@blamejs/pki 0.8.16 → 0.8.18

package/lib/lint.js

@@ -37,6 +37,7 @@ var crlSchema = require("./schema-crl");
 var csrSchema = require("./schema-csr");
 var ocspSchema = require("./schema-ocsp");
 var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
 var schema = require("./schema-engine");
 var path = require("./path-validate");
 var C = require("./constants");
@@ -84,11 +85,32 @@ function _derivedCert(o) {
   }
 }
 
+/** @internal The bytes a lint verb was handed, as a Buffer, or null where the input is not bytes
+ *  at all and the caller's own branches answer for it. Every parser in this toolkit reads any
+ *  BufferSource, so the one surface that promises never to throw on the data path does not turn
+ *  away a caller holding a Uint8Array from the network or an ArrayBuffer from a reader. Taking a
+ *  snapshot rather than the caller's view is also what closes the detached-backing-buffer hazard,
+ *  since a caller can neuter the buffer between the check and the read. */
+function _derBytesOf(input) {
+  if (!guard.bytes.isByteSource(input)) return null;
+  try {
+    return { der: guard.bytes.snapshotSource(input, LintError, "lint/bad-input", "pki.lint input") };
+  } catch (e) {
+    /** @internal A byte source whose backing buffer was detached is still a byte source, and it
+     * fails at the door rather than at the parse. The data path answers with a verdict either
+     * way, or one neutered buffer aborts the scan of a whole corpus. */
+    return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint",
+      message: "input is a byte source whose bytes could not be read", context: { code: e.code } } };
+  }
+}
+
 function _ingest(input) {
   var derived = _derivedCert(input);
   if (derived) return { cert: derived };
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = x509.pemDecode(input, "CERTIFICATE"); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER certificate", context: { code: e.code } } }; }
@@ -128,6 +150,11 @@ function _makeCtx(cert, profile) {
   return {
     profile: profile,
     explicitTlsProfile: explicitTls,
+    /** @internal An S/MIME subscriber certificate names its exact profile through a reserved
+     * policy identifier, so unlike the TLS case the rows detect it from the certificate itself and
+     * the flag only records that the caller also named it. */
+    explicitSmimeProfile: profile === "cabf-smime",
+    isCaCert: isCa,
     isTlsServerCert: explicitTls || (_hasEku(cert, "serverAuth") && !isCa),
     decode: function (name) { return _decodeOrNull(cert, name); },
     raw: function (name) { return _findRaw(cert, name); },
@@ -242,6 +269,7 @@ function _ecCurveName(spki) {
 
 var OID_UNOTICE = oid.byName("unotice");
 var OID_ANY_POLICY = oid.byName("anyPolicy");
+var OID_CPS = oid.byName("cps");
 /** @internal The extensions RFC 5280 says a conforming CA SHOULD mark non-critical, keyed by OID
  *  with the clause; the MUSTs live in the shared CERT_FIXED_CRITICALITY table. The subjectAltName
  *  and extKeyUsage recommendations are conditional and have their own rules. */
@@ -256,23 +284,40 @@ function _hasControlChar(str) {
   }
   return false;
 }
-function _policyDisplayTexts(ctx) {
+/** @internal Every policy qualifier of every PolicyInformation, handed to `fn` as its qualifier
+ *  OID, its value node, and the PolicyInformation carrying it. The decoder surfaces the qualifiers
+ *  as raw DER, because a qualifier may carry any type and the reader does not choose one for the
+ *  caller, so every walk re-decodes bytes that already passed the policy-qualifier door. */
+function _eachPolicyQualifier(ctx, fn) {
   var d = ctx.decode("certificatePolicies");
-  if (!d || !Array.isArray(d.value)) return [];
-  var out = [];
+  if (!d || !Array.isArray(d.value)) return;
   d.value.forEach(function (pi) {
     if (!pi.qualifiersBytes || !pi.qualifiersBytes.length) return;
     var quals;
     // allow:swallow-unverified re-decoding bytes that already decoded under assertPolicyQualifiers cannot throw
-    try { quals = asn1.decode(pi.qualifiersBytes).children; } catch (_e) { return; }
+    try {
+      quals = asn1.decode(pi.qualifiersBytes).children;
+    } catch (_e) {
+      return;
+    }
     (quals || []).forEach(function (pq) {
       var qid;
       // allow:swallow-unverified assertPolicyQualifiers already read this OID, so re-reading it cannot throw
-      try { qid = asn1.read.oid(pq.children[0]); } catch (_e2) { return; }
-      if (qid !== OID_UNOTICE) return;
-      out = out.concat(pkix.userNoticeTexts(pq.children[1]));
+      try {
+        qid = asn1.read.oid(pq.children[0]);
+      } catch (_e2) {
+        return;
+      }
+      fn(qid, pq.children[1], pi);
     });
   });
+}
+function _policyDisplayTexts(ctx) {
+  var out = [];
+  _eachPolicyQualifier(ctx, function (qid, value) {
+    if (qid !== OID_UNOTICE) return;
+    out = out.concat(pkix.userNoticeTexts(value));
+  });
   return out;
 }
 function _hasPolicyDisplayText(cert, ctx) { return _policyDisplayTexts(ctx).length > 0; }
@@ -544,7 +589,1103 @@ function _validityCeilingDays(notBefore) {
   return VALIDITY_SCHEDULE[VALIDITY_SCHEDULE.length - 1].maxDays;
 }
 
+/** @internal All FOUR reserved policy identifiers of BR sec. 7.1.6.1, one per Subscriber
+ *  Certificate type named in sec. 7.1.2.7.1: Domain, Organization and Individual Validated under
+ *  the baseline-requirements arc, and Extended Validation under ev-guidelines. Sec. 7.1.2.7.9:
+ *  "the Certificate Policies extension MUST contain exactly one Reserved Certificate Policy
+ *  Identifier", so a list short of one type reports every certificate of that type as asserting
+ *  none. */
+var CABF_RESERVED_POLICIES = ["domain-validated", "organization-validated", "individual-validated",
+  "ev-guidelines"]
+  .map(function (n) { return oid.byName(n); }).filter(function (d) { return !!d; });
+
+/** @internal BR sec. 7.1.2.7.10. Each is MUST NOT for a Subscriber Certificate. */
+var CABF_FORBIDDEN_EKU = ["codeSigning", "emailProtection", "timeStamping", "ocspSigning",
+  "anyExtendedKeyUsage", "precertificateSigningCert"]
+  .map(function (n) { var d = oid.byName(n); return d ? { name: n, oid: d } : null; })
+  .filter(function (e) { return !!e; });
+
+/** @internal BR sec. 7.1.2.7.7. Only these two accessMethods are permitted; any other MUST NOT. */
+var CABF_AIA_METHODS = ["ocsp", "caIssuers"].map(function (n) { return oid.byName(n); });
+
+/** @internal BR sec. 7.1.2.7.11, the two Key Usage tables. A bit marked "Permitted: N" for the
+ *  certificate's key type may not be set. The tables differ by key type, which is the point: the
