@blamejs/pki 0.7.8 → 0.7.10

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.10 — 2026-09-10
+
+An OCSP response is no longer signed with a status window that runs backwards.
+
+### Fixed
+
+- pki.ocsp.sign raises ocsp/bad-input for a response entry whose thisUpdate is after its nextUpdate, before anything is signed. RFC 6960 section 4.2.2.1 makes the pair a validity interval corresponding to the {thisUpdate, nextUpdate} interval in CRLs, and pki.crl.sign, pki.x509.sign, pki.attrcert.sign and pki.crmf.build each already refuse their own reversed window. Every entry in a batch is measured, not the first alone, and a nextUpdate that came from the default is held to the rule a supplied one is.
+- An entry whose thisUpdate equals its nextUpdate still signs, as the equivalent CRL does: a zero-length window is not forbidden. A response entry that names no certificate still reports that first. The times are compared as given, so a thisUpdate later than its nextUpdate is refused even where the two fall inside one second and would encode to the same GeneralizedTime, which is how pki.x509.sign, pki.crl.sign and pki.crmf.build read their own.
+- A pre-produced response still signs. RFC 6960 section 2.5 lets a responder sign a response ahead of the window it certifies, where producedAt is when the response was signed and thisUpdate is when the status was known correct, so a producedAt earlier than thisUpdate is conforming and is left alone.
+
+## v0.7.9 — 2026-09-10
+
+Certificate revocation lists can now be linted against the RFC 5280 profile.
+
+### Added
+
+- pki.lint.crl(pem | der | parsed, opts) lints a certificate revocation list against RFC 5280 section 5, under the new profile name rfc5280-crl. It returns the same LintReport as pki.lint.certificate, and hostile bytes produce a single fatal lint/unparseable finding carrying the strict parser's code rather than raising.
+- On the CRL itself: nextUpdate presence (section 5.1.2.5) and thisUpdate not following it; cRLNumber presence, and the 20-octet ceiling section 5.2.3 places on a CRL number, measured on both the cRLNumber and the baseCRLNumber a delta CRL carries, which section 5.2.4 defines as a CRLNumber; both halves of the authorityKeyIdentifier requirement, that it is present and that it uses the key identifier method (section 5.2.1); the criticality every profiled extension must carry (section 5.2), with issuerAltName reported separately at warn because section 5.2.2 states its criticality as a recommendation; freshestCRL in a delta CRL, and one carrying the reasons or cRLIssuer fields section 5.2.6 requires a CRL to omit (section 5.2.6); a delta whose cRLNumber does not exceed its baseCRLNumber (section 5.2.4); an issuingDistributionPoint stating a scope the profile does not permit (section 5.2.5), which includes a reason scope naming no reason at all, as an empty mask or one setting only the unused bit does; a distribution point named relative to the CRL issuer, in either the issuingDistributionPoint or the freshestCRL, at warn, since section 4.2.1.13 states that as a recommendation; an authorityInfoAccess that names no caIssuers access method, or that carries one other than caIssuers (section 5.2.7), with a warning where no location it gives is an HTTP or LDAP URI; and an unrecognized critical extension.
+- On each revoked entry: the entry-extension criticality section 5.3 requires; a certificate serial that is not positive or runs past 20 octets, the same section 4.1.2.2 profile a certificate's own serial carries; a removeFromCRL reason code outside a delta CRL (section 5.3.1); a certificateIssuer on a CRL that declares itself direct, or one that omits the issuer distinguished name the clause requires (section 5.3.3); a reasonCode encoding unspecified(0), which section 5.3.1 says should be absent instead, at warn, and as an error where the CRL is scoped to some reason codes, since section 5.2.5 makes a meaningful reason a requirement there; a reason the CRL's own issuingDistributionPoint does not declare, where that extension names at least one reason (section 5.2.5); a serial listed twice on a direct CRL, where a reader cannot tell which entry governs (section 5.1.2.6); and an unrecognized critical entry extension.
+- An extension the section 5 profile names, whose value does not read as the structure that identifier names, is reported in either scope. Only extensions the CRL profile names are read this way: a certificate-only extension carried on a CRL is an unrecognized one, which the profile lets a consumer ignore when it is non-critical and which the unknown-critical row reports when it is not. Recognizing an extension by its identifier says only that the profile names it, so without this a critical issuingDistributionPoint carrying a NULL satisfied the criticality rule, was not an unrecognized extension, and reported clean although no consumer can process it. The issuingDistributionPoint is read through the same decoder certification-path validation uses, so the two verbs cannot disagree about what a well-formed one is. Where that extension does not read, the CRL states neither a scope nor a direction, so the rows that depend on it stand aside and the extension is reported once rather than every entry that would have followed from it.
+- pki.lint.rules("rfc5280-crl") enumerates the CRL registry, and pki.lint.rules() with no argument now returns the certificate and CRL rules together. The two verbs do not accept each other's profile names: passing a CRL profile to pki.lint.certificate, or a certificate profile to pki.lint.crl, raises lint/unknown-profile naming the verb to use instead.
+
+### Changed
+
+- Six section 5 rules have no row, because the strict parser refuses them before a rule could run: a CRL whose version does not match the extensions it carries (section 5.1.2.1), a signatureAlgorithm that does not match the signature field inside tbsCertList (section 5.1.1.2), an empty issuer name (section 5.1.2.3), a present-but-empty revokedCertificates (section 5.1.2.6), a date carried in the wrong time type, which is UTCTime through 2049 and GeneralizedTime from 2050 (sections 5.1.2.4, 5.1.2.6 and 5.3.2), and an extension repeated on the CRL or on an entry (section 4.2). Each reaches a caller as the fatal lint/unparseable finding carrying the parser's own code.
+
 ## v0.7.8 — 2026-09-10
 
 A pre-encoded CRL extension whose value does not decode is refused instead of signed.

