@blamejs/pki 0.8.17 → 0.8.18

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.18 — 2026-09-24
+
+An S/MIME certificate is linted against the generation it declares itself to be.
+
+### Added
+
+- `pki.lint.certificate(der, { profile: "cabf-smime" })` runs the S/MIME BR v1.0.15 subscriber profile of section 7.1.2.3. The rows reach a certificate unprompted too, because one that asserts a reserved policy identifier has declared itself to be one; a certificate asserting none is left alone. A certificate issued to a subordinate CA carries a reserved identifier as well under section 7.1.6.3, so it is not read as a subscriber; naming the profile in the call still lints it as one.
+- certificatePolicies (a): the extension is required, should not be critical, and must include exactly one reserved policy identifier, which is also what leaves the generation unambiguous. An `id-qt-cps` qualifier must be a HTTP or HTTPS URL, where the URI scheme tables elsewhere in the section name HTTP alone. This clause asks for a URL rather than a scheme, so a bare `http://` naming no host is reported. An `id-qt-unotice` qualifier must carry `explicitText` and must not carry a `noticeRef`. A certificate issued under a Legacy generation profile on or after 15 July 2025 is reported, gated to the issuance date it states.
+- cRLDistributionPoints (b): the extension is required and should not be critical, and the URI scheme rule follows the generation. Strict and Multipurpose require every `uniformResourceIdentifier` to be HTTP; Legacy requires at least one and permits others beside it. HTTP means HTTP: the profile writes "a HTTP or HTTPS URL" where both are meant and "the URI scheme HTTP" here, so an HTTPS distribution point does not satisfy it. Having that scheme means being a URI of it, which RFC 7230 section 2.7.1 writes with an authority and no empty host, so `http:crl.example/a.crl` and `http://:80/a.crl` do not satisfy it either. An extension carrying no `uniformResourceIdentifier` at all is reported. A distribution point without one is not, where another point in the same extension carries a conforming URI.
+- authorityInformationAccess (c): the extension should be present and must not be critical, and it should carry an `id-ad-caIssuers` accessMethod. `id-ad-ocsp` and `id-ad-caIssuers` get a table each, unlike the distribution points, whose single table covers the whole extension. Strict and Multipurpose require every URI of a method to be HTTP; Legacy requires at least one of that method's own, so an HTTP OCSP URL does not answer for a caIssuers list that carries only an LDAP one. An accessLocation that is not a `uniformResourceIdentifier` carries no scheme, so it is reported rather than passed over. The profile asks for this extension at SHOULD where the TLS profile asks at SHALL, so the two report the same absence at different strengths.
+- basicConstraints (d) must not assert `cA` and must not carry a `pathLenConstraint`.
+- keyUsage (e): the extension is required, should be critical, and a bit outside the cell for the certificate's own key algorithm is reported. The cells differ, so `keyEncipherment` is conformant on an RSA key and reported on an elliptic-curve one, whose cell gives `keyAgreement` instead, and an ML-KEM key permits `keyEncipherment` alone. The RSA cell also differs by generation: Multipurpose and Legacy admit `dataEncipherment` where Strict does not. A bit set past the nine RFC 5280 named positions is outside every cell and is reported for every key algorithm. A key algorithm the section gives no cell for is held to none.
+- keyUsage (e) is read as the usage modes the cell states, not as a flat set of permitted bits. A conforming certificate asserts every bit of one mode and no bit outside that same mode, so bits the cell names can still combine into nothing it allows: `nonRepudiation` alone matches no mode, and on RSA `digitalSignature` with `dataEncipherment` matches none either, because `dataEncipherment` belongs to the key-management modes and those require `keyEncipherment`. On an elliptic curve `encipherOnly` and `decipherOnly` appear only in the modes that require `keyAgreement`, which is how the cell states "only if keyAgreement is set". A bit the cell names nowhere is reported by the row above this one, so one violation draws one finding.
+- extKeyUsage (f): `id-kp-emailProtection` is required, and `id-kp-serverAuth`, `id-kp-codeSigning`, `id-kp-timeStamping` and `anyExtendedKeyUsage` are forbidden at every generation. Under Strict alone, any other purpose is forbidden too.
+- authorityKeyIdentifier (g): the extension is required and must not be critical, its `keyIdentifier` field must be present, and `authorityCertIssuer` and `authorityCertSerialNumber` must not be. An extension naming only an issuer and serial satisfies the presence rule and is reported by the field rules.
+- subjectAltName (h and 7.1.4.2.1): the extension is required, must carry at least one `rfc822Name` or an `otherName` of type id-on-SmtpUTF8Mailbox, and should not be critical unless the subject is an empty sequence, which is the one condition that lifts it. An otherName is read for its type identifier, since every otherName carries the same tag and only the type tells a mailbox from anything else.
+- The optional extensions and the tables that admit them: smimeCapabilities (i), qcStatements (k) and subjectKeyIdentifier (n) must not be critical, and a subjectKeyIdentifier should be present. subjectDirectoryAttributes (j) is prohibited under Strict and Multipurpose and must not be critical under Legacy. The Adobe timestamp and ArchiveRevInfo extensions (m) are prohibited under Strict and must not be critical elsewhere. The Legal Entity Identifier extensions (l) are keyed on the certificate type rather than the generation: both are prohibited on a Mailbox-validated or Individual-validated certificate, the role identifier is prohibited on an Organization-validated one, and neither may be critical where it is admitted.
+- A cell that reads "Prohibited" carries no criticality sentence, so a prohibited extension that is also critical draws the prohibition alone. A certificate that declares no generation names no cell, and every table the section keys on the generation reads it against Strict, the narrowest of the three.
+
+### Changed
+
+- The twelve reserved S/MIME policy identifiers of section 7.1.6.1 resolve through `pki.oid`, named for the certificate type and generation each one declares, so an S/MIME certificate reads back with the profile it asserts rather than a bare dotted string. The Legal Entity Identifier and Adobe extension identifiers the profile reads resolve there too.
+- The fuzz harness for `pki.lint.certificate` drives every profile a caller can name as well as the default rule set, and `pki.lint.csr` has a harness of its own. Both hold the same contract: hostile bytes return a report carrying a `lint/unparseable` finding, never a throw.
+
+### Fixed
+
+- `pki.lint.certificate`, `csr`, `crl` and `ocsp` take any BufferSource, as every parser in the toolkit already did. They took a `Buffer` alone, so bytes read over the network as a `Uint8Array`, or handed over as an `ArrayBuffer`, raised `lint/bad-input` from the one surface whose data path is documented never to throw. The bytes are snapshotted at the door, so a caller cannot neuter the backing buffer between the check and the read, and a source whose buffer was already detached returns a `fatal` finding like any other unreadable input rather than aborting a scan. A value that is neither bytes, a PEM string nor a parsed object still raises `lint/bad-input`, which is caller error rather than a verdict on a certificate.
+- `pki.lint.rules("all")` and `pki.lint.rules("default")` return every row rather than throwing `lint/unknown-profile`. The lint verbs read both names as naming no profile, so a caller who linted under one and then asked which rows had run was refused the answer by the registry that ran them.
+- Naming a profile no longer reads an extension whose value does not decode as one that is absent. Every row asks for extensions by name and the shared decoder answers null for both cases, so `pki.lint.certificate(der, { profile: "cabf-tls" })` returned a clean report for a certificate whose basicConstraints, keyUsage or subjectAltName was malformed, and so did the RFC 9881, RFC 9909 and RFC 9935 profiles. The RFC 5280 row that reports the encoding runs under every named certificate profile now, as it already did for `pki.lint.csr`. Callers who pass no profile were never affected.
+
 ## v0.8.17 — 2026-09-24
 
 The CA/Browser Forum subscriber certificate profile is linted against its own tables, not a subset of them.