+ *  same bit is permitted for one and forbidden for the other. */
+var CABF_KU_FORBIDDEN_RSA = ["nonRepudiation", "keyAgreement", "keyCertSign", "cRLSign",
+  "encipherOnly", "decipherOnly"];
+var CABF_KU_FORBIDDEN_ECC = ["nonRepudiation", "keyEncipherment", "dataEncipherment",
+  "keyCertSign", "cRLSign", "encipherOnly", "decipherOnly"];
+var CABF_KU_RSA_BITS = ["digitalSignature", "keyEncipherment", "dataEncipherment"];
+
+/** @internal BR sec. 7.1.2.7.12: only dNSName and iPAddress are permitted in a Subscriber
+ *  Certificate's subjectAltName. The GeneralName context tag numbers are RFC 5280 sec. 4.2.1.6's. */
+var CABF_SAN_PERMITTED_TAGS = [2, 7];
+var CABF_SAN_TAG_NAMES = Object.assign(Object.create(null), {
+  0: "otherName", 1: "rfc822Name", 2: "dNSName", 3: "x400Address", 4: "directoryName",
+  5: "ediPartyName", 6: "uniformResourceIdentifier", 7: "iPAddress", 8: "registeredID",
+});
+
+/** @internal Which of the two Key Usage tables sec. 7.1.2.7.11 gives applies to this certificate,
+ *  or null where neither does. The section opens "The acceptable Key Usage values vary based on
+ *  whether the Certificate's subjectPublicKeyInfo identifies an RSA public key or an ECC public
+ *  key", and gives a table for each and none for anything else. A key outside the two, such as an
+ *  ML-DSA one, therefore has no table to be held to, and treating everything that is not ECC as
+ *  RSA would report it against requirements written for a different algorithm. */
+function _cabfKeyUsageTable(cert) {
+  var spki = cert.subjectPublicKeyInfo;
+  var name = spki && spki.algorithm && spki.algorithm.name;
+  if (name === "ecPublicKey") return "ecc";
+  if (RSA_KEY_ALGS[name]) return "rsa";
+  return null;
+}
+function _isEccKey(cert) { return _cabfKeyUsageTable(cert) === "ecc"; }
+function _subjectIsEmpty(cert) {
+  var rdns = cert.subject && cert.subject.rdns;
+  return !(Array.isArray(rdns) && rdns.length);
+}
+
+/** @internal Every policy qualifier of every PolicyInformation, as its qualifier OID. */
+function _policyQualifierIds(ctx) {
+  var out = [];
+  _eachPolicyQualifier(ctx, function (qid) { out.push(qid); });
+  return out;
+}
+
+/** @internal The S/MIME BR sec. 7.1.6.1 reserved policy identifiers, keyed by OID to the
+ *  generation that OID declares. A subscriber certificate asserts exactly one, so reading it is
+ *  how this profile learns which generation's table to hold the certificate to, and the presence
+ *  of one is also what says the certificate is one of these at all. */
+var SMIME_GENERATION_BY_POLICY = Object.create(null);
+/** @internal The same twelve identifiers keyed to the certificate TYPE they declare. The tables of
+ *  sec. 7.1.2.3 (l) are keyed on the type where the rest of the section is keyed on the
+ *  generation, so both directions of the matrix are read. */
+var SMIME_TYPE_BY_POLICY = Object.create(null);
+["mailbox", "organization", "sponsor", "individual"].forEach(function (type) {
+  ["legacy", "multipurpose", "strict"].forEach(function (gen) {
+    var d = oid.byName("smime-" + type + "-" + gen);
+    if (d) { SMIME_GENERATION_BY_POLICY[d] = gen; SMIME_TYPE_BY_POLICY[d] = type; }
+  });
+});
+
+/** @internal The keyUsage tables of sec. 7.1.2.3 (e). Each cell states its usage MODES (signing
+ *  only, key management only, dual use), and each mode fixes bits with SHALL and admits others
+ *  with MAY, so a conforming certificate asserts every bit of some one mode and no bit outside
+ *  that same mode. Flattening a cell into one permitted set loses that: on RSA, digitalSignature
+ *  with dataEncipherment sets only bits the cell names somewhere and still matches no mode,
+ *  because dataEncipherment belongs to the key-management modes and those require keyEncipherment.
+ *  The RSA cell is the one that also differs by GENERATION, Multipurpose and Legacy admitting
+ *  dataEncipherment where Strict does not. The elliptic-curve cell names encipherOnly and
+ *  decipherOnly only in the modes that require keyAgreement, which is how it states "only if
+ *  keyAgreement is set". A certificate declaring no generation is held to the Strict cell, the
+ *  narrowest of the three. */
+function _smimeKuModes(kind, gen) {
+  var relaxed = gen === "multipurpose" || gen === "legacy";
+  if (kind === "rsa") {
+    return [
+      { required: ["digitalSignature"], optional: ["nonRepudiation"] },
+      { required: ["keyEncipherment"], optional: relaxed ? ["dataEncipherment"] : [] },
+      { required: ["digitalSignature", "keyEncipherment"],
+        optional: relaxed ? ["nonRepudiation", "dataEncipherment"] : ["nonRepudiation"] },
+    ];
+  }
+  if (kind === "ec") {
+    return [
+      { required: ["digitalSignature"], optional: ["nonRepudiation"] },
+      { required: ["keyAgreement"], optional: ["encipherOnly", "decipherOnly"] },
+      { required: ["digitalSignature", "keyAgreement"],
+        optional: ["nonRepudiation", "encipherOnly", "decipherOnly"] },
+    ];
+  }
+  if (kind === "eddsa" || kind === "mldsa") {
+    return [{ required: ["digitalSignature"], optional: ["nonRepudiation"] }];
+  }
+  if (kind === "mlkem") return [{ required: ["keyEncipherment"], optional: [] }];
+  return null;
+}
+/** @internal Every bit any mode of the cell names, which is the complement of "Other bit positions
+ *  SHALL NOT be set". */
+function _smimeKuNamedAnywhere(modes) {
+  var out = [];
+  modes.forEach(function (m) {
+    m.required.concat(m.optional).forEach(function (bit) {
+      if (out.indexOf(bit) === -1) out.push(bit);
+    });
+  });
+  return out;
+}
+function _smimeKuAsserted(value) {
+  var out = [];
+  KU_BIT_NAMES.forEach(function (bit) { if (value[bit] === true) out.push(bit); });
+  return out;
+}
+/** @internal Whether the asserted bits are exactly some mode: every bit that mode requires, and no
+ *  bit it does not name. */
+function _smimeKuMatchesAMode(modes, asserted) {
+  for (var i = 0; i < modes.length; i++) {
+    var allowed = modes[i].required.concat(modes[i].optional);
+    var ok = true;
+    modes[i].required.forEach(function (bit) { if (asserted.indexOf(bit) === -1) ok = false; });
+    asserted.forEach(function (bit) { if (allowed.indexOf(bit) === -1) ok = false; });
+    if (ok) return true;
+  }
+  return false;
+}
+
+/** @internal Sec. 7.1.2.3 (c) gives a URI scheme table for each of these two accessMethods and
+ *  none for any other, so a scheme is measured on these and an unrecognized accessMethod has no
+ *  table to be held to. */
+var SMIME_AIA_METHODS = ["ocsp", "caIssuers"].map(function (n) { return oid.byName(n); });
+
+/** @internal Sec. 7.1.2.3 (l): the Legal Entity Identifier table is keyed on the certificate type.
