
       this.usages = usages ? usages.slice() : [];
       Object.defineProperty(this, "_handle", { value: handle, enumerable: false });
     }
+    function _requireOwnKey(key, who) {
+      if (key instanceof CryptoKey) return;
+      if (isCryptoKeyLike(key)) {
+        throw new WebCryptoError("webcrypto/invalid-access", who + ": the key was created by a different WebCrypto implementation; re-import it through this one");
+      }
+      throw new WebCryptoError("webcrypto/invalid-access", who + ": a CryptoKey is required");
+    }
     function _requireUsage(key, usage) {
+      _requireOwnKey(key, usage);
       if (key.usages.indexOf(usage) === -1) {
         throw new WebCryptoError("webcrypto/invalid-access", "key is not permitted for '" + usage + "' (usages: " + key.usages.join(",") + ")");
       }
@@ -3721,6 +3826,7 @@ var require_webcrypto = __commonJS({
       var name = alg.name;
       if (name === "ECDH" || name === "X25519" || name === "X448") {
         _requireAlgMatch(alg, alg.public, name + " public key");
+        _requireOwnKey(alg.public, "deriveBits public key");
         var secret = nodeCrypto.diffieHellman({ privateKey: key._handle, publicKey: alg.public._handle });
         if (length == null) return _toArrayBuffer(secret);
         _requireDeriveLength(length, name);
@@ -3731,8 +3837,13 @@ var require_webcrypto = __commonJS({
       }
       if (name === "HKDF") {
         _requireDeriveLength(length, "HKDF");
-        var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), _secretBytes(key), _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || Buffer.alloc(0), "HKDF info"), length / 8);
-        return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(Buffer.from(derived));
+        var ikm = _secretBytes(key);
+        try {
+          var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || Buffer.alloc(0), "HKDF info"), length / 8);
+          return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(Buffer.from(derived));
+        } finally {
+          guard.secret.zeroize(ikm, WebCryptoError, "webcrypto/operation", "the HKDF input key material");
+        }
       }
       if (name === "PBKDF2") {
         _requireDeriveLength(length, "PBKDF2");
@@ -3797,7 +3908,11 @@ var require_webcrypto = __commonJS({
       } catch (e) {
         throw new WebCryptoError("webcrypto/operation", "encapsulateBits: ML-KEM encapsulation failed", e);
       }
-      return { sharedKey: _toArrayBuffer(Buffer.from(r.sharedKey)), ciphertext: _toArrayBuffer(Buffer.from(r.ciphertext)) };
+      try {
+        return { sharedKey: _toArrayBuffer(r.sharedKey), ciphertext: _toArrayBuffer(r.ciphertext) };
+      } finally {
+        guard.secret.zeroize(r.sharedKey, WebCryptoError, "webcrypto/operation", "the KEM shared secret");
+      }
     };
     SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
       var alg = _normalizeAlg(algorithm, "decapsulateBits");
@@ -3806,13 +3921,24 @@ var require_webcrypto = __commonJS({
       _requireAlgMatch(alg, decapsulationKey, "decapsulateBits");
       if (decapsulationKey.type !== "private") throw new WebCryptoError("webcrypto/invalid-access", "decapsulateBits requires a private (decapsulation) key, got " + JSON.stringify(decapsulationKey.type));
       var ct = _toBuf(ciphertext, "decapsulateBits ciphertext");
+      var kemRow = oid.kemParams("id-" + ML_KEM_NODE[alg.name]);
+      if (kemRow && ct.length !== kemRow.ct) {
+        throw new WebCryptoError(
+          "webcrypto/bad-kem-ciphertext",
+          "decapsulateBits: " + alg.name + " expects a " + kemRow.ct + "-octet ciphertext, got " + ct.length + " (FIPS 203 sec. 7.3)"
+        );
+      }
       var ss;
       try {
         ss = nodeCrypto.decapsulate(decapsulationKey._handle, ct);
       } catch (e) {
         throw new WebCryptoError("webcrypto/operation", "decapsulateBits: ML-KEM decapsulation failed (malformed or wrong-length ciphertext)", e);
       }
-      return _toArrayBuffer(Buffer.from(ss));
+      try {
+        return _toArrayBuffer(ss);
+      } finally {
+        guard.secret.zeroize(ss, WebCryptoError, "webcrypto/operation", "the KEM shared secret");
+      }
     };
     SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey, wrapAlgorithm) {
       var exported = await this.exportKey(format, key);
@@ -3825,11 +3951,15 @@ var require_webcrypto = __commonJS({
         if (bytes.length < 16 || bytes.length % 8 !== 0) {
           throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + JSON.stringify(format) + " is not AES-KW-wrappable");
         }
+        var wkBytes = null;
         try {
-          var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", _secretBytes(wrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+          wkBytes = _secretBytes(wrappingKey);
+          var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
           return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
         } catch (e) {
           throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e);
+        } finally {
+          guard.secret.zeroize(wkBytes, WebCryptoError, "webcrypto/operation", "the AES-KW wrapping key");
         }
       }
       var wrapKeyClone = _cloneWithUsage(wrappingKey, "encrypt");
@@ -3846,11 +3976,15 @@ var require_webcrypto = __commonJS({
         if (wrapped.length < 24 || wrapped.length % 8 !== 0) {
           throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW wrapped key must be a multiple of 8 bytes (>= 24); got " + wrapped.length);
         }
+        var kwBytes = null;
         try {
-          var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", _secretBytes(unwrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+          kwBytes = _secretBytes(unwrappingKey);
+          var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
           bytes = Buffer.concat([d.update(wrapped), d.final()]);
         } catch (e) {
           throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e);
+        } finally {
+          guard.secret.zeroize(kwBytes, WebCryptoError, "webcrypto/operation", "the AES-KW unwrapping key");
         }
       } else {
         var unwrapKeyClone = _cloneWithUsage(unwrappingKey, "decrypt");
@@ -3871,7 +4005,11 @@ var require_webcrypto = __commonJS({
       } else {
         keyData = bytes;
       }
-      return this.importKey(format, keyData, unwrappedKeyAlgorithm, extractable, keyUsages);
+      try {
+        return await this.importKey(format, keyData, unwrappedKeyAlgorithm, extractable, keyUsages);
+      } finally {
+        guard.secret.zeroize(bytes, WebCryptoError, "webcrypto/operation", "the unwrapped key material");
+      }
     };
     function _cloneWithUsage(key, usage) {
       var k = new CryptoKey(key.type, key.extractable, key.algorithm, key.usages.concat([usage]), key._handle);
@@ -3891,9 +4029,10 @@ var require_webcrypto = __commonJS({
       }
     }
     var ML_KEM_INNER = {};
-    ML_KEM_INNER[oid.byName("id-ml-kem-512")] = { ek: 800, dk: 1632 };
-    ML_KEM_INNER[oid.byName("id-ml-kem-768")] = { ek: 1184, dk: 2400 };
-    ML_KEM_INNER[oid.byName("id-ml-kem-1024")] = { ek: 1568, dk: 3168 };
+    ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function(n) {
+      var row = oid.kemParams(n);
+      ML_KEM_INNER[oid.byName(n)] = { ek: row.ek, dk: row.dk };
+    });
     function _isOctet(node, size) {
       return node && node.tagClass === "universal" && node.tagNumber === asn1.TAGS.OCTET_STRING && !node.constructed && node.content && node.content.length === size;
     }
@@ -4056,12 +4195,17 @@ var require_webcrypto = __commonJS({
       return void 0;
     }
     SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
+      _requireOwnKey(key, "exportKey");
       if (!key.extractable) throw new WebCryptoError("webcrypto/invalid-access", "key is not extractable");
       if (format === "jwk") return key._handle.export({ format: "jwk" });
       if (key.type === "secret") {
         var raw = key._handle.export();
-        if (format === "raw") return _toArrayBuffer(raw);
-        throw new WebCryptoError("webcrypto/not-supported", "exportKey: secret keys support 'raw' / 'jwk' only");
+        try {
+          if (format === "raw") return _toArrayBuffer(raw);
+          throw new WebCryptoError("webcrypto/not-supported", "exportKey: secret keys support 'raw' / 'jwk' only");
+        } finally {
+          guard.secret.zeroize(raw, WebCryptoError, "webcrypto/operation", "the exported secret key");
+        }
       }
       if (format === "spki") return _toArrayBuffer(key._handle.export({ format: "der", type: "spki" }));
       if (format === "pkcs8") return _toArrayBuffer(key._handle.export({ format: "der", type: "pkcs8" }));
@@ -4099,13 +4243,66 @@ var require_webcrypto = __commonJS({
         throw E(code, "EC point is not on curve " + nodeCurve + " (de-compression failed)", e);
       }
     }
+    var _crypto = new Crypto();
+    var _EXPORT_FORMAT = Object.assign(/* @__PURE__ */ Object.create(null), { "private": "pkcs8", "public": "spki", "secret": "raw" });
+    function isCryptoKeyLike(x) {
+      return !!x && typeof x === "object" && typeof x.type === "string" && typeof x.extractable === "boolean" && !!x.algorithm && typeof x.algorithm === "object" && typeof x.algorithm.name === "string" && Array.isArray(x.usages);
+    }
+    function exportAnyKey(key, E, code) {
+      var format = _EXPORT_FORMAT[key && key.type];
+      if (!format) throw E(code, "a CryptoKey with a private, public, or secret type is required");
+      if (key instanceof CryptoKey) {
+        return Promise.resolve().then(function() {
+          return _crypto.subtle.exportKey(format, key);
+        }).then(function(b) {
+          return Buffer.from(b);
+        });
+      }
+      if (!key.extractable) {
+        throw E(code, "the CryptoKey comes from a different WebCrypto implementation and is not extractable, so its key material cannot be reached; import it through pki.webcrypto.subtle, or pass the key as DER");
+      }
+      var handle = key._handle;
+      if (handle instanceof nodeCrypto.KeyObject && handle.type === key.type) {
+        return Promise.resolve().then(function() {
+          return format === "raw" ? handle.export() : handle.export({ format: "der", type: format });
+        }).then(function(b) {
+          return Buffer.from(b);
+        }, function(e) {
+          throw E(code, "the CryptoKey comes from a different copy of this WebCrypto engine and its key material could not be read; import it through pki.webcrypto.subtle, or pass the key as DER", e);
+        });
+      }
+      return Promise.resolve().then(function() {
+        return nodeCrypto.webcrypto.subtle.exportKey(format, key);
+      }).then(function(b) {
+        return Buffer.from(b);
+      }, function(e) {
+        throw E(code, "the CryptoKey comes from a different WebCrypto implementation and could not be exported for re-import; import it through pki.webcrypto.subtle, or pass the key as DER", e);
+      });
+    }
+    function adoptKey(key, importParams, usages, E, code) {
+      if (key instanceof CryptoKey) return Promise.resolve(key);
+      if (!Array.isArray(key.usages)) throw E(code, "a CryptoKey carrying its permitted usages is required");
+      for (var i = 0; i < usages.length; i++) {
+        if (key.usages.indexOf(usages[i]) === -1) {
+          throw E(code, "the CryptoKey is not permitted for '" + usages[i] + "' (usages: " + key.usages.join(",") + ")");
+        }
+      }
+      return Promise.resolve().then(function() {
+        return exportAnyKey(key, E, code);
+      }).then(function(der) {
+        return _crypto.subtle.importKey(_EXPORT_FORMAT[key.type], der, importParams || key.algorithm, false, usages);
+      });
+    }
     module2.exports = {
-      webcrypto: new Crypto(),
+      webcrypto: _crypto,
       Crypto,
       SubtleCrypto,
       CryptoKey,
       WebCryptoError,
-      decompressEcPoint
+      decompressEcPoint,
+      isCryptoKeyLike,
+      exportAnyKey,
+      adoptKey
     };
   }
 });
@@ -5269,6 +5466,7 @@ var require_validator_tpm = __commonJS({
   "node_modules/@blamejs/pki/lib/validator-tpm.js"(exports2, module2) {
     "use strict";
     var ByteReader = require_byte_reader();
+    var guard = require_guard_all();
     var TPM_GENERATED_VALUE = 4283712327;
     var TPM_ST_ATTEST_CERTIFY = 32791;
     var TPM_ALG = { RSA: 1, SHA1: 4, SHA256: 11, SHA384: 12, SHA512: 13, NULL: 16, ECC: 35 };
@@ -5308,12 +5506,43 @@ var require_validator_tpm = __commonJS({
         r.u16();
       }
     }
+    var TPMA_OBJECT_BITS = Object.assign(/* @__PURE__ */ Object.create(null), {
+      fixedTPM: 1,
+      stClear: 2,
+      fixedParent: 4,
+      sensitiveDataOrigin: 5,
+      userWithAuth: 6,
+      adminWithPolicy: 7,
+      firmwareLimited: 8,
+      svnLimited: 9,
+      noDA: 10,
+      encryptedDuplication: 11,
+      restricted: 16,
+      decrypt: 17,
+      sign: 18,
+      x509sign: 19
+    });
+    var TPMA_OBJECT_RESERVED = 4293980169;
+    function _decodeAttributes(oa) {
+      var out = {};
+      Object.keys(TPMA_OBJECT_BITS).forEach(function(n) {
+        out[n] = (oa >>> TPMA_OBJECT_BITS[n] & 1) === 1;
+      });
+      return out;
+    }
     function parsePubArea(buf, E, code) {
       var r = new ByteReader(buf, 0, buf.length, E, code);
       var type = r.u16(), nameAlg = r.u16();
-      r.u32();
-      r.vector(2, 0, null);
-      var pub = { type, nameAlg, nameAlgBytes: buf.subarray(2, 4) };
+      var objectAttributes = r.u32();
+      var authPolicy = r.vector(2, 0, null);
+      var pub = {
+        type,
+        nameAlg,
+        nameAlgBytes: buf.subarray(2, 4),
+        objectAttributes: objectAttributes >>> 0,
+        attributes: _decodeAttributes(objectAttributes),
+        authPolicy
+      };
       if (type === TPM_ALG.RSA) {
         _symDef(r);
         _scheme(r);
@@ -5367,8 +5596,108 @@ var require_validator_tpm = __commonJS({
       }
       throw new E(code, "unsupported TPM pubArea key type");
     }
+    var TPM_POLICY_PROFILES = Object.assign(/* @__PURE__ */ Object.create(null), {
+      "hardware-bound": { fixedTPM: true, fixedParent: true, sensitiveDataOrigin: true, sign: true, restricted: false, x509sign: false }
+    });
+    var _TPM_POLICY_KEYS = Object.assign(/* @__PURE__ */ Object.create(null), { profile: 1, objectAttributes: 1, reservedBitsClear: 1, consistency: 1, authPolicy: 1 });
+    var _AUTH_POLICY_KEYS = Object.assign(/* @__PURE__ */ Object.create(null), { present: 1, allow: 1 });
+    function normalizeObjectAttributePolicy(policy, E, code) {
+      if (policy === void 0) return null;
+      if (!policy || typeof policy !== "object" || Array.isArray(policy)) throw new E(code, "opts.tpmPolicy must be an object");
+      guard.identifier.assertKnownKeys(policy, _TPM_POLICY_KEYS, function(c, m) {
+        return new E(c, m);
+      }, code, "opts.tpmPolicy has an unknown key ");
+      var want = {};
+      if (policy.profile !== void 0) {
+        var preset = TPM_POLICY_PROFILES[policy.profile];
+        if (!preset) throw new E(code, "opts.tpmPolicy.profile " + JSON.stringify(policy.profile) + " is not a defined profile");
+        Object.keys(preset).forEach(function(n) {
+          want[n] = preset[n];
+        });
+      }
+      var explicit = policy.objectAttributes;
+      if (explicit !== void 0) {
+        if (!explicit || typeof explicit !== "object" || Array.isArray(explicit)) throw new E(code, "opts.tpmPolicy.objectAttributes must be an object");
+        Object.keys(explicit).forEach(function(n) {
+          if (TPMA_OBJECT_BITS[n] === void 0) throw new E(code, "opts.tpmPolicy.objectAttributes has an unknown attribute " + JSON.stringify(n));
+          if (typeof explicit[n] !== "boolean") throw new E(code, "opts.tpmPolicy.objectAttributes." + n + " must be a boolean");
+          want[n] = explicit[n];
+        });
+      }
+      if (want.sensitiveDataOrigin === true && want.fixedTPM !== true) {
+        throw new E(code, "opts.tpmPolicy requires sensitiveDataOrigin without fixedTPM; on its own it does not establish that the TPM generated the key (TPM 2.0 Part 2 sec. 8.3.3.5)");
+      }
+      ["reservedBitsClear", "consistency"].forEach(function(k) {
+        if (policy[k] !== void 0 && typeof policy[k] !== "boolean") throw new E(code, "opts.tpmPolicy." + k + " must be a boolean");
+      });
+      var ap = policy.authPolicy;
+      var allow = null;
+      if (ap !== void 0) {
+        if (!ap || typeof ap !== "object" || Array.isArray(ap)) throw new E(code, "opts.tpmPolicy.authPolicy must be an object");
+        guard.identifier.assertKnownKeys(ap, _AUTH_POLICY_KEYS, function(c, m) {
+          return new E(c, m);
+        }, code, "opts.tpmPolicy.authPolicy has an unknown key ");
+        if (ap.present !== void 0 && typeof ap.present !== "boolean") throw new E(code, "opts.tpmPolicy.authPolicy.present must be a boolean");
+        if (ap.allow !== void 0) {
+          if (!Array.isArray(ap.allow)) throw new E(code, "opts.tpmPolicy.authPolicy.allow must be an array");
+          allow = ap.allow.map(function(entry, i) {
+            if (Buffer.isBuffer(entry)) return entry;
+            if (typeof entry !== "string" || entry.length === 0 || entry.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(entry)) {
+              throw new E(code, "opts.tpmPolicy.authPolicy.allow[" + i + "] must be a Buffer or an even-length hex string");
+            }
+            return Buffer.from(entry, "hex");
+          });
+        }
+      }
+      return {
+        objectAttributes: want,
+        reservedBitsClear: policy.reservedBitsClear === true,
+        consistency: policy.consistency === true,
+        authPolicy: ap ? { present: ap.present === true, allow } : null
+      };
+    }
+    function assertObjectAttributePolicy(pub, policy, E, policyCode, structuralCode) {
+      if (!policy) return;
+      var oa = pub.objectAttributes >>> 0;
+      if (policy.reservedBitsClear && (oa & TPMA_OBJECT_RESERVED) >>> 0 !== 0) {
+        throw new E(structuralCode, "the TPMT_PUBLIC objectAttributes sets a reserved bit (TPM 2.0 Part 2 sec. 8.3.2 Table 33: shall be zero)");
+      }
+      if (policy.consistency) {
+        if (pub.attributes.encryptedDuplication && pub.attributes.fixedTPM) {
+          throw new E(structuralCode, "the TPMT_PUBLIC objectAttributes sets encryptedDuplication on an object with fixedTPM SET (TPM 2.0 Part 2 sec. 8.3.3.11)");
+        }
+        if (pub.attributes.sign && pub.attributes.decrypt && pub.attributes.restricted) {
+          throw new E(structuralCode, "the TPMT_PUBLIC objectAttributes sets restricted with both sign and decrypt (TPM 2.0 Part 2 sec. 8.3.3)");
+        }
+        if (pub.authPolicy.length > 64) {
+          throw new E(structuralCode, "the TPMT_PUBLIC authPolicy is " + pub.authPolicy.length + " octets, above the 64-octet TPM2B_DIGEST maximum");
+        }
+      }
+      Object.keys(policy.objectAttributes).forEach(function(name) {
+        var want = policy.objectAttributes[name];
+        if (pub.attributes[name] !== want) {
+          throw new E(policyCode, "the TPM credential key has " + name + " " + (pub.attributes[name] ? "SET" : "CLEAR") + "; opts.tpmPolicy requires it " + (want ? "SET" : "CLEAR"));
+        }
+      });
+      var ap = policy.authPolicy;
+      if (!ap) return;
+      if (ap.present === true && pub.authPolicy.length === 0) {
+        throw new E(policyCode, "the TPM credential key carries the Empty Policy; opts.tpmPolicy.authPolicy.present requires a policy digest");
+      }
+      if (ap.allow) {
+        var got = pub.authPolicy;
+        var ok = ap.allow.some(function(want) {
+          return want.length === got.length && guard.crypto.constantTimeEqual(want, got);
+        });
+        if (!ok) throw new E(policyCode, "the TPM credential key authPolicy is not in opts.tpmPolicy.authPolicy.allow");
+      }
+    }
     module2.exports = {
       parsePubArea,
+      TPMA_OBJECT_BITS,
+      decodeObjectAttributes: _decodeAttributes,
+      normalizeObjectAttributePolicy,
+      assertObjectAttributePolicy,
       parseCertInfo,
       pubKeyEqualsCose,
       TPM_ALG_HASH
@@ -5491,7 +5820,22 @@ var require_rfc3339 = __commonJS({
       if (!isValid(v)) throw E(code, (label || "the value") + " is not a valid RFC 3339 date-time");
       return new Date(v);
     }
-    module2.exports = { isValid, parse };
+    var FULL_DATE_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+    function isValidDate(v) {
