@blamejs/pki 0.8.24 → 0.8.26

package/lib/lint.js

@@ -36,6 +36,9 @@ var x509 = require("./schema-x509");
 var crlSchema = require("./schema-crl");
 var csrSchema = require("./schema-csr");
 var ocspSchema = require("./schema-ocsp");
+var cmsSchema = require("./schema-cms");
+var tspSchema = require("./schema-tsp");
+var acSchema = require("./schema-attrcert");
 var pkix = require("./schema-pkix");
 var pkiBuild = require("./pki-build");
 var schema = require("./schema-engine");
@@ -2527,6 +2530,219 @@ var MICROSOFT_RULES = [
   },
 ];
 
+/** @internal The seven Trust Purposes appendix A defines, each as the extended key usage set it
+ *  requires. Dedication is a SUBSET test rather than equality, which the appendix states twice: a
+ *  subordinate CA "MUST contain only the EKU(s) specified for that Trust Purpose", and sec. 2.1.3
+ *  repeats it. So {id-kp-serverAuth} is dedicated under Server Authentication and under Legacy TLS
+ *  alike, and a set spanning two purposes is under neither. */
+var APPLE_TRUST_PURPOSES = [
+  ["serverAuth"],
+  ["serverAuth", "clientAuth"],
+  ["emailProtection"],
+  ["emailProtection", "clientAuth"],
+  ["clientAuth"],
+  ["timeStamping"],
+  ["brandIndicatorforMessageIdentification"],
+].map(function (ekus) {
+  return { ekus: ekus.map(function (n) { return oid.byName(n); }) };
+});
+/** @internal Every identifier the table names, across all seven purposes. */
+var APPLE_PURPOSE_EKUS = [];
+APPLE_TRUST_PURPOSES.forEach(function (p) {
+  p.ekus.forEach(function (d) {
+    if (APPLE_PURPOSE_EKUS.indexOf(d) === -1) APPLE_PURPOSE_EKUS.push(d);
+  });
+});
+/** @internal Sec. 1.7 and the change log: an extended key usage extension and the prohibition on
+ *  anyExtendedKeyUsage from this date, dedication to a single Trust Purpose from the later one.
+ *  Sec. 2's note fixes the comparison at "00:00:00 UTC" and sec. 1.7 defines the signing date as
+ *  the date of issuance, including for a renewal, a re-key or a cross-sign. */
+var APPLE_EKU_FROM = new Date("2026-08-01T00:00:00Z");
+var APPLE_SINGLE_PURPOSE_FROM = new Date("2027-07-01T00:00:00Z");
+var APPLE_SMIME_SAN_FROM = new Date("2027-02-01T00:00:00Z");
+var APPLE_ROOT_RSA_MIN_BITS = 4096;
+/** @internal "a minimum key size of ... ECDSA 384-bit", so P-384 and above. */
+var APPLE_ROOT_CURVES = ["secp384r1", "secp521r1"];
+
+function _isApple(cert, ctx) { return ctx.profile === "apple-root"; }
+function _isAppleRoot(cert, ctx) {
+  return _isApple(cert, ctx) && ctx.isCaCert && _sameName(cert.issuer, cert.subject) &&
+    _selfSignedIdentifiers(cert, ctx);
+}
+function _isAppleSubordinate(cert, ctx) {
+  return _isApple(cert, ctx) && ctx.isCaCert && !_sameName(cert.issuer, cert.subject);
+}
+function _isAppleSubscriber(cert, ctx) { return _isApple(cert, ctx) && !ctx.isCaCert; }
+function _applePurposes(ctx) {
+  var d = ctx.decode("extKeyUsage");
+  return (d && Array.isArray(d.value)) ? d.value : null;
+}
+/** @internal Whether an extended key usage set is dedicated to one Trust Purpose: non-empty, and
+ *  contained in at least one purpose's required set. WHICH purpose is not returned, and cannot
+ *  honestly be: {id-kp-clientAuth} sits inside Client Authentication, Legacy TLS and Legacy S/MIME
+ *  alike, which is why the appendix has to say in prose that such a certificate belongs under a
+ *  Client Authentication CP/CPS. No finding names a purpose, so the rows ask only the question the
+ *  bytes answer. The subset form is the document's, and under