+ *  The identifier is prohibited outright for two types; for Organization-validated the role
+ *  identifier alone is prohibited, and Sponsor-validated admits both. */
+var SMIME_LEI_EXTS = Object.assign(Object.create(null), { identifier: "lei-identifier", role: "lei-role" });
+/** @internal Whether the cell for a certificate type ADMITS one of the two extensions. A cell that
+ *  reads "Prohibited" carries no criticality sentence, so the criticality row is asked only where
+ *  this is true and a prohibited extension breaks one clause rather than two. A certificate
+ *  declaring no type names no cell and is held to neither row. */
+function _smimeLeiAdmits(type, which) {
+  if (type === "sponsor") return true;
+  if (type === "organization") return which === "identifier";
+  return false;
+}
+
+/** @internal Sec. 7.1.2.3 (m): both Adobe extensions the table names, prohibited under Strict. */
+var SMIME_ADOBE_EXTS = ["adobe-timestamp", "adobe-archive-rev-info"];
+
+/** @internal Sec. 7.1.2.3 (f): these four SHALL NOT be present at any generation, where any other
+ *  purpose is forbidden under Strict alone. */
+var SMIME_FORBIDDEN_EKU = ["serverAuth", "codeSigning", "timeStamping", "anyExtendedKeyUsage"]
+  .map(function (n) { var d = oid.byName(n); return d ? { name: n, oid: d } : null; })
+  .filter(function (e) { return !!e; });
+
+/** @internal "Effective July 15, 2025 S/MIME Subscriber Certificates SHALL NOT be issued using the
+ *  Legacy Generation profiles" (sec. 7.1.6.1). Dated, so a certificate issued before it is not
+ *  held to a rule that did not yet apply. */
+var SMIME_LEGACY_RETIRED = new Date("2025-07-15T00:00:00Z");
+
+function _smimeGeneration(ctx) {
+  var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return null;
+  var found = null;
+  d.value.forEach(function (pi) {
+    var gen = SMIME_GENERATION_BY_POLICY[pi.policyIdentifier];
+    if (gen && found === null) found = gen;
+  });
+  return found;
+}
+/** @internal A reserved policy identifier alone does not make a certificate a SUBSCRIBER one: sec.
+ *  7.1.6.3 says a certificate issued to a Subordinate CA "SHALL include one or more explicit policy
+ *  identifiers defined in Section 7.1.6.1", so an intermediate carries them too. Detection
+ *  therefore asks for the identifier AND that the certificate is not a CA, or these subscriber-only
+ *  rows would report an intermediate for asserting cA and keyCertSign and naming no mailbox.
+ *  Naming the profile still overrides, which is how a malformed subscriber is checked. */
+function _isSmime(cert, ctx) {
+  if (ctx.explicitSmimeProfile) return true;
+  return _smimeGeneration(ctx) !== null && !ctx.isCaCert;
+}
+function _smimeStrict(cert, ctx) { return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) === "strict"; }
+/** @internal The cell every table in sec. 7.1.2.3 is read against. A certificate declaring no
+ *  generation names no cell, and is held to Strict, the narrowest of the three. */
+function _smimeGenerationOrStrict(ctx) {
+  var gen = _smimeGeneration(ctx);
+  return gen === null ? "strict" : gen;
+}
+/** @internal The certificate type the asserted reserved identifier declares, for the sec.
+ *  7.1.2.3 (l) tables. Null where none is asserted, which is every certificate the caller named
+ *  the profile for rather than one that declared itself. */
+function _smimeType(ctx) {
+  var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return null;
+  var found = null;
+  for (var i = 0; i < d.value.length; i++) {
+    var t = SMIME_TYPE_BY_POLICY[d.value[i].policyIdentifier];
+    if (t && found === null) found = t;
+  }
+  return found;
+}
+
+/** @internal Which sec. 7.1.2.3 (e) table applies, from the subject key's own algorithm. A key
+ *  outside them has no table to be held to. */
+function _smimeKeyKind(cert) {
+  var spki = cert.subjectPublicKeyInfo;
+  var name = spki && spki.algorithm && spki.algorithm.name;
+  if (RSA_KEY_ALGS[name]) return "rsa";
+  if (name === "ecPublicKey") return "ec";
+  if (name === "Ed25519" || name === "Ed448") return "eddsa";
+  if (typeof name === "string" && name.indexOf("ml-dsa") !== -1) return "mldsa";
+  if (typeof name === "string" && name.indexOf("ml-kem") !== -1) return "mlkem";
+  return null;
+}
+
+/** @internal The URI of a GeneralName carried as raw DER, or null where it is not one. The
+ *  cRLDistributionPoints decoder surfaces each fullName entry as bytes, since a distribution point
+ *  may name any GeneralName type and the reader does not choose one for the caller. */
+function _generalNameUri(der) {
+  var n;
+  // allow:swallow-unverified an entry that does not decode is answered by the extension-syntax row
+  try { n = asn1.decode(der); } catch (_e) { return null; }
+  if (!n || n.tagClass !== "context" || n.tagNumber !== 6) return null;
+  return n.content.toString("latin1");
+}
+/** @internal HTTP, not HTTPS. The S/MIME BR distinguishes the two by wording: the policy qualifier
+ *  of sec. 7.1.2.3 (a) "SHALL be a HTTP or HTTPS URL", where the distribution point and access
+ *  method tables say "SHALL have the URI scheme HTTP" and "Other schemes SHALL NOT be present".
+ *  HTTPS is another scheme, and a revocation list fetched over TLS is a circular dependency.