+      if (typeof v !== "string") return false;
+      var m = FULL_DATE_RE.exec(v);
+      if (!m) return false;
+      var year = +m[1], month = +m[2], day = +m[3];
+      if (month < 1 || month > 12) return false;
+      var leap = year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+      var daysInMonth = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+      return day >= 1 && day <= daysInMonth[month - 1];
+    }
+    function parseDate(v, E, code, label) {
+      if (!isValidDate(v)) throw E(code, (label || "the value") + " is not a valid RFC 3339 full-date (YYYY-MM-DD)");
+      return /* @__PURE__ */ new Date(v + "T00:00:00Z");
+    }
+    module2.exports = { isValid, parse, isValidDate, parseDate };
   }
 });
 
@@ -6439,9 +6783,7 @@ var require_ct = __commonJS({
     }
     async function fetchLogList(opts) {
       opts = opts || {};
-      Object.keys(opts).forEach(function(k) {
-        if (!KNOWN_FETCH_OPTS[k]) throw _ctErr("ct/bad-input", "unknown opts field " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(opts, KNOWN_FETCH_OPTS, _ctErr, "ct/bad-input", "unknown opts field ");
       if (opts.signerKey == null) throw _ctErr("ct/bad-input", "opts.signerKey is required -- the caller-pinned CT log-list distributor SPKI (there is no baked-in key)");
       if (opts.url == null) throw _ctErr("ct/bad-input", "opts.url is required -- the log_list.json URL (there is no baked-in vendor URL)");
       var jsonParsed = _parseHttpsUrl(opts.url, "URL");
@@ -6934,6 +7276,62 @@ var require_schema_pkix = __commonJS({
         }
       });
     }
+    var DISPLAY_TEXT_MAX = 200;
+    function displayTextChars(str) {
+      return Array.from(str).length;
+    }
+    var _DISPLAY_TEXT_TAGS = null;
+    function _isDisplayTextNode(n) {
+      if (!_DISPLAY_TEXT_TAGS) {
+        _DISPLAY_TEXT_TAGS = {};
+        _DISPLAY_TEXT_TAGS[_T.IA5_STRING] = 1;
+        _DISPLAY_TEXT_TAGS[_T.VISIBLE_STRING] = 1;
+        _DISPLAY_TEXT_TAGS[_T.BMP_STRING] = 1;
+        _DISPLAY_TEXT_TAGS[_T.UTF8_STRING] = 1;
+      }
+      return !!n && n.tagClass === "universal" && _DISPLAY_TEXT_TAGS[n.tagNumber] === 1;
+    }
+    function _dtEntry(field, node) {
+      var text;
+      try {
+        text = asn1.read.string(node);
+      } catch (_e) {
+        text = null;
+      }
+      return { field, tagNumber: node.tagNumber, text, chars: text === null ? null : displayTextChars(text) };
+    }
+    function _noticeNumbers(node) {
+      if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children) return null;
+      var nums = [], ok = true;
+      node.children.forEach(function(n) {
+        try {
+          nums.push(String(asn1.read.integer(n)));
+        } catch (_e) {
+          ok = false;
+        }
+      });
+      return ok ? nums : null;
+    }
+    function userNoticeTexts(qualifier) {
+      if (!qualifier || qualifier.tagClass !== "universal" || qualifier.tagNumber !== _T.SEQUENCE || !qualifier.children) return [];
+      var kids = qualifier.children;
+      if (kids.length > 2) return [];
+      var i = 0, out = [];
+      if (i < kids.length && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.SEQUENCE) {
+        var nr = kids[i];
+        if (!nr.children || nr.children.length !== 2 || !_isDisplayTextNode(nr.children[0])) return [];
+        var org = _dtEntry("organization", nr.children[0]);
+        org.noticeNumbers = _noticeNumbers(nr.children[1]);
+        out.push(org);
+        i++;
+      }
+      if (i < kids.length) {
+        if (!_isDisplayTextNode(kids[i])) return [];
+        out.push(_dtEntry("explicitText", kids[i]));
+        i++;
+      }
+      return i === kids.length ? out : [];
+    }
     function _decodeHelpers(ns) {
       function decodeTop(buf, code, what) {
         var n;
@@ -7655,6 +8053,9 @@ var require_schema_pkix = __commonJS({
       signedEnvelopeTbs,
       rootSequenceChildren,
       assertPolicyQualifiers,
+      DISPLAY_TEXT_MAX,
+      displayTextChars,
+      userNoticeTexts,
       signedEnvelope,
       attrValueToString,
       attributeTypeAndValue,
@@ -7748,6 +8149,12 @@ var require_schema_c509 = __commonJS({
       29: _name("freshestCRL"),
       30: _name("inhibitAnyPolicy"),
       31: _name("subjectInfoAccess"),
+      // RFC 3779 resource-delegation extensions, and their RFC 8360 "v2" twins, which the draft
+      // encodes "exactly like" the originals -- same two codecs, four registry rows (sec. 8.8).
+      32: _name("ipAddrBlocks"),
+      33: _name("autonomousSysIds"),
+      34: _name("ipAddrBlocksV2"),
+      35: _name("autonomousSysIdsV2"),
       36: _name("ocspNoCheck"),
       38: _name("tlsFeature")
     };
@@ -7770,7 +8177,11 @@ var require_schema_c509 = __commonJS({
       certificatePolicies: 1,
       policyMappings: 1,
       policyConstraints: 1,
-      subjectDirectoryAttributes: 1
+      subjectDirectoryAttributes: 1,
+      ipAddrBlocks: 1,
+      autonomousSysIds: 1,
+      ipAddrBlocksV2: 1,
+      autonomousSysIdsV2: 1
     };
     var EKU_BY_INT = {
       0: _name("anyExtendedKeyUsage"),
@@ -7888,6 +8299,7 @@ var require_schema_c509 = __commonJS({
       if (node.majorType === 4 && node.children && node.children.length === 2) {
         var a = _oidName(node.children[0], code, label);
         if (node.children[1].majorType !== 2) throw _err(code, label + " algorithm parameters must be a CBOR byte string");
+        if (node.children[1].content.length === 0) throw _err(code, label + " algorithm parameters must not be an empty byte string; omit them with the bare ~oid form (draft sec. 3.1.3)");
         return { name: a.name, oid: a.oid, parameters: node.children[1].content };
       }
       throw _err(code, label + " is not a C509 AlgorithmIdentifier (int / ~oid / [~oid, params])");
@@ -7905,6 +8317,29 @@ var require_schema_c509 = __commonJS({
       }
       throw _err("c509/bad-name", "an attribute value is not a C509 SpecialText (text / bytes / tag-48)");
     }
+    var _HEX_OPTIMIZED = /^(?:[0-9a-f]{2})+$/;
+    var _EUI64_TEXT = /^(?:[0-9A-F]{2}-){7}[0-9A-F]{2}$/;
+    function _assertCanonicalSpecialText(node, isNative, E) {
+      if (isNative) return;
+      if (node.majorType === 3) {
+        var t = cbor.read.textString(node);
+        if (t.length >= 2 && _HEX_OPTIMIZED.test(t)) {
+          throw _err(E, "a text attribute value of even-length hex characters must be encoded as a CBOR byte string (draft sec. 3.1.4)");
+        }
+        if (_EUI64_TEXT.test(t)) {
+          throw _err(E, "a text attribute value in EUI-64 form must be encoded as a CBOR tag-48 MAC address (draft sec. 3.1.4)");
+        }
+        return;
+      }
+      if (node.majorType === 2) {
+        if (node.content.length === 0) throw _err(E, "an empty attribute value must be encoded as a CBOR text string (draft sec. 3.1.4)");
+        return;
+      }
+      var eui = node.children[0].content;
+      if (eui.length === 8 && eui[3] === 255 && eui[4] === 254) {
+        throw _err(E, "an EUI-64 of the form HH-HH-HH-FF-FE-HH-HH-HH must be encoded as a 48-bit MAC address (draft sec. 3.1.4)");
+      }
+    }
     function _assertAttrValue(rdn) {
       try {
         _reconAttrValue(rdn);
@@ -7917,6 +8352,7 @@ var require_schema_c509 = __commonJS({
       if (!isSubject && node.majorType === 7 && node.ai === 22) return null;
       if (node.majorType === 3 || node.majorType === 2 || node.majorType === 6) {
         var sv = _specialText(node);
+        _assertCanonicalSpecialText(node, isNative, "c509/bad-name");
         if (sv.eui64) return { rdns: [{ type: "commonName", eui64: sv.eui64 }], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
         var val = sv.text !== void 0 ? sv.text : sv.hex;
         var bareRdn = { type: "commonName", value: val };
@@ -7936,16 +8372,20 @@ var require_schema_c509 = __commonJS({
         var tname = ATTR_BY_INT[Math.abs(ti)];
         if (tname === void 0) throw _err("c509/bad-name", "attribute type integer " + ti + " has no C509 registry row");
         var v = _specialText(kids[i + 1]);
+        _assertCanonicalSpecialText(kids[i + 1], isNative, "c509/bad-name");
         var vv = v.text !== void 0 ? v.text : v.hex !== void 0 ? v.hex : _macToEui64String(v.eui64);
         var rdn = { type: tname, value: vv, printable: ti < 0 };
         _assertAttrValue(rdn);
         rdns.push(rdn);
         parts.push(_shortName(tname) + "=" + guard.name.escapeDnValue(vv));
       }
-      return { rdns, dn: parts.join(",") };
+      if (!isNative && rdns.length === 1 && rdns[0].type === "commonName" && !rdns[0].printable) {
+        throw _err("c509/bad-name", "a Name holding a single +1 commonName must be encoded as a bare SpecialText, not an array (draft sec. 3.1.4)");
+      }
+      return { rdns, dn: parts.join(", ") };
     }
     function _shortName(n) {
-      return n === "commonName" ? "CN" : n === "countryName" ? "C" : n === "organizationName" ? "O" : n === "organizationalUnitName" ? "OU" : n === "localityName" ? "L" : n === "stateOrProvinceName" ? "ST" : n;
+      return n && constants.NAMES.DN_SHORT[n] || n;
     }
     function _cborUint(node, label) {
       if (node.majorType !== 0) throw _err("c509/bad-extensions", "a " + label + " value must be a CBOR unsigned integer");
@@ -8154,6 +8594,222 @@ var require_schema_c509 = __commonJS({
       }
       return Buffer.concat([buf.subarray(0, addrLen), Buffer.from([prefixLen])]);
     }
+    function _isUniversal(n, tagNumber) {
+      return !!n && n.tagClass === "universal" && n.tagNumber === tagNumber;
+    }
+    function _ipSeqToInt(seq) {
+      if (!seq.length || seq[0] > 7) return null;
+      var head = Buffer.from([seq[0] + 1]);
+      return BigInt("0x" + Buffer.concat([head, seq.subarray(1)]).toString("hex"));
+    }
+    function _ipIntToSeq(n) {
+      if (n < 1n) return null;
+      var out = [];
+      for (var v = n; v > 0n; v >>= 8n) out.unshift(Number(v & 0xffn));
+      if (out.length > 9 || out[0] < 1 || out[0] > 8) return null;
+      out[0] -= 1;
+      return Buffer.from(out);
+    }
+    var _IP_WIDTH = { 1: 4, 2: 16 };
+    function _ipLow(seq, width) {
+      var v = Buffer.alloc(width);
+      seq.subarray(1).copy(v);
+      return v;
+    }
+    function _ipHigh(seq, width) {
+      var v = _ipLow(seq, width);
+      var bits = (seq.length - 1) * 8 - seq[0];
+      for (var i = bits; i < width * 8; i++) v[i >> 3] |= 128 >> (i & 7);
+      return v;
+    }
+    function _ipOctCmp(a, b2) {
+      for (var i = 0; i < a.length; i++) {
+        if (a[i] !== b2[i]) return a[i] - b2[i];
+      }
+      return 0;
+    }
+    function _ipIsSuccessor(a, b2) {
+      var carry = 1, inc = Buffer.from(a);
+      for (var i = inc.length - 1; i >= 0 && carry; i--) {
+        var s = inc[i] + carry;
+        inc[i] = s & 255;
+        carry = s >> 8;
+      }
+      if (carry) return false;
+      return _ipOctCmp(inc, b2) === 0;
+    }
+    function _ipRangeIsPrefix(lo, hi) {
+      var bits = lo.length * 8, n = 0;
+      while (n < bits) {
+        var byteAt = n >> 3, mask = 128 >> (n & 7);
+        if ((lo[byteAt] & mask) !== (hi[byteAt] & mask)) break;
+        n++;
+      }
+      for (var i = n; i < bits; i++) {
+        var bt = i >> 3, mk = 128 >> (i & 7);
+        if ((lo[bt] & mk) !== 0) return false;
+        if ((hi[bt] & mk) === 0) return false;
+      }
+      return true;
+    }
+    function _famOctCmp(a, b2) {
+      var n = Math.min(a.length, b2.length);
+      for (var i = 0; i < n; i++) {
+        if (a[i] !== b2[i]) return a[i] - b2[i];
+      }
+      return a.length - b2.length;
+    }
+    function _ipSeqBitsClear(seq) {
+      var unused = seq[0], value = seq.subarray(1);
+      if (!value.length) return unused === 0;
+      if (unused === 0) return true;
+      return (value[value.length - 1] & (1 << unused) - 1) === 0;
+    }
+    function _ipRangesCanonical(bounds) {
+      for (var i = 1; i < bounds.length; i++) {
+        var prev = bounds[i - 1], cur = bounds[i];
+        if (_ipOctCmp(cur.lo, prev.hi) <= 0) return false;
+        if (_ipIsSuccessor(prev.hi, cur.lo)) return false;
+      }
+      return true;
+    }
+    function _ipChoiceToDer(items, afi) {
+      var out = [], prev = null, sawBytes = false, sawInt = false, seqs = [];
+      var width = _IP_WIDTH[afi];
+      if (!width) throw _err("c509/bad-extensions", "address family " + afi + " has no known address width, so its addresses cannot be checked (RFC 3779 sec. 2.2.3.3)");
+      function widthOk(seq) {
+        return seq.length - 1 <= width;
+      }
+      function absolute(node) {
+        var seq;
+        if (node.majorType === 2) {
+          sawBytes = true;
+          if (node.content.length === 0) throw _err("c509/bad-extensions", "an IPAddress byte sequence must be non-empty");
+          if (node.content[0] > 7) throw _err("c509/bad-extensions", "an IPAddress unused-bit count must be 0..7 (DER)");
+          seq = node.content;
+        } else {
+          sawInt = true;
+          var d = _cborIntVal(node, "an IPAddress");
+          var abs = prev === null ? d : prev + d;
+          prev = abs;
+          guard.range.uint64(abs, _err, "c509/bad-extensions", "an IPAddress");
+          seq = _ipIntToSeq(abs);
+          if (!seq) throw _err("c509/bad-extensions", "an IPAddress integer does not encode a DER BIT STRING (sec. 3.3)");
+        }
+        if (!widthOk(seq)) {
+          throw _err("c509/bad-extensions", "an IPAddress is wider than address family " + afi + " permits (RFC 3779 sec. 2.2.3.8)");
+        }
+        if (!_ipSeqBitsClear(seq)) {
+          throw _err("c509/bad-extensions", "an IPAddress must leave its declared unused bits zero (RFC 3779 sec. 2.2.3.8)");
+        }
+        return seq;
+      }
+      var bounds = [];
+      for (var i = 0; i < items.length; i++) {
+        var it = items[i];
+        if (it.majorType === 4) {
+          if (!it.children || it.children.length !== 2) throw _err("c509/bad-extensions", "an IPAddress range must be exactly [min, max]");
+          var lo = absolute(it.children[0]), hi = absolute(it.children[1]);
+          seqs.push(lo);
+          seqs.push(hi);
+          var rlo = _ipLow(lo, width), rhi = _ipHigh(hi, width);
+          {
+            if (_ipRangeIsPrefix(rlo, rhi)) throw _err("c509/bad-extensions", "an address range that is exactly a prefix must use the prefix form (RFC 3779 sec. 2.2.3.7)");
+            bounds.push({ lo: rlo, hi: rhi });
+          }
+          out.push(b.sequence([b.bitString(lo.subarray(1), lo[0]), b.bitString(hi.subarray(1), hi[0])]));
+        } else {
+          var pfx = absolute(it);
+          seqs.push(pfx);
+          bounds.push({ lo: _ipLow(pfx, width), hi: _ipHigh(pfx, width) });
+          out.push(b.bitString(pfx.subarray(1), pfx[0]));
+        }
+      }
+      if (sawBytes && sawInt) throw _err("c509/bad-extensions", "an IPAddressFamily must use one address form throughout (sec. 3.3)");
+      if (sawBytes && !seqs.some(function(s) {
+        return s.length > 8;
+      })) {
+        throw _err("c509/bad-extensions", "an IPAddressFamily whose addresses all fit 8 octets must use the integer form (sec. 3.3)");
+      }
+      for (var r = 0; r < bounds.length; r++) {
+        if (_ipOctCmp(bounds[r].lo, bounds[r].hi) > 0) throw _err("c509/bad-extensions", "an IPAddress range must not end below its start (RFC 3779 sec. 2.2.3.9)");
+      }
+      if (!_ipRangesCanonical(bounds)) {
+        throw _err("c509/bad-extensions", "an IPAddressFamily must be sorted, non-overlapping and maximally merged (RFC 3779 sec. 2.2.3.6)");
+      }
+      return out;
+    }
+    function _ipChoiceFromDer(ch, afi) {
+      if (!_isUniversal(ch, asn1.TAGS.SEQUENCE) || !ch.children || ch.children.length === 0) return null;
+      var groups = [], flat = [];
+      for (var i = 0; i < ch.children.length; i++) {
+        var el = ch.children[i], pair;
+        if (_isUniversal(el, asn1.TAGS.BIT_STRING)) {
+          var bs = asn1.read.bitString(el);
+          pair = [Buffer.concat([Buffer.from([bs.unusedBits]), bs.bytes])];
+        } else if (_isUniversal(el, asn1.TAGS.SEQUENCE) && el.children && el.children.length === 2 && _isUniversal(el.children[0], asn1.TAGS.BIT_STRING) && _isUniversal(el.children[1], asn1.TAGS.BIT_STRING)) {
+          var lo = asn1.read.bitString(el.children[0]), hi = asn1.read.bitString(el.children[1]);
+          pair = [
+            Buffer.concat([Buffer.from([lo.unusedBits]), lo.bytes]),
+            Buffer.concat([Buffer.from([hi.unusedBits]), hi.bytes])
+          ];
+        } else return null;
+        groups.push(pair);
+        for (var k = 0; k < pair.length; k++) flat.push(pair[k]);
+      }
+      var width = _IP_WIDTH[afi];
+      if (!width) return null;
+      var bounds = [];
+      for (var g = 0; g < groups.length; g++) {
+        var bg = groups[g];
+        if (bg[0].length - 1 > width || bg[bg.length - 1].length - 1 > width) return null;
+        var blo = _ipLow(bg[0], width), bhi = _ipHigh(bg[bg.length - 1], width);
+        if (bg.length === 2 && _ipRangeIsPrefix(blo, bhi)) return null;
+        bounds.push({ lo: blo, hi: bhi });
+      }
+      for (var r = 0; r < bounds.length; r++) {
+        if (_ipOctCmp(bounds[r].lo, bounds[r].hi) > 0) return null;
+      }
+      if (!_ipRangesCanonical(bounds)) return null;
+      var useBytes = flat.some(function(s) {
+        return s.length > 8;
+      });
+      var out = [];
+      if (useBytes) {
+        groups.forEach(function(p) {
+          out.push(p.length === 1 ? cbor.build.byteString(p[0]) : cbor.build.array([cbor.build.byteString(p[0]), cbor.build.byteString(p[1])]));
+        });
+        return cbor.build.array(out);
+      }
+      var prev = null;
+      function delta(seq) {
+        var n = _ipSeqToInt(seq);
+        if (n === null) return null;
+        var d = prev === null ? n : n - prev;
+        prev = n;
+        return cbor.build.int(d);
+      }
+      for (var gi = 0; gi < groups.length; gi++) {
+        var grp = groups[gi];
+        if (grp.length === 1) {
+          var one = delta(grp[0]);
+          if (!one) return null;
+          out.push(one);
+        } else {
+          var dlo = delta(grp[0]);
+          var dhi = dlo ? delta(grp[1]) : null;
+          if (!dlo || !dhi) return null;
+          out.push(cbor.build.array([dlo, dhi]));
+        }
+      }
+      return cbor.build.array(out);
+    }
+    function _asDelta(node, prev) {
+      var d = _cborIntVal(node, "an ASIdentifier");
+      var abs = prev === null ? d : prev + d;
+      guard.range.int(abs, 0n, 4294967295n, _err, "c509/bad-extensions", "an ASIdentifier");
+      return abs;
+    }
     function _subtreesToDer(node, isNative) {
       if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a GeneralSubtrees value must be a CBOR array");
       var kids = node.children;
@@ -8350,8 +9006,8 @@ var require_schema_c509 = __commonJS({
           } else {
             items = [node];
           }
-          return b.sequence(items.map(function(it) {
-            return b.oid(_ekuPurposeOid(it));
+          return b.sequence(items.map(function(it2) {
+            return b.oid(_ekuPurposeOid(it2));
           }));
         }
         case "inhibitAnyPolicy":
@@ -8368,6 +9024,9 @@ var require_schema_c509 = __commonJS({
         case "subjectAltName":
         case "issuerAltName":
           if (node.majorType === 3) return b.sequence([b.contextPrimitive(2, _ia5Bytes(node, 2))]);
+          if (!isNative && node.majorType === 4 && node.children && node.children.length === 2 && node.children[0].majorType === 0 && Number(cbor.read.int(node.children[0])) === 2 && node.children[1].majorType === 3) {
+            throw _err("c509/bad-extensions", "a " + name + " holding exactly one dNSName must be encoded as a bare CBOR text string, not an array (draft sec. 3.3)");
+          }
           return b.sequence(_generalNamesToDer(node, isNative));
         case "nameConstraints": {
           if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a nameConstraints value must be a 2-element CBOR array [ permitted, excluded ] (sec. 3.3)");
@@ -8393,6 +9052,71 @@ var require_schema_c509 = __commonJS({
           return b.sequence(node.children.map(function(dp) {
             return _dpToDer(dp, isNative);
           }));
+        // IPAddrBlocks (and its RFC 8360 v2 twin): a FLAT array of (AFI, SAFI, choice) triples --
+        // IPAddressFamily is a parenthesized CDDL group, so it splices rather than nesting.