package/README.md

@@ -290,7 +290,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.sigstore` | Offline verifier for a Sigstore bundle, the artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots and Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key, the ephemeral Fulcio certificate chain validated as of the Rekor log time, the RFC 9162 inclusion proof folded to a Rekor-signed tree root, the log entry bound to this exact signature, and the in-toto SLSA subject digest the caller confirms against the published artifact. It reuses the X.509 parser, the RFC 5280 path validator, and the Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `verified: true` says the artifact was signed and logged, not that a party you trust signed it — Fulcio issues to anyone who completes an OIDC flow, so who signed is decided only by `opts.identity`, and `identityChecked` reports which of its fields were compared. An identity policy naming no field, or a field name that is not one of the three, is refused rather than satisfied — either would accept every signer while reading as a policy in force. A sixth leg is opt-in: pinning the certificate-transparency logs in `opts.ctLogs` checks the receipt Fulcio embeds in the certificate it issues (RFC 6962 §3.2), verified over the certificate as it stood before the receipt was added and under the key of the log that issued it, so the verdict says the signing certificate was public when it was issued rather than handed out quietly. At least one receipt must verify against a pinned log, the verdict reports `sctChecked` and `validScts`, and an empty log set is refused rather than read as a policy that checks nothing. Both content arms are read: a DSSE-wrapped in-toto attestation, and a message signature over an artifact's own bytes, which `cosign sign-blob` produces. For that arm `opts.artifact` supplies the bytes, and they are held to the hash the Rekor `hashedrekord` entry records before the signature is checked over them; the `messageDigest` the bundle carries is covered by no signature, so it is compared against the computed digest and never used in its place. `contentType` names the arm and the verdict has one shape for both — `pae`, `parseBundle`, `verifyBundle` |
 | `pki.inspect` | Human-readable inspection, the pure-JS equivalent of `openssl x509/crl/req/cms -text`. `certificate(pem \| der \| parsed)` renders an OpenSSL-style report: version, serial, signature algorithm, issuer and subject distinguished names, validity, public-key details (curve or modulus size plus the raw point or modulus), every decoded extension with its critical flag, and the signature. `crl`, `csr`, and `cms` render the other formats the same way — a CRL like `openssl crl -text`, a CSR like `openssl req -text`, and a CMS message like `openssl cms -cmsout -print`, with a stable summary for a non-SignedData ContentInfo — and `any(input)` detects the format and routes to the right report. Built over the strict parsers and the two-way OID registry with one set of field renderers, it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency, and the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version. A certificate policy's user notice renders as text, both its explicit text and a notice reference with the notice numbers that identify it, rather than hex, and a malformed part falls back to a hex dump rather than throwing — `certificate`, `crl`, `csr`, `cms`, `any` |
 | `pki.webauthn` | WebAuthn and passkey verification, both halves: offline trust evaluation of a W3C WebAuthn (Level 3) registration, and signature verification of the assertion every login returns. `parseAttestationObject(bytes)` decodes the CBOR attestation object, authenticatorData, and COSE credential key over the strict `pki.cbor` codec; `parseAuthenticatorData(bytes)` reads the bare form an assertion carries through the same parser; `parseClientData(bytes, opts)` decodes the `clientDataJSON` no signature check looks inside, through the shared JSON guard since these are attacker-chosen bytes, returning the challenge decoded so a caller compares bytes rather than spellings, and checking the ceremony type, challenge, and origin when the relying party supplies what it issued. `verifyAssertion(input)` verifies an assertion signature over `authenticatorData \|\| SHA-256(clientDataJSON)` — raw bytes, no COSE_Sign1, an ES256 signature in ASN.1 DER — and applies the §7.2 step 21 counter rule when a stored `previousSignCount` is given, so a counter that fails to advance is refused as a cloned authenticator. `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for packed, tpm, android-key, apple, fido-u2f, and none: the x5c leaf key, the apple nonce, the tpm `certInfo` Name and `extraData` over the `pubArea`, the android `KeyDescription`, and the fido-u2f `verificationData`. It binds the credential public key to each attestation, through the signed authenticatorData for packed and fido-u2f or a cert or `pubArea`-key equality check for android-key, apple, and tpm, and enforces each leaf's certificate requirements. The credential-key check covers the full WebAuthn COSE algorithm set — ES256/384/512, RS256/384/512, PS256/384/512, EdDSA (Ed25519), and the RFC 9864 fully-specified identifiers ESP256/384/512, Ed25519, and Ed448 — validating the public-key point on its curve, rejecting the compressed EC point form, and enforcing a minimally encoded DER ECDSA signature. The verdict field is `attestationVerified`, and `signatureVerified` for an assertion, rather than a bare `verified`, because a sound statement is a different claim from an acceptable ceremony: an attestation naming another origin's RP ID with user presence clear is perfectly sound and must not be registered. Pass `expectedRpId`, `requireUserPresence`, `requireUserVerification`, or `allowedAlgorithms` and those are checked, with `bindingChecked` reporting which ran, so a check that passed can be told from one that never happened. Pass `opts.clientDataJSON` instead of the digest and the client data is read here too: the ceremony type is checked unconditionally, since a login response replayed into a registration is what that rule stops, and the challenge, origin, and top-level origin are checked against what the relying party issued, with `clientData.checked` reporting which comparisons ran. A registration verdict also carries the `credentialId`, `credentialPublicKey`, and initial `signCount` a later login needs. A credential key declaring COSE algorithm `-65535` (RSASSA-PKCS1-v1_5 with SHA-1) is refused unless `allowedAlgorithms` names it, since every signature that credential ever makes would use SHA-1. Anchoring the trust path has two routes: `opts.metadata` resolves the roots the authenticator's own model registered, and `opts.rootCertificates` pins roots directly, which is what anchors the formats FIDO MDS does not cover, Apple's authenticators and the Google hardware-attestation roots among them. `metadata` governs when both are given, and `anchoredTo` names every route that anchored the path, joined with `+` when more than one did: `"metadata"`, `"rootCertificates"`, and `"safetyNetRoots"` for the android-safetynet chain, which anchors through the roots that format requires whether or not either other route was asked for. It is `null` only when nothing anchored the path. `verifyMetadataBlob(blob, opts)` reads a FIDO Metadata Service (MDS v3) BLOB, the signed catalogue of registered authenticator models, verifying its JWS and chaining its signer to an operator-supplied FIDO root before the payload is parsed, with sequence-number rollback and `nextUpdate` freshness checks. Passing the result as `opts.metadata` to `verify` resolves the authenticator's registered attestation roots from its identifier and requires the trust path to fully validate to one of them, refusing an unlisted or revoked model. `metadataAnchors(entry, opts)` applies the same status gate for a caller anchoring the path themselves: a model the catalogue has disqualified registers no anchors. Both of the catalogue's key spaces are covered: an aaguid, and the attestation-certificate key identifiers a U2F authenticator is listed under instead. No FIDO root is bundled, there is no trust-on-first-use, and retrieving the BLOB is out of scope. Fail-closed with typed `webauthn/*` errors — `parseAttestationObject`, `verify`, `verifyMetadataBlob`, `metadataFor`, `metadataAnchors` |
-| `pki.lint` | Certificate linting, the zlint or pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded advisory findings, each with a stable id, a severity (`fatal`, `error`, `warn`, `notice`), a source, a spec-clause citation, and a message, against the RFC 5280 profile, the post-quantum certificate profiles, and a representative CA/Browser Forum TLS BR subset: serial sign and size, validity ordering and the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality (basicConstraints, nameConstraints, policyConstraints and inhibitAnyPolicy must be critical, and keyUsage should be), nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI and AKI presence including the end-entity subjectKeyIdentifier, the six extensions a conforming CA must mark non-critical (reported by clause rather than as unrecognized) and the two it should (issuerAltName, cRLDistributionPoints), a policy mapping to or from anyPolicy, a unique identifier a conforming CA must not generate, a critical subjectAltName beside a non-empty subject, a critical extKeyUsage naming anyExtendedKeyUsage, a userNotice noticeRef, SAN required and CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys, the CA/Browser Forum subscriber certificate profile of §7.1.2.7 (the extension presence and criticality table, the authorityInformationAccess accessMethod and accessLocation tables, basicConstraints cA and pathLenConstraint, certificatePolicies against anyPolicy and the exactly-one reserved identifier rule and the permitted-qualifier table, the forbidden extended key purposes, the two Key Usage tables that differ by key type, and the subjectAltName GeneralName table with its criticality rule in both directions), the post-quantum key-usage rules binding a certificate's keyUsage bits to its subject key type (ML-KEM under RFC 9935 §5, ML-DSA under RFC 9881 §5, and SLH-DSA under RFC 9909 §6 across both its pure and prehash identifiers) together with the ML-KEM encapsulation-key encoding and size, and the §4.2.1.4 certificate-policy user-notice rules (a VisibleString or BMPString explicitText, a notice past 200 characters, an empty notice, control characters, and a non-NFC UTF8String notice, each at the strength the clause states). Alone among these entries the data path never throws: hostile bytes return a `fatal` `lint/unparseable` finding carrying the strict parser's code, so a whole directory lints without a try/catch, and only config-time misuse throws a typed `LintError` — `certificate`, `crl` (the RFC 5280 §5 revocation-list profile: nextUpdate presence, update ordering, cRLNumber presence and its 20-octet ceiling, authorityKeyIdentifier presence, the criticality each profiled CRL and entry extension must carry, freshestCRL in a delta CRL, and unrecognized critical extensions), `ocsp` (the RFC 6960 response profile: an empty signature, each SingleResponse's update ordering and its relation to producedAt, an empty `certs` field, the extended revoked definition and the fixed shape of a revoked answer for a non-issued certificate, the list each extension belongs in, the criticality and value syntax of the CRL entry extensions a SingleResponse may carry, unrecognized critical extensions, the reasons unspecified and removeFromCRL, and two answers for one CertID; the RFC 5019 lightweight rows run on request), `csr` (the artifact a CA reads before it issues: an empty subject naming no identity, an empty subject whose subjectAltName is not critical, a request for an extension the issuer determines, a request asking for a CA certificate, a broken signing digest, and a challengePassword traveling with the request; `opts.profile: "cabf-tls"` adds the certificate profile's own commonName-in-SAN, dNSName syntax, SAN-required and key-strength rows, applied to what the request asks for, and they run only when named because a request carries no extKeyUsage. It does not check the request's signature, which is a cryptographic operation `pki.csr.verify` owns), `rules`, `profiles` |
+| `pki.lint` | Certificate linting, the zlint or pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded advisory findings, each with a stable id, a severity (`fatal`, `error`, `warn`, `notice`), a source, a spec-clause citation, and a message, against the RFC 5280 profile, the post-quantum certificate profiles, and a representative CA/Browser Forum TLS BR subset: serial sign and size, validity ordering and the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality (basicConstraints, nameConstraints, policyConstraints and inhibitAnyPolicy must be critical, and keyUsage should be), nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI and AKI presence including the end-entity subjectKeyIdentifier, the six extensions a conforming CA must mark non-critical (reported by clause rather than as unrecognized) and the two it should (issuerAltName, cRLDistributionPoints), a policy mapping to or from anyPolicy, a unique identifier a conforming CA must not generate, a critical subjectAltName beside a non-empty subject, a critical extKeyUsage naming anyExtendedKeyUsage, a userNotice noticeRef, SAN required and CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys, the CA/Browser Forum subscriber certificate profile of §7.1.2.7 (the extension presence and criticality table, the authorityInformationAccess accessMethod and accessLocation tables, basicConstraints cA and pathLenConstraint, certificatePolicies against anyPolicy and the exactly-one reserved identifier rule and the permitted-qualifier table, the forbidden extended key purposes, the two Key Usage tables that differ by key type, and the subjectAltName GeneralName table with its criticality rule in both directions), the CA/Browser Forum S/MIME BR subscriber profile of §7.1.2.3 (a) through (n) as `cabf-smime`, whose requirements follow the generation a certificate declares through its reserved policy identifier (the distribution-point and accessMethod URI scheme rules, the policy qualifier rules for an id-qt-cps URL and an id-qt-unotice explicitText and noticeRef, the key-usage table for the certificate's own key algorithm including a bit set past the nine named positions, the extended key purposes forbidden at every generation and the ones Strict alone forbids, the authorityKeyIdentifier field rules, a required mailbox in the subjectAltName as an rfc822Name or an id-on-SmtpUTF8Mailbox otherName, the criticality each extension must carry, the subjectDirectoryAttributes and Adobe extensions the Strict generation prohibits, the Legal Entity Identifier extensions keyed on the certificate type rather than the generation, and the Legacy generation retired on 15 July 2025), the post-quantum key-usage rules binding a certificate's keyUsage bits to its subject key type (ML-KEM under RFC 9935 §5, ML-DSA under RFC 9881 §5, and SLH-DSA under RFC 9909 §6 across both its pure and prehash identifiers) together with the ML-KEM encapsulation-key encoding and size, and the §4.2.1.4 certificate-policy user-notice rules (a VisibleString or BMPString explicitText, a notice past 200 characters, an empty notice, control characters, and a non-NFC UTF8String notice, each at the strength the clause states). Alone among these entries the data path never throws: hostile bytes return a `fatal` `lint/unparseable` finding carrying the strict parser's code, so a whole directory lints without a try/catch, and only config-time misuse throws a typed `LintError` — `certificate`, `crl` (the RFC 5280 §5 revocation-list profile: nextUpdate presence, update ordering, cRLNumber presence and its 20-octet ceiling, authorityKeyIdentifier presence, the criticality each profiled CRL and entry extension must carry, freshestCRL in a delta CRL, and unrecognized critical extensions), `ocsp` (the RFC 6960 response profile: an empty signature, each SingleResponse's update ordering and its relation to producedAt, an empty `certs` field, the extended revoked definition and the fixed shape of a revoked answer for a non-issued certificate, the list each extension belongs in, the criticality and value syntax of the CRL entry extensions a SingleResponse may carry, unrecognized critical extensions, the reasons unspecified and removeFromCRL, and two answers for one CertID; the RFC 5019 lightweight rows run on request), `csr` (the artifact a CA reads before it issues: an empty subject naming no identity, an empty subject whose subjectAltName is not critical, a request for an extension the issuer determines, a request asking for a CA certificate, a broken signing digest, and a challengePassword traveling with the request; `opts.profile: "cabf-tls"` adds the certificate profile's own commonName-in-SAN, dNSName syntax, SAN-required and key-strength rows, applied to what the request asks for, and they run only when named because a request carries no extKeyUsage. It does not check the request's signature, which is a cryptographic operation `pki.csr.verify` owns), `rules`, `profiles` |
 | `pki.C` / `pki.constants` | Version-stable constants: the functional scale helpers `C.TIME.*` and `C.BYTES.*`, the codec `LIMITS`, and `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError`, `Asn1Error`, `OidError`, `PemError`, `CertificateError`, `CrlError`, `CsrError`, `Pkcs8Error`, `CmsError`, `OcspError`, `TspError`, `AttrCertError`, `CrmfError`, `Pkcs12Error`, `CmpError`, `PathError`, `CtError`, `JoseError`, `AcmeError`, `WebauthnError`, and `LintError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>`, `pki inspect <cert>`, `pki lint <cert\|crl\|ocsp-response>`, `pki convert <file> --to der\|pem`, `pki verify <cert>... --anchor <cert>`, `pki sign <file> --cert <c> --key <k>` |