+ *  Having that scheme means being a URI of it, so both readings go through the one place that
+ *  decides what an http or https URL is and differ only in which answer they accept. */
+function _isHttpUri(u) {
+  return pkiBuild.httpUrlScheme(u) === "http";
+}
+/** @internal The policy-qualifier clause of sec. 7.1.2.3 (a) names both schemes, where the URI
+ *  scheme tables name HTTP alone. It also asks for a URL rather than a scheme, so a bare
+ *  "http://" naming no host does not satisfy it. The shape is the one a reader holds a URL it was
+ *  given to, not the narrower one the builders hold what they emit to. */
+function _isHttpOrHttpsUrl(u) {
+  return pkiBuild.httpUrlScheme(u) !== null;
+}
+/** @internal The accessLocation URIs of sec. 7.1.2.3 (c), grouped BY accessMethod. The clause
+ *  gives id-ad-ocsp and id-ad-caIssuers a table each, where clause (b) gives the whole extension
+ *  one, so each method's URIs answer that method's table alone and an accessMethod with no table
+ *  is not measured. An accessLocation of another GeneralName type carries no URI to measure a
+ *  scheme on. */
+function _smimeAiaLocationsByMethod(ctx) {
+  var d = ctx.decode("authorityInfoAccess");
+  var out = Object.create(null);
+  if (!d || !Array.isArray(d.value)) return out;
+  for (var i = 0; i < d.value.length; i++) {
+    var ad = d.value[i];
+    if (SMIME_AIA_METHODS.indexOf(ad.accessMethod) === -1) continue;
+    if (!out[ad.accessMethod]) out[ad.accessMethod] = [];
+    /** @internal A location that is not a uniformResourceIdentifier carries no scheme, so it is
+     * kept as null rather than dropped: the method is still provided and still has no HTTP URI. */
+    var loc = ad.accessLocation;
+    out[ad.accessMethod].push(loc && loc.tag === 6 && typeof loc.value === "string" ? loc.value : null);
+  }
+  return out;
+}
+function _crldpUris(ctx) {
+  var d = ctx.decode("cRLDistributionPoints");
+  if (!d || !Array.isArray(d.value)) return [];
+  var out = [];
+  d.value.forEach(function (dp) {
+    var point = dp.distributionPoint;
+    if (!point || point.kind !== "fullName" || !Array.isArray(point.names)) return;
+    point.names.forEach(function (raw) {
+      var u = _generalNameUri(raw);
+      if (u !== null) out.push(u);
+    });
+  });
+  return out;
+}
+
+var SMIME_OID_SMTP_UTF8 = oid.byName("smtpUtf8Mailbox");
+
+/** @internal The nine named keyUsage bits of RFC 5280 sec. 4.2.1.3, in their bit order. */
+var KU_BIT_NAMES = ["digitalSignature", "nonRepudiation", "keyEncipherment", "dataEncipherment",
+  "keyAgreement", "keyCertSign", "cRLSign", "encipherOnly", "decipherOnly"];
+
+/** @internal The type OID of an otherName GeneralName. Every otherName is a [0], so the type is
+ *  the only thing telling one apart from another, and a decoded entry carries it on `value` where
+ *  the reader recognized the form and as bytes where it did not. */
+function _otherNameTypeOf(gn) {
+  if (gn && gn.value && typeof gn.value.typeId === "string") return gn.value.typeId;
+  if (gn && gn.value && typeof gn.value.type === "string") return gn.value.type;
+  var src = gn && (gn.bytes || gn.value);
+  if (!Buffer.isBuffer(src)) return null;
+  var n;
+  // allow:swallow-unverified an entry that does not decode is answered by the extension-syntax row
+  try { n = asn1.decode(src); } catch (_e) { return null; }
+  if (!n || !n.children || !n.children.length) return null;
+  // allow:swallow-unverified a first child that is not an OID is not an otherName type
+  try { return asn1.read.oid(n.children[0]); } catch (_e2) { return null; }
+}
+
+var CABF_SMIME_RULES = [
+  {
+    id: "lint/cabf-smime/policies-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal SHOULD NOT, so a warning rather than an error: the clause states a preference and
+     * the certificate is still conformant against the MUSTs around it. */
+    message: "certificatePolicies should not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("certificatePolicies"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/policies-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal Reachable only where the caller named the profile: without the extension there is
+     * no reserved identifier, and the reserved identifier is what otherwise says the certificate
+     * is one of these. Naming the profile is the caller supplying that statement. */
+    message: "a subscriber certificate must carry a certificatePolicies extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("certificatePolicies") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/policies-reserved-identifier-count", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "It SHALL include exactly one of the reserved policyIdentifiers", so two is as
+     * much a fault as none and the count says which. A certificate's own generation is read from
+     * that identifier, so two of them also leaves the generation ambiguous. */
+    message: "certificatePolicies must include exactly one reserved policy identifier",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      /** @internal An absent extension is the presence row's answer, not this one's, so it is
+       * skipped here and counted where it is present but names no reserved identifier. */
+      if (!ctx.raw("certificatePolicies")) return null;
+      var d = ctx.decode("certificatePolicies");
+      var list = (d && Array.isArray(d.value)) ? d.value : [];
+      var found = list.filter(function (pi) { return !!SMIME_GENERATION_BY_POLICY[pi.policyIdentifier]; });
+      return found.length === 1 ? null : { context: { count: found.length } };
+    },
+  },
+  {
+    id: "lint/cabf-smime/legacy-generation-retired", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.6.1",
+    message: "a subscriber certificate must not be issued under a Legacy generation profile",
+    appliesTo: _isSmime,
+    effectiveDate: SMIME_LEGACY_RETIRED,
+    check: function (cert, ctx) {
+      return _smimeGeneration(ctx) === "legacy" ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/crldp-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (b)",
+    message: "a subscriber certificate must carry a cRLDistributionPoints extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("cRLDistributionPoints") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/crldp-non-http-uri", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (b)",
+    /** @internal The scheme rule differs by generation: Strict and Multipurpose require EVERY
+     * uniformResourceIdentifier to be HTTP, where Legacy requires at least one and permits others
+     * beside it. One row measures both, because the generation decides which question to ask. */
+    message: "a cRLDistributionPoints URI does not meet the URI scheme rule for this generation",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      /** @internal An extension carrying no URI at all fails both readings: every generation
+       * requires an HTTP one, so an empty list is a violation rather than nothing to measure. The
+       * presence row answers only for the extension being absent. */
+      if (!ctx.raw("cRLDistributionPoints")) return null;
+      var uris = _crldpUris(ctx);
+      var gen = _smimeGeneration(ctx);
+      if (gen === "legacy" || !uris.length) {
+        return uris.some(_isHttpUri) ? null : { context: { generation: gen || "strict", uris: uris } };
+      }
+      var bad = uris.filter(function (u) { return !_isHttpUri(u); });
+      return bad.length ? { context: { generation: gen, uris: bad } } : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aia-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    message: "authorityInformationAccess must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("authorityInfoAccess"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/basic-constraints-ca-true", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (d)",
+    message: "a subscriber certificate's basicConstraints cA field must not be true",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("basicConstraints");
+      return (d && d.value && d.value.cA === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/basic-constraints-path-len", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (d)",
+    message: "a subscriber certificate's basicConstraints must not carry a pathLenConstraint",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("basicConstraints");
+      var pl = d && d.value ? d.value.pathLenConstraint : null;
+      return pl === null || pl === undefined ? null : { context: { pathLenConstraint: pl } };
+    },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    message: "a subscriber certificate must carry a keyUsage extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("keyUsage") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-forbidden-bit", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    /** @internal "Other bit positions SHALL NOT be set", over a table that differs by key
+     * algorithm: keyEncipherment belongs to the RSA table and keyAgreement to the EC one, so the