+        case "ipAddrBlocks":
+        case "ipAddrBlocksV2": {
+          if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "an IPAddrBlocks value must be a CBOR array");
+          var ipKids = node.children;
+          if (ipKids.length === 0 || ipKids.length % 3 !== 0) throw _err("c509/bad-extensions", "an IPAddrBlocks array must be non-empty (AFI, SAFI, addresses) triples (sec. 3.3)");
+          var families = [], prevFam = null;
+          for (var fi = 0; fi + 2 < ipKids.length; fi += 3) {
+            var afi = _cborUint(ipKids[fi], "an IPAddrBlocks AFI");
+            if (afi > 0xffffn) throw _err("c509/bad-extensions", "an IPAddrBlocks AFI must fit two octets (RFC 3779 sec. 2.2.3.3)");
+            var safiNode = ipKids[fi + 1], famBytes = [Number(afi >> 8n) & 255, Number(afi & 0xffn)];
+            if (!_isCborNull(safiNode)) {
+              var safi = _cborUint(safiNode, "an IPAddrBlocks SAFI");
+              if (safi > 0xffn) throw _err("c509/bad-extensions", "an IPAddrBlocks SAFI must fit one octet (RFC 3779 sec. 2.2.3.3)");
+              famBytes.push(Number(safi));
+            }
+            var famOct = Buffer.from(famBytes);
+            if (prevFam !== null && _famOctCmp(prevFam, famOct) >= 0) {
+              throw _err("c509/bad-extensions", "IPAddrBlocks address families must be unique and in ascending addressFamily order (RFC 3779 sec. 2.2.3.3)");
+            }
+            prevFam = famOct;
+            var choice = ipKids[fi + 2], famFields = [b.octetString(famOct)];
+            if (_isCborNull(choice)) {
+              famFields.push(b.nullValue());
+            } else {
+              if (choice.majorType !== 4 || !choice.children || choice.children.length === 0) {
+                throw _err("c509/bad-extensions", "an IPAddrBlocks address choice must be null (inherit) or a non-empty CBOR array");
+              }
+              famFields.push(b.sequence(_ipChoiceToDer(choice.children, Number(afi))));
+            }
+            families.push(b.sequence(famFields));
+          }
+          return b.sequence(families);
+        }
+        // ASIdentifiers (and its v2 twin): null = inherit, else a flat array of uint / [min,max].
+        // Only the asnum field is representable -- a present rdi has no compact form (sec. 3.3), so a
+        // certificate carrying one rides the ~oid byte-string form and never reaches this arm.
+        case "autonomousSysIds":
+        case "autonomousSysIdsV2": {
+          if (_isCborNull(node)) return b.sequence([b.explicit(0, b.nullValue())]);
+          if (node.majorType !== 4 || !node.children || node.children.length === 0) {
+            throw _err("c509/bad-extensions", "an ASIdentifiers value must be null (inherit) or a non-empty CBOR array");
+          }
+          var asKids = node.children, asDers = [], asPrev = null, asPrevHigh = null;
+          for (var asi2 = 0; asi2 < asKids.length; asi2++) {
+            var it = asKids[asi2];
+            if (it.majorType === 4) {
+              if (!it.children || it.children.length !== 2) throw _err("c509/bad-extensions", "an ASIdentifiers range must be exactly [min, max]");
+              var amin = _asDelta(it.children[0], asPrev), amax = _asDelta(it.children[1], amin);
+              if (amax <= amin) throw _err("c509/bad-extensions", "an ASIdentifiers range must be ascending (RFC 3779 sec. 3.2.3.6)");
+              if (asPrevHigh !== null && amin <= asPrevHigh + 1n) throw _err("c509/bad-extensions", "ASIdentifiers must be sorted, non-overlapping and maximally merged (RFC 3779 sec. 3.2.3.4)");
+              asDers.push(b.sequence([b.integer(amin), b.integer(amax)]));
+              asPrev = amax;
+              asPrevHigh = amax;
+            } else {
+              var aid = _asDelta(it, asPrev);
+              if (asPrevHigh !== null && aid <= asPrevHigh + 1n) throw _err("c509/bad-extensions", "ASIdentifiers must be sorted, non-overlapping and maximally merged (RFC 3779 sec. 3.2.3.4)");
+              asDers.push(b.integer(aid));
+              asPrev = aid;
+              asPrevHigh = aid;
+            }
+          }
+          return b.sequence([b.explicit(0, b.sequence(asDers))]);
+        }
         case "certificatePolicies": {
           if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a certificatePolicies value must be a CBOR array");
           var cpKids = node.children;
@@ -8548,6 +9272,70 @@ var require_schema_c509 = __commonJS({
               return r.triple;
             }));
           }
+          // IPAddrBlocks -> the flat (AFI, SAFI, choice) array. Any shape the compact form cannot
+          // represent exactly returns null, so the extension rides the ~oid byte-string form intact.
+          case "ipAddrBlocks":
+          case "ipAddrBlocksV2": {
+            if (!_isUniversal(node, asn1.TAGS.SEQUENCE) || !node.children || node.children.length === 0) return null;
+            var ipOut = [], prevFamOct = null;
+            for (var ifi = 0; ifi < node.children.length; ifi++) {
+              var fam = node.children[ifi];
+              if (!_isUniversal(fam, asn1.TAGS.SEQUENCE) || !fam.children || fam.children.length !== 2) return null;
+              var famOct = asn1.read.octetString(fam.children[0]);
+              if (famOct.length !== 2 && famOct.length !== 3) return null;
+              if (prevFamOct !== null && _famOctCmp(prevFamOct, famOct) >= 0) return null;
+              prevFamOct = famOct;
+              var afiVal = famOct[0] << 8 | famOct[1];
+              ipOut.push(cbor.build.uint(BigInt(afiVal)));
+              ipOut.push(famOct.length === 3 ? cbor.build.uint(BigInt(famOct[2])) : cbor.build.nullValue());
+              var ch = fam.children[1];
+              if (_isUniversal(ch, asn1.TAGS.NULL)) {
+                ipOut.push(cbor.build.nullValue());
+                continue;
+              }
+              var chOut = _ipChoiceFromDer(ch, afiVal);
+              if (!chOut) return null;
+              ipOut.push(chOut);
+            }
+            return cbor.build.array(ipOut);
+          }
+          // ASIdentifiers -> null (inherit) or the flat delta array. Only asnum is representable: a
+          // present rdi has no compact form (sec. 3.3), so such a certificate returns null here.
+          case "autonomousSysIds":
+          case "autonomousSysIdsV2": {
+            if (!_isUniversal(node, asn1.TAGS.SEQUENCE) || !node.children || node.children.length !== 1) return null;
+            var asnum = node.children[0];
+            if (asnum.tagClass !== "context" || asnum.tagNumber !== 0 || !asnum.children || asnum.children.length !== 1) return null;
+            var inner = asnum.children[0];
+            if (_isUniversal(inner, asn1.TAGS.NULL)) return cbor.build.nullValue();
+            if (!_isUniversal(inner, asn1.TAGS.SEQUENCE) || !inner.children || inner.children.length === 0) return null;
+            var asOut = [], asPrevOut = null, asPrevHigh = null;
+            for (var aoi = 0; aoi < inner.children.length; aoi++) {
+              var el = inner.children[aoi], elLo, elHi;
+              if (_isUniversal(el, asn1.TAGS.INTEGER)) {
+                elLo = asn1.read.integer(el);
+                elHi = elLo;
+                if (elLo < 0n || elLo > 4294967295n) return null;
+              } else if (_isUniversal(el, asn1.TAGS.SEQUENCE) && el.children && el.children.length === 2) {
+                elLo = asn1.read.integer(el.children[0]);
+                elHi = asn1.read.integer(el.children[1]);
+                if (elLo < 0n || elHi > 4294967295n || elHi <= elLo) return null;
+              } else return null;
+              if (asPrevHigh !== null && elLo <= asPrevHigh + 1n) return null;
+              if (el.tagNumber === asn1.TAGS.INTEGER) {
+                asOut.push(cbor.build.int(asPrevOut === null ? elLo : elLo - asPrevOut));
+                asPrevOut = elLo;
+              } else {
+                asOut.push(cbor.build.array([
+                  cbor.build.int(asPrevOut === null ? elLo : elLo - asPrevOut),
+                  cbor.build.int(elHi - elLo)
+                ]));
+                asPrevOut = elHi;
+              }
+              asPrevHigh = elHi;
+            }
+            return cbor.build.array(asOut);
+          }
           case "certificatePolicies": {
             if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
             var cpOut = [];
@@ -8787,6 +9575,9 @@ var require_schema_c509 = __commonJS({
       var out = [];
       var kids = node.children || [];
       if (kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a C509 extensions array must be id/value pairs (dangling extension identifier)");
+      if (!isNative && kids.length === 2 && (kids[0].majorType === 0 || kids[0].majorType === 1) && (kids[1].majorType === 0 || kids[1].majorType === 1) && Math.abs(Number(cbor.read.int(kids[0]))) === 2) {
+        throw _err("c509/bad-extensions", "an extensions field holding only keyUsage must be encoded as a single CBOR int, not an array (draft sec. 3.1.10)");
+      }
       for (var i = 0; i + 1 < kids.length; i += 2) {
         var idNode = kids[i], valNode = kids[i + 1];
         var name, extOid, critical, valContent;
@@ -8902,15 +9693,20 @@ var require_schema_c509 = __commonJS({
     }
     function _reconstructDer(r, sigNode) {
       var sigAlgSeq = _reconAlgId(r.signatureAlgorithm);
+      var subjectName = _reconName(r.subject);
+      var spelledIssuer = r.issuer && r.issuer.rdns ? _reconName(r.issuer) : null;
+      if (spelledIssuer !== null && spelledIssuer.equals(subjectName)) {
+        throw _err("c509/bad-name", "an issuer identical to the subject must be encoded as the CBOR simple value null (draft sec. 3.1.4)");
+      }
       var tbsFields = [
         b.explicit(0, b.integer(2n)),
         // version v3 (type-3 is X.509 v3)
         b.integer(r.serialNumber),
         sigAlgSeq,
-        _reconName(r.issuer && r.issuer.rdns ? r.issuer : r.subject),
+        spelledIssuer === null ? subjectName : spelledIssuer,
         // null issuer -> issuer == subject
         b.sequence([_reconTime(r.validity.notBefore), _reconTime(r.validity.notAfter)]),
-        _reconName(r.subject),
+        subjectName,
         _reconSpki(r.subjectPublicKeyAlgorithm, r.subjectPublicKey, r.rsaPublicKey)
       ];
       if (r.extensions.length) tbsFields.push(_reconExtensions(r.extensions));
@@ -9012,7 +9808,9 @@ var require_schema_c509 = __commonJS({
     }
     function _encSpecialText(rdn) {
       if (rdn.eui64) return cbor.build.tag(48, cbor.build.byteString(rdn.eui64));
-      return cbor.build.textString(String(rdn.value));
+      var v = String(rdn.value);
+      if (v.length >= 2 && _HEX_OPTIMIZED.test(v)) return cbor.build.byteString(Buffer.from(v, "hex"));
+      return cbor.build.textString(v);
     }
     function _encName(name, isSubject) {
       if (name === null || name === void 0) {
@@ -9197,6 +9995,7 @@ var require_schema_c509 = __commonJS({
       } catch (e) {
         throw _err("c509/bad-input", "the input is not a valid X.509 certificate", e);
       }
+      if (c.version !== 3) throw _err("c509/non-invertible", "C509 covers X.509 v3 certificates; got v" + c.version);
       if (!/^ecdsa/i.test(c.signatureAlgorithm.name || "")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
       if (c.subjectPublicKeyInfo.algorithm.name !== "ecPublicKey") throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
       var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
@@ -9210,7 +10009,13 @@ var require_schema_c509 = __commonJS({
         serialNumber: c.serialNumber,
         // no serialNumberHex -> the encoder uses the minimal ~biguint magnitude
         signatureAlgorithm: { name: c.signatureAlgorithm.name, oid: c.signatureAlgorithm.oid },
-        issuer: _c509NameFromDer(c.issuer.bytes),
+        // sec. 3.1.4: "If the 'issuer' field is identical to the 'subject' field, e.g., in case of
+        // self-signed certificates, then the 'issuer' field MUST be encoded as the CBOR simple value
+        // null." Compared on the RAW DER bytes, not on a canonicalized name: the reconstruction rebuilds
+        // a null issuer FROM the subject, so two names that merely compare equal (a PrintableString
+        // against a UTF8String of the same characters) would rebuild different bytes and break the
+        // signature that covers them. Byte-identical is exactly the condition under which that is safe.