package/README.md

@@ -252,7 +252,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.sigstore` | Offline verifier for a Sigstore bundle, the artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots and Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key, the ephemeral Fulcio certificate chain validated as of the Rekor log time, the RFC 9162 inclusion proof folded to a Rekor-signed tree root, the log entry bound to this exact signature, and the in-toto SLSA subject digest the caller confirms against the published artifact. It reuses the X.509 parser, the RFC 5280 path validator, and the Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `verified: true` says the artifact was signed and logged, not that a party you trust signed it — Fulcio issues to anyone who completes an OIDC flow, so who signed is decided only by `opts.identity`, and `identityChecked` reports which of its fields were compared. An identity policy naming no field, or a field name that is not one of the three, is refused rather than satisfied — either would accept every signer while reading as a policy in force. A sixth leg is opt-in: pinning the certificate-transparency logs in `opts.ctLogs` checks the receipt Fulcio embeds in the certificate it issues (RFC 6962 §3.2), verified over the certificate as it stood before the receipt was added and under the key of the log that issued it, so the verdict says the signing certificate was public when it was issued rather than handed out quietly. At least one receipt must verify against a pinned log, the verdict reports `sctChecked` and `validScts`, and an empty log set is refused rather than read as a policy that checks nothing. Both content arms are read: a DSSE-wrapped in-toto attestation, and a message signature over an artifact's own bytes, which `cosign sign-blob` produces. For that arm `opts.artifact` supplies the bytes, and they are held to the hash the Rekor `hashedrekord` entry records before the signature is checked over them; the `messageDigest` the bundle carries is covered by no signature, so it is compared against the computed digest and never used in its place. `contentType` names the arm and the verdict has one shape for both — `pae`, `parseBundle`, `verifyBundle` |
 | `pki.inspect` | Human-readable inspection, the pure-JS equivalent of `openssl x509/crl/req/cms -text`. `certificate(pem \| der \| parsed)` renders an OpenSSL-style report: version, serial, signature algorithm, issuer and subject distinguished names, validity, public-key details (curve or modulus size plus the raw point or modulus), every decoded extension with its critical flag, and the signature. `crl`, `csr`, and `cms` render the other formats the same way — a CRL like `openssl crl -text`, a CSR like `openssl req -text`, and a CMS message like `openssl cms -cmsout -print`, with a stable summary for a non-SignedData ContentInfo — and `any(input)` detects the format and routes to the right report. Built over the strict parsers and the two-way OID registry with one set of field renderers, it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency, and the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version. A certificate policy's user notice renders as text, both its explicit text and a notice reference with the notice numbers that identify it, rather than hex, and a malformed part falls back to a hex dump rather than throwing — `certificate`, `crl`, `csr`, `cms`, `any` |
 | `pki.webauthn` | WebAuthn and passkey verification, both halves: offline trust evaluation of a W3C WebAuthn (Level 3) registration, and signature verification of the assertion every login returns. `parseAttestationObject(bytes)` decodes the CBOR attestation object, authenticatorData, and COSE credential key over the strict `pki.cbor` codec; `parseAuthenticatorData(bytes)` reads the bare form an assertion carries through the same parser; `parseClientData(bytes, opts)` decodes the `clientDataJSON` no signature check looks inside, through the shared JSON guard since these are attacker-chosen bytes, returning the challenge decoded so a caller compares bytes rather than spellings, and checking the ceremony type, challenge, and origin when the relying party supplies what it issued. `verifyAssertion(input)` verifies an assertion signature over `authenticatorData \|\| SHA-256(clientDataJSON)` — raw bytes, no COSE_Sign1, an ES256 signature in ASN.1 DER — and applies the §7.2 step 21 counter rule when a stored `previousSignCount` is given, so a counter that fails to advance is refused as a cloned authenticator. `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for packed, tpm, android-key, apple, fido-u2f, and none: the x5c leaf key, the apple nonce, the tpm `certInfo` Name and `extraData` over the `pubArea`, the android `KeyDescription`, and the fido-u2f `verificationData`. It binds the credential public key to each attestation, through the signed authenticatorData for packed and fido-u2f or a cert or `pubArea`-key equality check for android-key, apple, and tpm, and enforces each leaf's certificate requirements. The credential-key check covers the full WebAuthn COSE algorithm set — ES256/384/512, RS256/384/512, PS256/384/512, EdDSA (Ed25519), and the RFC 9864 fully-specified identifiers ESP256/384/512, Ed25519, and Ed448 — validating the public-key point on its curve, rejecting the compressed EC point form, and enforcing a minimally encoded DER ECDSA signature. The verdict field is `attestationVerified`, and `signatureVerified` for an assertion, rather than a bare `verified`, because a sound statement is a different claim from an acceptable ceremony: an attestation naming another origin's RP ID with user presence clear is perfectly sound and must not be registered. Pass `expectedRpId`, `requireUserPresence`, `requireUserVerification`, or `allowedAlgorithms` and those are checked, with `bindingChecked` reporting which ran, so a check that passed can be told from one that never happened. Pass `opts.clientDataJSON` instead of the digest and the client data is read here too: the ceremony type is checked unconditionally, since a login response replayed into a registration is what that rule stops, and the challenge, origin, and top-level origin are checked against what the relying party issued, with `clientData.checked` reporting which comparisons ran. A registration verdict also carries the `credentialId`, `credentialPublicKey`, and initial `signCount` a later login needs. A credential key declaring COSE algorithm `-65535` (RSASSA-PKCS1-v1_5 with SHA-1) is refused unless `allowedAlgorithms` names it, since every signature that credential ever makes would use SHA-1. Anchoring the trust path has two routes: `opts.metadata` resolves the roots the authenticator's own model registered, and `opts.rootCertificates` pins roots directly, which is what anchors the formats FIDO MDS does not cover, Apple's authenticators and the Google hardware-attestation roots among them. `metadata` governs when both are given, and `anchoredTo` names every route that anchored the path, joined with `+` when more than one did: `"metadata"`, `"rootCertificates"`, and `"safetyNetRoots"` for the android-safetynet chain, which anchors through the roots that format requires whether or not either other route was asked for. It is `null` only when nothing anchored the path. `verifyMetadataBlob(blob, opts)` reads a FIDO Metadata Service (MDS v3) BLOB, the signed catalogue of registered authenticator models, verifying its JWS and chaining its signer to an operator-supplied FIDO root before the payload is parsed, with sequence-number rollback and `nextUpdate` freshness checks. Passing the result as `opts.metadata` to `verify` resolves the authenticator's registered attestation roots from its identifier and requires the trust path to fully validate to one of them, refusing an unlisted or revoked model. `metadataAnchors(entry, opts)` applies the same status gate for a caller anchoring the path themselves: a model the catalogue has disqualified registers no anchors. Both of the catalogue's key spaces are covered: an aaguid, and the attestation-certificate key identifiers a U2F authenticator is listed under instead. No FIDO root is bundled, there is no trust-on-first-use, and retrieving the BLOB is out of scope. Fail-closed with typed `webauthn/*` errors — `parseAttestationObject`, `verify`, `verifyMetadataBlob`, `metadataFor`, `metadataAnchors` |
-| `pki.lint` | Certificate linting, the zlint or pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded advisory findings, each with a stable id, a severity (`fatal`, `error`, `warn`, `notice`), a source, a spec-clause citation, and a message, against the RFC 5280 profile, the post-quantum certificate profiles, and a representative CA/Browser Forum TLS BR subset: serial sign and size, validity ordering and the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality (basicConstraints, nameConstraints, policyConstraints and inhibitAnyPolicy must be critical, and keyUsage should be), nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI and AKI presence including the end-entity subjectKeyIdentifier, SAN required and CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys, the post-quantum key-usage rules binding a certificate's keyUsage bits to its subject key type (ML-KEM under RFC 9935 §5, ML-DSA under RFC 9881 §5, and SLH-DSA under RFC 9909 §6 across both its pure and prehash identifiers) together with the ML-KEM encapsulation-key encoding and size, and the §4.2.1.4 certificate-policy user-notice rules (a VisibleString or BMPString explicitText, a notice past 200 characters, an empty notice, control characters, and a non-NFC UTF8String notice, each at the strength the clause states). Alone among these entries the data path never throws: hostile bytes return a `fatal` `lint/unparseable` finding carrying the strict parser's code, so a whole directory lints without a try/catch, and only config-time misuse throws a typed `LintError` — `certificate`, `rules`, `profiles` |
+| `pki.lint` | Certificate linting, the zlint or pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded advisory findings, each with a stable id, a severity (`fatal`, `error`, `warn`, `notice`), a source, a spec-clause citation, and a message, against the RFC 5280 profile, the post-quantum certificate profiles, and a representative CA/Browser Forum TLS BR subset: serial sign and size, validity ordering and the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality (basicConstraints, nameConstraints, policyConstraints and inhibitAnyPolicy must be critical, and keyUsage should be), nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI and AKI presence including the end-entity subjectKeyIdentifier, SAN required and CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys, the post-quantum key-usage rules binding a certificate's keyUsage bits to its subject key type (ML-KEM under RFC 9935 §5, ML-DSA under RFC 9881 §5, and SLH-DSA under RFC 9909 §6 across both its pure and prehash identifiers) together with the ML-KEM encapsulation-key encoding and size, and the §4.2.1.4 certificate-policy user-notice rules (a VisibleString or BMPString explicitText, a notice past 200 characters, an empty notice, control characters, and a non-NFC UTF8String notice, each at the strength the clause states). Alone among these entries the data path never throws: hostile bytes return a `fatal` `lint/unparseable` finding carrying the strict parser's code, so a whole directory lints without a try/catch, and only config-time misuse throws a typed `LintError` — `certificate`, `crl` (the RFC 5280 §5 revocation-list profile: nextUpdate presence, update ordering, cRLNumber presence and its 20-octet ceiling, authorityKeyIdentifier presence, the criticality each profiled CRL and entry extension must carry, freshestCRL in a delta CRL, and unrecognized critical extensions), `rules`, `profiles` |
 | `pki.C` / `pki.constants` | Version-stable constants: the functional scale helpers `C.TIME.*` and `C.BYTES.*`, the codec `LIMITS`, and `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError`, `Asn1Error`, `OidError`, `PemError`, `CertificateError`, `CrlError`, `CsrError`, `Pkcs8Error`, `CmsError`, `OcspError`, `TspError`, `AttrCertError`, `CrmfError`, `Pkcs12Error`, `CmpError`, `PathError`, `CtError`, `JoseError`, `AcmeError`, `WebauthnError`, and `LintError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>`, `pki inspect <cert>`, `pki lint <cert>`, `pki convert <file> --to der\|pem`, `pki verify <cert>... --anchor <cert>`, `pki sign <file> --cert <c> --key <k>` |

package/lib/lint.js

@@ -5,14 +5,16 @@
  * @module pki.lint
  * @nav        Tooling
  * @title      Lint
- * @fullname   Certificate linting against CA/Browser Forum requirements
- * @intro The certificate LINTING engine, the zlint / pkilint of JavaScript. It walks an
- *   ALREADY-PARSED certificate (from `pki.schema.x509.parse`, whose extension values it
- *   decodes with the shared RFC 5280 decoders) and emits graded, advisory FINDINGS: each
- *   with a stable id, a severity (`fatal` > `error` > `warn` > `notice` > `pass`), a source,
- *   a spec-clause citation, and a human message. It ships the RFC 5280 certificate profile,
- *   the post-quantum certificate profiles for ML-KEM, ML-DSA and SLH-DSA, and a
- *   representative CA/Browser Forum TLS Baseline Requirements subset.
+ * @fullname   Certificate and revocation-list linting against RFC 5280 and CA/Browser Forum
+ *             requirements
+ * @intro The LINTING engine, the zlint / pkilint of JavaScript. It walks an ALREADY-PARSED
+ *   certificate or certificate revocation list (from `pki.schema.x509.parse` or
+ *   `pki.schema.crl.parse`, whose extension values it decodes with the shared RFC 5280
+ *   decoders) and emits graded, advisory FINDINGS: each with a stable id, a severity
+ *   (`fatal` > `error` > `warn` > `notice` > `pass`), a source, a spec-clause citation, and
+ *   a human message. It ships the RFC 5280 certificate profile, the RFC 5280 section 5
+ *   revocation-list profile, the post-quantum certificate profiles for ML-KEM, ML-DSA and
+ *   SLH-DSA, and a representative CA/Browser Forum TLS Baseline Requirements subset.
  *
  *   Unlike every other toolkit entry, the lint data path never throws. A linter surveys a
  *   corpus that includes malformed members, so `pki.lint.certificate(hostileBytes)` returns
@@ -22,7 +24,7 @@
  *   raises a typed `LintError`. This deliberate inversion of the toolkit's fail-closed-throw
  *   posture is what lets an operator lint a whole directory without a try/catch per file.
  * @spec RFC 5280, RFC 9881, RFC 9909, RFC 9935, CA/Browser Forum TLS Baseline Requirements
- * @card Lint a certificate against RFC 5280 + CABF TLS BR, in pure JS.
+ * @card Lint a certificate or CRL against RFC 5280 + CABF TLS BR, in pure JS.
  */
 
 var frameworkError = require("./framework-error");
@@ -30,7 +32,9 @@ var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
+var crlSchema = require("./schema-crl");
 var pkix = require("./schema-pkix");
+var schema = require("./schema-engine");
 var path = require("./path-validate");
 var C = require("./constants");
 var ipUtils = require("./ip-utils");
@@ -149,12 +153,27 @@ function _runLints(rules, cert, ctx) {
 }
 