package/lib/lint.js

@@ -37,6 +37,7 @@ var crlSchema = require("./schema-crl");
 var csrSchema = require("./schema-csr");
 var ocspSchema = require("./schema-ocsp");
 var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
 var schema = require("./schema-engine");
 var path = require("./path-validate");
 var C = require("./constants");
@@ -84,11 +85,32 @@ function _derivedCert(o) {
   }
 }
 
+/** @internal The bytes a lint verb was handed, as a Buffer, or null where the input is not bytes
+ *  at all and the caller's own branches answer for it. Every parser in this toolkit reads any
+ *  BufferSource, so the one surface that promises never to throw on the data path does not turn
+ *  away a caller holding a Uint8Array from the network or an ArrayBuffer from a reader. Taking a
+ *  snapshot rather than the caller's view is also what closes the detached-backing-buffer hazard,
+ *  since a caller can neuter the buffer between the check and the read. */
+function _derBytesOf(input) {
+  if (!guard.bytes.isByteSource(input)) return null;
+  try {
+    return { der: guard.bytes.snapshotSource(input, LintError, "lint/bad-input", "pki.lint input") };
+  } catch (e) {
+    /** @internal A byte source whose backing buffer was detached is still a byte source, and it
+     * fails at the door rather than at the parse. The data path answers with a verdict either
+     * way, or one neutered buffer aborts the scan of a whole corpus. */
+    return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint",
+      message: "input is a byte source whose bytes could not be read", context: { code: e.code } } };
+  }
+}
+
 function _ingest(input) {
   var derived = _derivedCert(input);
   if (derived) return { cert: derived };
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = x509.pemDecode(input, "CERTIFICATE"); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER certificate", context: { code: e.code } } }; }
@@ -128,6 +150,11 @@ function _makeCtx(cert, profile) {
   return {
     profile: profile,
     explicitTlsProfile: explicitTls,
+    /** @internal An S/MIME subscriber certificate names its exact profile through a reserved
+     * policy identifier, so unlike the TLS case the rows detect it from the certificate itself and
+     * the flag only records that the caller also named it. */
+    explicitSmimeProfile: profile === "cabf-smime",
+    isCaCert: isCa,
     isTlsServerCert: explicitTls || (_hasEku(cert, "serverAuth") && !isCa),
     decode: function (name) { return _decodeOrNull(cert, name); },
     raw: function (name) { return _findRaw(cert, name); },
@@ -257,23 +284,40 @@ function _hasControlChar(str) {
   }
   return false;
 }
-function _policyDisplayTexts(ctx) {
+/** @internal Every policy qualifier of every PolicyInformation, handed to `fn` as its qualifier
+ *  OID, its value node, and the PolicyInformation carrying it. The decoder surfaces the qualifiers
+ *  as raw DER, because a qualifier may carry any type and the reader does not choose one for the
+ *  caller, so every walk re-decodes bytes that already passed the policy-qualifier door. */
+function _eachPolicyQualifier(ctx, fn) {
   var d = ctx.decode("certificatePolicies");
-  if (!d || !Array.isArray(d.value)) return [];
-  var out = [];
+  if (!d || !Array.isArray(d.value)) return;
   d.value.forEach(function (pi) {
     if (!pi.qualifiersBytes || !pi.qualifiersBytes.length) return;
     var quals;
     // allow:swallow-unverified re-decoding bytes that already decoded under assertPolicyQualifiers cannot throw
-    try { quals = asn1.decode(pi.qualifiersBytes).children; } catch (_e) { return; }
+    try {
+      quals = asn1.decode(pi.qualifiersBytes).children;
+    } catch (_e) {
+      return;
+    }
     (quals || []).forEach(function (pq) {
       var qid;
       // allow:swallow-unverified assertPolicyQualifiers already read this OID, so re-reading it cannot throw
-      try { qid = asn1.read.oid(pq.children[0]); } catch (_e2) { return; }
-      if (qid !== OID_UNOTICE) return;
-      out = out.concat(pkix.userNoticeTexts(pq.children[1]));
+      try {
+        qid = asn1.read.oid(pq.children[0]);
+      } catch (_e2) {
+        return;
+      }
+      fn(qid, pq.children[1], pi);
     });
   });
+}
+function _policyDisplayTexts(ctx) {
+  var out = [];
+  _eachPolicyQualifier(ctx, function (qid, value) {
+    if (qid !== OID_UNOTICE) return;
+    out = out.concat(pkix.userNoticeTexts(value));
+  });
   return out;
 }
 function _hasPolicyDisplayText(cert, ctx) { return _policyDisplayTexts(ctx).length > 0; }
@@ -600,25 +644,801 @@ function _subjectIsEmpty(cert) {
   return !(Array.isArray(rdns) && rdns.length);
 }
 