+        issuer: c.issuer.bytes.equals(c.subject.bytes) ? null : _c509NameFromDer(c.issuer.bytes),
         validity: { notBefore: c.validity.notBefore, notAfter: c.validity.notAfter.getTime() === _NO_EXPIRY ? null : c.validity.notAfter },
         subject: _c509NameFromDer(c.subject.bytes),
         subjectPublicKeyAlgorithm: { name: "ecPublicKey", oid: c.subjectPublicKeyInfo.algorithm.oid, curve },
@@ -9679,9 +10484,9 @@ var require_schema_cms = __commonJS({
     WRAP_KEK_LENGTHS[oid.byName("aes192-wrap")] = 24;
     WRAP_KEK_LENGTHS[oid.byName("aes256-wrap")] = 32;
     var KEM_CT_LENGTHS = {};
-    KEM_CT_LENGTHS[oid.byName("id-ml-kem-512")] = 768;
-    KEM_CT_LENGTHS[oid.byName("id-ml-kem-768")] = 1088;
-    KEM_CT_LENGTHS[oid.byName("id-ml-kem-1024")] = 1568;
+    ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function(n) {
+      KEM_CT_LENGTHS[oid.byName(n)] = oid.kemParams(n).ct;
+    });
     var AEAD_GCM_ICVLENS = /* @__PURE__ */ new Set([12, 13, 14, 15, 16]);
     var AEAD_CCM_ICVLENS = /* @__PURE__ */ new Set([4, 6, 8, 10, 12, 14, 16]);
     var AEAD_ALGS = {};
@@ -14755,7 +15560,7 @@ var require_sign_scheme = __commonJS({
     function _importKey(key, imp, E) {
       if (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type === "private") {
         _assertKeyMatchesScheme(key, imp, E);
-        return Promise.resolve(key);
+        return webcrypto.adoptKey(key, imp, ["sign"], E, "bad-input");
       }
       var der;
       if (Buffer.isBuffer(key)) der = key;
@@ -15005,9 +15810,7 @@ var require_pki_build = __commonJS({
         if (bc.cA != null && typeof bc.cA !== "boolean") throw E("bad-input", "basicConstraints cA must be a boolean");
         if (bc.critical != null && typeof bc.critical !== "boolean") throw E("bad-input", "basicConstraints critical must be a boolean");
         if (bc.pathLen != null) pathLen(bc.pathLen);
-        Object.keys(bc).forEach(function(k) {
-          if (k !== "cA" && k !== "pathLen" && k !== "critical") throw E("bad-input", "unknown basicConstraints field " + JSON.stringify(k));
-        });
+        guard.identifier.assertKnownKeys(bc, BC_KEYS, E, "bad-input", "unknown basicConstraints field ");
       }
       function extBasicConstraints(spec) {
         var children = [];
@@ -15103,6 +15906,7 @@ var require_pki_build = __commonJS({
         var last = n.children[n.children.length - 1];
         if (last.tagNumber !== asn1.TAGS.OCTET_STRING || last.tagClass !== "universal") throw E("bad-input", "pre-encoded extension [" + idx + "] extnValue must be an OCTET STRING");
       }
+      var BC_KEYS = { cA: 1, pathLen: 1, critical: 1 };
       var REQ_EXT_KEYS = {
         subjectAltName: 1,
         keyUsage: 1,
@@ -15139,8 +15943,8 @@ var require_pki_build = __commonJS({
           }));
         }
         if (!extSpec || typeof extSpec !== "object") throw E("bad-input", "requested extensions must be an object or an array of pre-encoded Extension DER");
-        Object.keys(extSpec).forEach(function(k) {
-          if (!REQ_EXT_KEYS[k]) throw E("bad-input", "unknown requested extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension");
+        guard.identifier.assertKnownKeys(extSpec, REQ_EXT_KEYS, E, "bad-input", function(k) {
+          return "unknown requested extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension";
         });
         var out = [];
         if (extSpec.subjectKeyIdentifier != null) {
@@ -15271,6 +16075,7 @@ var require_crmf_sign = __commonJS({
     var pkix = require_schema_pkix();
     var pkiBuild = require_pki_build();
     var frameworkError = require_framework_error();
+    var guard = require_guard_all();
     var CrmfError = frameworkError.CrmfError;
     var b = asn1.build;
     function _err(code, message, cause) {
@@ -15294,6 +16099,7 @@ var require_crmf_sign = __commonJS({
       EXT_DECODERS
     });
     var KNOWN_SPEC_KEYS = { certReqId: 1, certTemplate: 1, controls: 1, regInfo: 1, pop: 1 };
+    var KNOWN_BATCH_KEYS = { messages: 1 };
     var KNOWN_TEMPLATE_KEYS = { version: 1, subject: 1, publicKey: 1, validity: 1, extensions: 1, issuer: 1 };
     var REVOCATION_TEMPLATE_KEYS = { version: 1, subject: 1, publicKey: 1, validity: 1, extensions: 1, issuer: 1, serialNumber: 1 };
     function _ctlUtf8(v) {
@@ -15321,9 +16127,7 @@ var require_crmf_sign = __commonJS({
     function _encodeCertTemplate(tpl, opts) {
       if (!tpl || typeof tpl !== "object" || Buffer.isBuffer(tpl)) throw _err("crmf/bad-cert-template", "certTemplate must be an object");
       var allowed = opts && opts.revocation ? REVOCATION_TEMPLATE_KEYS : KNOWN_TEMPLATE_KEYS;
-      Object.keys(tpl).forEach(function(k) {
-        if (!allowed[k]) throw _err("crmf/bad-input", "unknown certTemplate field " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(tpl, allowed, _err, "crmf/bad-input", "unknown certTemplate field ");
       var fields = [];
       if (tpl.version != null) {
         if (tpl.version !== 2) throw _err("crmf/bad-version", "certTemplate version MUST be 2 (v3) if supplied (RFC 4211 sec. 5)");
@@ -15368,9 +16172,11 @@ var require_crmf_sign = __commonJS({
       }
       if (!spec || typeof spec !== "object") throw _err("crmf/bad-input", label + " must be an object or an array of pre-encoded AttributeTypeAndValue DER");
       var out = [], seen = {};
+      guard.identifier.assertKnownKeys(spec, valueMap, _err, "crmf/bad-input", function(k) {
+        return "unknown " + label + " " + JSON.stringify(k) + "; pass a pre-encoded AttributeTypeAndValue DER via the array form for a " + label + " entry outside " + Object.keys(valueMap).join("/");
+      });
       Object.keys(spec).forEach(function(k) {
         var enc = valueMap[k];
-        if (!enc) throw _err("crmf/bad-input", "unknown " + label + " " + JSON.stringify(k) + "; pass a pre-encoded AttributeTypeAndValue DER via the array form for a " + label + " entry outside " + Object.keys(valueMap).join("/"));
         var typeOid = O(k);
         if (seen[typeOid]) throw _err(code, "duplicate " + label + " type " + k);
         seen[typeOid] = true;
@@ -15441,9 +16247,7 @@ var require_crmf_sign = __commonJS({
     }
     function _buildCertReqMsg(spec, key, opts) {
       if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crmf/bad-input", "each certificate-request-message spec must be an object");
-      Object.keys(spec).forEach(function(k) {
-        if (!KNOWN_SPEC_KEYS[k]) throw _err("crmf/bad-input", "unknown spec field " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "crmf/bad-input", "unknown spec field ");
       if (spec.certTemplate == null) throw _err("crmf/bad-input", "spec.certTemplate is required");
       var signingKey = key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key ? key.key : key;
       var template = _encodeCertTemplate(spec.certTemplate);
@@ -15463,8 +16267,8 @@ var require_crmf_sign = __commonJS({
       var specs;
       if (spec.messages != null) {
         if (!Array.isArray(spec.messages)) throw _err("crmf/bad-input", "spec.messages must be an array of certificate-request-message specs");
-        Object.keys(spec).forEach(function(k) {
-          if (k !== "messages") throw _err("crmf/bad-input", "unknown batch-envelope field " + JSON.stringify(k) + " -- a batch spec carries only 'messages'");
+        guard.identifier.assertKnownKeys(spec, KNOWN_BATCH_KEYS, _err, "crmf/bad-input", function(k) {
+          return "unknown batch-envelope field " + JSON.stringify(k) + " -- a batch spec carries only 'messages'";
         });
         specs = spec.messages;
       } else {
@@ -15509,8 +16313,17 @@ var require_pbes2 = __commonJS({
       PRF_NODE_BY_OID[O(n)] = PRF_NODE_BY_NAME[n];
     });
     var CONTENT_KEYBITS = {};
-    [["aes128-CBC", 128], ["aes192-CBC", 192], ["aes256-CBC", 256], ["aes128-GCM", 128], ["aes192-GCM", 192], ["aes256-GCM", 256]].forEach(function(r) {
+    var CONTENT_MODE = {};
+    [
+      ["aes128-CBC", 128, "cbc"],
+      ["aes192-CBC", 192, "cbc"],
+      ["aes256-CBC", 256, "cbc"],
+      ["aes128-GCM", 128, "gcm"],
+      ["aes192-GCM", 192, "gcm"],
+      ["aes256-GCM", 256, "gcm"]
+    ].forEach(function(r) {
       CONTENT_KEYBITS[O(r[0])] = r[1];
+      CONTENT_MODE[O(r[0])] = r[2];
     });
     function passwordBytes(p, E, prefix) {
       if (Buffer.isBuffer(p)) return p;
@@ -15663,6 +16476,7 @@ var require_pbes2 = __commonJS({
       pbes2Encrypt,
       pbes2Decrypt,
       CONTENT_KEYBITS,
+      CONTENT_MODE,
       pbmac1AlgId,
       pbmac1
     };
@@ -15769,6 +16583,7 @@ var require_cmp_build = __commonJS({
     var CRMF_BODY = { ir: 1, cr: 1, kur: 1 };
     var CERT_REP_ARM = { ip: 1, cp: 1, kup: 1, ccp: 1 };
     var KNOWN_OPTS_KEYS = { key: 1, cert: 1, mac: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 };
+    var KNOWN_MESSAGE_KEYS = { header: 1, body: 1 };
     var KNOWN_MAC_KEYS = { secret: 1, salt: 1, iterationCount: 1, prf: 1, keyLength: 1, algorithm: 1 };
     var PBMAC1_DEFAULT_ITER = 1e5;
     var PBMAC1_DEFAULT_SALT_BYTES = 16;
@@ -15858,9 +16673,7 @@ var require_cmp_build = __commonJS({
     }
     function _encodeHeader(headerSpec, protectionAlgDer, pvno) {
       if (!headerSpec || typeof headerSpec !== "object" || Buffer.isBuffer(headerSpec)) throw _err("cmp/bad-input", "message.header must be an object");
-      Object.keys(headerSpec).forEach(function(k) {
-        if (!KNOWN_HEADER_KEYS[k]) throw _err("cmp/bad-input", "unknown header field " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(headerSpec, KNOWN_HEADER_KEYS, _err, "cmp/bad-input", "unknown header field ");
       if (headerSpec.sender == null) throw _err("cmp/bad-input", "message.header.sender is required (GeneralName)");
       if (headerSpec.recipient == null) throw _err("cmp/bad-input", "message.header.recipient is required (GeneralName)");
       var children = [
@@ -16183,9 +16996,7 @@ var require_cmp_build = __commonJS({
       }
       var m = opts.mac;
       if (!m || typeof m !== "object" || Buffer.isBuffer(m)) throw _err("cmp/bad-input", "opts.mac must be an object { secret, salt?, iterationCount?, prf?, keyLength? }");
-      Object.keys(m).forEach(function(k) {
-        if (!KNOWN_MAC_KEYS[k]) throw _err("cmp/bad-input", "unknown opts.mac field " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(m, KNOWN_MAC_KEYS, _err, "cmp/bad-input", "unknown opts.mac field ");
       if (m.algorithm != null && m.algorithm !== "pbmac1") throw _err("cmp/unsupported-algorithm", "opts.mac.algorithm " + JSON.stringify(m.algorithm) + " is not supported (v1 ships pbmac1; passwordBasedMac is deferred)");
       var secret = m.secret;
       if (typeof secret !== "string" || !secret) {
@@ -16224,12 +17035,10 @@ var require_cmp_build = __commonJS({
     function _build(message, opts) {
       opts = opts || {};
       if (!message || typeof message !== "object" || Buffer.isBuffer(message)) throw _err("cmp/bad-input", "the PKIMessage spec must be an object { header, body }");
-      Object.keys(message).forEach(function(k) {
-        if (k !== "header" && k !== "body") throw _err("cmp/bad-input", "unknown message field " + JSON.stringify(k) + " (a message carries only header + body)");
-      });
-      Object.keys(opts).forEach(function(k) {
-        if (!KNOWN_OPTS_KEYS[k]) throw _err("cmp/bad-input", "unknown opts field " + JSON.stringify(k));
+      guard.identifier.assertKnownKeys(message, KNOWN_MESSAGE_KEYS, _err, "cmp/bad-input", function(k) {
+        return "unknown message field " + JSON.stringify(k) + " (a message carries only header + body)";
       });
+      guard.identifier.assertKnownKeys(opts, KNOWN_OPTS_KEYS, _err, "cmp/bad-input", "unknown opts field ");
       if (message.header == null) throw _err("cmp/bad-input", "message.header is required");
       if (message.body == null) throw _err("cmp/bad-input", "message.body is required");
       var prot = _resolveProtection(opts);
@@ -16338,9 +17147,7 @@ var require_cmp_build = __commonJS({
     }
     function _transfer(url, message, opts) {
       opts = opts || {};
-      Object.keys(opts).forEach(function(k) {
-        if (!KNOWN_TRANSFER_OPTS[k]) throw _err("cmp/bad-input", "unknown opts field " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(opts, KNOWN_TRANSFER_OPTS, _err, "cmp/bad-input", "unknown opts field ");
       var der = _cmpMessageDer(message);
       var parsedUrl;
       try {
@@ -16387,8 +17194,8 @@ var require_cmp_build = __commonJS({
     var KNOWN_WELLKNOWN_OPTS = { label: 1, operation: 1 };
     function wellKnownUrl(base, opts) {
       opts = opts || {};
-      Object.keys(opts).forEach(function(k) {
-        if (!KNOWN_WELLKNOWN_OPTS[k]) throw _err("cmp/bad-input", "unknown wellKnownUrl option " + JSON.stringify(k) + " (expected label / operation)");
+      guard.identifier.assertKnownKeys(opts, KNOWN_WELLKNOWN_OPTS, _err, "cmp/bad-input", function(k) {
+        return "unknown wellKnownUrl option " + JSON.stringify(k) + " (expected label / operation)";
       });
       var u;
       try {
@@ -16885,9 +17692,7 @@ var require_cmp_verify = __commonJS({
     async function _verify(message, opts) {
       if (opts == null) opts = {};
       if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cmp/bad-input", "opts must be an object");
-      Object.keys(opts).forEach(function(k) {
-        if (!KNOWN_VERIFY_OPTS[k]) throw _err("cmp/bad-input", "unknown opts field " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(opts, KNOWN_VERIFY_OPTS, _err, "cmp/bad-input", "unknown opts field ");
       ["transactionID", "expectRecipNonce"].forEach(function(k) {
         if (opts[k] != null && !Buffer.isBuffer(opts[k]) && !(opts[k] instanceof Uint8Array)) throw _err("cmp/bad-input", "opts." + k + " must be a Buffer / Uint8Array");
       });
@@ -17271,9 +18076,7 @@ var require_cmp_session = __commonJS({
     function session(opts) {
       if (opts == null) opts = {};
       if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("cmp/bad-input", "opts must be an object");
-      Object.keys(opts).forEach(function(k) {
-        if (!KNOWN_SESSION_OPTS[k]) throw _err("cmp/bad-input", "unknown session opts field " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(opts, KNOWN_SESSION_OPTS, _err, "cmp/bad-input", "unknown session opts field ");
       opts = Object.assign({}, opts);
       if (typeof opts.url !== "string" || !opts.url) throw _err("cmp/bad-input", "opts.url (the CMP endpoint) is required");
       var isSig = opts.key != null || opts.cert != null;
@@ -20338,15 +21141,26 @@ var require_cms_encrypt = __commonJS({
       var pub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: wcName }, false, ["encapsulateBits"]);
       var kem = await subtle.encapsulateBits({ name: wcName }, pub);
       var ss = Buffer.from(kem.sharedKey), kemct = Buffer.from(kem.ciphertext);
-      var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
-      var kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapName, kekBytes, ukm) }, ssKey, kekBytes * 8));
-      var encryptedKey = await _aesKwWrap(kek, cek);
-      var rid = _rid(cert, opts.keyIdentifier);
-      var kemriKids = [b.integer(0n), rid.node, _algId(oid.name(keyOid), "absent"), b.octetString(kemct), _algId("hkdfWithSha256", "absent"), b.integer(BigInt(kekBytes))];
-      if (ukm) kemriKids.push(b.explicit(0, b.octetString(ukm)));
-      kemriKids.push(_algId(wrapName, "absent"), b.octetString(encryptedKey));
-      var kemri = b.sequence(kemriKids);
-      return { tag: 4, node: b.sequence([b.oid(O("kem")), kemri]) };
+      var kek = null, kekAb = null;
+      try {
+        var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
+        kekAb = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapName, kekBytes, ukm) }, ssKey, kekBytes * 8);
+        kek = Buffer.from(kekAb);
+        var encryptedKey = await _aesKwWrap(kek, cek);
+        var rid = _rid(cert, opts.keyIdentifier);
+        var kemriKids = [b.integer(0n), rid.node, _algId(oid.name(keyOid), "absent"), b.octetString(kemct), _algId("hkdfWithSha256", "absent"), b.integer(BigInt(kekBytes))];
+        if (ukm) kemriKids.push(b.explicit(0, b.octetString(ukm)));
+        kemriKids.push(_algId(wrapName, "absent"), b.octetString(encryptedKey));
+        var kemri = b.sequence(kemriKids);
+        return { tag: 4, node: b.sequence([b.oid(O("kem")), kemri]) };
+      } finally {
+        guard.secret.zeroizeAll(
+          [ss, kek, kem.sharedKey ? new Uint8Array(kem.sharedKey) : null, kekAb ? new Uint8Array(kekAb) : null],
+          CmsError,
+          "cms/bad-input",
+          "the KEM shared secret"
+        );
+      }
     }
     async function _aesKwWrap(kek, cek) {
       var kekKey = await subtle.importKey("raw", kek, { name: "AES-KW" }, false, ["wrapKey"]);
@@ -20602,6 +21416,7 @@ var require_cms_decrypt = __commonJS({
       return new CmsError("cms/decrypt-failed", "the CMS content could not be decrypted (uniform by design -- padding / integrity / key-unwrap failures are indistinguishable to defeat oracles)");
     }
     var CONTENT_KEYBITS = pbes2.CONTENT_KEYBITS;
+    var CONTENT_MODE = pbes2.CONTENT_MODE;
     async function decrypt(input, keyMaterial, opts) {
       opts = opts || {};
       if (keyMaterial == null || typeof keyMaterial !== "object") throw _err("cms/bad-input", "decrypt requires a key-material object");
@@ -20619,6 +21434,7 @@ var require_cms_decrypt = __commonJS({
       var recips = parsed.recipientInfos || [];
       var candidates = _selectCandidates(recips, keyMaterial, opts);
       var eci = parsed.encryptedContentInfo;
+      _assertContentCipherMode(eci, ct);
       for (var ci = 0; ci < candidates.length; ci++) {
         try {
           _assertSupported(candidates[ci].ri, keyMaterial);
@@ -20814,7 +21630,7 @@ var require_cms_decrypt = __commonJS({
       var inner = asn1.decode(kea.parameters);
       var innerOid = asn1.read.oid(inner.children[0]);
       var innerBits = CONTENT_KEYBITS[innerOid];
-      if (!innerBits || !/CBC/.test(oid.name(innerOid) || "")) throw _err("cms/unsupported-algorithm", "unsupported pwri inner cipher");
+      if (!innerBits || CONTENT_MODE[innerOid] !== "cbc") throw _err("cms/unsupported-algorithm", "unsupported pwri inner cipher");
       var iv = asn1.read.octetString(inner.children[1]);
       var kek = nodeCrypto.pbkdf2Sync(pbes2.passwordBytes(km.password, _err, "cms"), pb.salt, pb.iterations, innerBits / 8, pb.prfNode);
       return _pwriUnwrap(kek, ri.encryptedKey, iv, innerBits);
@@ -20831,10 +21647,30 @@ var require_cms_decrypt = __commonJS({
       var wrapAlg = k.wrap;
       if (WRAP_KEK_LENGTHS[wrapAlg.oid] !== kekBytes) throw _fail();
       var priv = await subtle.importKey("pkcs8", _normKeyDer(km.key), { name: wcName }, false, ["decapsulateBits"]);
-      var ss = Buffer.from(await subtle.decapsulateBits({ name: wcName }, priv, kemct));
-      var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
-      var kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapAlg.name, kekBytes, k.ukm || null) }, ssKey, kekBytes * 8));
-      return await _aesKwUnwrap(kek, k.encryptedKey);
+      var ss = null, kek = null, ssAb = null, kekAb = null;
+      try {
+        ssAb = await subtle.decapsulateBits({ name: wcName }, priv, kemct);
+        ss = Buffer.from(ssAb);
+        var ssKey = await subtle.importKey("raw", ss, { name: "HKDF" }, false, ["deriveBits"]);
+        kekAb = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: Buffer.alloc(0), info: _kemOtherInfo(wrapAlg.name, kekBytes, k.ukm || null) }, ssKey, kekBytes * 8);
+        kek = Buffer.from(kekAb);
+        return await _aesKwUnwrap(kek, k.encryptedKey);
+      } finally {
+        guard.secret.zeroizeAll(