 
+/** @internal The octet length of a big-endian magnitude. DER prefixes a 0x00 to a positive integer
+ * whose top bit is set, so that octet is encoding overhead rather than part of the number. Every
+ * rule that measures a number against a ceiling reads it here, so no two of them can answer
+ * differently for one value.
+ *
+ * The ceiling is measured against the VALUE, not its encoding. Sections 4.1.2.2 and 5.2.3 bound
+ * "serialNumber values" and "CRLNumber values", and each requires that users be able to handle
+ * values up to 20 octets. Every value from 2^159 through 2^160-1 is a 20-octet value whose DER
+ * content needs a 21st octet for the sign, so reading the ceiling against the encoding would make
+ * conforming values unrepresentable. Measuring the encoding is a real reading elsewhere in the
+ * ecosystem, which is why some CAs clear the top bit of a 20-octet serial; this is a deliberate
+ * choice between the two, not an oversight. */
+function _magnitudeOctets(buf) {
+  if (buf.length > 1 && buf[0] === 0x00 && (buf[1] & 0x80)) return buf.length - 1;
+  return buf.length;
+}
+
 function _serialOctets(cert) {
   var hex = cert.serialNumberHex || "";
   if (hex.length % 2) hex = "0" + hex;
-  var buf = Buffer.from(hex, "hex");
-  if (buf.length > 1 && buf[0] === 0x00 && (buf[1] & 0x80)) buf = buf.subarray(1);
-  return buf.length;
+  return _magnitudeOctets(Buffer.from(hex, "hex"));
 }
 
 function _dnsNameProblem(s) { return pkix.dnsNameProblem(s); }
@@ -559,6 +578,709 @@ var RFC9909_RULES = [
   _pqcSigKeyUsageRule("lint/rfc9909/slhdsa-key-usage", "rfc9909", "RFC 9909 6", "SLH-DSA", _isSlhDsa),
 ];
 