-/** @internal Every policy qualifier of every PolicyInformation, as its qualifier OID. The bytes
- *  are re-decoded the way the display-text walk above re-decodes them. */
+/** @internal Every policy qualifier of every PolicyInformation, as its qualifier OID. */
 function _policyQualifierIds(ctx) {
+  var out = [];
+  _eachPolicyQualifier(ctx, function (qid) { out.push(qid); });
+  return out;
+}
+
+/** @internal The S/MIME BR sec. 7.1.6.1 reserved policy identifiers, keyed by OID to the
+ *  generation that OID declares. A subscriber certificate asserts exactly one, so reading it is
+ *  how this profile learns which generation's table to hold the certificate to, and the presence
+ *  of one is also what says the certificate is one of these at all. */
+var SMIME_GENERATION_BY_POLICY = Object.create(null);
+/** @internal The same twelve identifiers keyed to the certificate TYPE they declare. The tables of
+ *  sec. 7.1.2.3 (l) are keyed on the type where the rest of the section is keyed on the
+ *  generation, so both directions of the matrix are read. */
+var SMIME_TYPE_BY_POLICY = Object.create(null);
+["mailbox", "organization", "sponsor", "individual"].forEach(function (type) {
+  ["legacy", "multipurpose", "strict"].forEach(function (gen) {
+    var d = oid.byName("smime-" + type + "-" + gen);
+    if (d) { SMIME_GENERATION_BY_POLICY[d] = gen; SMIME_TYPE_BY_POLICY[d] = type; }
+  });
+});
+
+/** @internal The keyUsage tables of sec. 7.1.2.3 (e). Each cell states its usage MODES (signing
+ *  only, key management only, dual use), and each mode fixes bits with SHALL and admits others
+ *  with MAY, so a conforming certificate asserts every bit of some one mode and no bit outside
+ *  that same mode. Flattening a cell into one permitted set loses that: on RSA, digitalSignature
+ *  with dataEncipherment sets only bits the cell names somewhere and still matches no mode,
+ *  because dataEncipherment belongs to the key-management modes and those require keyEncipherment.
+ *  The RSA cell is the one that also differs by GENERATION, Multipurpose and Legacy admitting
+ *  dataEncipherment where Strict does not. The elliptic-curve cell names encipherOnly and
+ *  decipherOnly only in the modes that require keyAgreement, which is how it states "only if
+ *  keyAgreement is set". A certificate declaring no generation is held to the Strict cell, the
+ *  narrowest of the three. */
+function _smimeKuModes(kind, gen) {
+  var relaxed = gen === "multipurpose" || gen === "legacy";
+  if (kind === "rsa") {
+    return [
+      { required: ["digitalSignature"], optional: ["nonRepudiation"] },
+      { required: ["keyEncipherment"], optional: relaxed ? ["dataEncipherment"] : [] },
+      { required: ["digitalSignature", "keyEncipherment"],
+        optional: relaxed ? ["nonRepudiation", "dataEncipherment"] : ["nonRepudiation"] },
+    ];
+  }
+  if (kind === "ec") {
+    return [
+      { required: ["digitalSignature"], optional: ["nonRepudiation"] },
+      { required: ["keyAgreement"], optional: ["encipherOnly", "decipherOnly"] },
+      { required: ["digitalSignature", "keyAgreement"],
+        optional: ["nonRepudiation", "encipherOnly", "decipherOnly"] },
+    ];
+  }
+  if (kind === "eddsa" || kind === "mldsa") {
+    return [{ required: ["digitalSignature"], optional: ["nonRepudiation"] }];
+  }
+  if (kind === "mlkem") return [{ required: ["keyEncipherment"], optional: [] }];
+  return null;
+}
+/** @internal Every bit any mode of the cell names, which is the complement of "Other bit positions
+ *  SHALL NOT be set". */
+function _smimeKuNamedAnywhere(modes) {
+  var out = [];
+  modes.forEach(function (m) {
+    m.required.concat(m.optional).forEach(function (bit) {
+      if (out.indexOf(bit) === -1) out.push(bit);
+    });
+  });
+  return out;
+}
+function _smimeKuAsserted(value) {
+  var out = [];
+  KU_BIT_NAMES.forEach(function (bit) { if (value[bit] === true) out.push(bit); });
+  return out;
+}
+/** @internal Whether the asserted bits are exactly some mode: every bit that mode requires, and no
+ *  bit it does not name. */
+function _smimeKuMatchesAMode(modes, asserted) {
+  for (var i = 0; i < modes.length; i++) {
+    var allowed = modes[i].required.concat(modes[i].optional);
+    var ok = true;
+    modes[i].required.forEach(function (bit) { if (asserted.indexOf(bit) === -1) ok = false; });
+    asserted.forEach(function (bit) { if (allowed.indexOf(bit) === -1) ok = false; });
+    if (ok) return true;
+  }
+  return false;
+}
+
+/** @internal Sec. 7.1.2.3 (c) gives a URI scheme table for each of these two accessMethods and
+ *  none for any other, so a scheme is measured on these and an unrecognized accessMethod has no
+ *  table to be held to. */
+var SMIME_AIA_METHODS = ["ocsp", "caIssuers"].map(function (n) { return oid.byName(n); });
+
+/** @internal Sec. 7.1.2.3 (l): the Legal Entity Identifier table is keyed on the certificate type.
+ *  The identifier is prohibited outright for two types; for Organization-validated the role
+ *  identifier alone is prohibited, and Sponsor-validated admits both. */
+var SMIME_LEI_EXTS = Object.assign(Object.create(null), { identifier: "lei-identifier", role: "lei-role" });
+/** @internal Whether the cell for a certificate type ADMITS one of the two extensions. A cell that
+ *  reads "Prohibited" carries no criticality sentence, so the criticality row is asked only where
+ *  this is true and a prohibited extension breaks one clause rather than two. A certificate
+ *  declaring no type names no cell and is held to neither row. */
+function _smimeLeiAdmits(type, which) {
+  if (type === "sponsor") return true;
+  if (type === "organization") return which === "identifier";
+  return false;
+}
+
+/** @internal Sec. 7.1.2.3 (m): both Adobe extensions the table names, prohibited under Strict. */
+var SMIME_ADOBE_EXTS = ["adobe-timestamp", "adobe-archive-rev-info"];
+
+/** @internal Sec. 7.1.2.3 (f): these four SHALL NOT be present at any generation, where any other
+ *  purpose is forbidden under Strict alone. */
+var SMIME_FORBIDDEN_EKU = ["serverAuth", "codeSigning", "timeStamping", "anyExtendedKeyUsage"]
+  .map(function (n) { var d = oid.byName(n); return d ? { name: n, oid: d } : null; })
+  .filter(function (e) { return !!e; });
+
+/** @internal "Effective July 15, 2025 S/MIME Subscriber Certificates SHALL NOT be issued using the
+ *  Legacy Generation profiles" (sec. 7.1.6.1). Dated, so a certificate issued before it is not
+ *  held to a rule that did not yet apply. */
+var SMIME_LEGACY_RETIRED = new Date("2025-07-15T00:00:00Z");
+
+function _smimeGeneration(ctx) {
   var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return null;
+  var found = null;
+  d.value.forEach(function (pi) {
+    var gen = SMIME_GENERATION_BY_POLICY[pi.policyIdentifier];
+    if (gen && found === null) found = gen;
+  });
+  return found;
+}
+/** @internal A reserved policy identifier alone does not make a certificate a SUBSCRIBER one: sec.
+ *  7.1.6.3 says a certificate issued to a Subordinate CA "SHALL include one or more explicit policy
+ *  identifiers defined in Section 7.1.6.1", so an intermediate carries them too. Detection
+ *  therefore asks for the identifier AND that the certificate is not a CA, or these subscriber-only
+ *  rows would report an intermediate for asserting cA and keyCertSign and naming no mailbox.
+ *  Naming the profile still overrides, which is how a malformed subscriber is checked. */
+function _isSmime(cert, ctx) {
+  if (ctx.explicitSmimeProfile) return true;
+  return _smimeGeneration(ctx) !== null && !ctx.isCaCert;
+}
+function _smimeStrict(cert, ctx) { return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) === "strict"; }
+/** @internal The cell every table in sec. 7.1.2.3 is read against. A certificate declaring no
+ *  generation names no cell, and is held to Strict, the narrowest of the three. */
+function _smimeGenerationOrStrict(ctx) {
+  var gen = _smimeGeneration(ctx);
+  return gen === null ? "strict" : gen;
+}
+/** @internal The certificate type the asserted reserved identifier declares, for the sec.
+ *  7.1.2.3 (l) tables. Null where none is asserted, which is every certificate the caller named
+ *  the profile for rather than one that declared itself. */
+function _smimeType(ctx) {
+  var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return null;
+  var found = null;
+  for (var i = 0; i < d.value.length; i++) {
+    var t = SMIME_TYPE_BY_POLICY[d.value[i].policyIdentifier];
+    if (t && found === null) found = t;
+  }
+  return found;
+}
+
+/** @internal Which sec. 7.1.2.3 (e) table applies, from the subject key's own algorithm. A key
+ *  outside them has no table to be held to. */
+function _smimeKeyKind(cert) {
+  var spki = cert.subjectPublicKeyInfo;
+  var name = spki && spki.algorithm && spki.algorithm.name;
+  if (RSA_KEY_ALGS[name]) return "rsa";
+  if (name === "ecPublicKey") return "ec";
+  if (name === "Ed25519" || name === "Ed448") return "eddsa";
+  if (typeof name === "string" && name.indexOf("ml-dsa") !== -1) return "mldsa";
+  if (typeof name === "string" && name.indexOf("ml-kem") !== -1) return "mlkem";
+  return null;
+}
+
+/** @internal The URI of a GeneralName carried as raw DER, or null where it is not one. The
+ *  cRLDistributionPoints decoder surfaces each fullName entry as bytes, since a distribution point
+ *  may name any GeneralName type and the reader does not choose one for the caller. */
+function _generalNameUri(der) {
+  var n;
+  // allow:swallow-unverified an entry that does not decode is answered by the extension-syntax row
+  try { n = asn1.decode(der); } catch (_e) { return null; }
+  if (!n || n.tagClass !== "context" || n.tagNumber !== 6) return null;
+  return n.content.toString("latin1");
+}
+/** @internal HTTP, not HTTPS. The S/MIME BR distinguishes the two by wording: the policy qualifier
+ *  of sec. 7.1.2.3 (a) "SHALL be a HTTP or HTTPS URL", where the distribution point and access
+ *  method tables say "SHALL have the URI scheme HTTP" and "Other schemes SHALL NOT be present".
+ *  HTTPS is another scheme, and a revocation list fetched over TLS is a circular dependency.
+ *  Having that scheme means being a URI of it, so both readings go through the one place that
+ *  decides what an http or https URL is and differ only in which answer they accept. */
+function _isHttpUri(u) {
+  return pkiBuild.httpUrlScheme(u) === "http";
+}
+/** @internal The policy-qualifier clause of sec. 7.1.2.3 (a) names both schemes, where the URI
+ *  scheme tables name HTTP alone. It also asks for a URL rather than a scheme, so a bare
+ *  "http://" naming no host does not satisfy it. The shape is the one a reader holds a URL it was
+ *  given to, not the narrower one the builders hold what they emit to. */
+function _isHttpOrHttpsUrl(u) {
+  return pkiBuild.httpUrlScheme(u) !== null;
+}
+/** @internal The accessLocation URIs of sec. 7.1.2.3 (c), grouped BY accessMethod. The clause
+ *  gives id-ad-ocsp and id-ad-caIssuers a table each, where clause (b) gives the whole extension
+ *  one, so each method's URIs answer that method's table alone and an accessMethod with no table
+ *  is not measured. An accessLocation of another GeneralName type carries no URI to measure a
+ *  scheme on. */
+function _smimeAiaLocationsByMethod(ctx) {
+  var d = ctx.decode("authorityInfoAccess");
+  var out = Object.create(null);
+  if (!d || !Array.isArray(d.value)) return out;
+  for (var i = 0; i < d.value.length; i++) {
+    var ad = d.value[i];
+    if (SMIME_AIA_METHODS.indexOf(ad.accessMethod) === -1) continue;
+    if (!out[ad.accessMethod]) out[ad.accessMethod] = [];
+    /** @internal A location that is not a uniformResourceIdentifier carries no scheme, so it is
+     * kept as null rather than dropped: the method is still provided and still has no HTTP URI. */
+    var loc = ad.accessLocation;
+    out[ad.accessMethod].push(loc && loc.tag === 6 && typeof loc.value === "string" ? loc.value : null);
+  }
+  return out;
+}
+function _crldpUris(ctx) {
+  var d = ctx.decode("cRLDistributionPoints");
   if (!d || !Array.isArray(d.value)) return [];
   var out = [];
-  d.value.forEach(function (pi) {
-    if (!pi.qualifiersBytes || !pi.qualifiersBytes.length) return;
-    var quals;
-    // allow:swallow-unverified bytes that already decoded under the policy-qualifier door cannot throw
-    try { quals = asn1.decode(pi.qualifiersBytes).children; } catch (_e) { return; }
-    (quals || []).forEach(function (pq) {
-      // allow:swallow-unverified the same door already read this OID
-      try { out.push(asn1.read.oid(pq.children[0])); } catch (_e2) { void 0; }
+  d.value.forEach(function (dp) {
+    var point = dp.distributionPoint;
+    if (!point || point.kind !== "fullName" || !Array.isArray(point.names)) return;
+    point.names.forEach(function (raw) {
+      var u = _generalNameUri(raw);
+      if (u !== null) out.push(u);
     });
   });
   return out;
 }
 