+     * same bit is conformant on one key and not on the other. A key algorithm the section gives no
+     * table for is held to neither. "Other bit positions" reaches past the nine RFC 5280 names as
+     * well, so a bit set beyond them is reported for every key algorithm. */
+    message: "a keyUsage bit this key algorithm's table does not permit is set",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      var kind = _smimeKeyKind(cert);
+      if (kind === null) return null;
+      var modes = _smimeKuModes(kind, _smimeGeneration(ctx));
+      if (modes === null) return null;
+      var named = _smimeKuNamedAnywhere(modes);
+      var out = [];
+      KU_BIT_NAMES.forEach(function (bit) {
+        if (d.value[bit] === true && named.indexOf(bit) === -1) {
+          out.push({ context: { keyUsage: bit, keyAlgorithm: kind } });
+        }
+      });
+      if (d.value.reservedBitsSet === true) {
+        out.push({ context: { reservedBitSet: true, keyAlgorithm: kind } });
+      }
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-matches-no-mode", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    /** @internal A cell is a set of modes rather than a set of bits, so bits that all appear
+     * somewhere in the cell can still combine into no mode: digitalSignature with dataEncipherment
+     * on RSA, or encipherOnly without keyAgreement on an elliptic curve. This row runs only where
+     * every asserted bit is one the cell names, since a bit outside the cell is the row above. */
+    message: "the keyUsage bits set match no usage mode of this key algorithm's table",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value || d.value.reservedBitsSet === true) return null;
+      var kind = _smimeKeyKind(cert);
+      if (kind === null) return null;
+      var gen = _smimeGeneration(ctx);
+      var modes = _smimeKuModes(kind, gen);
+      if (modes === null) return null;
+      var asserted = _smimeKuAsserted(d.value);
+      var named = _smimeKuNamedAnywhere(modes);
+      for (var i = 0; i < asserted.length; i++) {
+        if (named.indexOf(asserted[i]) === -1) return null;
+      }
+      return _smimeKuMatchesAMode(modes, asserted)
+        ? null
+        : { context: { keyAlgorithm: kind, generation: gen || "strict", keyUsage: asserted } };
+    },
+  },
+  {
+    id: "lint/cabf-smime/eku-missing-email-protection", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (f)",
+    message: "extKeyUsage must include id-kp-emailProtection",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return true;
+      return d.value.indexOf(oid.byName("emailProtection")) === -1 ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/eku-forbidden-purpose", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (f)",
+    message: "a key purpose the profile forbids at every generation is present in extKeyUsage",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var out = [];
+      SMIME_FORBIDDEN_EKU.forEach(function (e) {
+        if (d.value.indexOf(e.oid) !== -1) out.push({ context: { keyPurpose: e.name, oid: e.oid } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/eku-extra-purpose-strict", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (f)",
+    /** @internal Strict alone says "Other values SHALL NOT be present"; Multipurpose and Legacy
+     * say they MAY be. So this row is the one place the generation turns a permission into a
+     * prohibition, and it runs only where the certificate declared Strict. The four values the
+     * sentence after the table forbids at every generation are left to the row that owns them, so
+     * one purpose draws one finding citing the narrower of the two rules it breaks. */
+    message: "under the Strict generation, extKeyUsage must carry no purpose beyond id-kp-emailProtection",
+    appliesTo: _smimeStrict,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var email = oid.byName("emailProtection");
+      var extra = d.value.filter(function (o) {
+        if (o === email) return false;
+        for (var i = 0; i < SMIME_FORBIDDEN_EKU.length; i++) {
+          if (SMIME_FORBIDDEN_EKU[i].oid === o) return false;
+        }
+        return true;
+      });
+      return extra.length ? { context: { purposes: extra } } : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aki-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    message: "a subscriber certificate must carry an authorityKeyIdentifier extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("authorityKeyIdentifier") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/aki-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    message: "authorityKeyIdentifier must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("authorityKeyIdentifier"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/san-no-mailbox", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.4.2.1",
+    /** @internal "SHALL contain at least one GeneralName entry of the following types: Rfc822Name
+     * and/or otherName of type id-on-SmtpUTF8Mailbox". An otherName is read for its type OID,
+     * since any otherName is a [0] and only that one carries a mailbox. */
+    message: "subjectAltName must carry at least one rfc822Name or SmtpUTF8Mailbox otherName",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("subjectAltName");
+      if (!d || !d.value || !Array.isArray(d.value.names)) return true;
+      var found = d.value.names.some(function (gn) {
+        if (gn.tagNumber === 1) return true;
+        if (gn.tagNumber !== 0) return false;
+        return _otherNameTypeOf(gn) === SMIME_OID_SMTP_UTF8;
+      });
+      return found ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/ski-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (n)",
+    message: "subjectKeyIdentifier must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("subjectKeyIdentifier"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/smime-capabilities-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (i)",
+    message: "smimeCapabilities must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("smimeCapabilities"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/subject-directory-attributes-prohibited", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (j)",
+    /** @internal Prohibited under Strict and Multipurpose, permitted under Legacy. The generation
+     * the certificate declares decides, so this runs at two of the three. */
+    message: "subjectDirectoryAttributes is prohibited under the Strict and Multipurpose generations",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) !== "legacy";
+    },
+    check: function (cert, ctx) { return ctx.raw("subjectDirectoryAttributes") ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/subject-directory-attributes-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (j)",
+    /** @internal The criticality sentence sits in the Legacy row alone, which reads "MAY be present
+     * and SHALL NOT be marked critical". The other row reads "Prohibited" and carries no
+     * criticality sentence, so a critical extension there breaks one clause rather than two. */
+    message: "subjectDirectoryAttributes must not be marked critical",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) === "legacy";
+    },
+    check: function (cert, ctx) {
+      var e = ctx.raw("subjectDirectoryAttributes");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/policies-cps-not-http-url", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "the value of the qualifier SHALL be a HTTP or HTTPS URL". This clause names both
+     * schemes where the URI scheme tables of (b) and (c) name HTTP alone. */
+    message: "an id-qt-cps policy qualifier must be a HTTP or HTTPS URL",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_CPS) return;
+        var uri = null;
+        // allow:swallow-unverified a CPSuri that will not read as a string is not a URL either, so it falls to the report below rather than out of the rule
+        try {
+          uri = asn1.read.string(value);
+        } catch (_e) {
+          void 0;
+        }
+        if (!_isHttpOrHttpsUrl(uri)) {
+          out.push({ context: { policyIdentifier: pi.policyIdentifier, cps: uri } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/policies-unotice-no-explicit-text", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "If a qualifier of type id-qt-unotice is included, then it SHALL contain
+     * explicitText". Both halves of that sentence are rows, since a notice can fail either. */
+    message: "an id-qt-unotice policy qualifier must contain explicitText",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_UNOTICE) return;
+        var carries = pkix.userNoticeTexts(value).some(function (t) { return t.field === "explicitText"; });
+        if (!carries) out.push({ context: { policyIdentifier: pi.policyIdentifier } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/policies-unotice-notice-ref", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "...and SHALL NOT contain noticeRef." */