+/** @internal RFC 5280 sec. 5 states the criticality of each CRL extension it profiles, and sec. 5.3
+ * does the same for the entry extensions. certificateIssuer is critical (sec. 5.3.3) because a
+ * consumer that ignores it attributes an entry to the wrong issuer. */
+/** @internal The extensions section 5.2 profiles for a CRL. This is the RECOGNIZED set, which is
+ * wider than the table below: issuerAltName is profiled here but its criticality is a SHOULD, so it
+ * is recognized without being held to a required value. */
+var CRL_KNOWN_EXTENSIONS = Object.create(null);
+["authorityKeyIdentifier", "issuerAltName", "cRLNumber", "deltaCRLIndicator",
+  "issuingDistributionPoint", "freshestCRL", "authorityInfoAccess"]
+  .forEach(function (n) { CRL_KNOWN_EXTENSIONS[oid.byName(n)] = true; });
+
+/** @internal Only the extensions whose criticality section 5.2 states as a MUST. issuerAltName is
+ * deliberately absent: section 5.2.2 says a conforming issuer SHOULD mark it non-critical, and
+ * grading a SHOULD as an error would promote the requirement level the clause states. */
+var CRL_CRITICALITY = Object.create(null);
+[["cRLNumber", false], ["authorityKeyIdentifier", false], ["freshestCRL", false],
+  ["authorityInfoAccess", false],
+  ["issuingDistributionPoint", true], ["deltaCRLIndicator", true]]
+  .forEach(function (r) { CRL_CRITICALITY[oid.byName(r[0])] = r[1]; });
+var CRL_ENTRY_CRITICALITY = Object.create(null);
+[["reasonCode", false], ["invalidityDate", false], ["certificateIssuer", true]]
+  .forEach(function (r) { CRL_ENTRY_CRITICALITY[oid.byName(r[0])] = r[1]; });
+
+function _crlExtList(crl) { return crl.crlExtensions || []; }
+function _crlExtByName(crl, name) {
+  var dotted = oid.byName(name), list = _crlExtList(crl);
+  for (var i = 0; i < list.length; i++) { if (list[i].oid === dotted) return list[i]; }
+  return null;
+}
+/** @internal An AuthorityKeyIdentifier value read through the shared extension decoder, which holds
+ * it to the structure RFC 5280 sec. 4.2.1.1 states. Scanning for a [0] child by hand would admit a
+ * SET carrying one, and a SEQUENCE whose [0] is constructed, neither of which is an
+ * AuthorityKeyIdentifier. Bytes the decoder refuses come back as null and the caller reports that;
+ * nothing here returns a verdict. */
+function _akiValue(bytes) {
+  var dec = EXT_DECODERS[oid.byName("authorityKeyIdentifier")];
+  if (!dec) return null;
+  // allow:swallow-unverified a value the shared decoder refuses is not an AuthorityKeyIdentifier, which the caller reports
+  try { return dec(bytes) || null; }
+  catch (_e) { return null; }
+}
+
+/** @internal The decoded names of a GeneralNames value, or null when the bytes are not one. The
+ * value-syntax row reports that separately, so nothing here returns a verdict. */
+function _generalNamesOf(bytes) {
+  // allow:swallow-unverified bytes that are not GeneralNames carry no names for the caller to read
+  try {
+    var m = schema.walk(pkix.generalNames(NS, { decodeValue: true, code: _LINT_VALUE_CODE }), asn1.decode(bytes), NS);
+    return (m.result && m.result.names) || null;
+  } catch (_e) { return null; }
+}
+
+/** @internal A CRLReason value mapped onto its ReasonFlags bit. The two enumerations do NOT line
+ * up: RFC 5280 sec. 5.3.1 leaves CRLReason 7 unused and numbers privilegeWithdrawn 9 and
+ * aACompromise 10, while sec. 4.2.1.13 gives them ReasonFlags bits 7 and 8. unspecified(0) and
+ * removeFromCRL(8) have no bit at all, so neither can sit outside a reason scope and both are
+ * absent here; their own rows answer for them. Assuming identity would report conforming CRLs. */
+var REASON_TO_FLAG_BIT = Object.create(null);
+[[1, 1], [2, 2], [3, 3], [4, 4], [5, 5], [6, 6], [9, 7], [10, 8]]
+  .forEach(function (p) { REASON_TO_FLAG_BIT[p[0]] = p[1]; });
+
+/** @internal Whether a ReasonFlags BIT STRING has the given bit set. */
+function _reasonBitSet(bs, bit) {
+  if (!bs || !bs.bytes) return false;
+  var byteI = bit >> 3;
+  if (byteI >= bs.bytes.length) return false;
+  return (bs.bytes[byteI] & (0x80 >> (bit & 7))) !== 0;
+}
+
+/** @internal Whether a ReasonFlags mask names at least one reason code. Bit 0 is named `unused`,
+ * so a mask setting only it, or setting nothing at all, names none and partitions nothing.
+ *
+ * Bit 0 set ALONGSIDE a real reason is deliberately not reported. Section 5.2.5 requires the reason
+ * codes associated with a distribution point to be specified here, and such a mask specifies one;
+ * RFC 5280 states nothing about bit 0 being clear, so reporting it would name a violation the
+ * profile does not state. */
+function _scopeNamesAnyReason(bs) {
+  for (var bit = 1; bit <= 8; bit++) { if (_reasonBitSet(bs, bit)) return true; }
+  return false;
+}
+
+/** @internal The ReasonFlags of a CRL's issuingDistributionPoint, or null when it states no reason
+ * scope. Read through the shared decoder, so a malformed one scopes nothing. A mask naming no
+ * reason scopes nothing either: it gives an entry no partition to belong to, so the extension is
+ * what is at fault and the profile row reports it rather than every entry in turn. */
+function _crlReasonScope(crl) {
+  var e = _crlExtByName(crl, "issuingDistributionPoint");
+  if (!e || !Buffer.isBuffer(e.value)) return null;
+  var idp = pkix.decodeIssuingDistributionPointValue(NS, e.value, _LINT_VALUE_CODE);
+  if (idp.malformed || !idp.onlySomeReasonsPresent) return null;
+  if (!_scopeNamesAnyReason(idp.onlySomeReasonsValue)) return null;
+  return idp.onlySomeReasonsValue || null;
+}
+
+/** @internal Whether the CRL is scoped to some reason codes, which is what makes a revocation
+ * reason load-bearing: the reason decides which partition an entry belongs in. Reads the scope
+ * itself so the two cannot answer differently about the same CRL. */
+function _crlHasReasonScope(crl) {
+  return _crlReasonScope(crl) !== null;
+}
+
+/** @internal Whether the CRL affirmatively declares itself DIRECT, read from the same
+ * IssuingDistributionPoint decoder certification-path validation uses. Three cases, because a
+ * malformed extension is not the same as an absent one: a CRL carrying no issuingDistributionPoint
+ * is direct by omission, a well-formed one answers with its indirectCRL flag, and one that does not
+ * decode declares neither direction. The rows that only mean something on a direct CRL stand aside
+ * for that last case, so an unreadable declaration is reported against the extension by the
+ * value-syntax row rather than against each entry in turn. That row is an error, so no CRL reaches
+ * a clean report with those rows unevaluated. */
+function _crlDeclaresDirect(crl) {
+  var e = _crlExtByName(crl, "issuingDistributionPoint");
+  if (!e) return true;
+  if (!Buffer.isBuffer(e.value)) return false;
+  var idp = pkix.decodeIssuingDistributionPointValue(NS, e.value, _LINT_VALUE_CODE);
+  if (idp.malformed) return false;
+  return idp.indirect !== true;
+}
+
+var CA_ISSUERS_OID = oid.byName("caIssuers");
+
+/** @internal A recognized CRL extension's value, read through the same decoder every other consumer
+ * of that extension uses. null when the extension is absent or its value does not read, and the
+ * value-syntax row reports the latter on its own. */
+function _crlDecodedExtension(crl, name) {
+  var e = _crlExtByName(crl, name);
+  if (!e || !Buffer.isBuffer(e.value)) return null;
+  var dec = EXT_DECODERS[oid.byName(name)];
+  if (!dec) return null;
+  try {
+    return dec(e.value);
+  } catch (_e) {
+    return null;
+  }
+}
+
+/** @internal Whether a string opens with the given URI scheme followed by a colon, compared
+ * without regard to case by scanning character codes. */
+function _uriSchemeIs(s, scheme) {
+  if (typeof s !== "string" || s.length <= scheme.length) return false;
+  for (var i = 0; i < scheme.length; i++) {
+    var c = s.charCodeAt(i);
+    if (c >= 65 && c <= 90) c += 32;
+    if (c !== scheme.charCodeAt(i)) return false;
+  }
+  return s.charCodeAt(scheme.length) === 58;
+}
+
+/** @internal The schemes that satisfy the section 5.2.7 recommendation. The secured forms count:
+ * warning about an https or ldaps location would report the more protected spelling of the two the
+ * clause names. */
+var AIA_RECOMMENDED_SCHEMES = ["http", "https", "ldap", "ldaps"];
+
+/** @internal The DER content length an integer occupies, which is what the 20-octet ceilings in
+ * RFC 5280 bound. Measured by re-encoding, since the parser hands back the decoded value; a
+ * non-minimal encoding cannot reach here because strict DER refuses one at parse. */
+function _integerOctets(v) {
+  if (typeof v !== "bigint") return null;
+  // allow:swallow-unverified a value the codec cannot re-encode is not one this can size
+  try { return _magnitudeOctets(asn1.decode(asn1.build.integer(v)).content); }
+  catch (_e) { return null; }
+}
+
+/** @internal The extensions that carry a CRLNumber. RFC 5280 sec. 5.2.4 defines BaseCRLNumber as a
+ * CRLNumber, so the sec. 5.2.3 ceiling bounds the delta indicator's value as well as the CRL's own
+ * number. The parser decodes cRLNumber to a bigint and leaves deltaCRLIndicator opaque, so each
+ * carrier names how its value is read. */
+var CRL_NUMBER_CARRIERS = [
+  { name: "cRLNumber", read: function (e) { return e.value; } },
+  { name: "deltaCRLIndicator", read: function (e) { return _crlIntegerValue(e.value); } },
+];
+
+/** @internal An extension value the CRL parser leaves opaque, read as the INTEGER it should be.
+ * Bytes that are not one come back as null and the caller decides what that means. */
+function _crlIntegerValue(bytes) {
+  if (!Buffer.isBuffer(bytes)) return null;
+  // allow:swallow-unverified bytes that are not an INTEGER are reported by the value-syntax row, not decided here
+  try {
+    var n = asn1.decode(bytes);
+    if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.INTEGER) return null;
+    return asn1.read.integer(n);
+  } catch (_e) { return null; }
+}
+
+/** @internal How each recognized extension's value is read, for the ones the CRL parser leaves as
+ * opaque bytes. Each walks the shared schema for that structure rather than testing an outer tag:
+ * a SEQUENCE carrying a NULL is not an IssuingDistributionPoint, and matching the outer type would
+ * admit it. Where a shared decoder exists it answers instead, and where the parser already decoded
+ * the value to a JavaScript type there is nothing left to check. */
+var _LINT_VALUE_CODE = "lint/bad-extension-value";
+var CRL_VALUE_READER = Object.create(null);
+CRL_VALUE_READER[oid.byName("deltaCRLIndicator")] = function (bytes) {
+  var n = asn1.decode(bytes);
+  if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.INTEGER) throw _cfg(_LINT_VALUE_CODE, "not an INTEGER");
+  /** @internal BaseCRLNumber is a CRLNumber, which RFC 5280 sec. 5.2.3 constrains to a
+   * non-negative integer, so a negative one is not a BaseCRLNumber at all. */
+  if (asn1.read.integer(n) < 0n) throw _cfg(_LINT_VALUE_CODE, "a negative BaseCRLNumber");
+};
+/** @internal Read through the SAME decoder certification-path validation uses, rather than a walk
+ * assembled here. The shared IssuingDistributionPoint schema leaves distributionPoint as `any`, so
+ * validating only that far accepts a wrapper carrying something that is not a DistributionPointName
+ * at all, and the linter would call well formed what the path validator rejects. */
+CRL_VALUE_READER[oid.byName("issuingDistributionPoint")] = function (bytes) {
+  if (pkix.decodeIssuingDistributionPointValue(NS, bytes, _LINT_VALUE_CODE).malformed) {
+    throw _cfg(_LINT_VALUE_CODE, "malformed IssuingDistributionPoint");
+  }
+};
+/** @internal Only certificateIssuer. The parser decodes reasonCode and invalidityDate itself and
+ * refuses a value that is not the type they name, so an entry for either would be dead. */
+var CRL_ENTRY_VALUE_READER = Object.create(null);
+CRL_ENTRY_VALUE_READER[oid.byName("certificateIssuer")] = function (bytes) {
+  schema.walk(pkix.generalNames(NS, { code: _LINT_VALUE_CODE }), asn1.decode(bytes), NS);
+};
+
+/** @internal Whether a recognized extension's value reads as the structure its identifier names.
+ * Returns null when it does, and a reason when it does not. An extension whose value the parser
+ * already turned into a JavaScript value needs no check: it could not have been decoded otherwise. */
+function _valueSyntaxFault(e, knownTable, readerTable) {
+  /** @internal Only an extension section 5 profiles FOR A CRL has a syntax to enforce here. A
+   * certificate-only extension carried on a CRL is an unrecognized one, which section 5.2 lets a
+   * consumer ignore when it is non-critical and the unknown-critical row reports when it is not;
+   * decoding its value against the CERTIFICATE profile would report a fault no CRL rule states. */
+  if (knownTable[e.oid] === undefined) return null;
+  var dec = EXT_DECODERS[e.oid];
+  if (dec && Buffer.isBuffer(e.value)) {
+    // allow:swallow-unverified the decoder's refusal IS the fault this returns
+    try { dec(e.value); return null; }