+var SMIME_OID_SMTP_UTF8 = oid.byName("smtpUtf8Mailbox");
+
+/** @internal The nine named keyUsage bits of RFC 5280 sec. 4.2.1.3, in their bit order. */
+var KU_BIT_NAMES = ["digitalSignature", "nonRepudiation", "keyEncipherment", "dataEncipherment",
+  "keyAgreement", "keyCertSign", "cRLSign", "encipherOnly", "decipherOnly"];
+
+/** @internal The type OID of an otherName GeneralName. Every otherName is a [0], so the type is
+ *  the only thing telling one apart from another, and a decoded entry carries it on `value` where
+ *  the reader recognized the form and as bytes where it did not. */
+function _otherNameTypeOf(gn) {
+  if (gn && gn.value && typeof gn.value.typeId === "string") return gn.value.typeId;
+  if (gn && gn.value && typeof gn.value.type === "string") return gn.value.type;
+  var src = gn && (gn.bytes || gn.value);
+  if (!Buffer.isBuffer(src)) return null;
+  var n;
+  // allow:swallow-unverified an entry that does not decode is answered by the extension-syntax row
+  try { n = asn1.decode(src); } catch (_e) { return null; }
+  if (!n || !n.children || !n.children.length) return null;
+  // allow:swallow-unverified a first child that is not an OID is not an otherName type
+  try { return asn1.read.oid(n.children[0]); } catch (_e2) { return null; }
+}
+
+var CABF_SMIME_RULES = [
+  {
+    id: "lint/cabf-smime/policies-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal SHOULD NOT, so a warning rather than an error: the clause states a preference and
+     * the certificate is still conformant against the MUSTs around it. */
+    message: "certificatePolicies should not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("certificatePolicies"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/policies-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal Reachable only where the caller named the profile: without the extension there is
+     * no reserved identifier, and the reserved identifier is what otherwise says the certificate
+     * is one of these. Naming the profile is the caller supplying that statement. */
+    message: "a subscriber certificate must carry a certificatePolicies extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("certificatePolicies") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/policies-reserved-identifier-count", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "It SHALL include exactly one of the reserved policyIdentifiers", so two is as
+     * much a fault as none and the count says which. A certificate's own generation is read from
+     * that identifier, so two of them also leaves the generation ambiguous. */
+    message: "certificatePolicies must include exactly one reserved policy identifier",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      /** @internal An absent extension is the presence row's answer, not this one's, so it is
+       * skipped here and counted where it is present but names no reserved identifier. */
+      if (!ctx.raw("certificatePolicies")) return null;
+      var d = ctx.decode("certificatePolicies");
+      var list = (d && Array.isArray(d.value)) ? d.value : [];
+      var found = list.filter(function (pi) { return !!SMIME_GENERATION_BY_POLICY[pi.policyIdentifier]; });
+      return found.length === 1 ? null : { context: { count: found.length } };
+    },
+  },
+  {
+    id: "lint/cabf-smime/legacy-generation-retired", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.6.1",
+    message: "a subscriber certificate must not be issued under a Legacy generation profile",
+    appliesTo: _isSmime,
+    effectiveDate: SMIME_LEGACY_RETIRED,
+    check: function (cert, ctx) {
+      return _smimeGeneration(ctx) === "legacy" ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/crldp-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (b)",
+    message: "a subscriber certificate must carry a cRLDistributionPoints extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("cRLDistributionPoints") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/crldp-non-http-uri", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (b)",
+    /** @internal The scheme rule differs by generation: Strict and Multipurpose require EVERY
+     * uniformResourceIdentifier to be HTTP, where Legacy requires at least one and permits others
+     * beside it. One row measures both, because the generation decides which question to ask. */
+    message: "a cRLDistributionPoints URI does not meet the URI scheme rule for this generation",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      /** @internal An extension carrying no URI at all fails both readings: every generation
+       * requires an HTTP one, so an empty list is a violation rather than nothing to measure. The
+       * presence row answers only for the extension being absent. */
+      if (!ctx.raw("cRLDistributionPoints")) return null;
+      var uris = _crldpUris(ctx);
+      var gen = _smimeGeneration(ctx);
+      if (gen === "legacy" || !uris.length) {
+        return uris.some(_isHttpUri) ? null : { context: { generation: gen || "strict", uris: uris } };
+      }
+      var bad = uris.filter(function (u) { return !_isHttpUri(u); });
+      return bad.length ? { context: { generation: gen, uris: bad } } : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aia-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    message: "authorityInformationAccess must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("authorityInfoAccess"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/basic-constraints-ca-true", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (d)",
+    message: "a subscriber certificate's basicConstraints cA field must not be true",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("basicConstraints");
+      return (d && d.value && d.value.cA === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/basic-constraints-path-len", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (d)",
+    message: "a subscriber certificate's basicConstraints must not carry a pathLenConstraint",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("basicConstraints");
+      var pl = d && d.value ? d.value.pathLenConstraint : null;
+      return pl === null || pl === undefined ? null : { context: { pathLenConstraint: pl } };
+    },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    message: "a subscriber certificate must carry a keyUsage extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("keyUsage") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-forbidden-bit", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    /** @internal "Other bit positions SHALL NOT be set", over a table that differs by key
+     * algorithm: keyEncipherment belongs to the RSA table and keyAgreement to the EC one, so the
+     * same bit is conformant on one key and not on the other. A key algorithm the section gives no
+     * table for is held to neither. "Other bit positions" reaches past the nine RFC 5280 names as
+     * well, so a bit set beyond them is reported for every key algorithm. */
+    message: "a keyUsage bit this key algorithm's table does not permit is set",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      var kind = _smimeKeyKind(cert);
+      if (kind === null) return null;
+      var modes = _smimeKuModes(kind, _smimeGeneration(ctx));
+      if (modes === null) return null;
+      var named = _smimeKuNamedAnywhere(modes);
+      var out = [];
+      KU_BIT_NAMES.forEach(function (bit) {
+        if (d.value[bit] === true && named.indexOf(bit) === -1) {
+          out.push({ context: { keyUsage: bit, keyAlgorithm: kind } });
+        }
+      });
+      if (d.value.reservedBitsSet === true) {
+        out.push({ context: { reservedBitSet: true, keyAlgorithm: kind } });
+      }
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-matches-no-mode", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    /** @internal A cell is a set of modes rather than a set of bits, so bits that all appear
+     * somewhere in the cell can still combine into no mode: digitalSignature with dataEncipherment
+     * on RSA, or encipherOnly without keyAgreement on an elliptic curve. This row runs only where
+     * every asserted bit is one the cell names, since a bit outside the cell is the row above. */
+    message: "the keyUsage bits set match no usage mode of this key algorithm's table",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value || d.value.reservedBitsSet === true) return null;
+      var kind = _smimeKeyKind(cert);
+      if (kind === null) return null;
+      var gen = _smimeGeneration(ctx);
+      var modes = _smimeKuModes(kind, gen);
+      if (modes === null) return null;
+      var asserted = _smimeKuAsserted(d.value);
+      var named = _smimeKuNamedAnywhere(modes);
+      for (var i = 0; i < asserted.length; i++) {
+        if (named.indexOf(asserted[i]) === -1) return null;
+      }
+      return _smimeKuMatchesAMode(modes, asserted)
+        ? null
+        : { context: { keyAlgorithm: kind, generation: gen || "strict", keyUsage: asserted } };
+    },
+  },
+  {
+    id: "lint/cabf-smime/eku-missing-email-protection", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (f)",
+    message: "extKeyUsage must include id-kp-emailProtection",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return true;
+      return d.value.indexOf(oid.byName("emailProtection")) === -1 ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/eku-forbidden-purpose", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (f)",
+    message: "a key purpose the profile forbids at every generation is present in extKeyUsage",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var out = [];
+      SMIME_FORBIDDEN_EKU.forEach(function (e) {
+        if (d.value.indexOf(e.oid) !== -1) out.push({ context: { keyPurpose: e.name, oid: e.oid } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/eku-extra-purpose-strict", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (f)",
+    /** @internal Strict alone says "Other values SHALL NOT be present"; Multipurpose and Legacy
+     * say they MAY be. So this row is the one place the generation turns a permission into a
+     * prohibition, and it runs only where the certificate declared Strict. The four values the
+     * sentence after the table forbids at every generation are left to the row that owns them, so
+     * one purpose draws one finding citing the narrower of the two rules it breaks. */
+    message: "under the Strict generation, extKeyUsage must carry no purpose beyond id-kp-emailProtection",
+    appliesTo: _smimeStrict,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var email = oid.byName("emailProtection");
+      var extra = d.value.filter(function (o) {
+        if (o === email) return false;
+        for (var i = 0; i < SMIME_FORBIDDEN_EKU.length; i++) {
+          if (SMIME_FORBIDDEN_EKU[i].oid === o) return false;
+        }
+        return true;
+      });
+      return extra.length ? { context: { purposes: extra } } : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aki-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    message: "a subscriber certificate must carry an authorityKeyIdentifier extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("authorityKeyIdentifier") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/aki-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    message: "authorityKeyIdentifier must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("authorityKeyIdentifier"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/san-no-mailbox", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.4.2.1",
+    /** @internal "SHALL contain at least one GeneralName entry of the following types: Rfc822Name
+     * and/or otherName of type id-on-SmtpUTF8Mailbox". An otherName is read for its type OID,
+     * since any otherName is a [0] and only that one carries a mailbox. */
+    message: "subjectAltName must carry at least one rfc822Name or SmtpUTF8Mailbox otherName",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var d = ctx.decode("subjectAltName");
+      if (!d || !d.value || !Array.isArray(d.value.names)) return true;
+      var found = d.value.names.some(function (gn) {
+        if (gn.tagNumber === 1) return true;
+        if (gn.tagNumber !== 0) return false;
+        return _otherNameTypeOf(gn) === SMIME_OID_SMTP_UTF8;
+      });
+      return found ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/ski-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (n)",
+    message: "subjectKeyIdentifier must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("subjectKeyIdentifier"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/smime-capabilities-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (i)",
+    message: "smimeCapabilities must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { var e = ctx.raw("smimeCapabilities"); return (e && e.critical === true) ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/subject-directory-attributes-prohibited", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (j)",
+    /** @internal Prohibited under Strict and Multipurpose, permitted under Legacy. The generation
+     * the certificate declares decides, so this runs at two of the three. */
+    message: "subjectDirectoryAttributes is prohibited under the Strict and Multipurpose generations",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) !== "legacy";
+    },
+    check: function (cert, ctx) { return ctx.raw("subjectDirectoryAttributes") ? true : null; },
+  },
+  {
+    id: "lint/cabf-smime/subject-directory-attributes-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (j)",
+    /** @internal The criticality sentence sits in the Legacy row alone, which reads "MAY be present
+     * and SHALL NOT be marked critical". The other row reads "Prohibited" and carries no
+     * criticality sentence, so a critical extension there breaks one clause rather than two. */
+    message: "subjectDirectoryAttributes must not be marked critical",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) === "legacy";
+    },
+    check: function (cert, ctx) {
+      var e = ctx.raw("subjectDirectoryAttributes");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/policies-cps-not-http-url", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "the value of the qualifier SHALL be a HTTP or HTTPS URL". This clause names both
+     * schemes where the URI scheme tables of (b) and (c) name HTTP alone. */
+    message: "an id-qt-cps policy qualifier must be a HTTP or HTTPS URL",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_CPS) return;
+        var uri = null;
+        // allow:swallow-unverified a CPSuri that will not read as a string is not a URL either, so it falls to the report below rather than out of the rule
+        try {
+          uri = asn1.read.string(value);
+        } catch (_e) {
+          void 0;
+        }
+        if (!_isHttpOrHttpsUrl(uri)) {
+          out.push({ context: { policyIdentifier: pi.policyIdentifier, cps: uri } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/policies-unotice-no-explicit-text", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "If a qualifier of type id-qt-unotice is included, then it SHALL contain
+     * explicitText". Both halves of that sentence are rows, since a notice can fail either. */
+    message: "an id-qt-unotice policy qualifier must contain explicitText",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_UNOTICE) return;
+        var carries = pkix.userNoticeTexts(value).some(function (t) { return t.field === "explicitText"; });
+        if (!carries) out.push({ context: { policyIdentifier: pi.policyIdentifier } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/policies-unotice-notice-ref", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (a)",
+    /** @internal "...and SHALL NOT contain noticeRef." */
+    message: "an id-qt-unotice policy qualifier must not contain a noticeRef",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_UNOTICE) return;
+        /** @internal NoticeReference requires its organization DisplayText, which userNoticeTexts
+         * surfaces under that field name, so the field's presence is the noticeRef's presence. */
+        var carries = pkix.userNoticeTexts(value).some(function (t) { return t.field === "organization"; });
+        if (carries) out.push({ context: { policyIdentifier: pi.policyIdentifier } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/crldp-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (b)",
+    message: "cRLDistributionPoints should not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var e = ctx.raw("cRLDistributionPoints");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aia-missing", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    /** @internal "(SHOULD be present)", where the TLS profile's own heading for the same extension
+     * reads SHALL, so the two profiles report it at different strengths. */
+    message: "a subscriber certificate should carry an authorityInformationAccess extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("authorityInfoAccess") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/aia-ca-issuers-missing", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    /** @internal "SHOULD contain at least one accessMethod value of type id-ad-caIssuers". Read
+     * only where the extension is there at all, since its absence is the row above. */
+    message: "authorityInformationAccess should carry an id-ad-caIssuers accessMethod",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityInfoAccess"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityInfoAccess");
+      if (!d || !Array.isArray(d.value)) return null;
+      var wanted = oid.byName("caIssuers");
+      for (var i = 0; i < d.value.length; i++) {
+        if (d.value[i].accessMethod === wanted) return null;
+      }
+      return true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aia-non-http-uri", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (c)",
+    /** @internal Strict and Multipurpose require every accessMethod URI to be HTTP, Legacy at
+     * least one. Each accessMethod has its OWN table, so "at least one" is answered per method and
+     * an HTTP URI on one does not satisfy the other's row. */
+    message: "an authorityInformationAccess accessMethod URI does not meet the URI scheme rule for this generation",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityInfoAccess"); },
+    check: function (cert, ctx) {
+      var byMethod = _smimeAiaLocationsByMethod(ctx);
+      var gen = _smimeGeneration(ctx);
+      var out = [];
+      function report(method, offending) {
+        out.push({ context: { generation: gen || "strict", accessMethod: oid.name(method) || method,
+          uris: offending.filter(function (u) { return u !== null; }),
+          nonUriLocations: offending.filter(function (u) { return u === null; }).length } });
+      }
+      SMIME_AIA_METHODS.forEach(function (method) {
+        var locs = byMethod[method];
+        if (!locs || !locs.length) return;
+        if (gen === "legacy") {
+          if (!locs.some(_isHttpUri)) report(method, locs);
+          return;
+        }
+        var bad = locs.filter(function (u) { return !_isHttpUri(u); });
+        if (bad.length) report(method, bad);
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/key-usage-not-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (e)",
+    message: "keyUsage should be marked critical",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("keyUsage"); },
+    check: function (cert, ctx) {
+      var e = ctx.raw("keyUsage");
+      return (e && e.critical === true) ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aki-key-identifier-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    /** @internal "The keyIdentifier field SHALL be present", which is a field rule rather than the
+     * extension-presence one above it: an authorityKeyIdentifier naming only an issuer and serial
+     * satisfies that row and not this one. */
+    message: "the authorityKeyIdentifier keyIdentifier field must be present",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityKeyIdentifier"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityKeyIdentifier");
+      if (!d || !d.value) return null;
+      var kid = d.value.keyIdentifier;
+      return (kid === null || kid === undefined) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/aki-issuer-or-serial-present", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (g)",
+    /** @internal "authorityCertIssuer and authorityCertSerialNumber fields SHALL NOT be present."
+     * Either one alone is a violation, so both are reported by name. */
+    message: "the authorityKeyIdentifier must not carry authorityCertIssuer or authorityCertSerialNumber",
+    appliesTo: function (cert, ctx) { return _isSmime(cert, ctx) && !!ctx.raw("authorityKeyIdentifier"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityKeyIdentifier");
+      if (!d || !d.value) return null;
+      var out = [];
+      ["authorityCertIssuer", "authorityCertSerialNumber"].forEach(function (f) {
+        var v = d.value[f];
+        if (v !== null && v !== undefined) out.push({ context: { field: f } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/san-missing", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (h)",
+    message: "a subscriber certificate must carry a subjectAltName extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("subjectAltName") ? null : true; },
+  },
+  {
+    id: "lint/cabf-smime/san-critical", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (h)",
+    /** @internal "SHOULD NOT be marked critical unless the subject field is an empty sequence",
+     * which is the one condition that lifts it, so the subject is read rather than assumed. */
+    message: "subjectAltName should not be marked critical where the subject is not an empty sequence",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var e = ctx.raw("subjectAltName");
+      if (!e || e.critical !== true) return null;
+      var rdns = cert.subject && cert.subject.rdns;
+      var empty = !Array.isArray(rdns) || rdns.length === 0;
+      return empty ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-smime/qc-statements-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (k)",
+    message: "qcStatements must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var e = ctx.raw("qcStatements");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/lei-prohibited", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (l)",
+    /** @internal The table is keyed on the certificate TYPE: Mailbox-validated and
+     * Individual-validated admit neither identifier, Organization-validated admits the LEI but not
+     * the role, and Sponsor-validated admits both. A certificate declaring no type is held to
+     * none, since the table has no row to select. */
+    message: "a Legal Entity Identifier extension is prohibited for this certificate type",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var type = _smimeType(ctx);
+      if (type === null) return null;
+      var out = [];
+      ["identifier", "role"].forEach(function (which) {
+        if (_smimeLeiAdmits(type, which)) return;
+        if (ctx.raw(SMIME_LEI_EXTS[which])) out.push({ context: { certificateType: type, extension: which } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/lei-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (l)",
+    /** @internal Where the table admits one it reads "MAY be present and SHALL NOT be marked
+     * critical", so criticality is fixed in the cells that admit it and nowhere else. */
+    message: "a Legal Entity Identifier extension must not be marked critical",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) {
+      var type = _smimeType(ctx);
+      if (type === null) return null;
+      var out = [];
+      ["identifier", "role"].forEach(function (which) {
+        if (!_smimeLeiAdmits(type, which)) return;
+        var e = ctx.raw(SMIME_LEI_EXTS[which]);
+        if (e && e.critical === true) out.push({ context: { certificateType: type, extension: which } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/adobe-extension-prohibited", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (m)",
+    /** @internal Prohibited under Strict, permitted under Multipurpose and Legacy. */
+    message: "an Adobe extension is prohibited under the Strict generation",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) === "strict";
+    },
+    check: function (cert, ctx) {
+      var out = [];
+      SMIME_ADOBE_EXTS.forEach(function (name) {
+        if (ctx.raw(name)) out.push({ context: { extension: name } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/adobe-extension-critical", severity: "error", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (m)",
+    /** @internal The criticality sentence sits in the Multipurpose and Legacy row. The Strict row
+     * reads "Prohibited" and carries none, so a critical extension there breaks one clause. */
+    message: "an Adobe extension must not be marked critical",
+    appliesTo: function (cert, ctx) {
+      return _isSmime(cert, ctx) && _smimeGenerationOrStrict(ctx) !== "strict";
+    },
+    check: function (cert, ctx) {
+      var out = [];
+      SMIME_ADOBE_EXTS.forEach(function (name) {
+        var e = ctx.raw(name);
+        if (e && e.critical === true) out.push({ context: { extension: name } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-smime/ski-missing", severity: "warn", source: "cabf-smime", citation: "CABF S/MIME BR 7.1.2.3 (n)",
+    /** @internal "(SHOULD be present)". The same clause adds that the value SHOULD be derived from
+     * the public key, which names no derivation, so a certificate using one this cannot recompute
+     * is conformant and no row reports it. */
+    message: "a subscriber certificate should carry a subjectKeyIdentifier extension",
+    appliesTo: _isSmime,
+    check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },
+  },
+];
+
 var CABF_TLS_RULES = [
   {
     id: "lint/cabf-tls/aia-missing", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.6",
@@ -2253,28 +3073,32 @@ var CABF_TLS_CSR_RULE_IDS = [
   "lint/cabf-tls/weak-key",
 ];
 