+          [ss, kek, ssAb ? new Uint8Array(ssAb) : null, kekAb ? new Uint8Array(kekAb) : null],
+          CmsError,
+          "cms/bad-input",
+          "the KEM shared secret"
+        );
+      }
+    }
+    function _assertContentCipherMode(eci, ct) {
+      var oidStr = eci.contentEncryptionAlgorithm.oid;
+      if (!CONTENT_MODE[oidStr]) return;
+      var wantMode = ct === "authEnvelopedData" ? "gcm" : "cbc";
+      if (CONTENT_MODE[oidStr] !== wantMode) {
+        throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is not a " + wantMode.toUpperCase() + " cipher, which " + ct + " requires (RFC 5083 sec. 2.1 / RFC 5084 sec. 3)");
+      }
     }
     async function _openContent(parsed, eci, cek, ct) {
       var alg = eci.contentEncryptionAlgorithm;
@@ -20906,7 +21742,15 @@ var require_cms_decrypt = __commonJS({
     async function _aesKwUnwrap(kek, wrapped) {
       var kekKey = await subtle.importKey("raw", kek, { name: "AES-KW" }, false, ["unwrapKey"]);
       var raw = await subtle.unwrapKey("raw", wrapped, kekKey, { name: "AES-KW" }, { name: "HMAC", hash: "SHA-256" }, true, ["sign"]);
-      return Buffer.from(await subtle.exportKey("raw", raw));
+      var rawAb = await subtle.exportKey("raw", raw);
+      try {
+        var view = new Uint8Array(rawAb);
+        var out = Buffer.alloc(view.length);
+        out.set(view);
+        return out;
+      } finally {
+        guard.secret.zeroize(new Uint8Array(rawAb), CmsError, "cms/bad-input", "the unwrapped content key");
+      }
     }
     function _eccSharedInfo(wrapName, ukm, kekBytes) {
       var kids = [b.sequence([b.oid(O(wrapName))])];
@@ -23209,8 +24053,8 @@ var require_x509_sign = __commonJS({
         return arr;
       }
       if (typeof extSpec !== "object") throw _err("x509/bad-input", "extensions must be an object or an array of pre-encoded Extension DER");
-      Object.keys(extSpec).forEach(function(k) {
-        if (!KNOWN_EXT_KEYS[k]) throw _err("x509/bad-input", "unknown extension " + JSON.stringify(k) + " in the extensions spec; pass a pre-encoded Extension DER via the array form for a custom extension");
+      guard.identifier.assertKnownKeys(extSpec, KNOWN_EXT_KEYS, _err, "x509/bad-input", function(k) {
+        return "unknown extension " + JSON.stringify(k) + " in the extensions spec; pass a pre-encoded Extension DER via the array form for a custom extension";
       });
       var bc = extSpec.basicConstraints;
       if (bc != null) _validateBcSpec(bc);
@@ -23384,7 +24228,9 @@ var require_csr_sign = __commonJS({
     var pkix = require_schema_pkix();
     var pkiBuild = require_pki_build();
     var frameworkError = require_framework_error();
+    var guard = require_guard_all();
     var CsrError = frameworkError.CsrError;
+    var KNOWN_SPEC_KEYS = { subject: 1, subjectPublicKey: 1, extensionRequest: 1, challengePassword: 1, attributes: 1 };
     var b = asn1.build;
     function _err(code, message, cause) {
       return new CsrError(code, message, cause);
@@ -23425,9 +24271,7 @@ var require_csr_sign = __commonJS({
     function _sign(spec, key, opts) {
       opts = opts || {};
       if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("csr/bad-input", "the certification-request spec must be an object");
-      Object.keys(spec).forEach(function(k) {
-        if (k !== "subject" && k !== "subjectPublicKey" && k !== "extensionRequest" && k !== "challengePassword" && k !== "attributes") throw _err("csr/bad-input", "unknown spec field " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "csr/bad-input", "unknown spec field ");
       var signingKey = key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key ? key.key : key;
       if (signingKey == null) throw _err("csr/bad-input", "a signing key (the subject's private key) is required");
       var subjectSpki = _b.reqDer(spec.subjectPublicKey, "spec.subjectPublicKey (the SPKI DER of the requested key)");
@@ -23595,9 +24439,7 @@ var require_attrcert_sign = __commonJS({
     }
     function _encodeHolder(holder) {
       if (!holder || typeof holder !== "object" || Buffer.isBuffer(holder)) throw _err("attrcert/bad-input", "holder must be an object with exactly one form");
-      Object.keys(holder).forEach(function(k) {
-        if (!KNOWN_HOLDER_KEYS[k]) throw _err("attrcert/bad-input", "unknown holder form " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(holder, KNOWN_HOLDER_KEYS, _err, "attrcert/bad-input", "unknown holder form ");
       var forms = Object.keys(holder).filter(function(k) {
         return holder[k] != null;
       });
@@ -23814,8 +24656,10 @@ var require_attrcert_sign = __commonJS({
         return b.sequence(attrs);
       }
       if (!attrSpec || typeof attrSpec !== "object") throw _err("attrcert/bad-input", "attributes must be an object or an array of pre-encoded Attribute DER");
+      guard.identifier.assertKnownKeys(attrSpec, ATTR_VALUE_ENCODER, _err, "attrcert/bad-input", function(k) {
+        return "unknown attribute " + JSON.stringify(k) + "; pass a pre-encoded Attribute DER via the array form for a custom attribute";
+      });
       Object.keys(attrSpec).forEach(function(k) {
-        if (!ATTR_VALUE_ENCODER[k]) throw _err("attrcert/bad-input", "unknown attribute " + JSON.stringify(k) + "; pass a pre-encoded Attribute DER via the array form for a custom attribute");
         add(O(ATTR_OID_NAME[k]), ATTR_VALUE_ENCODER[k](attrSpec[k]));
       });
       if (!attrs.length) throw _err("attrcert/bad-attributes", "attributes must carry at least one Attribute (RFC 5755 sec. 4.2.7)");
@@ -23850,8 +24694,8 @@ var require_attrcert_sign = __commonJS({
         return b.sequence(exts);
       }
       if (typeof extSpec !== "object") throw _err("attrcert/bad-input", "extensions must be an object or an array of pre-encoded Extension DER");
-      Object.keys(extSpec).forEach(function(k) {
-        if (!EXT_META[k]) throw _err("attrcert/bad-input", "unknown extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension");
+      guard.identifier.assertKnownKeys(extSpec, EXT_META, _err, "attrcert/bad-input", function(k) {
+        return "unknown extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension";
       });
       var out = [], seen = {};
       Object.keys(extSpec).forEach(function(k) {
@@ -23872,9 +24716,7 @@ var require_attrcert_sign = __commonJS({
     function _sign(spec, issuer, opts) {
       opts = opts || {};
       if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("attrcert/bad-input", "the attribute-certificate spec must be an object");
-      Object.keys(spec).forEach(function(k) {
-        if (!KNOWN_SPEC_KEYS[k]) throw _err("attrcert/bad-input", "unknown spec field " + JSON.stringify(k));
-      });
+      guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "attrcert/bad-input", "unknown spec field ");
       issuer = issuer || {};
       if (issuer.key == null) throw _err("attrcert/bad-input", "a signing key (issuer.key, the AA's PKCS#8 private key) is required");
       var issuerDnSpec, aaSpki;
@@ -24056,8 +24898,8 @@ var require_crl_sign = __commonJS({
     }
     function _idpValue(idp) {
       if (!idp || typeof idp !== "object" || Array.isArray(idp) || Buffer.isBuffer(idp)) throw _err("crl/bad-idp", "issuingDistributionPoint must be an object");
-      Object.keys(idp).forEach(function(k) {
-        if (!KNOWN_IDP_KEYS[k]) throw _err("crl/bad-idp", "unknown issuingDistributionPoint field " + JSON.stringify(k) + " (pass a pre-encoded Extension DER via the extensions array for an exotic field like onlySomeReasons)");
+      guard.identifier.assertKnownKeys(idp, KNOWN_IDP_KEYS, _err, "crl/bad-idp", function(k) {
+        return "unknown issuingDistributionPoint field " + JSON.stringify(k) + " (pass a pre-encoded Extension DER via the extensions array for an exotic field like onlySomeReasons)";
       });
       if (idp.onlyContainsAttributeCerts === true) throw _err("crl/bad-idp", "onlyContainsAttributeCerts=TRUE is not permitted for a conforming CRL issuer (RFC 5280 sec. 5.2.5)");
       var children = [];
@@ -24161,8 +25003,8 @@ var require_crl_sign = __commonJS({
         return { exts: out, isDelta };
       }
       if (typeof ext !== "object") throw _err("crl/bad-input", "extensions must be an object or an array of pre-encoded Extension DER");
-      Object.keys(ext).forEach(function(k) {
-        if (!KNOWN_CRL_EXT_KEYS[k]) throw _err("crl/bad-input", "unknown CRL extension " + JSON.stringify(k) + " in the extensions spec; pass a pre-encoded Extension DER via the array form");
+      guard.identifier.assertKnownKeys(ext, KNOWN_CRL_EXT_KEYS, _err, "crl/bad-input", function(k) {
+        return "unknown CRL extension " + JSON.stringify(k) + " in the extensions spec; pass a pre-encoded Extension DER via the array form";
       });
       isDelta = ext.deltaCRLIndicator != null;
       if (ext.authorityKeyIdentifier != null) push("authorityKeyIdentifier", false, _extAki(_akiKeyId(ext.authorityKeyIdentifier, ctx)));
@@ -24394,7 +25236,6 @@ var require_key = __commonJS({
     var guard = require_guard_all();
     var b = asn1.build;
     var subtle = webcrypto.webcrypto.subtle;
-    var CryptoKey = webcrypto.CryptoKey;
     var KeyError = frameworkError.KeyError;
     var PemError = frameworkError.PemError;
     function O(n) {
@@ -24435,7 +25276,7 @@ var require_key = __commonJS({
       INFER_ALG[O("id-slh-dsa-" + s)] = { name: ("SLH-DSA-" + s).toUpperCase() };
     });
     function _isCryptoKey(x) {
-      return x instanceof CryptoKey;
+      return webcrypto.isCryptoKeyLike(x);
     }
     function _algName(a) {
       return typeof a === "string" ? a : a && a.name;
@@ -24443,7 +25284,7 @@ var require_key = __commonJS({
     async function _toPrivateKeyDer(input) {
       if (_isCryptoKey(input)) {
         if (input.type !== "private") throw _err("key/bad-input", "a private CryptoKey is required (got a " + input.type + " key)");
-        return Buffer.from(await subtle.exportKey("pkcs8", input));
+        return webcrypto.exportAnyKey(input, _err, "key/bad-input");
       }
       return pkix.coerceToDer(input, { pemLabel: "PRIVATE KEY", PemError, ErrorClass: KeyError, prefix: "key" });
     }
@@ -24498,15 +25339,11 @@ var require_key = __commonJS({
     async function export_(key, opts) {
       opts = opts || {};
       if (!_isCryptoKey(key)) throw _err("key/bad-input", "export expects a WebCrypto CryptoKey");
-      var format, defaultLabel;
-      if (key.type === "private") {
-        format = "pkcs8";
-        defaultLabel = "PRIVATE KEY";
-      } else if (key.type === "public") {
-        format = "spki";
-        defaultLabel = "PUBLIC KEY";
-      } else throw _err("key/bad-input", "export supports asymmetric (private / public) CryptoKeys only");
-      var der = Buffer.from(await subtle.exportKey(format, key));
+      var defaultLabel;
+      if (key.type === "private") defaultLabel = "PRIVATE KEY";
+      else if (key.type === "public") defaultLabel = "PUBLIC KEY";
+      else throw _err("key/bad-input", "export supports asymmetric (private / public) CryptoKeys only");
+      var der = await webcrypto.exportAnyKey(key, _err, "key/bad-input");
       var fmt = opts.format || "der";
       if (fmt === "der") return der;
       if (fmt === "pem") return pkix.pemEncode(der, opts.label || defaultLabel, PemError);
@@ -27751,7 +28588,8 @@ var require_jose = __commonJS({
   "node_modules/@blamejs/pki/lib/jose.js"(exports2, module2) {
     "use strict";
     var constants = require_constants();
-    var webcrypto = require_webcrypto().webcrypto;
+    var wcEngine = require_webcrypto();
+    var webcrypto = wcEngine.webcrypto;
     var frameworkError = require_framework_error();
     var guard = require_guard_all();
     var edwardsPoint = require_edwards_point();
@@ -27935,7 +28773,7 @@ var require_jose = __commonJS({
       var payload = opts.payload;
       if (!Buffer.isBuffer(payload)) throw E("jose/bad-input", "payload must be a Buffer (empty Buffer for POST-as-GET)");
       payload = guard.bytes.view(payload, JoseError, "jose/bad-input", "payload");
-      if (!opts.key || typeof opts.key !== "object" || typeof opts.key.algorithm !== "object") throw E("jose/bad-input", "a private or secret CryptoKey (opts.key) is required");
+      if (!wcEngine.isCryptoKeyLike(opts.key)) throw E("jose/bad-input", "a private or secret CryptoKey (opts.key) is required");
       var checked = _checkHeader(header, opts.profile || "acme-outer");
       if ((checked.algRow.kty === "RSA" || checked.algRow.kty === "oct") && (!opts.key.algorithm.hash || opts.key.algorithm.hash.name !== checked.algRow.hash)) {
         throw E("jose/bad-key", "the signing key's hash does not match the algorithm " + checked.alg);
@@ -27948,7 +28786,8 @@ var require_jose = __commonJS({
       var payloadB64 = payload.length === 0 ? "" : b64uEncode(payload);
       var signingInput = Buffer.from(protectedB64 + "." + payloadB64, "ascii");
       var jwk = header.jwk || opts.jwk || {};
-      var sigBuf = Buffer.from(await webcrypto.subtle.sign(_cryptoAlg(checked.algRow, jwk, opts.key), opts.key, signingInput));
+      var signKey = await wcEngine.adoptKey(opts.key, null, ["sign"], E, "jose/bad-input");
+      var sigBuf = Buffer.from(await webcrypto.subtle.sign(_cryptoAlg(checked.algRow, jwk, signKey), signKey, signingInput));
       var want = _expectedSigBytes(checked.algRow, jwk, opts.key);
       if (want != null && sigBuf.length !== want) throw E("jose/bad-key", "the signing key produced a " + sigBuf.length + "-byte signature but " + checked.alg + " requires " + want + " (the key does not match the algorithm)");
       if (header.jwk) {
@@ -30077,6 +30916,7 @@ var require_inspect = __commonJS({
     }
     var NS = pkix.makeNS("inspect", InspectError, oid);
     var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+    var OID_UNOTICE = oid.byName("unotice");
     var HEX = "0123456789abcdef";
     function _hexColon(buf, opts) {
       opts = opts || {};
@@ -30187,14 +31027,14 @@ var require_inspect = __commonJS({
       }
       return _hexColon(buf, {});
     }
+    function _gnDn(value) {
+      return value && Array.isArray(value.rdns) ? _dnString(value) : value && value.dn || "";
+    }
     function _gn(g) {
       if (!g || typeof g !== "object") return "";
       var t = g.tagNumber;
       if (t === 7 && Buffer.isBuffer(g.value)) return "IP Address:" + _ipString(g.value);
-      if (t === 4) {
-        var dn = g.value && Array.isArray(g.value.rdns) ? _dnString(g.value) : g.value && g.value.dn || "";
-        return "DirName:" + dn;
-      }
+      if (t === 4) return "DirName:" + _gnDn(g.value);
       if (t === 0) return "othername:" + (Buffer.isBuffer(g.bytes) ? _hexColon(g.bytes, {}) : "<unsupported>");
       var kind = GN_KIND[t] || "tag" + t;
       var v = typeof g.value === "string" ? _clean(g.value) : Buffer.isBuffer(g.value) ? _hexColon(g.value, {}) : Buffer.isBuffer(g.bytes) ? _hexColon(g.bytes, {}) : "";
@@ -30325,6 +31165,18 @@ var require_inspect = __commonJS({
                 label = oid.name(qid);
               } catch (_e) {
               }
+              if (qid === OID_UNOTICE) {
+                var texts = pkix.userNoticeTexts(q);
+                if (texts.length && texts.every(function(t) {
+                  return t.text !== null && (t.field !== "organization" || t.noticeNumbers !== null);
+                })) {
+                  texts.forEach(function(t) {
+                    var nums = t.noticeNumbers && t.noticeNumbers.length ? " #" + t.noticeNumbers.join(", ") : "";
+                    lines.push(inner + "  " + (label || qid) + " " + t.field + ": " + _clean(t.text) + nums);
+                  });
+                  return;
+                }
+              }
               var val = q && !q.constructed && Buffer.isBuffer(q.content) && _printable(q.content) ? _clean(q.content.toString("latin1")) : _hexColon(q && Buffer.isBuffer(q.bytes) ? q.bytes : Buffer.alloc(0), {});
               lines.push(inner + "  " + (label || qid) + ": " + val);
             });
@@ -30349,6 +31201,7 @@ var require_inspect = __commonJS({
           else if (loc.tag === 2) lv = "DNS:" + loc.value;
           else if (loc.tag === 1) lv = "email:" + loc.value;
           else if (loc.tag === 7) lv = "IP:" + _ipString(loc.value);
+          else if (loc.tag === 4) lv = "DirName:" + _gnDn(loc.value);
           else lv = typeof loc.value === "string" ? loc.value : "[" + loc.tag + "]";
           return inner + (LABEL[m] || m || ad.accessMethod) + " - " + lv;
         }).join("\n");
@@ -30994,14 +31847,53 @@ var require_lint = __commonJS({
         return null;
       }
     }
-    function _criticalityRule(name, id, severity, citation, message) {
-      return {
-        id,
-        severity,
-        source: "rfc5280",
-        citation,
-        message,
-        appliesTo: function(cert, ctx) {
+    var OID_UNOTICE = oid.byName("unotice");
+    var _T_BMP = asn1.TAGS.BMP_STRING;
+    var _T_VISIBLE = asn1.TAGS.VISIBLE_STRING;
+    var _T_UTF8 = asn1.TAGS.UTF8_STRING;
+    function _hasControlChar(str) {
+      for (var i = 0; i < str.length; i++) {
+        var c = str.charCodeAt(i);
+        if (c <= 31 || c >= 127 && c <= 159) return true;
+      }
+      return false;
+    }
+    function _policyDisplayTexts(ctx) {
+      var d = ctx.decode("certificatePolicies");
+      if (!d || !Array.isArray(d.value)) return [];
+      var out = [];
+      d.value.forEach(function(pi) {
+        if (!pi.qualifiersBytes || !pi.qualifiersBytes.length) return;
+        var quals;
+        try {
+          quals = asn1.decode(pi.qualifiersBytes).children;
+        } catch (_e) {
+          return;
+        }
+        (quals || []).forEach(function(pq) {
+          var qid;
+          try {
+            qid = asn1.read.oid(pq.children[0]);
+          } catch (_e2) {
+            return;
+          }
+          if (qid !== OID_UNOTICE) return;
+          out = out.concat(pkix.userNoticeTexts(pq.children[1]));
+        });
+      });
+      return out;
+    }
+    function _hasPolicyDisplayText(cert, ctx) {
+      return _policyDisplayTexts(ctx).length > 0;
+    }
+    function _criticalityRule(name, id, severity, citation, message) {
+      return {
+        id,
+        severity,
+        source: "rfc5280",
+        citation,
+        message,
+        appliesTo: function(cert, ctx) {
           return !!ctx.raw(name);
         },
         check: function(cert, ctx) {
@@ -31238,6 +32130,88 @@ var require_lint = __commonJS({
         check: function(cert, ctx) {
           return ctx.raw("subjectKeyIdentifier") ? null : true;
         }
+      },
+      // 4.2.1.4 governs the userNotice qualifier's DisplayText with one MUST NOT and three SHOULD-level
+      // rules. None of them can live in the decoder: the section closes by directing certificate users to
+      // "gracefully handle explicitText with more than 200 characters", so a verifier that rejected these
+      // would refuse certificates that are in the wild and otherwise valid. Reporting them is exactly what
+      // a linter is for, so each rule carries the severity its normative word does.
+      {
+        // DisplayText is SIZE (1..200) -- both ends -- but the two ends get SEPARATE ids rather than one
+        // length rule, because the section treats them differently: it tells certificate users to handle a
+        // notice ABOVE 200 gracefully, and says nothing of the sort about an empty one. An operator acting
+        // on that advice suppresses the over-long finding; folding both into a single id would silently
+        // suppress the empty case along with it, which has no such carve-out.