+    catch (_e) { return "does not decode as the structure its extension identifier names"; }
+  }
+  var read = readerTable[e.oid];
+  if (read === undefined || !Buffer.isBuffer(e.value)) return null;
+  // allow:swallow-unverified the reader's refusal IS the fault this returns
+  try { read(e.value); return null; }
+  catch (_e) { return "does not decode as the structure its extension identifier names"; }
+}
+
+function _criticalityRows(list, table, what) {
+  var out = [];
+  (list || []).forEach(function (e) {
+    /** @internal The table has a null prototype and boolean values, so an absent OID is undefined. */
+    var want = table[e.oid];
+    if (want === undefined) return;
+    if ((e.critical === true) !== want) {
+      out.push({ context: { extension: e.name || e.oid, required: want ? "critical" : "non-critical", was: e.critical === true ? "critical" : "non-critical", scope: what } });
+    }
+  });
+  return out;
+}
+
+/** @internal Three of the section 5 rules have no row here, because the strict parser refuses them
+ * before a rule could run and a rule for them would be dead: the version against the extensions
+ * present (sec. 5.1.2.1, `crl/bad-version`), an empty issuer name (sec. 5.1.2.3, `crl/bad-issuer`),
+ * and a present-but-empty revokedCertificates (sec. 5.1.2.6, `crl/bad-revoked-certificates`). Each
+ * reaches a caller as the engine's fatal lint/unparseable carrying that code. */
+var RFC5280_CRL_RULES = [
+  {
+    id: "lint/rfc5280-crl/next-update-missing", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.1.2.5",
+    message: "a conforming CRL issuer includes the nextUpdate field in every CRL",
+    check: function (crl) { return crl.nextUpdate == null ? true : null; },
+  },
+  {
+    id: "lint/rfc5280-crl/update-times-inverted", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.1.2.4 / 5.1.2.5",
+    message: "a CRL's thisUpdate must not follow its nextUpdate",
+    check: function (crl) {
+      // allow:nan-date-comparison-unguarded -- both are codec-parsed CRL times (asn1 readTime rejects a NaN instant).
+      if (!guard.time.isDate(crl.thisUpdate) || !guard.time.isDate(crl.nextUpdate)) return null;
+      return guard.time.instantOf(crl.thisUpdate) > guard.time.instantOf(crl.nextUpdate) ? true : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/crl-number-missing", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.3",
+    message: "a conforming CRL issuer includes the cRLNumber extension in every CRL",
+    check: function (crl) { return _crlExtByName(crl, "cRLNumber") ? null : true; },
+  },
+  {
+    id: "lint/rfc5280-crl/crl-number-too-long", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.3 / 5.2.4",
+    /** @internal One requirement over two carriers, so one row measures both and the context names
+     * which one it measured. A value that is not an INTEGER sizes as null here and is reported by
+     * the value-syntax row instead. */
+    message: "a CRL number must not be longer than 20 octets",
+    check: function (crl) {
+      var out = [];
+      CRL_NUMBER_CARRIERS.forEach(function (carrier) {
+        var e = _crlExtByName(crl, carrier.name);
+        if (!e) return;
+        var octets = _integerOctets(carrier.read(e));
+        if (octets !== null && octets > 20) out.push({ context: { extension: carrier.name, octets: octets } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/aki-missing", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.1",
+    /** @internal Section 5.2.1 states this in the same terms section 5.2.3 states cRLNumber:
+     * conforming CRL issuers MUST include the extension in all CRLs. Two clauses of the same
+     * strength are graded the same, so a caller filtering at `error` sees both or neither. The
+     * certificate profile grades its own authorityKeyIdentifier row differently, and that is
+     * shipped surface left as it is rather than re-graded from here. */
+    message: "a conforming CRL issuer includes an authorityKeyIdentifier in every CRL",
+    check: function (crl) { return _crlExtByName(crl, "authorityKeyIdentifier") ? null : true; },
+  },
+  {
+    id: "lint/rfc5280-crl/aki-without-key-identifier", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.1",
+    message: "a CRL's authorityKeyIdentifier must be well formed and use the key identifier method",
+    /** @internal Section 5.2.1 states two requirements: include the extension, and use the key
+     * identifier method. The row above answers the first. This answers the second, and it also
+     * answers for the value being an AuthorityKeyIdentifier at all, since the CRL parser leaves
+     * this extension as opaque bytes and nothing else reads it. */
+    appliesTo: function (crl) { return !!_crlExtByName(crl, "authorityKeyIdentifier"); },
+    check: function (crl) {
+      var e = _crlExtByName(crl, "authorityKeyIdentifier");
+      if (!Buffer.isBuffer(e.value)) return null;
+      var v = _akiValue(e.value);
+      if (v === null) return { context: { undecodable: true } };
+      return v.keyIdentifier ? null : true;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/extension-criticality", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2",
+    message: "a CRL extension is marked with a criticality the profile does not allow",
+    check: function (crl) {
+      var rows = _criticalityRows(_crlExtList(crl), CRL_CRITICALITY, "crlExtensions");
+      return rows.length ? rows : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/entry-extension-criticality", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.3",
+    message: "a CRL entry extension is marked with a criticality the profile does not allow",
+    check: function (crl) {
+      /** @internal Appended rather than concatenated: a CRL may list very many entries, and this
+       * verb exists to survey ones that arrived from elsewhere, so rebuilding the accumulator per
+       * entry would make the rule quadratic in the length of a list an attacker chooses. */
+      var rows = [];
+      (crl.revokedCertificates || []).forEach(function (r, i) {
+        _criticalityRows(r.crlEntryExtensions, CRL_ENTRY_CRITICALITY, "crlEntryExtensions")
+          .forEach(function (row) { row.context.entry = i; rows.push(row); });
+      });
+      return rows.length ? rows : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/issuer-alt-name-critical", severity: "warn", source: "rfc5280-crl", citation: "RFC 5280 5.2.2",
+    message: "a conforming CRL issuer should mark the issuerAltName extension as non-critical",
+    check: function (crl) {
+      var e = _crlExtByName(crl, "issuerAltName");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/duplicate-entry-serial", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.1.2.6",
+    /** @internal On a direct CRL a serial identifies one certificate, so listing it twice states
+     * two revocations of the same certificate and a reader cannot tell which entry governs. An
+     * INDIRECT CRL is excluded: there a serial is unique per issuer rather than per list, and the
+     * effective issuer is carried forward by certificateIssuer, which is a different computation
+     * from the one here. */
+    appliesTo: function (crl) { return _crlDeclaresDirect(crl); },
+    message: "a direct CRL lists the same certificate serial number more than once",
+    check: function (crl) {
+      var seen = Object.create(null), out = [];
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        if (typeof row.serialNumber !== "bigint") return;
+        var key = row.serialNumber.toString(16);
+        if (seen[key] !== undefined) out.push({ context: { entry: i, firstSeenAt: seen[key], serialNumber: String(row.serialNumber) } });
+        else seen[key] = i;
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/certificate-issuer-on-direct-crl", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.3.3",
+    /** @internal certificateIssuer names the issuer an entry belongs to, which only means something
+     * on a CRL that declares itself indirect through the issuingDistributionPoint indirectCRL flag.
+     * On a direct CRL the entry and the list disagree about whose certificates are covered, and no
+     * revocation status follows from it. */
+    appliesTo: function (crl) { return _crlDeclaresDirect(crl); },
+    message: "a revoked entry carries certificateIssuer on a CRL that does not declare itself indirect",
+    check: function (crl) {
+      var out = [];
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        (row.crlEntryExtensions || []).forEach(function (e) {
+          if (e.oid === oid.byName("certificateIssuer")) out.push({ context: { entry: i } });
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/certificate-issuer-without-dn", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.3.3",
+    message: "a certificateIssuer must carry the issuer distinguished name of the certificate its entry names",
+    /** @internal Section 5.3.3: a conforming issuer MUST include in this extension the distinguished
+     * name from the issuer field of the certificate the entry names. In a GeneralNames that is the
+     * directoryName [4] arm, so a certificateIssuer carrying only some other name form does not
+     * attribute the entry to an issuer at all. Separate from whether the value decodes. */
+    check: function (crl) {
+      var out = [];
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        (row.crlEntryExtensions || []).forEach(function (e) {
+          if (e.oid !== oid.byName("certificateIssuer") || !Buffer.isBuffer(e.value)) return;
+          var names = _generalNamesOf(e.value);
+          if (names === null) return;
+          /** @internal A directoryName wrapping an empty Name is a name container holding no name.
+           * RFC 5280 sec. 4.1.2.4 gives a certificate's issuer a non-empty distinguished name, so
+           * an empty one cannot be the DN sec. 5.3.3 requires, and matching only the tag would
+           * accept it. */
+          var hasDn = false;
+          names.forEach(function (n) {
+            if (n.tagNumber === 4 && n.value && (n.value.rdns || []).length > 0) hasDn = true;
+          });
+          if (!hasDn) out.push({ context: { entry: i } });
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/unspecified-reason-in-reason-scoped-crl", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.5",
+    /** @internal Section 5.2.5: where the issuingDistributionPoint carries onlySomeReasons, every
+     * revoked certificate in scope MUST be assigned a reason other than unspecified, because the
+     * reason is what decides which partition the entry belongs in. That is a MUST here, where the
+     * same encoding is only a SHOULD under section 5.3.1, so it is reported as an error and the
+     * SHOULD row stands aside. An entry carrying NO reasonCode is untouched: the clause says the
+     * extension need not be present. */
+    appliesTo: function (crl) { return _crlHasReasonScope(crl); },
+    message: "a CRL scoped to some reason codes lists an entry whose reasonCode is unspecified(0)",
+    check: function (crl) {
+      var out = [];
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        (row.crlEntryExtensions || []).forEach(function (e) {
+          if (e.oid === oid.byName("reasonCode") && Number(e.value) === 0) out.push({ context: { entry: i } });
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/reason-outside-crl-scope", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.5",
+    /** @internal Section 5.2.5: the reason codes associated with a distribution point MUST be
+     * specified in onlySomeReasons, and the section's own partitioning example shows a CRL carrying
+     * only the reasons it declares. An entry whose reason is not among them is a revocation this
+     * CRL says it does not carry, so a reader partitioning by reason would miss it. */
+    appliesTo: function (crl) { return _crlReasonScope(crl) !== null; },
+    message: "a revoked entry states a reason the CRL's issuingDistributionPoint does not declare",
+    check: function (crl) {
+      var scope = _crlReasonScope(crl), out = [];
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        (row.crlEntryExtensions || []).forEach(function (e) {
+          if (e.oid !== oid.byName("reasonCode")) return;
+          var bit = REASON_TO_FLAG_BIT[Number(e.value)];
+          if (bit === undefined) return;
+          if (!_reasonBitSet(scope, bit)) out.push({ context: { entry: i, reasonCode: Number(e.value) } });
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/reason-code-unspecified", severity: "warn", source: "rfc5280-crl", citation: "RFC 5280 5.3.1",
+    /** @internal Section 5.3.1 states this as a SHOULD, so it is a warning rather than an error:
+     * the reason code extension should be absent instead of encoding unspecified(0), which says
+     * nothing a reader can act on while costing an extension slot. Where the CRL is scoped to some
+     * reason codes the row above answers instead, at the strength section 5.2.5 states. */