+    message: "an id-qt-unotice policy qualifier must not contain a noticeRef",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_UNOTICE) return;
+        /** @internal NoticeReference requires its organization DisplayText, which userNoticeTexts
+         * surfaces under that field name, so the field's presence is the noticeRef's presence. */
+        var carries = pkix.userNoticeTexts(value).some(function (t) { return t.field === "organization"; });
+        if (carries) out.push({ context: { policyIdentifier: pi.policyIdentifier } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/crldp-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (b)",
+    message: "cRLDistributionPoints should not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var e = ctx.raw("cRLDistributionPoints");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aia-missing", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    /** @internal "(SHOULD be present)", where the TLS profile's own heading for the same extension
+     * reads SHALL, so the two profiles report it at different strengths. */
+    message: "a subscriber certificate should carry an authorityInformationAccess extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("authorityInfoAccess") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/aia-ca-issuers-missing", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    /** @internal "SHOULD contain at least one accessMethod value of type id-ad-caIssuers". Read
+     * only where the extension is there at all, since its absence is the row above. */
+    message: "authorityInformationAccess should carry an id-ad-caIssuers accessMethod",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityInfoAccess"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityInfoAccess");
+      if (!d || !Array.isArray(d.value)) return null;
+      var wanted = oid.byName("caIssuers");
+      for (var i = 0; i < d.value.length; i++) {
+        if (d.value[i].accessMethod === wanted) return null;
+      }
+      return true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aia-non-http-uri", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    /** @internal Strict and Multipurpose require every accessMethod URI to be HTTP, Legacy at
+     * least one. Each accessMethod has its OWN table, so "at least one" is answered per method and
+     * an HTTP URI on one does not satisfy the other's row. */
+    message: "an authorityInformationAccess accessMethod URI does not meet the URI scheme rule for this generation",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityInfoAccess"); },
+    check: function (cert, ctx) {
+      var byMethod = _smimeAiaLocationsByMethod(ctx);
+      var gen = _smimeGeneration(ctx);
+      var out = [];
+      function report(method, offending) {
+        out.push({ context: { generation: gen || "strict", accessMethod: oid.name(method) || method,
+          uris: offending.filter(function (u) { return u !== null; }),
+          nonUriLocations: offending.filter(function (u) { return u === null; }).length } });
+      }
+      SMIME_AIA_METHODS.forEach(function (method) {
+        var locs = byMethod[method];
+        if (!locs || !locs.length) return;
+        if (gen === "legacy") {
+          if (!locs.some(_isHttpUri)) report(method, locs);
+          return;
+        }
+        var bad = locs.filter(function (u) { return !_isHttpUri(u); });
+        if (bad.length) report(method, bad);
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-not-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    message: "keyUsage should be marked critical",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("keyUsage"); },
+    check: function (cert, ctx) {
+      var e = ctx.raw("keyUsage");
+      return (e && e.critical === true) ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aki-key-identifier-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    /** @internal "The keyIdentifier field SHALL be present", which is a field rule rather than the
+     * extension-presence one above it: an authorityKeyIdentifier naming only an issuer and serial
+     * satisfies that row and not this one. */
+    message: "the authorityKeyIdentifier keyIdentifier field must be present",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityKeyIdentifier"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityKeyIdentifier");
+      if (!d || !d.value) return null;
+      var kid = d.value.keyIdentifier;
+      return (kid === null || kid === undefined) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aki-issuer-or-serial-present", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    /** @internal "authorityCertIssuer and authorityCertSerialNumber fields SHALL NOT be present."
+     * Either one alone is a violation, so both are reported by name. */
+    message: "the authorityKeyIdentifier must not carry authorityCertIssuer or authorityCertSerialNumber",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityKeyIdentifier"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityKeyIdentifier");
+      if (!d || !d.value) return null;
+      var out = [];
+      ["authorityCertIssuer", "authorityCertSerialNumber"].forEach(function (f) {
+        var v = d.value[f];
+        if (v !== null && v !== undefined) out.push({ context: { field: f } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/san-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (h)",
+    message: "a subscriber certificate must carry a subjectAltName extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("subjectAltName") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/san-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (h)",
+    /** @internal "SHOULD NOT be marked critical unless the subject field is an empty sequence",
+     * which is the one condition that lifts it, so the subject is read rather than assumed. */
+    message: "subjectAltName should not be marked critical where the subject is not an empty sequence",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var e = ctx.raw("subjectAltName");
+      if (!e || e.critical !== true) return null;
+      var rdns = cert.subject && cert.subject.rdns;
+      var empty = !Array.isArray(rdns) || rdns.length === 0;
+      return empty ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/qc-statements-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (k)",
+    message: "qcStatements must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var e = ctx.raw("qcStatements");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/lei-prohibited", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (l)",
+    /** @internal The table is keyed on the certificate TYPE: Mailbox-validated and
+     * Individual-validated admit neither identifier, Organization-validated admits the LEI but not
+     * the role, and Sponsor-validated admits both. A certificate declaring no type is held to
+     * none, since the table has no row to select. */
+    message: "a Legal Entity Identifier extension is prohibited for this certificate type",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var type = _smimeType(ctx);
+      if (type === null) return null;
+      var out = [];
+      ["identifier", "role"].forEach(function (which) {
+        if (_smimeLeiAdmits(type, which)) return;
+        if (ctx.raw(SMIME_LEI_EXTS[which])) out.push({ context: { certificateType: type, extension: which } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/lei-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (l)",
+    /** @internal Where the table admits one it reads "MAY be present and SHALL NOT be marked
+     * critical", so criticality is fixed in the cells that admit it and nowhere else. */
+    message: "a Legal Entity Identifier extension must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var type = _smimeType(ctx);
+      if (type === null) return null;
+      var out = [];
+      ["identifier", "role"].forEach(function (which) {
+        if (!_smimeLeiAdmits(type, which)) return;
+        var e = ctx.raw(SMIME_LEI_EXTS[which]);
+        if (e && e.critical === true) out.push({ context: { certificateType: type, extension: which } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/adobe-extension-prohibited", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (m)",
+    /** @internal Prohibited under Strict, permitted under Multipurpose and Legacy. */
+    message: "an Adobe extension is prohibited under the Strict generation",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) === "strict";
+    },
+    check: function (cert, ctx) {
+      var out = [];
+      SMIME_ADOBE_EXTS.forEach(function (name) {
+        if (ctx.raw(name)) out.push({ context: { extension: name } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/adobe-extension-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (m)",
+    /** @internal The criticality sentence sits in the Multipurpose and Legacy row. The Strict row
+     * reads "Prohibited" and carries none, so a critical extension there breaks one clause. */