+        id: "lint/rfc5280/explicit-text-too-long",
+        severity: "warn",
+        source: "rfc5280",
+        citation: "RFC 5280 4.2.1.4",
+        message: "a userNotice DisplayText should not exceed 200 characters",
+        appliesTo: _hasPolicyDisplayText,
+        check: function(cert, ctx) {
+          var over = _policyDisplayTexts(ctx).filter(function(d) {
+            return d.text !== null && d.chars > pkix.DISPLAY_TEXT_MAX;
+          });
+          return over.length ? { context: { count: over.length, longest: Math.max.apply(null, over.map(function(d) {
+            return d.chars;
+          })) } } : null;
+        }
+      },
+      {
+        id: "lint/rfc5280/explicit-text-empty",
+        severity: "warn",
+        source: "rfc5280",
+        citation: "RFC 5280 4.2.1.4",
+        message: "a userNotice DisplayText must not be empty (SIZE (1..200))",
+        appliesTo: _hasPolicyDisplayText,
+        check: function(cert, ctx) {
+          var empty = _policyDisplayTexts(ctx).filter(function(d) {
+            return d.text !== null && d.chars < 1;
+          });
+          return empty.length ? { context: { count: empty.length } } : null;
+        }
+      },
+      {
+        id: "lint/rfc5280/explicit-text-bad-encoding",
+        severity: "error",
+        source: "rfc5280",
+        citation: "RFC 5280 4.2.1.4",
+        message: "conforming CAs must not encode explicitText as VisibleString or BMPString",
+        appliesTo: _hasPolicyDisplayText,
+        check: function(cert, ctx) {
+          var bad = _policyDisplayTexts(ctx).filter(function(d) {
+            return d.field === "explicitText" && (d.tagNumber === _T_VISIBLE || d.tagNumber === _T_BMP);
+          });
+          return bad.length ? { context: { count: bad.length, encoding: bad[0].tagNumber === _T_BMP ? "BMPString" : "VisibleString" } } : null;
+        }
+      },
+      {
+        id: "lint/rfc5280/explicit-text-control-chars",
+        severity: "warn",
+        source: "rfc5280",
+        citation: "RFC 5280 4.2.1.4",
+        message: "an explicitText should not include control characters (U+0000 to U+001F, U+007F to U+009F)",
+        appliesTo: _hasPolicyDisplayText,
+        check: function(cert, ctx) {
+          var bad = _policyDisplayTexts(ctx).filter(function(d) {
+            return d.field === "explicitText" && d.text !== null && _hasControlChar(d.text);
+          });
+          return bad.length ? { context: { count: bad.length } } : null;
+        }
+      },
+      {
+        id: "lint/rfc5280/explicit-text-not-nfc",
+        severity: "notice",
+        source: "rfc5280",
+        citation: "RFC 5280 4.2.1.4",
+        message: "a UTF8String explicitText should be normalized to Unicode normalization form C (NFC)",
+        appliesTo: _hasPolicyDisplayText,
+        check: function(cert, ctx) {
+          var bad = _policyDisplayTexts(ctx).filter(function(d) {
+            return d.field === "explicitText" && d.text !== null && d.tagNumber === _T_UTF8 && d.text.normalize("NFC") !== d.text;
+          });
+          return bad.length ? { context: { count: bad.length } } : null;
+        }
       }
     ];
     function _isTls(cert, ctx) {
@@ -31359,8 +32333,8 @@ var require_lint = __commonJS({
       }
     ];
     var ML_KEM_EK_LEN = {};
-    ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function(n, i) {
-      ML_KEM_EK_LEN[n] = [800, 1184, 1568][i];
+    ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function(n) {
+      ML_KEM_EK_LEN[n] = oid.kemParams(n).ek;
     });
     function _isMlKem(cert) {
       var spki = cert.subjectPublicKeyInfo;
@@ -31452,6 +32426,573 @@ var require_lint = __commonJS({
   }
 });
 
+// node_modules/@blamejs/pki/lib/webauthn-mds.js
+var require_webauthn_mds = __commonJS({
+  "node_modules/@blamejs/pki/lib/webauthn-mds.js"(exports2, module2) {
+    "use strict";
+    var frameworkError = require_framework_error();
+    var asn1 = require_asn1_der();
+    var x509 = require_schema_x509();
+    var guard = require_guard_all();
+    var jose = require_jose();
+    var rfc3339 = require_rfc3339();
+    var constants = require_constants();
+    var pathValidate = require_path_validate();
+    var webcrypto = require_webcrypto();
+    var nodeCrypto = require("crypto");
+    var WebauthnError = frameworkError.WebauthnError;
+    function _err(code, message, cause) {
+      return new WebauthnError(code, message, cause);
+    }
+    var C = constants.LIMITS;
+    var BLOB_ALGS = Object.assign(/* @__PURE__ */ Object.create(null), {
+      ES256: { family: "EC", hash: "SHA-256", imp: { name: "ECDSA", namedCurve: "P-256" }, ver: { name: "ECDSA", hash: "SHA-256" } },
+      ES384: { family: "EC", hash: "SHA-384", imp: { name: "ECDSA", namedCurve: "P-384" }, ver: { name: "ECDSA", hash: "SHA-384" } },
+      ES512: { family: "EC", hash: "SHA-512", imp: { name: "ECDSA", namedCurve: "P-521" }, ver: { name: "ECDSA", hash: "SHA-512" } },
+      RS256: { family: "RSA", hash: "SHA-256", imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, ver: { name: "RSASSA-PKCS1-v1_5" } },
+      RS384: { family: "RSA", hash: "SHA-384", imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" }, ver: { name: "RSASSA-PKCS1-v1_5" } },
+      RS512: { family: "RSA", hash: "SHA-512", imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" }, ver: { name: "RSASSA-PKCS1-v1_5" } }
+    });
+    var DISQUALIFYING = Object.assign(/* @__PURE__ */ Object.create(null), {
+      REVOKED: 1,
+      ATTESTATION_KEY_COMPROMISE: 1,
+      USER_KEY_REMOTE_COMPROMISE: 1,
+      USER_KEY_PHYSICAL_COMPROMISE: 1,
+      USER_VERIFICATION_BYPASS: 1
+    });
+    var CERT_SCOPED_STATUS = Object.assign(/* @__PURE__ */ Object.create(null), { ATTESTATION_KEY_COMPROMISE: 1 });
+    var _BLOB_OPTS = Object.assign(/* @__PURE__ */ Object.create(null), {
+      rootCertificates: 1,
+      time: 1,
+      previousNo: 1,
+      requireRollbackCheck: 1,
+      allowStale: 1,
+      statusPolicy: 1,
+      rejectUnknownStatus: 1
+    });
+    function _isPlainObject(v) {
+      return !!v && typeof v === "object" && !Array.isArray(v);
+    }
+    var _verifiedResults = /* @__PURE__ */ new WeakSet();
+    function isVerifiedResult(v) {
+      return _isPlainObject(v) && _verifiedResults.has(v);
+    }
+    function _deepFreeze(v, depth) {
+      if (!v || typeof v !== "object" || Object.isFrozen(v) || ArrayBuffer.isView(v)) return v;
+      if (depth > C.JSON_MAX_DEPTH) return v;
+      Object.freeze(v);
+      Object.keys(v).forEach(function(k) {
+        _deepFreeze(v[k], depth + 1);
+      });
+      return v;
+    }
+    var AAGUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+    var ZERO_AAGUID = "00000000-0000-0000-0000-000000000000";
+    var UNDERSTOOD_HEADER = Object.assign(/* @__PURE__ */ Object.create(null), {
+      alg: 1,
+      typ: 1,
+      cty: 1,
+      crit: 1,
+      jku: 1,
+      jwk: 1,
+      kid: 1,
+      x5u: 1,
+      x5c: 1,
+      x5t: 1,
+      "x5t#S256": 1
+    });
+    function _assertLeafSigns(leaf) {
+      var exts = leaf.extensions || [];
+      for (var i = 0; i < exts.length; i++) {
+        if (exts[i].name !== "keyUsage" || exts[i].value == null) continue;
+        var ku;
+        try {
+          ku = asn1.read.bitString(asn1.decode(exts[i].value));
+        } catch (e) {
+          throw _err("webauthn/bad-att-cert", "the metadata BLOB x5c leaf keyUsage extension is malformed", e);
+        }
+        if (!ku.bytes.length || (ku.bytes[0] & 128) === 0) {
+          throw _err("webauthn/bad-att-cert", "the metadata BLOB x5c leaf keyUsage does not assert digitalSignature, so it may not sign the BLOB (RFC 5280 sec. 4.2.1.3)");
+        }
+        return;
+      }
+    }
+    function _isAnchorItself(cert, anchor) {
+      return guard.name.dnEqual(cert.subject, anchor.subject) && cert.subjectPublicKeyInfo.bytes.equals(anchor.subjectPublicKeyInfo.bytes);
+    }
+    function _asCert(v, label) {
+      if (v && typeof v === "object" && !Buffer.isBuffer(v) && !(v instanceof Uint8Array) && v.subject && v.subjectPublicKeyInfo && Buffer.isBuffer(v.subjectPublicKeyInfo.bytes) && v.signatureAlgorithm && typeof v.signatureAlgorithm.oid === "string" && // `validity` is what separates a certificate from the other signed structures that carry a
+      // subject, a public key and a signature algorithm: a parsed certification request has all
+      // three and would otherwise be installed as a trust anchor.
+      v.validity && v.validity.notBefore !== void 0) {
+        return v;
+      }
+      try {
+        return x509.parse(v);
+      } catch (e) {
+        throw _err("webauthn/bad-input", label + " is not a decodable certificate", e);
+      }
+    }
+    function verifyMetadataBlob(blob, opts) {
+      return Promise.resolve().then(function() {
+        return _verifyMetadataBlob(blob, opts);
+      });
+    }
+    function _verifyMetadataBlob(blob, opts) {
+      opts = opts || {};
+      if (!_isPlainObject(opts)) throw _err("webauthn/bad-input", "opts must be an object");
+      guard.identifier.assertKnownKeys(opts, _BLOB_OPTS, _err, "webauthn/bad-input", "opts has an unknown key ");
+      var roots = opts.rootCertificates;
+      if (!Array.isArray(roots) || roots.length === 0) {
+        throw _err("webauthn/metadata-no-root", "verifying a metadata BLOB requires opts.rootCertificates -- the FIDO root(s) to anchor it to; this library bundles none");
+      }
+      if (opts.time !== void 0) guard.time.assertValid(opts.time, _err, "webauthn/bad-input", "opts.time");
+      var at = opts.time === void 0 ? /* @__PURE__ */ new Date() : opts.time;
+      if (opts.previousNo !== void 0 && (!Number.isSafeInteger(opts.previousNo) || opts.previousNo < 0)) {
+        throw _err("webauthn/bad-input", "opts.previousNo must be a non-negative safe integer");
+      }
+      ["requireRollbackCheck", "allowStale", "rejectUnknownStatus"].forEach(function(k) {
+        if (opts[k] !== void 0 && typeof opts[k] !== "boolean") {
+          throw _err("webauthn/bad-input", "opts." + k + " must be a boolean");
+        }
+      });
+      if (opts.statusPolicy !== void 0 && typeof opts.statusPolicy !== "function" && opts.statusPolicy !== "any" && opts.statusPolicy !== "latest-by-date") {
+        throw _err("webauthn/bad-input", 'opts.statusPolicy must be "any", "latest-by-date", or a function');
+      }
+      if (opts.requireRollbackCheck === true && opts.previousNo === void 0) {
+        throw _err("webauthn/metadata-no-baseline", "opts.requireRollbackCheck was set without opts.previousNo, so there is no baseline to compare against");
+      }
+      var anchors = roots.map(function(r, i) {
+        return _asCert(r, "opts.rootCertificates[" + i + "]");
+      });
+      var raw = Buffer.isBuffer(blob) || blob instanceof Uint8Array ? guard.bytes.view(blob, WebauthnError, "webauthn/bad-input", "the metadata BLOB") : null;
+      var declaredLength = raw ? raw.length : typeof blob === "string" ? Buffer.byteLength(blob, "utf8") : null;
+      if (declaredLength !== null && declaredLength > C.MDS_BLOB_MAX_BYTES) {
+        throw _err("webauthn/too-large", "the metadata BLOB is " + declaredLength + " bytes, above the " + C.MDS_BLOB_MAX_BYTES + "-byte ceiling");
+      }
+      if (!raw && typeof blob !== "string") {
+        throw _err("webauthn/bad-input", "the metadata BLOB must be bytes or a string");
+      }
+      var bytes = raw || Buffer.from(blob, "utf8");
+      if (bytes.length > C.MDS_BLOB_MAX_BYTES) {
+        throw _err("webauthn/too-large", "the metadata BLOB is " + bytes.length + " bytes, above the " + C.MDS_BLOB_MAX_BYTES + "-byte ceiling");
+      }
+      var segs = bytes.toString("utf8").split(".");
+      if (segs.length !== 3) throw _err("webauthn/bad-metadata-blob", "the metadata BLOB is not a three-part JWS compact serialization (RFC 7515 sec. 3.1)");
+      if (segs[0].length > Math.ceil(C.MDS_BLOB_HEADER_MAX_BYTES / 3) * 4) {
+        throw _err("webauthn/too-large", "the metadata BLOB protected header is above the " + C.MDS_BLOB_HEADER_MAX_BYTES + "-byte ceiling");
+      }
+      if (segs[2].length > Math.ceil(C.MDS_BLOB_SIG_MAX_BYTES / 3) * 4) {
+        throw _err("webauthn/too-large", "the metadata BLOB signature is above the " + C.MDS_BLOB_SIG_MAX_BYTES + "-byte ceiling");
+      }
+      var header, sig;
+      try {
+        header = guard.json.parse(Buffer.from(jose.base64url.decode(segs[0])), _err, {
+          // The header is read BEFORE anything is authenticated, so its ceiling is the header's own,
+          // not the whole BLOB's: a JWS protected header is a few hundred bytes, and giving this reader
+          // the 32 MiB envelope cap would let unauthenticated bytes buy an unbounded multiple of that
+          // in heap ahead of the signature check. The payload's reader keeps the envelope cap, which is
+          // sound because nothing reaches it until the signature and chain hold.
+          maxBytes: C.MDS_BLOB_HEADER_MAX_BYTES,
+          maxDepth: C.JSON_MAX_DEPTH,
+          tooLarge: "webauthn/too-large",
+          badJson: "webauthn/bad-metadata-blob",
+          // Every code the guard can raise is named. An omitted one falls back to the framework default
+          // and the module's own defences -- duplicate-member smuggling, the depth cap -- surface under
+          // a generic code no webauthn/* consumer can switch on.
+          tooDeep: "webauthn/bad-metadata-blob",
+          duplicateMember: "webauthn/bad-metadata-blob",
+          badInput: "webauthn/bad-metadata-blob",
+          label: "the metadata BLOB header"
+        });
+        sig = Buffer.from(jose.base64url.decode(segs[2]));
+      } catch (e) {
+        if (e instanceof WebauthnError) throw e;
+        throw _err("webauthn/bad-metadata-blob", "the metadata BLOB header or signature is not decodable", e);
+      }
+      if (!_isPlainObject(header)) throw _err("webauthn/bad-metadata-blob", "the metadata BLOB header must be a JSON object");
+      if (header.x5u !== void 0) {
+        throw _err("webauthn/bad-metadata-blob", "the metadata BLOB header carries x5u, which names a chain to fetch; supply a BLOB with an inline x5c instead");
+      }
+      if (Object.prototype.hasOwnProperty.call(header, "crit")) {
+        var crit = header.crit;
+        if (!Array.isArray(crit) || crit.length === 0) {
+          throw _err("webauthn/bad-metadata-blob", "the metadata BLOB header crit must be a non-empty array (RFC 7515 sec. 4.1.11)");
+        }
+        var critSeen = /* @__PURE__ */ Object.create(null);
+        for (var ci = 0; ci < crit.length; ci++) {
+          var critName = crit[ci];
+          if (typeof critName !== "string") throw _err("webauthn/bad-metadata-blob", "the metadata BLOB header crit entries must be strings");
+          if (critSeen[critName]) throw _err("webauthn/bad-metadata-blob", "the metadata BLOB header crit repeats " + JSON.stringify(critName));
+          critSeen[critName] = 1;
+          if (UNDERSTOOD_HEADER[critName]) {
+            throw _err("webauthn/bad-metadata-blob", "the metadata BLOB header crit must not name the standard header parameter " + JSON.stringify(critName) + " (RFC 7515 sec. 4.1.11)");
+          }
+          throw _err("webauthn/bad-metadata-blob", "the metadata BLOB header names critical header parameter " + JSON.stringify(critName) + ", which this reader does not process");
+        }
+      }
+      var algRow = typeof header.alg === "string" ? BLOB_ALGS[header.alg] : void 0;
+      if (!algRow) throw _err("webauthn/unsupported-algorithm", "the metadata BLOB alg " + JSON.stringify(header.alg) + " is not a supported JWS signature algorithm");
+      if (!Array.isArray(header.x5c) || header.x5c.length === 0) {
+        throw _err("webauthn/bad-metadata-blob", "the metadata BLOB header carries no x5c certificate chain (RFC 7515 sec. 4.1.6)");
+      }
+      if (header.x5c.length > C.WEBAUTHN_X5C_MAX_CERTS) {
+        throw _err("webauthn/too-large", "the metadata BLOB x5c carries " + header.x5c.length + " certificates, above the " + C.WEBAUTHN_X5C_MAX_CERTS + " this library will parse");
+      }
+      var chain = header.x5c.map(function(entry, i) {
+        if (typeof entry !== "string") throw _err("webauthn/bad-metadata-blob", "the metadata BLOB x5c entry " + i + " is not a string");
+        var der;
+        try {
+          der = guard.encoding.base64(entry, C.MDS_BLOB_MAX_BYTES, _err, "webauthn/bad-metadata-blob", "a metadata BLOB x5c entry");
+        } catch (e) {
+          throw _err("webauthn/bad-metadata-blob", "the metadata BLOB x5c entry " + i + " is not canonical base64", e);
+        }
+        try {
+          return x509.parse(der);
+        } catch (e) {
+          throw _err("webauthn/bad-att-cert", "the metadata BLOB x5c entry " + i + " is not a decodable certificate", e);
+        }
+      });
+      var leaf = chain[0];
+      _assertLeafSigns(leaf);
+      var leafAlg = (leaf.subjectPublicKeyInfo.algorithm || {}).name;
+      var leafFamily = leafAlg === "ecPublicKey" ? "EC" : leafAlg === "rsaEncryption" ? "RSA" : null;
+      if (leafFamily !== algRow.family) {
+        throw _err("webauthn/unsupported-algorithm", "the metadata BLOB alg " + header.alg + " does not match the x5c leaf key type " + JSON.stringify(leafAlg));
+      }
+      var signingInput = Buffer.from(segs[0] + "." + segs[1], "ascii");
+      return webcrypto.webcrypto.subtle.importKey("spki", leaf.subjectPublicKeyInfo.bytes, algRow.imp, false, ["verify"]).then(
+        function(key) {
+          return webcrypto.webcrypto.subtle.verify(algRow.ver, key, sig, signingInput);
+        },
+        function(e) {
+          throw _err("webauthn/unsupported-algorithm", "the metadata BLOB x5c leaf key could not be imported for " + header.alg, e);
+        }
+      ).then(function(ok) {
+        if (!ok) throw _err("webauthn/verify-failed", "the metadata BLOB signature does not verify under its x5c leaf key");
+        return _chainToAnchor(chain, anchors, at);
+      }).then(function() {
+        return _parsePayload(segs[1], at, opts);
+      });
+    }
+    function _chainToAnchor(chain, anchors, at, what) {
+      var subject = what || "metadata BLOB certificate chain";
+      var ordered = chain.slice().reverse();
+      var lastFault = null;
+      return anchors.reduce(function(p, anchor) {
+        return p.then(function(done) {
+          if (done) return true;
+          var path = ordered.slice();
+          var strippedAnchor = false;
+          if (path.length && _isAnchorItself(path[0], anchor)) {
+            path = path.slice(1);
+            strippedAnchor = true;
+          }
+          if (path.length === 0) return strippedAnchor;
+          return pathValidate.validate(path, {
+            time: at,
+            // The anchor tuple names the anchor's own KEY -- its SubjectPublicKeyInfo algorithm and that
+            // algorithm's parameters -- not the algorithm its issuer used to sign it. The validator
+            // carries these forward as the working public key, and a certificate below the anchor may
+            // inherit its key parameters from them (the DSA-style parameter-inheritance case), so
+            // supplying the signature OID leaves such a key unreconstructable and refuses a valid chain.