+    message: "a reasonCode extension encoding unspecified(0) should be absent instead",
+    appliesTo: function (crl) { return !_crlHasReasonScope(crl); },
+    check: function (crl) {
+      var out = [];
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        (row.crlEntryExtensions || []).forEach(function (e) {
+          if (e.oid === oid.byName("reasonCode") && Number(e.value) === 0) out.push({ context: { entry: i } });
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/entry-serial-not-positive", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 4.1.2.2",
+    message: "a revoked entry's certificate serial number must be a positive integer",
+    /** @internal userCertificate is a CertificateSerialNumber, so it carries the sec. 4.1.2.2
+     * profile the certificate rows already apply to a certificate's own serial. */
+    check: function (crl) {
+      var out = [];
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        if (typeof row.serialNumber === "bigint" && row.serialNumber <= 0n) {
+          out.push({ context: { entry: i, serialNumber: String(row.serialNumber) } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/entry-serial-too-long", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 4.1.2.2",
+    message: "a revoked entry's certificate serial number must not be longer than 20 octets",
+    check: function (crl) {
+      var out = [];
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        var octets = _integerOctets(row.serialNumber);
+        if (octets !== null && octets > 20) out.push({ context: { entry: i, octets: octets } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/idp-profile", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.5",
+    message: "an issuingDistributionPoint states a scope the profile does not permit",
+    /** @internal A separate decision from whether the value DECODES, which the value-syntax row
+     * answers. These are the constraints section 5.2.5 places on a well-formed one, read from the
+     * same decoder certification-path validation uses. */
+    appliesTo: function (crl) { return !!_crlExtByName(crl, "issuingDistributionPoint"); },
+    check: function (crl) {
+      var idp = pkix.decodeIssuingDistributionPointValue(NS, _crlExtByName(crl, "issuingDistributionPoint").value, _LINT_VALUE_CODE);
+      if (idp.malformed) return null;
+      var out = [];
+      if (!idp.hasDistributionPoint && !idp.onlyUser && !idp.onlyCa && !idp.onlySomeReasonsPresent && !idp.indirect && !idp.onlyAttr) {
+        out.push({ context: { reason: "states no scope at all" } });
+      }
+      if (idp.onlyUser && idp.onlyCa) out.push({ context: { reason: "sets both onlyContainsUserCerts and onlyContainsCACerts" } });
+      if (idp.onlyAttr) out.push({ context: { reason: "sets onlyContainsAttributeCerts" } });
+      if (idp.onlySomeReasonsPresent && !_scopeNamesAnyReason(idp.onlySomeReasonsValue)) {
+        out.push({ context: { reason: "sets onlySomeReasons to a mask naming no reason code" } });
+      }
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/freshest-crl-forbidden-field", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.6",
+    /** @internal Section 5.2.6 reuses the cRLDistributionPoints syntax but states that only the
+     * distribution point field is meaningful on a CRL, and that reasons and cRLIssuer are omitted.
+     * The shared decoder accepts both because the certificate extension permits them, so this row
+     * carries the restriction the certificate profile does not have. */
+    message: "a CRL's freshestCRL must omit the reasons and cRLIssuer fields",
+    appliesTo: function (crl) { return !!_crlExtByName(crl, "freshestCRL"); },
+    check: function (crl) {
+      var dps = _crlDecodedExtension(crl, "freshestCRL");
+      if (dps === null) return null;
+      var out = [];
+      dps.forEach(function (dp, i) {
+        if (dp.reasons) out.push({ context: { index: i, field: "reasons" } });
+        if (dp.cRLIssuer) out.push({ context: { index: i, field: "cRLIssuer" } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/aia-without-ca-issuers", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.7",
+    /** @internal caIssuers is what this extension is for on a CRL: it names where to fetch the
+     * certificates a reader verifies the CRL's signature with. Present without one, it gives a
+     * reader nothing to fetch. */
+    message: "a CRL's authorityInfoAccess must include an AccessDescription whose method is caIssuers",
+    appliesTo: function (crl) { return !!_crlExtByName(crl, "authorityInfoAccess"); },
+    check: function (crl) {
+      var descs = _crlDecodedExtension(crl, "authorityInfoAccess");
+      if (descs === null) return null;
+      var found = descs.some(function (d) { return d.accessMethod === CA_ISSUERS_OID; });
+      if (found) return null;
+      return { context: { methods: descs.map(function (d) { return oid.name(d.accessMethod) || d.accessMethod; }) } };
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/aia-forbidden-access-method", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.7",
+    message: "a CRL's authorityInfoAccess must not carry an access method other than caIssuers",
+    appliesTo: function (crl) { return !!_crlExtByName(crl, "authorityInfoAccess"); },
+    check: function (crl) {
+      var descs = _crlDecodedExtension(crl, "authorityInfoAccess");
+      if (descs === null) return null;
+      var out = [];
+      descs.forEach(function (d, i) {
+        if (d.accessMethod === CA_ISSUERS_OID) return;
+        out.push({ context: { index: i, method: oid.name(d.accessMethod) || d.accessMethod } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/aia-location-not-http-or-ldap", severity: "warn", source: "rfc5280-crl", citation: "RFC 5280 5.2.7",
+    /** @internal Section 5.2.7 states this one as a SHOULD, so it is a warning where the two rules
+     * above are errors. */
+    message: "at least one authorityInfoAccess location should be an HTTP or LDAP URI",
+    appliesTo: function (crl) { return !!_crlExtByName(crl, "authorityInfoAccess"); },
+    check: function (crl) {
+      var descs = _crlDecodedExtension(crl, "authorityInfoAccess");
+      if (descs === null || descs.length === 0) return null;
+      var reachable = descs.some(function (d) {
+        var loc = d.accessLocation;
+        if (!loc || loc.tag !== 6) return false;
+        return AIA_RECOMMENDED_SCHEMES.some(function (s) { return _uriSchemeIs(loc.value, s); });
+      });
+      return reachable ? null : true;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/distribution-point-name-relative", severity: "warn", source: "rfc5280-crl", citation: "RFC 5280 5.2.5 / 5.2.6 / 4.2.1.13",
+    /** @internal Sections 5.2.5 and 5.2.6 both give their distribution point the syntax and
+     * encoding conventions section 4.2.1.13 states, and there naming a distribution point relative
+     * to the CRL issuer is a SHOULD NOT, so this is a warning rather than an error. One requirement
+     * over two carriers, so one row reads both and the context names which it read. The MUST NOT
+     * stated beside it is conditioned on cRLIssuer carrying more than one name; an
+     * IssuingDistributionPoint has no cRLIssuer field, and section 5.2.6 requires freshestCRL to
+     * omit its own, so that sentence cannot reach a CRL either way. */
+    message: "a distribution point name should not be given relative to the CRL issuer",
+    appliesTo: function (crl) {
+      return !!_crlExtByName(crl, "issuingDistributionPoint") || !!_crlExtByName(crl, "freshestCRL");
+    },
+    check: function (crl) {
+      var out = [];
+      var e = _crlExtByName(crl, "issuingDistributionPoint");
+      if (e && Buffer.isBuffer(e.value)) {
+        var idp = pkix.decodeIssuingDistributionPointValue(NS, e.value, _LINT_VALUE_CODE);
+        if (!idp.malformed && idp.distributionPoint && idp.distributionPoint.kind === "rdn") {
+          out.push({ context: { extension: "issuingDistributionPoint", form: "nameRelativeToCRLIssuer" } });
+        }
+      }
+      var dps = _crlDecodedExtension(crl, "freshestCRL");
+      if (dps) {
+        dps.forEach(function (dp, i) {
+          if (!dp.distributionPoint || dp.distributionPoint.kind !== "rdn") return;
+          out.push({ context: { extension: "freshestCRL", index: i, form: "nameRelativeToCRLIssuer" } });
+        });
+      }
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/delta-number-not-advancing", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.4",
+    message: "a delta CRL's cRLNumber must be greater than its baseCRLNumber",
+    appliesTo: function (crl) { return !!_crlExtByName(crl, "deltaCRLIndicator"); },
+    check: function (crl) {
+      var num = _crlExtByName(crl, "cRLNumber");
+      var base = _crlIntegerValue(_crlExtByName(crl, "deltaCRLIndicator").value);
+      if (base === null || !num || typeof num.value !== "bigint") return null;
+      return num.value > base ? null : { context: { crlNumber: String(num.value), baseCRLNumber: String(base) } };
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/remove-from-crl-outside-delta", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.3.1",
+    message: "the removeFromCRL reason code may appear only in a delta CRL",
+    appliesTo: function (crl) { return !_crlExtByName(crl, "deltaCRLIndicator"); },
+    check: function (crl) {
+      var out = [];
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        (row.crlEntryExtensions || []).forEach(function (e) {
+          if (e.oid === oid.byName("reasonCode") && Number(e.value) === 8) out.push({ context: { entry: i } });
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/freshest-in-delta", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2.6",
+    message: "the freshestCRL extension must not appear in a delta CRL",
+    appliesTo: function (crl) { return !!_crlExtByName(crl, "deltaCRLIndicator"); },
+    check: function (crl) { return _crlExtByName(crl, "freshestCRL") ? true : null; },
+  },
+  {
+    id: "lint/rfc5280-crl/extension-value-syntax", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2 / 5.3",
+    message: "a recognized extension's value does not read as the structure its identifier names",
+    /** @internal Recognizing an extension by its identifier says only that the profile names it.
+     * Without this, a critical extension the profile recognizes but whose value no consumer can
+     * process reports clean: the criticality row is satisfied and the unknown-critical row does not
+     * fire, because the identifier IS known. Both scopes are walked. */
+    check: function (crl) {
+      var out = [];
+      _crlExtList(crl).forEach(function (e) {
+        var why = _valueSyntaxFault(e, CRL_KNOWN_EXTENSIONS, CRL_VALUE_READER);
+        if (why) out.push({ context: { extension: e.name || e.oid, scope: "crlExtensions", reason: why } });
+      });
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        (row.crlEntryExtensions || []).forEach(function (e) {
+          var why = _valueSyntaxFault(e, CRL_ENTRY_CRITICALITY, CRL_ENTRY_VALUE_READER);
+          if (why) out.push({ context: { extension: e.name || e.oid, scope: "crlEntryExtensions", entry: i, reason: why } });
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5280-crl/unknown-critical-extension", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.2 / 5.3",
+    message: "a critical extension is not recognized by the profile -- a conforming consumer must not use the CRL",
+    /** @internal Sections 5.2 and 5.3 state the same obligation, once for the CRL's extensions and
+     * once for a revoked entry's, so both lists are walked. The recognized set for each scope is
+     * the extensions that section profiles, which is exactly the table its criticality rule keys
+     * on. The certificate registry cannot answer here: it does not recognize deltaCRLIndicator or
+     * issuingDistributionPoint, which section 5.2 REQUIRES to be critical, and it does recognize
+     * certificate-only extensions that have no meaning on a CRL. */
+    check: function (crl) {
+      var out = [];
+      _crlExtList(crl).forEach(function (e) {
+        if (e.critical === true && CRL_KNOWN_EXTENSIONS[e.oid] === undefined) {
+          out.push({ context: { oid: e.oid, name: e.name || null, scope: "crlExtensions" } });
+        }
+      });
+      (crl.revokedCertificates || []).forEach(function (row, i) {
+        (row.crlEntryExtensions || []).forEach(function (e) {
+          if (e.critical === true && CRL_ENTRY_CRITICALITY[e.oid] === undefined) {
+            out.push({ context: { oid: e.oid, name: e.name || null, scope: "crlEntryExtensions", entry: i } });
+          }
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
+];
+
+var CRL_PROFILES = Object.assign(Object.create(null), { "rfc5280-crl": RFC5280_CRL_RULES });
+var ALL_CRL_RULES = RFC5280_CRL_RULES;
+
 var PROFILES = Object.assign(Object.create(null), {
   "rfc5280": RFC5280_RULES,
   "rfc9881": RFC9881_RULES,
@@ -570,7 +1292,10 @@ var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat
 