+    message: "an Adobe extension must not be marked critical",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) !== "strict";
+    },
+    check: function (cert, ctx) {
+      var out = [];
+      SMIME_ADOBE_EXTS.forEach(function (name) {
+        var e = ctx.raw(name);
+        if (e && e.critical === true) out.push({ context: { extension: name } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/ski-missing", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (n)",
+    /** @internal "(SHOULD be present)". The same clause adds that the value SHOULD be derived from
+     * the public key, which names no derivation, so a certificate using one this cannot recompute
+     * is conformant and no row reports it. */
+    message: "a subscriber certificate should carry a subjectKeyIdentifier extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },
+  },
+];
+
 var CABF_TLS_RULES = [
+  {
+    id: "lint/cabf-tls/aia-missing", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.6",
+    message: "a subscriber certificate must carry an authorityInformationAccess extension",
+    appliesTo: _isTls,
+    check: function (cert, ctx) { return ctx.raw("authorityInfoAccess") ? null : true; },
+  },
+  {
+    id: "lint/cabf-tls/aia-critical", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.6",
+    message: "authorityInformationAccess must not be marked critical",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var e = ctx.raw("authorityInfoAccess");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-tls/aia-forbidden-access-method", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.7",
+    /** @internal The table permits id-ad-ocsp and id-ad-caIssuers and says of any other value
+     * "No other accessMethods may be used". */
+    message: "an authorityInformationAccess accessMethod other than id-ad-ocsp or id-ad-caIssuers is not permitted",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityInfoAccess");
+      if (!d || !Array.isArray(d.value)) return null;
+      var out = [];
+      d.value.forEach(function (ad) {
+        if (CABF_AIA_METHODS.indexOf(ad.accessMethod) === -1) {
+          out.push({ context: { accessMethod: ad.accessMethod, name: oid.name(ad.accessMethod) || null } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-tls/aia-location-not-uri", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.7",
+    /** @internal Each permitted accessMethod states uniformResourceIdentifier as its accessLocation
+     * GeneralName type, and "each accessLocation MUST be encoded as the specified GeneralName type". */
+    message: "an authorityInformationAccess accessLocation must be a uniformResourceIdentifier",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityInfoAccess");
+      if (!d || !Array.isArray(d.value)) return null;
+      var out = [];
+      d.value.forEach(function (ad) {
+        if (CABF_AIA_METHODS.indexOf(ad.accessMethod) === -1) return;
+        var loc = ad.accessLocation;
+        if (!loc || loc.tag !== 6) {
+          out.push({ context: { accessMethod: oid.name(ad.accessMethod) || ad.accessMethod,
+            generalNameTag: loc ? loc.tag : null } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-tls/policies-missing", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.6",
+    message: "a subscriber certificate must carry a certificatePolicies extension",
+    appliesTo: _isTls,
+    check: function (cert, ctx) { return ctx.raw("certificatePolicies") ? null : true; },
+  },
+  {
+    id: "lint/cabf-tls/policies-any-policy", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.9",
+    /** @internal "The anyPolicy Policy Identifier MUST NOT be present." */
+    message: "certificatePolicies must not assert anyPolicy",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var d = ctx.decode("certificatePolicies");
+      if (!d || !Array.isArray(d.value)) return null;
+      return d.value.some(function (pi) { return pi.policyIdentifier === OID_ANY_POLICY; }) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-tls/policies-reserved-identifier-count", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.9",
+    /** @internal "Regardless of the order of PolicyInformation values, the Certificate Policies
+     * extension MUST contain exactly one Reserved Certificate Policy Identifier." Exactly one, so
+     * naming none and naming two are the same fault and the count says which. */
+    message: "certificatePolicies must assert exactly one reserved certificate policy identifier",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var d = ctx.decode("certificatePolicies");
+      if (!d || !Array.isArray(d.value)) return null;
+      var found = d.value.filter(function (pi) {
+        return CABF_RESERVED_POLICIES.indexOf(pi.policyIdentifier) !== -1;
+      });
+      return found.length === 1 ? null : { context: { count: found.length,
+        identifiers: found.map(function (pi) { return pi.policyIdentifier; }) } };
+    },
+  },
+  {
+    id: "lint/cabf-tls/policy-qualifier-forbidden", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.9",
+    /** @internal The permitted-qualifier table admits id-qt-cps and says of any other qualifier
+     * MUST NOT, which includes the userNotice RFC 5280 otherwise allows. */
+    message: "a certificatePolicies qualifier other than id-qt-cps is not permitted",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var out = [];
+      _policyQualifierIds(ctx).forEach(function (qid) {
+        if (qid !== OID_CPS) out.push({ context: { qualifier: qid, name: oid.name(qid) || null } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-tls/eku-forbidden-purpose", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.10",
+    message: "a key purpose the subscriber profile forbids is present in extKeyUsage",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var out = [];
+      CABF_FORBIDDEN_EKU.forEach(function (e) {
+        if (d.value.indexOf(e.oid) !== -1) out.push({ context: { keyPurpose: e.name, oid: e.oid } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-tls/name-constraints-present", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.6",
+    message: "a subscriber certificate must not carry a nameConstraints extension",
+    appliesTo: _isTls,
+    check: function (cert, ctx) { return ctx.raw("nameConstraints") ? true : null; },
+  },
+  {
+    id: "lint/cabf-tls/basic-constraints-ca-true", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.8",
+    message: "a subscriber certificate's basicConstraints cA must be FALSE",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var d = ctx.decode("basicConstraints");
+      return (d && d.value && d.value.cA === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-tls/basic-constraints-path-len", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.8",
+    message: "a subscriber certificate's basicConstraints must not carry a pathLenConstraint",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var d = ctx.decode("basicConstraints");
+      var pl = d && d.value ? d.value.pathLenConstraint : null;
+      return pl === null || pl === undefined ? null : { context: { pathLenConstraint: pl } };
+    },
+  },
+  {
+    id: "lint/cabf-tls/key-usage-forbidden-bit", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.11",
+    /** @internal The two Key Usage tables differ by key type, which is the whole point: the same
+     * bit is permitted for one and forbidden for the other, so the key decides which table asks. */
+    message: "a keyUsage bit the subscriber profile does not permit for this key type is set",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      var table = _cabfKeyUsageTable(cert);
+      if (table === null) return null;
+      var forbidden = table === "ecc" ? CABF_KU_FORBIDDEN_ECC : CABF_KU_FORBIDDEN_RSA;
+      var out = [];
+      forbidden.forEach(function (bit) {
+        if (d.value[bit] === true) out.push({ context: { keyUsage: bit, keyType: table } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-tls/key-usage-ecc-without-digital-signature", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.11",
+    /** @internal The ECC table marks digitalSignature Required: MUST, where the RSA table marks it
+     * SHOULD and admits a keyEncipherment-only certificate. */
+    message: "an ECC subscriber certificate's keyUsage must assert digitalSignature",
+    appliesTo: function (cert, ctx) { return _isTls(cert, ctx) && _isEccKey(cert); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      return d.value.digitalSignature === true ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-tls/key-usage-rsa-no-bit-set", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.11",
+    /** @internal "At least one Key Usage MUST be set for RSA Public Keys." Measured over the bits
+     * that table permits, since a forbidden bit being set is the row above's answer, not this one's. */
+    message: "an RSA subscriber certificate's keyUsage must set at least one permitted bit",
+    appliesTo: function (cert, ctx) { return _isTls(cert, ctx) && _cabfKeyUsageTable(cert) === "rsa"; },