+            trustAnchor: {
+              name: anchor.subject,
+              publicKey: anchor.subjectPublicKeyInfo.bytes,
+              algorithm: anchor.subjectPublicKeyInfo.algorithm.oid,
+              parameters: anchor.subjectPublicKeyInfo.algorithm.parameters
+            }
+          }).then(function(r) {
+            return !!(r && r.valid);
+          }, function(e) {
+            lastFault = e;
+            return false;
+          });
+        });
+      }, Promise.resolve(false)).then(function(trusted) {
+        if (!trusted) {
+          throw _err("webauthn/metadata-untrusted", "the " + subject + " does not validate to any of the roots it must reach", lastFault);
+        }
+      });
+    }
+    function _staleAfter(nextUpdate) {
+      var d = rfc3339.parseDate(
+        nextUpdate,
+        function(c, m) {
+          return _err("webauthn/bad-metadata-blob", m);
+        },
+        "webauthn/bad-metadata-blob",
+        "the metadata BLOB nextUpdate"
+      );
+      return d.getTime() + constants.TIME.days(1);
+    }
+    function assertFresh(metadata, at, label) {
+      if (!metadata || metadata.allowStale === true || typeof metadata.nextUpdate !== "string") return;
+      var atMs = at instanceof Date ? at.getTime() : NaN;
+      var limit = _staleAfter(metadata.nextUpdate);
+      if (!isFinite(atMs) || !isFinite(limit)) return;
+      if (atMs >= limit) {
+        throw _err("webauthn/metadata-stale", (label || "the metadata") + " expired after " + metadata.nextUpdate + "; re-verify a current BLOB, or pass opts.allowStale when verifying it");
+      }
+    }
+    function _parsePayload(seg, at, opts) {
+      var payload;
+      try {
+        payload = guard.json.parse(Buffer.from(jose.base64url.decode(seg)), _err, {
+          maxBytes: C.MDS_BLOB_MAX_BYTES,
+          maxDepth: C.JSON_MAX_DEPTH,
+          tooLarge: "webauthn/too-large",
+          badJson: "webauthn/bad-metadata-blob",
+          tooDeep: "webauthn/bad-metadata-blob",
+          duplicateMember: "webauthn/bad-metadata-blob",
+          badInput: "webauthn/bad-metadata-blob",
+          label: "the metadata BLOB payload"
+        });
+      } catch (e) {
+        if (e instanceof WebauthnError) throw e;
+        throw _err("webauthn/bad-metadata-blob", "the metadata BLOB payload is not decodable JSON", e);
+      }
+      if (!_isPlainObject(payload)) throw _err("webauthn/bad-metadata-blob", "the metadata BLOB payload must be a JSON object");
+      if (typeof payload.legalHeader !== "string") throw _err("webauthn/bad-metadata-blob", "the metadata BLOB payload must carry a string legalHeader");
+      if (!Number.isSafeInteger(payload.no) || payload.no < 0) throw _err("webauthn/bad-metadata-blob", "the metadata BLOB payload must carry a non-negative integer no");
+      if (opts.previousNo !== void 0 && payload.no <= opts.previousNo) {
+        throw _err("webauthn/metadata-rollback", "the metadata BLOB no " + payload.no + " does not exceed the previously held " + opts.previousNo);
+      }
+      var staleAfter = _staleAfter(payload.nextUpdate);
+      var atMs = at.getTime();
+      if (!isFinite(atMs) || !isFinite(staleAfter)) {
+        throw _err("webauthn/bad-input", "the metadata freshness comparison has no usable instant");
+      }
+      var stale = atMs >= staleAfter;
+      if (stale && opts.allowStale !== true) {
+        throw _err("webauthn/metadata-stale", "the metadata BLOB expired after " + payload.nextUpdate + "; pass opts.allowStale to accept it anyway");
+      }
+      if (!Array.isArray(payload.entries)) throw _err("webauthn/bad-metadata-blob", "the metadata BLOB payload must carry an entries array");
+      if (payload.entries.length > C.MDS_MAX_ENTRIES) {
+        throw _err("webauthn/too-large", "the metadata BLOB declares " + payload.entries.length + " entries, above the " + C.MDS_MAX_ENTRIES + " ceiling");
+      }
+      var byAaguid = /* @__PURE__ */ Object.create(null);
+      var byKeyIdentifier = /* @__PURE__ */ Object.create(null);
+      var entries = payload.entries.map(function(e, i) {
+        if (!_isPlainObject(e)) throw _err("webauthn/bad-metadata-blob", "metadata entry " + i + " is not an object");
+        if (!Array.isArray(e.statusReports) || e.statusReports.length === 0) {
+          throw _err("webauthn/bad-metadata-blob", "metadata entry " + i + " must carry a non-empty statusReports array");
+        }
+        if (e.statusReports.length > C.MDS_MAX_STATUS_REPORTS_PER_ENTRY) {
+          throw _err("webauthn/too-large", "metadata entry " + i + " declares " + e.statusReports.length + " status reports, above the " + C.MDS_MAX_STATUS_REPORTS_PER_ENTRY + " ceiling");
+        }
+        e.statusReports.forEach(function(r, ri) {
+          if (!_isPlainObject(r)) throw _err("webauthn/bad-metadata-blob", "metadata entry " + i + " status report " + ri + " is not an object");
+          if (typeof r.status !== "string" || !r.status) {
+            throw _err("webauthn/bad-metadata-blob", "metadata entry " + i + " status report " + ri + " has no status (MDS v3.0 sec. 3.1.3 requires one)");
+          }
+        });
+        var aaguid = null;
+        if (e.aaguid !== void 0) {
+          if (typeof e.aaguid !== "string" || !AAGUID_RE.test(e.aaguid.toLowerCase())) {
+            throw _err("webauthn/bad-metadata-blob", "metadata entry " + i + " has a malformed aaguid");
+          }
+          aaguid = e.aaguid.toLowerCase();
+        }
+        var st = e.metadataStatement;
+        var keyIds = [];
+        var seenKeyId = /* @__PURE__ */ Object.create(null);
+        [[e.attestationCertificateKeyIdentifiers, "entry"], [st && st.attestationCertificateKeyIdentifiers, "metadataStatement"]].forEach(function(pair) {
+          var list = pair[0];
+          if (list === void 0) return;
+          if (!Array.isArray(list)) {
+            throw _err("webauthn/bad-metadata-blob", "metadata entry " + i + " " + pair[1] + " attestationCertificateKeyIdentifiers is not an array");
+          }
+          if (list.length > C.MDS_MAX_KEY_IDS_PER_ENTRY) {
+            throw _err("webauthn/too-large", "metadata entry " + i + " declares " + list.length + " attestation certificate key identifiers, above the " + C.MDS_MAX_KEY_IDS_PER_ENTRY + " ceiling");
+          }
+          list.forEach(function(k) {
+            if (typeof k !== "string" || !/^[0-9a-fA-F]{40}$/.test(k)) {
+              throw _err("webauthn/bad-metadata-blob", "metadata entry " + i + " has a malformed attestation certificate key identifier");
+            }
+            var lower = k.toLowerCase();
+            if (!seenKeyId[lower]) {
+              seenKeyId[lower] = 1;
+              keyIds.push(lower);
+            }
+          });
+        });
+        var out = {
+          index: i,
+          aaguid,
+          keyIdentifiers: keyIds,
+          statusReports: e.statusReports,
+          metadataStatement: st || null,
+          timeOfLastStatusChange: e.timeOfLastStatusChange || null
+        };
+        if (aaguid) {
+          if (byAaguid[aaguid]) throw _err("webauthn/duplicate-metadata-entry", "two metadata entries claim aaguid " + aaguid);
+          byAaguid[aaguid] = out;
+        }
+        keyIds.forEach(function(k) {
+          if (byKeyIdentifier[k]) throw _err("webauthn/duplicate-metadata-entry", "two metadata entries claim attestation certificate key identifier " + k);
+          byKeyIdentifier[k] = out;
+        });
+        return out;
+      });
+      var result = {
+        no: payload.no,
+        legalHeader: payload.legalHeader,
+        nextUpdate: payload.nextUpdate,
+        stale,
+        allowStale: opts.allowStale === true,
+        entries,
+        byAaguid,
+        byKeyIdentifier,
+        statusPolicy: opts.statusPolicy || "any",
+        rejectUnknownStatus: opts.rejectUnknownStatus === true
+      };
+      _deepFreeze(result, 0);
+      _verifiedResults.add(result);
+      return result;
+    }
+    function metadataFor(metadata, identifier) {
+      if (!isVerifiedResult(metadata)) throw _err("webauthn/bad-input", "metadataFor expects a verifyMetadataBlob result -- an object that merely resembles one, such as a catalogue restored from a cache, has not been through the signature and chain checks");
+      if (typeof identifier !== "string") return null;
+      var key = identifier.toLowerCase();
+      if (AAGUID_RE.test(key)) {
+        if (key === ZERO_AAGUID) return null;
+        return metadata.byAaguid[key] || null;
+      }
+      if (/^[0-9a-f]{40}$/.test(key)) return metadataForKeyIdentifier(metadata, key);
+      return null;
+    }
+    function metadataAnchors(entry) {
+      if (!entry || typeof entry !== "object") throw _err("webauthn/bad-input", "metadataAnchors expects a metadata entry");
+      var st = entry.metadataStatement;
+      var list = st && Array.isArray(st.attestationRootCertificates) ? st.attestationRootCertificates : [];
+      if (list.length > C.MDS_MAX_ANCHORS_PER_ENTRY) {
+        throw _err("webauthn/too-large", "metadata entry " + entry.index + " declares " + list.length + " attestation roots, above the " + C.MDS_MAX_ANCHORS_PER_ENTRY + " ceiling");
+      }
+      return list.map(function(b64, i) {
+        var der;
+        try {
+          der = guard.encoding.base64(b64, C.MDS_BLOB_MAX_BYTES, _err, "webauthn/bad-metadata-entry", "an attestation root certificate");
+        } catch (e) {
+          throw _err("webauthn/bad-metadata-entry", "metadata entry " + entry.index + " attestation root " + i + " is not canonical base64", e);
+        }
+        try {
+          return x509.parse(der);
+        } catch (e) {
+          throw _err("webauthn/bad-metadata-entry", "metadata entry " + entry.index + " attestation root " + i + " is not a decodable certificate", e);
+        }
+      });
+    }
+    function _reportNamesOtherCert(report, leaf) {
+      if (typeof report.certificate !== "string" || !report.certificate) return false;
+      if (!leaf) return false;
+      var named;
+      try {
+        named = x509.parse(guard.encoding.base64(report.certificate, C.MDS_BLOB_MAX_BYTES, _err, "webauthn/bad-metadata-entry", "a status report certificate"));
+      } catch (_e) {
+        return false;
+      }
+      try {
+        return certKeyIdentifier(named) !== certKeyIdentifier(leaf);
+      } catch (_e) {
+        return false;
+      }
+    }
+    function _reportInForceAt(report, atMs) {
+      var d = rfc3339.parseDate(
+        report.effectiveDate,
+        function(c, m) {
+          return _err("webauthn/bad-metadata-blob", m);
+        },
+        "webauthn/bad-metadata-blob",
+        "a status report effectiveDate"
+      );
+      return d.getTime() <= atMs;
+    }
+    function statusDenied(entry, metadata, leaf, at) {
+      var policy = metadata && metadata.statusPolicy || "any";
+      var reports = entry.statusReports || [];
+      if (typeof policy === "function") return policy(reports) === true;
+      reports = reports.filter(function(r) {
+        return !(r && typeof r.status === "string" && CERT_SCOPED_STATUS[r.status] && _reportNamesOtherCert(r, leaf));
+      });
+      var isDated = function(r) {
+        return r && typeof r.effectiveDate === "string" && rfc3339.isValidDate(r.effectiveDate);
+      };
+      var atMs = at instanceof Date && isFinite(at.getTime()) ? at.getTime() : null;
+      if (atMs !== null) {
+        reports = reports.filter(function(r) {
+          return !isDated(r) || _reportInForceAt(r, atMs);
+        });
+      }
+      var considered = reports;
+      if (policy === "latest-by-date") {
+        var dated = reports.filter(isDated);
+        if (dated.length) {
+          var newest = dated.reduce(function(a, b) {
+            return a.effectiveDate >= b.effectiveDate ? a : b;
+          }).effectiveDate;
+          considered = dated.filter(function(r) {
+            return r.effectiveDate === newest;
+          }).concat(reports.filter(function(r) {
+            return !isDated(r);
+          }));
+        }
+      }
+      var rejectUnknown = !!(metadata && metadata.rejectUnknownStatus);
+      return considered.some(function(r) {
+        var s = r && typeof r.status === "string" ? r.status : null;
+        if (s === null) return false;
+        if (DISQUALIFYING[s]) return true;
+        return rejectUnknown && !_KNOWN_STATUS[s];
+      });
+    }
+    var _KNOWN_STATUS = Object.assign(/* @__PURE__ */ Object.create(null), {
+      NOT_FIDO_CERTIFIED: 1,
+      SELF_ASSERTION_SUBMITTED: 1,
+      FIDO_CERTIFIED: 1,
+      FIDO_CERTIFIED_L1: 1,
+      FIDO_CERTIFIED_L1plus: 1,
+      FIDO_CERTIFIED_L2: 1,
+      FIDO_CERTIFIED_L2plus: 1,
+      FIDO_CERTIFIED_L3: 1,
+      FIDO_CERTIFIED_L3plus: 1,
+      UPDATE_AVAILABLE: 1
+    });
+    function aaguidToString(buf) {
+      if (!Buffer.isBuffer(buf) || buf.length !== 16) return null;
+      var h = buf.toString("hex");
+      return h.slice(0, 8) + "-" + h.slice(8, 12) + "-" + h.slice(12, 16) + "-" + h.slice(16, 20) + "-" + h.slice(20);
+    }
+    function certKeyIdentifier(cert) {
+      var pk = cert && cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.publicKey;
+      if (!pk || !Buffer.isBuffer(pk.bytes)) {
+        throw _err("webauthn/bad-input", "certKeyIdentifier expects a parsed certificate carrying a subject public key");
+      }
+      return nodeCrypto.createHash("sha1").update(pk.bytes).digest("hex");
+    }
+    function metadataForKeyIdentifier(metadata, keyId) {
+      if (!isVerifiedResult(metadata)) throw _err("webauthn/bad-input", "metadataForKeyIdentifier expects a verifyMetadataBlob result -- an object that merely resembles one has not been through the signature and chain checks");
+      if (typeof keyId !== "string") return null;
+      return metadata.byKeyIdentifier[keyId.toLowerCase()] || null;
+    }
+    module2.exports = {
+      verifyMetadataBlob,
+      metadataFor,
+      metadataForKeyIdentifier,
+      metadataAnchors,
+      chainToAnchor: _chainToAnchor,
+      assertFresh,
+      isVerifiedResult,
+      statusDenied,
+      aaguidToString,
+      ZERO_AAGUID,
+      certKeyIdentifier,
+      DISQUALIFYING
+    };
+  }
+});
+
 // node_modules/@blamejs/pki/lib/webauthn.js
 var require_webauthn = __commonJS({
   "node_modules/@blamejs/pki/lib/webauthn.js"(exports2, module2) {
@@ -31466,6 +33007,10 @@ var require_webauthn = __commonJS({
     var constants = require_constants();
     var validator = require_validator_all();
     var edwardsPoint = require_edwards_point();
+    var guard = require_guard_all();
+    var jose = require_jose();
+    var pathValidate = require_path_validate();
+    var mds = require_webauthn_mds();
     var nodeCrypto = require("crypto");
     var WebauthnError = frameworkError.WebauthnError;
     function _err(code, message, cause) {
@@ -31696,7 +33241,11 @@ var require_webauthn = __commonJS({
       var fmtN = cbor.read.mapGet(root, "fmt"), attStmtN = cbor.read.mapGet(root, "attStmt"), authDataN = cbor.read.mapGet(root, "authData");
       if (root.children.length !== 3 || !fmtN || !attStmtN || !authDataN) throw _err("webauthn/bad-attestation-object", "the attestation object must be exactly { fmt, attStmt, authData }");
       if (fmtN.majorType !== 3) throw _err("webauthn/bad-attestation-object", "attestation object 'fmt' must be a text string");
-      if (attStmtN.majorType !== 5) throw _err("webauthn/bad-attestation-object", "attestation object 'attStmt' must be a CBOR map");
+      var wantMajor = ATT_STMT_MAJOR[cbor.read.textString(fmtN)];
+      if (wantMajor === void 0) wantMajor = 5;
+      if (attStmtN.majorType !== wantMajor) {
+        throw _err("webauthn/bad-attestation-object", "attestation object 'attStmt' must be a CBOR " + (wantMajor === 4 ? "array" : "map") + " for format " + JSON.stringify(cbor.read.textString(fmtN)));
+      }
       if (authDataN.majorType !== 2) throw _err("webauthn/bad-attestation-object", "attestation object 'authData' must be a byte string");
       var authDataBytes = cbor.read.byteString(authDataN);
       return {
@@ -31738,9 +33287,28 @@ var require_webauthn = __commonJS({
         if (!have[k]) throw _err("webauthn/bad-att-stmt", "the attestation statement is missing the '" + k + "' field");
       });
     }
+    var ATT_STMT_MAJOR = { compound: 4 };
+    var _AAGUID_SIGNED_BY_FMT = Object.assign(/* @__PURE__ */ Object.create(null), { "fido-u2f": false });
+    function _aaguidIsSigned(fmt) {
+      return _AAGUID_SIGNED_BY_FMT[fmt] !== false;
+    }
+    var _VERIFY_OPTS = Object.assign(/* @__PURE__ */ Object.create(null), {
+      time: 1,
+      metadata: 1,
+      tpmPolicy: 1,
+      safetyNetRoots: 1,
+      verifySafetyNetJws: 1,
+      requireCtsProfileMatch: 1
+    });
+    function _requireX5cCount(n) {
+      if (n > constants.LIMITS.WEBAUTHN_X5C_MAX_CERTS) {
+        throw _err("webauthn/bad-att-stmt", "an attestation certificate chain carries " + n + " certificates, above the " + constants.LIMITS.WEBAUTHN_X5C_MAX_CERTS + " this toolkit will parse");
+      }
+    }
     function _readX5c(attStmt) {
       var x5cN = cbor.read.mapGet(attStmt, "x5c");
       if (!x5cN || x5cN.majorType !== 4 || !x5cN.children || !x5cN.children.length) throw _err("webauthn/bad-att-stmt", "x5c must be a non-empty array of certificates");
+      _requireX5cCount(x5cN.children.length);
       return x5cN.children.map(function(c) {
         var der;
         try {
@@ -31841,7 +33409,8 @@ var require_webauthn = __commonJS({
       },
       // tpm (WebAuthn 8.3): decode certInfo/pubArea, enforce magic/type/extraData/Name,
       // bind pubArea to the credential key, and verify sig over certInfo with the AIK.