+/** @internal RFC 5280 sec. 4.2 fixes each extension's syntax wherever it is carried. Every row in
+ *  every profile below asks for an extension BY NAME, and the shared decoder returns null both for
+ *  one that is absent and for one whose value does not decode, so without this row a malformed
+ *  value reads as absence and passes every row that asks for it. The certificate's own row is
+ *  reused rather than restated, and it is folded into each named profile rather than into the
+ *  *_RULES arrays, which `ALL_RULES` concatenates and would otherwise report it twice. */
+var RFC5280_EXTENSION_SYNTAX_RULES = RFC5280_RULES.filter(function (r) {
+  return r.id === "lint/rfc5280/extension-undecodable";
+});
 var PROFILES = Object.assign(Object.create(null), {
   "rfc5280": RFC5280_RULES,
-  "rfc9881": RFC9881_RULES,
-  "rfc9909": RFC9909_RULES,
-  "rfc9935": RFC9935_RULES,
-  "cabf-tls": CABF_TLS_RULES,
+  "rfc9881": RFC9881_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "rfc9909": RFC9909_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "rfc9935": RFC9935_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "cabf-tls": CABF_TLS_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "cabf-smime": CABF_SMIME_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
-var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES).concat(CABF_TLS_RULES);
+var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
+  .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES);
 