 function _selectRules(profile) {
   if (profile == null || profile === "all" || profile === "default") return ALL_RULES;
-  if (!PROFILES[profile]) throw _cfg("lint/unknown-profile", "unknown lint profile \"" + profile + "\" (known: " + Object.keys(PROFILES).join(", ") + ")");
+  if (!PROFILES[profile]) {
+    if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
+    throw _cfg("lint/unknown-profile", "unknown lint profile \"" + profile + "\" (known: " + Object.keys(PROFILES).join(", ") + ")");
+  }
   return PROFILES[profile];
 }
 
@@ -636,6 +1361,107 @@ function certificate(input, opts) {
   return report;
 }
 
+var _CRL_OPTS = Object.assign(Object.create(null), { profile: 1, severity: 1 });
+
+/** @internal The same door the certificate path uses. A parsed CRL is admitted only when the shared
+ * guard says it is one, so an object that merely carries a `crlExtensions` property is refused with
+ * the typed config error rather than reaching a rule and faulting there. */
+function _derivedCrl(o) {
+  if (!o || typeof o !== "object" || guard.bytes.isByteSource(o)) return null;
+  // allow:swallow-unverified an object the guard refuses is not a parsed CRL, and the byte paths below answer for it
+  try {
+    var p = guard.parsed.acceptDerived(o, "crl", crlSchema.parse, _cfg, "lint/bad-input", "the CRL");
+    return guard.parsed.isCrl(p) ? p : null;
+  } catch (_e) {
+    return null;
+  }
+}
+
+function _ingestCrl(input) {
+  var derived = _derivedCrl(input);
+  if (derived) return { crl: derived };
+  var der;
+  if (Buffer.isBuffer(input)) der = input;
+  else if (typeof input === "string") {
+    try { der = crlSchema.pemDecode(input); }
+    catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER CRL", context: { code: e.code } } }; }
+  } else {
+    throw _cfg("lint/bad-input", "pki.lint.crl input must be a parsed CRL, a DER Buffer, or a PEM string");
+  }
+  try { return { crl: crlSchema.parse(der) }; }
+  catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "RFC 5280", message: "input is not a well-formed X.509 CRL", context: { code: e.code } } }; }
+}
+
+/**
+ * @primitive  pki.lint.crl
+ * @signature  pki.lint.crl(pem | der | parsed, opts?) -> LintReport
+ * @since      0.7.9
+ * @status     stable
+ * @spec       RFC 5280 sec. 5
+ * @related    pki.lint.certificate, pki.schema.crl.parse, pki.crl.sign
+ *
+ * Lint a certificate revocation list against the RFC 5280 section 5 profile. `input` is a PEM
+ * string, a DER `Buffer`, or an already-parsed `pki.schema.crl` object. It returns the same
+ * `LintReport` shape `pki.lint.certificate` returns, and it never throws on the data path:
+ * bytes that are not a well-formed CRL produce a single `fatal` finding `lint/unparseable`
+ * carrying the strict parser's own code.
+ *
+ * The rows cover the CRL's update times (nextUpdate presence and ordering), its extensions
+ * (cRLNumber presence and length, authorityKeyIdentifier presence and the key identifier method,
+ * the criticality every profiled extension is required to carry, the scope an
+ * issuingDistributionPoint states, freshestCRL in a delta CRL, and an unrecognized critical
+ * extension), and each revoked entry (the serial profile, a reason code against the scope the CRL
+ * declares, certificateIssuer, and entry-extension criticality).
+ *
+ * Six section 5 rules never appear here because the strict parser refuses them first, and a rule
+ * for them could not fire. A CRL carrying extensions without the version that admits them
+ * (section 5.1.2.1), a `signatureAlgorithm` differing from the `signature` field inside
+ * `tbsCertList` (section 5.1.1.2), an empty issuer name (section 5.1.2.3), a present-but-empty
+ * `revokedCertificates` (section 5.1.2.6), a date carried in the wrong time type, which is UTCTime
+ * through 2049 and GeneralizedTime from 2050 (sections 5.1.2.4, 5.1.2.6 and 5.3.2), and an
+ * extension repeated on the CRL or on an entry (section 4.2) each arrive as `lint/unparseable`
+ * carrying the parser's own code.
+ *
+ * @opts  profile   `"rfc5280-crl"`, the only CRL profile (default runs every CRL rule). A
+ *                  certificate profile name is refused rather than run against a CRL.
+ * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
+ *                  always reflect the complete, unfiltered result.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var crlDer = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"),
+ *     nextUpdate: new Date("2026-02-01T00:00:00Z"), crlNumber: 1n },
+ *     { name: "Example CA", publicKey: await pki.key.export(pair.publicKey), key: pair.privateKey });
+ *   var report = pki.lint.crl(crlDer);
+ *   report.worst;                                       // -> "error", for the missing AKI
+ *   report.findings.map(function (f) { return f.id; }); // -> ["lint/rfc5280-crl/aki-missing"]
+ */
+function crl(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
+  guard.identifier.assertKnownKeys(opts, _CRL_OPTS, _cfg, "lint/bad-input",
+    "pki.lint.crl has an unknown option: ");
+  if (opts.severity != null && VALID_SEVERITY.indexOf(opts.severity) === -1) {
+    throw _cfg("lint/bad-severity", "unknown severity threshold \"" + opts.severity + "\" (known: " + VALID_SEVERITY.join(", ") + ")");
+  }
+  var profile = opts.profile;
+  var rules_;
+  if (profile == null || profile === "all" || profile === "default") rules_ = ALL_CRL_RULES;
+  else if (CRL_PROFILES[profile]) rules_ = CRL_PROFILES[profile];
+  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
+  else throw _cfg("lint/unknown-profile", "unknown CRL lint profile \"" + profile + "\" (known: " + Object.keys(CRL_PROFILES).join(", ") + ")");
+
+  var ingested = _ingestCrl(input);
+  var report;
+  if (ingested.fatal) {
+    report = { findings: [ingested.fatal], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
+  } else {
+    report = _runLints(rules_, ingested.crl, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
+  }
+  report.worst = _worst(report.findings);
+  report.findings = _applyThreshold(report, opts.severity);
+  return report;
+}
+
 /**
  * @primitive  pki.lint.rules
  * @signature  pki.lint.rules(profile?) -> [{id, severity, source, citation}]
@@ -650,7 +1476,10 @@ function certificate(input, opts) {
  *   pki.lint.rules("rfc5280").length;   // -> a positive count
  */
 function rules(profile) {
-  var set = profile == null ? ALL_RULES : (PROFILES[profile] || (function () { throw _cfg("lint/unknown-profile", "unknown lint profile \"" + profile + "\""); })());
+  var set = profile == null
+    ? ALL_RULES.concat(ALL_CRL_RULES)
+    : (PROFILES[profile] || CRL_PROFILES[profile]
+      || (function () { throw _cfg("lint/unknown-profile", "unknown lint profile \"" + profile + "\""); })());
   return set.map(function (r) { return { id: r.id, severity: r.severity, source: r.source, citation: r.citation }; });
 }
 
@@ -663,12 +1492,13 @@ function rules(profile) {
  *
  * List the known lint-profile names.
  * @example
- *   pki.lint.profiles();   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls"]
+ *   pki.lint.profiles();   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "rfc5280-crl"]
  */
-function profiles() { return Object.keys(PROFILES); }
+function profiles() { return Object.keys(PROFILES).concat(Object.keys(CRL_PROFILES)); }
 
 module.exports = {
   certificate: certificate,
+  crl: crl,
   rules: rules,
   profiles: profiles,
 };