-      tpm: function(att, clientDataHash) {
+      tpm: function(att, clientDataHash, opts) {
+        var tpmPolicy = validator.tpm.normalizeObjectAttributePolicy((opts || {}).tpmPolicy, WebauthnError, "webauthn/bad-input");
         _requireAttShape(att.attStmt, ["ver", "alg", "sig", "certInfo", "pubArea", "x5c"], ["ver", "alg", "sig", "certInfo", "pubArea", "x5c"]);
         var verN = cbor.read.mapGet(att.attStmt, "ver");
         if (!verN || verN.majorType !== 3 || cbor.read.textString(verN) !== "2.0") throw _err("webauthn/bad-att-stmt", `tpm attestation 'ver' MUST be "2.0" (WebAuthn 8.3)`);
@@ -31862,7 +33431,150 @@ var require_webauthn = __commonJS({
           if (!ok) throw _err("webauthn/verify-failed", "the tpm attestation signature does not verify over certInfo under the AIK");
           _checkAikCert(aik);
           _checkAaguidExt(aik, att.authData.aaguid);
-          return _result("tpm", "AttCA", chain, att);
+          validator.tpm.assertObjectAttributePolicy(pub, tpmPolicy, WebauthnError, "webauthn/tpm-policy", "webauthn/bad-tpm");
+          var tpmRes = _result("tpm", "AttCA", chain, att);
+          tpmRes.tpm = { objectAttributes: pub.objectAttributes, attributes: pub.attributes, authPolicy: pub.authPolicy };
+          return tpmRes;
+        });
+      },
+      // android-safetynet (WebAuthn 8.5): the attStmt carries a SafetyNet JWS ("response") whose payload
+      // binds a nonce to this registration and whose x5c header chains to a Google root.
+      //
+      // OFF BY DEFAULT, and anchored only by the caller. Google retired the SafetyNet Attestation API, so
+      // nothing mints these any more -- the surviving use is a relying party re-checking attestations it
+      // stored years ago. Enabling a format whose producer is gone, against a root this library chose,
+      // would widen what every caller trusts for no live benefit; so the caller opts in AND supplies the
+      // root. With the opt off the verdict is byte-identical to the one this format had before the arm
+      // existed. There is no bundled root and no trust-on-first-use.
+      "android-safetynet": function(att, clientDataHash, opts) {
+        opts = opts || {};
+        if (opts.verifySafetyNetJws !== true) {
+          if (opts.verifySafetyNetJws !== void 0 && typeof opts.verifySafetyNetJws !== "boolean") {
+            throw _err("webauthn/bad-input", "opts.verifySafetyNetJws must be a boolean");
+          }
+          throw _err("webauthn/unsupported-format", "attestation statement format 'android-safetynet' is not supported");
+        }
+        var roots = opts.safetyNetRoots;
+        if (!Array.isArray(roots) || roots.length === 0) {
+          throw _err("webauthn/safetynet-no-root", "verifying an android-safetynet attestation requires opts.safetyNetRoots -- the Google root(s) to anchor the x5c chain to; this library bundles none (WebAuthn 8.5)");
+        }
+        if (opts.time !== void 0) guard.time.assertValid(opts.time, _err, "webauthn/bad-input", "opts.time");
+        _requireAttShape(att.attStmt, ["ver", "response"], ["ver", "response"]);
+        _attRead(att.attStmt, "ver", cbor.read.textString, "a text string");
+        var responseBytes = _attRead(att.attStmt, "response", cbor.read.byteString, "a byte string");
+        if (!responseBytes.length) throw _err("webauthn/bad-att-stmt", "the android-safetynet response is empty");
+        var segs = guard.text.decode(responseBytes, constants.LIMITS.SAFETYNET_JWS_MAX_BYTES, WebauthnError, "webauthn/bad-att-stmt", "the android-safetynet response").split(".");
+        if (segs.length !== 3) throw _err("webauthn/bad-att-stmt", "the android-safetynet response is not a three-part JWS compact serialization (RFC 7515 sec. 3.1)");
+        var header, payload, sigBytes;
+        try {
+          header = jose.parseJson(jose.base64url.decode(segs[0]));
+          payload = jose.parseJson(jose.base64url.decode(segs[1]));
+          sigBytes = Buffer.from(jose.base64url.decode(segs[2]));
+        } catch (e) {
+          throw _err("webauthn/bad-att-stmt", "the android-safetynet response is not a decodable JWS", e);
+        }
+        if (!_isPlainObject(header) || !_isPlainObject(payload)) {
+          throw _err("webauthn/bad-att-stmt", "the android-safetynet JWS header and payload must each be a JSON object");
+        }
+        if (header.alg !== "RS256") throw _err("webauthn/unsupported-algorithm", "the android-safetynet JWS alg must be RS256, got " + JSON.stringify(header.alg));
+        if (!Array.isArray(header.x5c) || header.x5c.length === 0) {
+          throw _err("webauthn/bad-att-stmt", "the android-safetynet JWS header carries no x5c certificate chain (RFC 7515 sec. 4.1.6)");
+        }
+        _requireX5cCount(header.x5c.length);
+        var chain = header.x5c.map(function(entry, i) {
+          if (typeof entry !== "string") throw _err("webauthn/bad-att-stmt", "the android-safetynet x5c entry " + i + " is not a string");
+          var der;
+          try {
+            der = guard.encoding.base64(entry, constants.LIMITS.SAFETYNET_CERT_MAX_BYTES, WebauthnError, "webauthn/bad-att-stmt", "an android-safetynet x5c entry");
+          } catch (e) {
+            throw _err("webauthn/bad-att-stmt", "the android-safetynet x5c entry " + i + " is not canonical base64", e);
+          }
+          try {
+            return x509.parse(der);
+          } catch (e) {
+            throw _err("webauthn/bad-att-cert", "the android-safetynet x5c entry " + i + " is not a decodable certificate", e);
+          }
+        });
+        var leaf = chain[0];
+        var wantNonce = _sha("sha256", Buffer.concat([att.authDataBytes, clientDataHash])).toString("base64");
+        if (typeof payload.nonce !== "string" || !guard.crypto.constantTimeEqual(Buffer.from(payload.nonce, "utf8"), Buffer.from(wantNonce, "utf8"))) {
+          throw _err("webauthn/safetynet-nonce-mismatch", "the android-safetynet nonce does not bind this authenticatorData and clientDataHash (WebAuthn 8.5)");
+        }
+        if (!_safetyNetHostnameOk(leaf)) {
+          throw _err("webauthn/safetynet-bad-hostname", "the android-safetynet x5c leaf is not issued to attest.android.com (WebAuthn 8.5)");
+        }
+        var chainAt;
+        var signals = {
+          ctsProfileMatch: payload.ctsProfileMatch,
+          basicIntegrity: payload.basicIntegrity,
+          timestampMs: payload.timestampMs,
+          apkPackageName: payload.apkPackageName,
+          apkCertificateDigestSha256: payload.apkCertificateDigestSha256,
+          advice: payload.advice
+        };
+        if (opts.requireCtsProfileMatch === true && signals.ctsProfileMatch !== true) {
+          throw _err("webauthn/safetynet-cts-profile", "the android-safetynet response reports ctsProfileMatch " + JSON.stringify(signals.ctsProfileMatch) + ", and opts.requireCtsProfileMatch demands true");
+        }
+        if (opts.requireCtsProfileMatch !== void 0 && typeof opts.requireCtsProfileMatch !== "boolean") {
+          throw _err("webauthn/bad-input", "opts.requireCtsProfileMatch must be a boolean");
+        }
+        return _verifySig(
+          -257,
+          sigBytes,
+          leaf.subjectPublicKeyInfo.bytes,
+          Buffer.from(segs[0] + "." + segs[1], "ascii"),
+          _err
+        ).then(function(ok) {
+          if (!ok) throw _err("webauthn/verify-failed", "the android-safetynet JWS signature does not verify under the x5c leaf key");
+          chainAt = opts.time !== void 0 ? opts.time : typeof payload.timestampMs === "number" && isFinite(payload.timestampMs) && payload.timestampMs > 0 ? new Date(payload.timestampMs) : void 0;
+          return _safetyNetChainTrusted(chain, roots, chainAt);
+        }).then(function() {
+          var res = _result("android-safetynet", "Basic", chain, att);
+          res.safetyNet = signals;
+          if (chainAt !== void 0) res.chainValidatedAt = chainAt;
+          return res;
+        });
+      },
+      // compound (WebAuthn 8.9): the attStmt is an ARRAY of nested attestation statements, each
+      // verified over the SAME authenticatorData and clientDataHash as the outer object. sec. 8.9
+      // leaves the acceptance threshold to relying-party policy ("if validation fails for one or more
+      // subStmt, decide the appropriate result based on RP policy"); this toolkit's policy is
+      // fail-closed -- EVERY element must verify, because accepting a compound whose strong element
+      // failed and whose `none` element passed would let a wrapper launder a failed attestation.
+      compound: function(att, clientDataHash, opts) {
+        var kids = att.attStmt.children || [];
+        if (kids.length < 2) throw _err("webauthn/bad-att-stmt", "a compound attestation statement must carry at least two nested statements (WebAuthn 8.9)");
+        if (kids.length > constants.LIMITS.WEBAUTHN_COMPOUND_MAX_STATEMENTS) {
+          throw _err("webauthn/bad-att-stmt", "a compound attestation statement carries " + kids.length + " nested statements, above the " + constants.LIMITS.WEBAUTHN_COMPOUND_MAX_STATEMENTS + " this toolkit will verify");
+        }
+        var elements = kids.map(function(el, i) {
+          if (!el || el.majorType !== 5) throw _err("webauthn/bad-att-stmt", "compound element " + i + " must be a CBOR map { fmt, attStmt } (WebAuthn 8.9)");
+          var fN = cbor.read.mapGet(el, "fmt"), sN = cbor.read.mapGet(el, "attStmt");
+          if (el.children.length !== 2 || !fN || !sN) throw _err("webauthn/bad-att-stmt", "compound element " + i + " must be exactly { fmt, attStmt } (WebAuthn 8.9)");
+          if (fN.majorType !== 3) throw _err("webauthn/bad-att-stmt", "compound element " + i + " 'fmt' must be a text string");
+          var f = cbor.read.textString(fN);
+          if (f === "compound") throw _err("webauthn/bad-att-stmt", "a compound attestation statement must not nest another compound (WebAuthn 8.9)");
+          var v = VERIFIERS[f];
+          if (!v) throw _err("webauthn/unsupported-format", "compound element " + i + " uses unsupported attestation statement format '" + f + "'");
+          var wantMajor = ATT_STMT_MAJOR[f] === void 0 ? 5 : ATT_STMT_MAJOR[f];
+          if (sN.majorType !== wantMajor) throw _err("webauthn/bad-att-stmt", "compound element " + i + " 'attStmt' has the wrong CBOR shape for format '" + f + "'");
+          return { fmt: f, index: i, att: { fmt: f, attStmt: sN, authData: att.authData, authDataBytes: att.authDataBytes } };
+        });
+        var out = [];
+        return elements.reduce(function(p, e) {
+          return p.then(function() {
+            return Promise.resolve().then(function() {
+              return VERIFIERS[e.fmt](e.att, clientDataHash, opts);
+            }).then(function(r) {
+              out.push(r);
+            }, function(err) {
+              throw _err("webauthn/compound-element-failed", "compound element " + e.index + " (format '" + e.fmt + "') did not verify", err);
+            });
+          });
+        }, Promise.resolve()).then(function() {
+          var res = _result("compound", "Compound", [], att);
+          res.compound = out;
+          return res;
         });
       },
       // none (WebAuthn 8.7): the authenticator provides no attestation. attStmt MUST be
@@ -31875,6 +33587,69 @@ var require_webauthn = __commonJS({
         return Promise.resolve(_result("none", "None", [], att));
       }
     };
+    function _isPlainObject(v) {
+      return !!v && typeof v === "object" && !Array.isArray(v);
+    }
+    function _safetyNetHostnameOk(leaf) {
+      var want = "attest.android.com";
+      var san = _decodeExt(leaf, "subjectAltName");
+      var entries = san && Array.isArray(san.value) ? san.value : [];
+      var dns = entries.filter(function(gn) {
+        return gn && gn.type === "dNSName" && typeof gn.value === "string";
+      });
+      if (dns.length) return dns.some(function(gn) {
+        return gn.value.toLowerCase() === want;
+      });
+      return leaf.subject.rdns.some(function(rdn) {
+        return rdn.some(function(atv) {
+          return atv.name === "commonName" && typeof atv.value === "string" && atv.value.toLowerCase() === want;
+        });
+      });
+    }
+    function _safetyNetChainTrusted(chain, roots, time) {
+      var ordered = chain.slice().reverse();
+      var when = time === void 0 ? /* @__PURE__ */ new Date() : time;
+      var attempts = roots.map(function(root, i) {
+        return function() {
+          var anchorCert;
+          try {
+            anchorCert = Buffer.isBuffer(root) || typeof root === "string" ? x509.parse(root) : root;
+          } catch (e) {
+            throw _err("webauthn/bad-input", "opts.safetyNetRoots[" + i + "] is not a decodable certificate", e);
+          }
+          if (!anchorCert || !anchorCert.subject || !anchorCert.subjectPublicKeyInfo) {
+            throw _err("webauthn/bad-input", "opts.safetyNetRoots[" + i + "] is not a certificate");
+          }
+          var path = ordered.slice();
+          if (path.length > 1 && guard.name.dnEqual(path[0].subject, anchorCert.subject) && guard.name.dnEqual(path[0].issuer, path[0].subject)) {
+            path = path.slice(1);
+          }
+          return pathValidate.validate(path, {
+            time: when,
+            // The anchor's own KEY algorithm and its parameters, not the algorithm its issuer signed it
+            // with: the validator carries these forward as the working public key, and a certificate
+            // below the anchor may inherit its key parameters from them.
+            trustAnchor: {
+              name: anchorCert.subject,
+              publicKey: anchorCert.subjectPublicKeyInfo.bytes,
+              algorithm: anchorCert.subjectPublicKeyInfo.algorithm.oid,
+              parameters: anchorCert.subjectPublicKeyInfo.algorithm.parameters
+            }
+          }).then(function(r) {
+            return !!(r && r.valid);
+          }, function() {
+            return false;
+          });
+        };
+      });
+      return attempts.reduce(function(p, next) {
+        return p.then(function(done) {
+          return done ? true : next();
+        });
+      }, Promise.resolve(false)).then(function(trusted) {
+        if (!trusted) throw _err("webauthn/safetynet-cert-untrusted", "the android-safetynet x5c chain does not validate to any supplied root (opts.safetyNetRoots)");
+      });
+    }
     function _result(fmt, attestationType, chain, att) {
       return { verified: true, fmt, attestationType, trustPath: (chain || []).slice().reverse(), aaguid: att.authData.aaguid, credentialPublicKey: att.authData.credentialPublicKey };
     }
@@ -31900,6 +33675,13 @@ var require_webauthn = __commonJS({
     }
     function verify(attestationObject, clientDataHash, opts) {
       opts = opts || {};
+      try {
+        if (!_isPlainObject(opts)) throw _err("webauthn/bad-input", "opts must be an object");
+        guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "webauthn/bad-input", "opts has an unknown key ");
+        if (opts.time !== void 0) guard.time.assertValid(opts.time, _err, "webauthn/bad-input", "opts.time");
+      } catch (e) {
+        return Promise.reject(e);
+      }
       if (!Buffer.isBuffer(clientDataHash) || clientDataHash.length !== 32) {
         return Promise.reject(_err("webauthn/bad-input", "clientDataHash must be a 32-byte SHA-256 digest"));
       }
@@ -31914,13 +33696,93 @@ var require_webauthn = __commonJS({
       }
       var verifier = VERIFIERS[att.fmt];
       if (!verifier) return Promise.reject(_err("webauthn/unsupported-format", "attestation statement format '" + att.fmt + "' is not supported"));
+      if (opts.tpmPolicy !== void 0 && !_formatCanSatisfyTpmPolicy(att)) {
+        return Promise.reject(_err("webauthn/tpm-policy", "opts.tpmPolicy requires a TPM attestation, but this attestation is format '" + att.fmt + "', which carries no TPM public area"));
+      }
       return Promise.resolve().then(function() {
         return verifier(att, clientDataHash, opts);
+      }).then(function(res) {
+        return opts.metadata === void 0 ? res : _applyMetadata(res, att, opts);
+      });
+    }
+    function _applyMetadata(res, att, opts) {
+      var md = opts.metadata;
+      if (!mds.isVerifiedResult(md)) {
+        throw _err("webauthn/bad-input", "opts.metadata must be a pki.webauthn.verifyMetadataBlob result, not a raw BLOB");
+      }
+      var paths = res.fmt === "compound" && Array.isArray(res.compound) ? res.compound.filter(function(el) {
+        return el.trustPath && el.trustPath.length;
+      }).map(function(el) {
+        return { tp: el.trustPath, fmt: el.fmt, at: el.chainValidatedAt };
+      }) : res.trustPath && res.trustPath.length ? [{ tp: res.trustPath, fmt: res.fmt, at: res.chainValidatedAt }] : [];
+      if (!paths.length) {
+        throw _err("webauthn/metadata-not-applicable", "opts.metadata was supplied, but this attestation carries no trust path to anchor (format '" + res.fmt + "')");
+      }
+      var aaguid = mds.aaguidToString(att.authData.aaguid);
+      var applied = [];
+      function govern(info) {
+        var tp = info.tp;
+        var declared = _aaguidIsSigned(info.fmt) && aaguid && aaguid !== mds.ZERO_AAGUID;
+        var entry, identifier;
+        if (declared) {
+          entry = mds.metadataFor(md, aaguid);
+          identifier = "aaguid " + aaguid;
+        } else {
+          var keyId = mds.certKeyIdentifier(tp[tp.length - 1]);
+          entry = mds.metadataForKeyIdentifier(md, keyId);
+          identifier = "attestation certificate key identifier " + keyId;
+        }
+        if (!entry) throw _err("webauthn/metadata-not-found", "no metadata entry matches this authenticator (" + identifier + ")");
+        if (mds.statusDenied(entry, md, tp[tp.length - 1], at)) {
+          throw _err("webauthn/metadata-status", "the metadata entry for " + identifier + " carries a disqualifying status report");
+        }
+        var anchors = mds.metadataAnchors(entry);
+        if (!anchors.length) throw _err("webauthn/metadata-no-anchor", "the metadata entry for " + identifier + " supplies no attestation root certificate");
+        applied.push({ entry, anchors, identifier });
+        return { anchors, identifier };
+      }
+      var at = opts.time !== void 0 ? opts.time : /* @__PURE__ */ new Date();
+      mds.assertFresh(md, at, "the metadata supplied as opts.metadata");
+      return paths.reduce(function(p, info) {
+        return p.then(function() {
+          var g = govern(info);
+          var pathAt = opts.time !== void 0 ? opts.time : info.at || at;
+          return mds.chainToAnchor(
+            info.tp.slice().reverse(),
+            g.anchors,
+            pathAt,
+            "attestation trust path for " + g.identifier + " (against the roots its metadata entry registers)"
+          );
+        });
+      }, Promise.resolve()).then(function() {
+        var primary = applied[0];
+        res.metadata = {
+          aaguid: primary.entry.aaguid,
+          keyIdentifiers: primary.entry.keyIdentifiers || [],
+          entry: primary.entry,
+          entries: applied.map(function(a) {
+            return a.entry;
+          }),
+          anchors: primary.anchors.length
+        };
+        return res;
+      });
+    }
+    function _formatCanSatisfyTpmPolicy(att) {
+      if (att.fmt === "tpm") return true;
+      if (att.fmt !== "compound") return false;
+      return (att.attStmt.children || []).some(function(el) {
+        if (!el || el.majorType !== 5) return false;
+        var fN = cbor.read.mapGet(el, "fmt");
+        return !!fN && fN.majorType === 3 && cbor.read.textString(fN) === "tpm";
       });
     }
     module2.exports = {
       parseAttestationObject,
-      verify
+      verify,
+      verifyMetadataBlob: mds.verifyMetadataBlob,
+      metadataFor: mds.metadataFor,
+      metadataAnchors: mds.metadataAnchors
     };
   }
 });