 var CABF_TLS_CSR_RULES = CABF_TLS_RULES.filter(function (r) {
   return CABF_TLS_CSR_RULE_IDS.indexOf(r.id) !== -1;
 });
-/** @internal RFC 5280 sec. 4.2 fixes each extension's syntax wherever it is carried, and a
- *  requested extension whose value does not decode is the same fault in a request as in a
- *  certificate. The certificate's own row reads `extensions` and the request view supplies it, so
- *  the row is reused rather than restated. Without it a malformed requested value counted as a
- *  passing check, because the shared decoder returns null and every row that asks by name reads
- *  that null as absence. */
-var RFC5280_CSR_RULES = RFC5280_RULES.filter(function (r) {
-  return r.id === "lint/rfc5280/extension-undecodable";
-});
-var CSR_STRUCTURAL_RULES = RFC2986_CSR_RULES.concat(RFC5280_CSR_RULES);
+/** @internal A requested extension whose value does not decode is the same fault in a request as
+ *  in a certificate, so the request profiles take the same row the certificate profiles do. */
+var CSR_STRUCTURAL_RULES = RFC2986_CSR_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES);
 var CSR_PROFILES = Object.assign(Object.create(null), {
   "rfc2986": CSR_STRUCTURAL_RULES,
   "cabf-tls": CSR_STRUCTURAL_RULES.concat(CABF_TLS_CSR_RULES),
@@ -2378,7 +3202,9 @@ function _ingestCsr(input) {
   var derived = _derivedCsr(input);
   if (derived) return { csr: derived };
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = csrSchema.pemDecode(input); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER certification request", context: { code: e.code } } }; }
@@ -2487,7 +3313,9 @@ function _ingestCrl(input) {
   var derived = _derivedCrl(input);
   if (derived) return { crl: derived };
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = crlSchema.pemDecode(input); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER CRL", context: { code: e.code } } }; }
@@ -2660,7 +3488,9 @@ var _OCSP_CLAIM = ["responseStatus", "basicResponse", "tbsResponseDataBytes"];
  * responses. Bytes and PEM take the fatal path below, never a throw. */
 function _ingestOcsp(input) {
   var der;
-  if (Buffer.isBuffer(input)) der = input;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
   else if (typeof input === "string") {
     try { der = ocspSchema.pemDecode(input); }
     catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER OCSP response", context: { code: e.code } } }; }
@@ -2793,6 +3623,10 @@ var BY_ARTIFACT = Object.assign(Object.create(null), {
 });
 
 function rules(profile, artifact) {
+  /** @internal Every lint verb reads "all" and "default" as naming no profile, so the enumerator
+   * reads them the same way: a caller who linted under one of those names and then asked which
+   * rows ran would otherwise be refused the answer by the same registry that ran them. */
+  if (profile === "all" || profile === "default") profile = null;
   if (artifact != null && !Object.prototype.hasOwnProperty.call(BY_ARTIFACT, artifact)) {
     throw _cfg("lint/bad-input", "unknown lint artifact \"" + artifact +
       "\" (known: " + Object.keys(BY_ARTIFACT).join(", ") + ")");

package/lib/oid.js

@@ -118,11 +118,27 @@ var FAMILIES = Object.assign(Object.create(null), {
 
   pkixOn: { base: [1, 3, 6, 1, 5, 5, 7, 8], of: { hardwareModuleName: 4, dnsSRV: 7, smtpUtf8Mailbox: 9, macAddress: 12 } },
 
+  /** @internal The S/MIME BR reserved policy identifiers of sec. 7.1.6.1 are a 4x3 matrix of
+   *  certificate type by generation, and a subscriber certificate asserts exactly one. Reading it
+   *  is how a linter learns which generation's table to hold the certificate to, so all twelve are
+   *  named rather than only the current ones. */
   cabfPolicy: { base: [2, 23, 140, 1], of: {
-    "ev-guidelines": 1, "domain-validated": [2, 1], "organization-validated": [2, 2], "individual-validated": [2, 3] } },
+    "ev-guidelines": 1, "domain-validated": [2, 1], "organization-validated": [2, 2], "individual-validated": [2, 3],
+    "smime-mailbox-legacy": [5, 1, 1], "smime-mailbox-multipurpose": [5, 1, 2], "smime-mailbox-strict": [5, 1, 3],
+    "smime-organization-legacy": [5, 2, 1], "smime-organization-multipurpose": [5, 2, 2], "smime-organization-strict": [5, 2, 3],
+    "smime-sponsor-legacy": [5, 3, 1], "smime-sponsor-multipurpose": [5, 3, 2], "smime-sponsor-strict": [5, 3, 3],
+    "smime-individual-legacy": [5, 4, 1], "smime-individual-multipurpose": [5, 4, 2], "smime-individual-strict": [5, 4, 3] } },
 
   idCp: { base: [1, 3, 6, 1, 5, 5, 7, 14], of: { "id-cp-ipAddr-asNumber": 2, "id-cp-ipAddr-asNumber-v2": 3 } },
 