package/lib/ocsp.js

@@ -326,10 +326,33 @@ function _buildSingleResponse(r, opts) {
   if (r.certID != null) certIdP = Promise.resolve(b.raw(guard.bytes.view(r.certID, OcspError, "ocsp/bad-input", "a response entry's certID")));
   else if (r.cert != null && r.issuer != null) certIdP = _buildCertID(_certOf(r.cert, "a response certificate"), _certOf(r.issuer, "a response issuer"), r.hashAlgorithm || "sha1");
   else return Promise.reject(_err("ocsp/bad-input", "each response entry needs { certID } or { cert, issuer }"));
+  /** @internal Every per-entry refusal stays INSIDE this chain. These entries are built through a
+   * map into Promise.all, so a synchronous throw here would abort the map before Promise.all
+   * attached handlers, and an earlier entry's rejection would be orphaned: the caller catches
+   * sign()'s failure and the process still sees an unhandled rejection. */
   return certIdP.then(function (certID) {
+    var thisUpdate = _asDate(r.thisUpdate) || new Date();
+    var nextUpdate = r.nextUpdate === null ? null : (_asDate(r.nextUpdate) || _defaultNextUpdate());
+    /** @internal RFC 6960 sec. 4.2.2.1 makes thisUpdate and nextUpdate a validity interval, and says
+     * it corresponds to the {thisUpdate, nextUpdate} interval in CRLs. An interval whose end
+     * precedes its start states a status window that closed before it opened, and pki.ocsp.verify
+     * reports such a response unknown, so signing one emits what nothing can act on. pki.x509.sign,
+     * pki.crl.sign, pki.attrcert.sign and pki.crmf.build each refuse their own reversed window; this
+     * is that rule in the one place it was missing. The RESOLVED values are compared rather than the
+     * caller's, since a defaulted nextUpdate reaches a relying party the same way a supplied one
+     * does. An equal pair is left alone, as it is for a CRL: a zero-length window is not forbidden.
+     *
+     * The CALLER's instants are compared, at their full precision, which is what the four sibling
+     * verbs do. Two instants inside one second encode to the same whole-second GeneralizedTime, so
+     * comparing the encoded values instead would accept a descending pair and quietly emit the
+     * zero-length window it truncates to. A caller naming a later thisUpdate than nextUpdate has
+     * stated a reversed one whatever the seconds round to, and hears so here. */
+    if (nextUpdate !== null && guard.time.instantOf(thisUpdate) > guard.time.instantOf(nextUpdate)) {
+      throw _err("ocsp/bad-input", "thisUpdate must not be after nextUpdate (RFC 6960 sec. 4.2.2.1)");
+    }
     var statusNode = _certStatusNode(r.status, opts);
-    var srChildren = [certID, statusNode, b.generalizedTime(_asDate(r.thisUpdate) || new Date())];
-    if (r.nextUpdate !== null) srChildren.push(b.explicit(0, b.generalizedTime(_asDate(r.nextUpdate) || _defaultNextUpdate())));
+    var srChildren = [certID, statusNode, b.generalizedTime(thisUpdate)];
+    if (nextUpdate !== null) srChildren.push(b.explicit(0, b.generalizedTime(nextUpdate)));
     if (r.singleExtensions && r.singleExtensions.length) srChildren.push(b.explicit(1, b.sequence(r.singleExtensions)));
     return b.sequence(srChildren);
   });

package/lib/path-validate.js

@@ -1387,8 +1387,6 @@ var OID_AUTHORITY_KEY_ID = oid.byName("authorityKeyIdentifier");
 var OID_CRL_NUMBER = oid.byName("cRLNumber");
 var OID_FRESHEST_CRL = oid.byName("freshestCRL");
 
-var IDP_SCHEMA = pkix.issuingDistributionPoint("path/bad-idp");
-
 var ALL_REASONS = 0x1FE;
 
 function reasonMaskFromBitString(bs) {
@@ -1411,37 +1409,23 @@ function interimReasonMask(idpMask, dpMask) {
   return ALL_REASONS;
 }
 
+/** @internal The structural read is shared with certificate-revocation-list linting through
+ * schema-pkix, so the two cannot disagree about what a well-formed IssuingDistributionPoint is.
+ * Only the reason-flags MASK is added here, because only path validation compares against it. */
 function decodeIdp(ext) {
-  var out = { hasDistributionPoint: false, distributionPoint: null, onlyUser: false, onlyCa: false, onlySomeReasons: null, indirect: false, onlyAttr: false, malformed: false };
-  var m;
-  try {
-    m = schema.walk(IDP_SCHEMA, asn1.decode(ext.value), NS);
-    if (m.fields.distributionPoint.present) {
-      var dpnWrap = m.fields.distributionPoint.node;
-      if (!dpnWrap.children || dpnWrap.children.length !== 1) {
-        throw E("path/bad-idp", "IssuingDistributionPoint distributionPoint [0] must wrap exactly one DistributionPointName");
-      }
-      out.distributionPoint = pkix.distributionPointName(NS, dpnWrap.children[0], "path/bad-idp");
-    }
-  }
-  catch (_e) { out.malformed = true; return out; }
-  function flag(f) {
-    if (!f.present) return false;
-    var isSet = f.value === true;
-    if (!isSet) out.malformed = true;
-    return isSet;
-  }
-  out.hasDistributionPoint = m.fields.distributionPoint.present;
-  out.onlyUser = flag(m.fields.onlyContainsUserCerts);
-  out.onlyCa = flag(m.fields.onlyContainsCACerts);
-  out.onlySomeReasons = m.fields.onlySomeReasons.present ? true : null;
-  out.onlySomeReasonsMask = null;
-  if (m.fields.onlySomeReasons.present) {
-    out.onlySomeReasonsMask = reasonMaskFromBitString(m.fields.onlySomeReasons.value);
+  var s = pkix.decodeIssuingDistributionPointValue(NS, ext.value, "path/bad-idp");
+  var out = {
+    hasDistributionPoint: s.hasDistributionPoint, distributionPoint: s.distributionPoint,
+    onlyUser: s.onlyUser, onlyCa: s.onlyCa,
+    onlySomeReasons: s.onlySomeReasonsPresent ? true : null,
+    indirect: s.indirect, onlyAttr: s.onlyAttr, malformed: s.malformed,
+    onlySomeReasonsMask: null,
+  };
+  if (out.malformed) return out;
+  if (s.onlySomeReasonsPresent) {
+    out.onlySomeReasonsMask = reasonMaskFromBitString(s.onlySomeReasonsValue);
     if (out.onlySomeReasonsMask === null) out.malformed = true;
   }
-  out.indirect = flag(m.fields.indirectCRL);
-  out.onlyAttr = flag(m.fields.onlyContainsAttributeCerts);
   return out;
 }
 

package/lib/schema-pkix.js

@@ -643,6 +643,58 @@ function issuingDistributionPoint(code) {
   ], { assert: "sequence", code: code, what: "IssuingDistributionPoint" });
 }
 
+/** @internal The STRUCTURAL read of an IssuingDistributionPoint value, shared so that certification
+ * path validation and certificate-revocation-list linting cannot disagree about what a well-formed
+ * one is. It lives here rather than being exported from a consumer, because this module is not on
+ * the public surface and a decoder taking one module's internal shape should not become API.
+ * Reports a fault as `malformed` rather than throwing, since both callers survey hostile input.
+ * The reason-flags MASK is deliberately absent: it is a path-validation concern, and that caller
+ * composes it on top of this. */
+function decodeIssuingDistributionPointValue(ns, bytes, code) {
+  var out = { malformed: false, hasDistributionPoint: false, distributionPoint: null,
+    onlyUser: false, onlyCa: false, onlySomeReasonsPresent: false, onlySomeReasonsValue: null,
+    indirect: false, onlyAttr: false, fields: null };
+  var m;
+  try {
+    m = schema.walk(issuingDistributionPoint(code), asn1.decode(bytes), ns);
+    if (m.fields.distributionPoint.present) {
+      var wrap = m.fields.distributionPoint.node;
+      if (!wrap.children || wrap.children.length !== 1) {
+        throw ns.E(code, "IssuingDistributionPoint distributionPoint [0] must wrap exactly one DistributionPointName");
+      }
+      out.distributionPoint = distributionPointName(ns, wrap.children[0], code);
+    }
+  } catch (_e) {
+    out.malformed = true;
+    return out;
+  }
+  function flag(f) {
+    if (!f.present) return false;
+    if (f.value !== true) { out.malformed = true; return false; }
+    return true;
+  }
+  out.fields = m.fields;
+  out.hasDistributionPoint = m.fields.distributionPoint.present;
+  out.onlyUser = flag(m.fields.onlyContainsUserCerts);
+  out.onlyCa = flag(m.fields.onlyContainsCACerts);
+  out.onlySomeReasonsPresent = m.fields.onlySomeReasons.present;
+  out.onlySomeReasonsValue = m.fields.onlySomeReasons.present ? m.fields.onlySomeReasons.value : null;
+  /** @internal ReasonFlags is a NamedBitList, so DER requires the trailing zero bits be dropped.
+   * That is an encoding rule rather than a path-validation policy, so it belongs to the structural
+   * read both callers share: a value keeping its trailing zeros is malformed for either of them. */
+  if (out.onlySomeReasonsPresent) {
+    var bs = out.onlySomeReasonsValue;
+    if (!bs || !bs.bytes) out.malformed = true;
+    else {
+      try { schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (msg) { throw ns.E(code, msg); }); }
+      catch (_e) { out.malformed = true; } // allow:swallow-unverified the refusal IS the malformed flag this sets
+    }
+  }
+  out.indirect = flag(m.fields.indirectCRL);
+  out.onlyAttr = flag(m.fields.onlyContainsAttributeCerts);
+  return out;
+}
+
 var _T = asn1.TAGS;
 
 function assertPolicyQualifiers(qNode, fail) {
@@ -1337,6 +1389,7 @@ module.exports = {
   generalNames: generalNames,
   distributionPointName: distributionPointName,
   issuingDistributionPoint: issuingDistributionPoint,
+  decodeIssuingDistributionPointValue: decodeIssuingDistributionPointValue,
   keyUsageOf: keyUsageOf,
   extKeyUsageOf: extKeyUsageOf,
   assertsPurpose: assertsPurpose,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.8",
+  "version": "0.7.10",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:eb6258f5-7cf4-4371-80b7-ed98047003ac",
+  "serialNumber": "urn:uuid:34b0c9f8-e610-4b07-817f-7e260dc2355a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T13:51:21.922Z",
+    "timestamp": "2026-09-10T21:28:40.246Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.8",
+      "bom-ref": "@blamejs/pki@0.7.10",
       "type": "application",
       "name": "pki",
-      "version": "0.7.8",
+      "version": "0.7.10",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.8",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.10",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.8",
+      "ref": "@blamejs/pki@0.7.10",
       "dependsOn": []
     }
   ]