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      var any = CABF_KU_RSA_BITS.some(function (bit) { return d.value[bit] === true; });
+      return any ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-tls/san-forbidden-name-type", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.12",
+    /** @internal The GeneralName table permits dNSName and iPAddress and marks every other type
+     * Permitted: N, including the uniformResourceIdentifier and rfc822Name RFC 5280 allows. */
+    message: "a subjectAltName entry of a type the subscriber profile does not permit is present",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var d = ctx.decode("subjectAltName");
+      if (!d || !d.value || !Array.isArray(d.value.names)) return null;
+      var out = [];
+      d.value.names.forEach(function (gn) {
+        if (CABF_SAN_PERMITTED_TAGS.indexOf(gn.tagNumber) === -1) {
+          out.push({ context: { generalName: CABF_SAN_TAG_NAMES[gn.tagNumber] || null, tag: gn.tagNumber } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-tls/san-criticality-mismatch", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.12",
+    /** @internal "If the subject field of the certificate is an empty SEQUENCE, this extension MUST
+     * be marked critical ... Otherwise, this extension MUST NOT be marked critical." Both
+     * directions are MUST, so one row measures the pair and the context says which way it failed. */
+    message: "subjectAltName must be critical where the subject is empty and non-critical otherwise",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var e = ctx.raw("subjectAltName");
+      if (!e) return null;
+      var empty = _subjectIsEmpty(cert);
+      var critical = e.critical === true;
+      if (empty === critical) return null;
+      return { context: { subjectEmpty: empty, critical: critical } };
+    },
+  },
+  {
+    id: "lint/cabf-tls/dnsname-trailing-dot", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.12",
+    /** @internal "The zero-length Domain Label representing the root zone ... MUST NOT be included
+     * (e.g. 'example.com' MUST be encoded as 'example.com' and MUST NOT be encoded as
+     * 'example.com.')." */
+    message: "a subjectAltName dNSName must not carry the root zone's zero-length label",
+    appliesTo: _isTls,
+    check: function (cert, ctx) {
+      var out = [];
+      _sanDnsNames(ctx).forEach(function (name) {
+        if (typeof name === "string" && name.length > 0 && name.charAt(name.length - 1) === ".") {
+          out.push({ context: { dnsName: name } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-tls/ski-present", severity: "notice", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.6",
+    /** @internal NOT RECOMMENDED here, which is the opposite of what RFC 5280 sec. 4.2.1.2 asks of
+     * an end-entity certificate. Both readings ship, each under the profile that states it, so a
+     * caller running one profile is not told the other's answer. Graded notice because the clause
+     * is NOT RECOMMENDED rather than MUST NOT. */
+    message: "a subscriber certificate's subjectKeyIdentifier is NOT RECOMMENDED by this profile",
+    appliesTo: _isTls,
+    check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? true : null; },
+  },
   {
     id: "lint/cabf-tls/san-missing", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.4.2.1",
     message: "a TLS server certificate must include a usable subjectAltName extension",
@@ -1932,28 +3073,32 @@ var CABF_TLS_CSR_RULE_IDS = [
   "lint/cabf-tls/weak-key",
 ];
 
+/** @internal RFC 5280 sec. 4.2 fixes each extension's syntax wherever it is carried. Every row in
+ *  every profile below asks for an extension BY NAME, and the shared decoder returns null both for
+ *  one that is absent and for one whose value does not decode, so without this row a malformed
+ *  value reads as absence and passes every row that asks for it. The certificate's own row is
+ *  reused rather than restated, and it is folded into each named profile rather than into the
+ *  *_RULES arrays, which `ALL_RULES` concatenates and would otherwise report it twice. */
+var RFC5280_EXTENSION_SYNTAX_RULES = RFC5280_RULES.filter(function (r) {
+  return r.id === "lint/rfc5280/extension-undecodable";
+});
 var PROFILES = Object.assign(Object.create(null), {
   "rfc5280": RFC5280_RULES,
-  "rfc9881": RFC9881_RULES,
-  "rfc9909": RFC9909_RULES,
-  "rfc9935": RFC9935_RULES,
-  "cabf-tls": CABF_TLS_RULES,
+  "rfc9881": RFC9881_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "rfc9909": RFC9909_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "rfc9935": RFC9935_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "cabf-tls": CABF_TLS_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "cabf-smime": CABF_SMIME_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
-var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES).concat(CABF_TLS_RULES);
+var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
+  .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES);
 
 var CABF_TLS_CSR_RULES = CABF_TLS_RULES.filter(function (r) {
   return CABF_TLS_CSR_RULE_IDS.indexOf(r.id) !== -1;
 });
-/** @internal RFC 5280 sec. 4.2 fixes each extension's syntax wherever it is carried, and a
- *  requested extension whose value does not decode is the same fault in a request as in a
- *  certificate. The certificate's own row reads `extensions` and the request view supplies it, so
- *  the row is reused rather than restated. Without it a malformed requested value counted as a
- *  passing check, because the shared decoder returns null and every row that asks by name reads
- *  that null as absence. */
-var RFC5280_CSR_RULES = RFC5280_RULES.filter(function (r) {
-  return r.id === "lint/rfc5280/extension-undecodable";
-});
-var CSR_STRUCTURAL_RULES = RFC2986_CSR_RULES.concat(RFC5280_CSR_RULES);
+/** @internal A requested extension whose value does not decode is the same fault in a request as
+ *  in a certificate, so the request profiles take the same row the certificate profiles do. */
+var CSR_STRUCTURAL_RULES = RFC2986_CSR_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES);
 var CSR_PROFILES = Object.assign(Object.create(null), {
   "rfc2986": CSR_STRUCTURAL_RULES,
   "cabf-tls": CSR_STRUCTURAL_RULES.concat(CABF_TLS_CSR_RULES),
@@ -2057,7 +3202,9 @@ function _ingestCsr(input) {
   var derived = _derivedCsr(input);
   if (derived) return { csr: derived };
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = csrSchema.pemDecode(input); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER certification request", context: { code: e.code } } }; }
@@ -2104,7 +3251,13 @@ function _applyThreshold(report, severity) {
  * raises a typed `LintError`.
  *
  * @opts  profile   One of `pki.lint.profiles()` (default runs every profile). Selecting
- *                  `"cabf-tls"` lints the input AS a TLS server certificate.
+ *                  `"cabf-tls"` lints the input AS a TLS SUBSCRIBER certificate, which is an
+ *                  assertion about the input rather than a question asked of it: the section
+ *                  7.1.2.7 rows then apply whatever the certificate says it is, so naming it for
+ *                  a CA certificate reports that CA against subscriber requirements. The CA
+ *                  profiles of section 7.1.2.10 are a separate set this does not yet carry. Left
+ *                  unnamed, a certificate is held to those rows only where it asserts
+ *                  id-kp-serverAuth and is not a CA.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and
  *                  `worst` always reflect the complete, unfiltered result.
  * @example
@@ -2160,7 +3313,9 @@ function _ingestCrl(input) {
   var derived = _derivedCrl(input);
   if (derived) return { crl: derived };
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = crlSchema.pemDecode(input); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER CRL", context: { code: e.code } } }; }
@@ -2333,7 +3488,9 @@ var _OCSP_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
  * responses. Bytes and PEM take the fatal path below, never a throw. */
 function _ingestOcsp(input) {
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = ocspSchema.pemDecode(input); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER OCSP response", context: { code: e.code } } }; }
@@ -2466,6 +3623,10 @@ var BY_ARTIFACT = Object.assign(Object.create(null), {
 });
 
 function rules(profile, artifact) {
+  /** @internal Every lint verb reads "all" and "default" as naming no profile, so the enumerator
+   * reads them the same way: a caller who linted under one of those names and then asked which
+   * rows ran would otherwise be refused the answer by the same registry that ran them. */
+  if (profile === "all" || profile === "default") profile = null;
   if (artifact != null && !Object.prototype.hasOwnProperty.call(BY_ARTIFACT, artifact)) {
     throw _cfg("lint/bad-input", "unknown lint artifact \"" + artifact +
       "\" (known: " + Object.keys(BY_ARTIFACT).join(", ") + ")");