+  /** @internal The Legal Entity Identifier extensions of S/MIME BR sec. 7.1.2.3 (l), which the
+   *  certificate type decides the admissibility of. */
+  lei: { base: [1, 3, 6, 1, 4, 1, 52266], of: { "lei-identifier": 1, "lei-role": 2 } },
+
+  /** @internal The Adobe extensions of S/MIME BR sec. 7.1.2.3 (m), prohibited under the Strict
+   *  generation. */
+  adobe: { base: [1, 2, 840, 113583, 1, 1, 9], of: { "adobe-timestamp": 1, "adobe-archive-rev-info": 2 } },
+
   gsmaRspRole: { base: [2, 23, 146, 1, 2, 1], of: {
     "id-rspRole-ci": 0, "id-rspRole-euicc-v2": 1, "id-rspRole-euicc": [0, 0, 0, 0, 0],
     "id-rspRole-eum-v2": 2, "id-rspRole-eum": [0, 0, 0],

package/lib/pki-build.js

@@ -42,6 +42,9 @@ function _isSubDelim(c) {
   }
 }
 function _isUserinfoByte(c) { return _isUnreserved(c) || _isSubDelim(c) || c === 58; }
+/** @internal The bytes RFC 3986 sec. 3.2.2 admits in a reg-name, beside a percent-encoding. A DNS
+ *  label admits fewer, which is why a reader does not hold a host it was given to that rule. */
+function _isRegNameByte(c) { return _isUnreserved(c) || _isSubDelim(c); }
 function _isUriByte(c) {
   return _isUnreserved(c) || _isSubDelim(c) || c === 58 || c === 47 || c === 63 || c === 35 || c === 64;
 }
@@ -99,7 +102,61 @@ function _validUriIp6Host(s, from, to) {
   return packed !== null && intrinsic.sizeOf(packed) === 16;
 }
 
+/** @internal A port as RFC 3986 sec. 3.2.3 writes it: ":" *DIGIT, or nothing. An empty port after
+ *  the colon is what the grammar allows, so it is not a reason to refuse. */
+function _validUriPort(s, at, to) {
+  if (at === to) return true;
+  if (_charCodeAt(s, at) !== 58) return false;
+  for (var i = at + 1; i < to; i += 1) { if (!_isDigitCode(_charCodeAt(s, i))) return false; }
+  return true;
+}
+/** @internal An IPvFuture literal, RFC 3986 sec. 3.2.2: "v" 1*HEXDIG "." 1*( unreserved /
+ *  sub-delims / ":" ). */
+function _validIpvFuture(s, from, to) {
+  if (to - from < 4) return false;
+  var c = _charCodeAt(s, from);
+  if (c !== 118 && c !== 86) return false;
+  var i = from + 1, hex = 0;
+  while (i < to && _isHexCode(_charCodeAt(s, i))) { i += 1; hex += 1; }
+  if (hex === 0 || i >= to || _charCodeAt(s, i) !== 46) return false;
+  i += 1;
+  if (i >= to) return false;
+  for (; i < to; i += 1) {
+    c = _charCodeAt(s, i);
+    if (!_isUnreserved(c) && !_isSubDelim(c) && c !== 58) return false;
+  }
+  return true;
+}
+/** @internal The authority of a URL a reader was GIVEN, as RFC 3986 sec. 3.2 writes it:
+ *  [ userinfo "@" ] host [ ":" port ], where host is a non-empty reg-name, an IPv6 literal in
+ *  brackets, or an IPvFuture literal. RFC 7230 sec. 2.7.1 forbids an empty host for http, so the
+ *  host is required here. The structure is checked; the reg-name's own bytes are not held to DNS
+ *  label rules, which is what a URL this toolkit EMITS must satisfy and is not what RFC 3986
+ *  conformance means. Applying the emit rule to a value someone else wrote rejects legal URLs, and
+ *  dropping the structure with it accepts "http://:80". */
+function _validReadAuthority(s, from, to) {
+  var i, at = -1;
+  for (i = from; i < to; i += 1) { if (_charCodeAt(s, i) === 64) at = i; }
+  if (at !== -1 && !_componentBytesOk(s, from, at, _isUserinfoByte)) return false;
+  var hostStart = at === -1 ? from : at + 1;
+  if (hostStart >= to) return false;
+  if (_charCodeAt(s, hostStart) === 91) {
+    var close = -1;
+    for (i = hostStart + 1; i < to; i += 1) { if (_charCodeAt(s, i) === 93) { close = i; break; } }
+    if (close === -1) return false;
+    if (!_validUriIp6Host(s, hostStart + 1, close) && !_validIpvFuture(s, hostStart + 1, close)) return false;
+    return _validUriPort(s, close + 1, to);
+  }
+  var colon = -1;
+  for (i = hostStart; i < to; i += 1) { if (_charCodeAt(s, i) === 58) { colon = i; break; } }
+  var hostEnd = colon === -1 ? to : colon;
+  if (hostEnd === hostStart) return false;
+  if (!_componentBytesOk(s, hostStart, hostEnd, _isRegNameByte)) return false;
+  return colon === -1 ? true : _validUriPort(s, colon, to);
+}
+
 function _validUriAuthority(s, from, to, shape) {
+  if (shape.anyAuthority) return _validReadAuthority(s, from, to);
   var i, c, at = -1;
   for (i = from; i < to; i += 1) {
     c = _charCodeAt(s, i);
@@ -136,6 +193,13 @@ var _URI_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: false,
 /** @internal An HTTP URL (RFC 2616 sec. 3.2.2: "http:" "//" host [ ":" port ] [ abs_path [ "?" query ]]):
  *  no userinfo, a host of one label or many, a query only after an absolute path, no fragment. */
 var _HTTP_URL_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: true, userinfo: false, emptyAuthority: false, emptyHost: false, queryNeedsPath: true, fragment: false });
+/** @internal An http or https URL as RFC 7230 sec. 2.7.1 and 2.7.2 write it: "http:" "//"
+ *  authority path-abempty [ "?" query ], where path-abempty MAY be empty, so a query sits directly
+ *  after the authority, and where a fragment is allowed on the URI reference (RFC 3986 sec. 3.5).
+ *  This is the shape a reader holds a URL it was GIVEN to. The shape above is what the builders
+ *  hold the URLs they EMIT to, which is deliberately narrower, and applying it to a value someone
+ *  else wrote reports a conforming URL. */
+var _HTTP_URL_READ_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: true, userinfo: true, emptyAuthority: false, emptyHost: false, queryNeedsPath: false, fragment: true, anyAuthority: true });
 /** @internal An LDAP URL (RFC 4516 sec. 2: scheme "://" [host [":" port]] ["/" dn ...]): no
  *  userinfo, a host of any label count that may be left out, with or without a port, and no
  *  fragment. The dn, attributes, scope and filter after the "/" are not parsed. */
@@ -143,6 +207,17 @@ var _LDAP_URL_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: tr
 
 function _looksLikeUri(s) { return _uriShape(s, _URI_SHAPE); }
 function isHttpUrl(s) { return typeof s === "string" && guard.name.uriSchemeIs(s, "http") && _uriShape(s, _HTTP_URL_SHAPE); }
+/** @internal The scheme of a well-formed http or https URL as a READER judges one, or null where
+ *  the string is not one of either. Carrying the scheme token is not the same as being a URI of
+ *  that scheme: RFC 7230 sec. 2.7.1 writes http-URI as "http:" "//" authority path-abempty and
+ *  forbids an empty host, so "http:example.com/a" and "http://:80" are neither. A caller that
+ *  admits one scheme and not the other compares the answer rather than testing a prefix. */
+function httpUrlScheme(s) {
+  if (typeof s !== "string" || !_uriShape(s, _HTTP_URL_READ_SHAPE)) return null;
+  if (guard.name.uriSchemeIs(s, "http")) return "http";
+  if (guard.name.uriSchemeIs(s, "https")) return "https";
+  return null;
+}
 function isLdapUrl(s) { return typeof s === "string" && guard.name.uriSchemeIs(s, "ldap") && _uriShape(s, _LDAP_URL_SHAPE); }
 
 function _uriShape(s, shape) {
@@ -1378,4 +1453,4 @@ function samePublicKey(spkiA, spkiB) {
   return _keyEquals(ka, kb) === true;
 }
 
-module.exports = intrinsic.freeze({ makeBuilder: makeBuilder, reqDenseArray: reqDenseArrayImpl, KU_BIT: KU_BIT, tbsNameField: tbsNameField, tbsSerialNumber: tbsSerialNumber, randomSerial: randomSerial, skiValueOf: skiValueOf, isHttpUrl: isHttpUrl, isLdapUrl: isLdapUrl });
+module.exports = intrinsic.freeze({ makeBuilder: makeBuilder, reqDenseArray: reqDenseArrayImpl, KU_BIT: KU_BIT, tbsNameField: tbsNameField, tbsSerialNumber: tbsSerialNumber, randomSerial: randomSerial, skiValueOf: skiValueOf, isHttpUrl: isHttpUrl, httpUrlScheme: httpUrlScheme, isLdapUrl: isLdapUrl });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.17",
+  "version": "0.8.18",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1b8d2783-3d1c-49be-ad22-5e029717a170",
+  "serialNumber": "urn:uuid:d298e2df-b5dc-4670-a00b-3f63a3d1a174",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-24T06:15:30.953Z",
+    "timestamp": "2026-09-24T09:13:14.788Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.17",
+      "bom-ref": "@blamejs/pki@0.8.18",
       "type": "application",
       "name": "pki",
-      "version": "0.8.17",
+      "version": "0.8.18",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.17",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.18",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.17",
+      "ref": "@blamejs/pki@0.8.18",
       "dependsOn": []
     }
   ]