+ *  the CURRENT table it decides nothing an equality test would not: every proper non-empty subset
+ *  of the two purposes with two identifiers is itself another purpose's whole set. No vector
+ *  separates the two readings, and that is a fact about the table rather than about the rule, so a
+ *  purpose added later is what the subset form is written for. */
+function _appleIsDedicated(purposes) {
+  if (!purposes || !purposes.length) return false;
+  for (var i = 0; i < APPLE_TRUST_PURPOSES.length; i++) {
+    var p = APPLE_TRUST_PURPOSES[i];
+    var within = true;
+    for (var j = 0; j < purposes.length; j++) {
+      if (p.ekus.indexOf(purposes[j]) === -1) { within = false; break; }
+    }
+    if (within) return true;
+  }
+  return false;
+}
+/** @internal Whether the set is under a Trust Purpose at all, which is what separates a certificate
+ *  the scoping reaches from one it does not. anyExtendedKeyUsage is not in the appendix's table and
+ *  is still in scope: RFC 5280 sec. 4.2.1.12 makes it a certificate "not restricted to any specific
+ *  key purpose", so it names EVERY purpose rather than none, and it conforms to no single one. That
+ *  is what separates it from id-kp-codeSigning, which names a use the table does not list and
+ *  leaves the certificate under no purpose. */
+function _appleNamesAPurpose(purposes) {
+  if (!purposes) return false;
+  if (purposes.indexOf(oid.byName("anyExtendedKeyUsage")) !== -1) return true;
+  for (var i = 0; i < purposes.length; i++) {
+    if (APPLE_PURPOSE_EKUS.indexOf(purposes[i]) !== -1) return true;
+  }
+  return false;
+}
+function _appleSignedBefore(cert, when) {
+  var nb = cert.validity && cert.validity.notBefore;
+  if (!guard.time.isDate(nb)) return false;
+  return guard.time.instantOf(nb) < guard.time.instantOf(when);
+}
+function _appleEkuLabels(purposes) {
+  return purposes.map(function (d) { return oid.name(d) || d; });
+}
+
+/** @internal The Apple Root Program Policy v2.0 profile. */
+var APPLE_RULES = [
+  {
+    id: "lint/apple-root/root-key-too-small", severity: "error", source: "apple-root", citation: "Apple Root Program Policy 1.5",
+    /** @internal "Root Inclusion Requests MUST only contain Root CA Certificates that have a
+     * minimum key size of RSA 4096-bit or ECDSA 384-bit." The clause names two families and no
+     * others, so a key outside both is outside it. */
+    message: "a root certificate needs an RSA modulus of at least 4096 bits or a curve of at least NIST P-384",
+    appliesTo: _isAppleRoot,
+    check: function (cert) {
+      var spki = cert.subjectPublicKeyInfo;
+      var name = spki && spki.algorithm && spki.algorithm.name;
+      if (name && RSA_KEY_ALGS[name]) {
+        var bits = _rsaModulusBits(spki);
+        if (bits === null) return { context: { rsaBits: null } };
+        return bits < APPLE_ROOT_RSA_MIN_BITS ? { context: { rsaBits: bits } } : null;
+      }
+      if (name === "ecPublicKey") {
+        var curve = _ecCurveName(spki);
+        return APPLE_ROOT_CURVES.indexOf(curve) === -1 ? { context: { curve: curve } } : null;
+      }
+      return { context: { algorithm: name || null } };
+    },
+  },
+  {
+    id: "lint/apple-root/subordinate-ca-eku-missing", severity: "error", source: "apple-root", citation: "Apple Root Program Policy 1.7",
+    message: "a subordinate CA certificate must carry an extKeyUsage extension",
+    appliesTo: _isAppleSubordinate,
+    effectiveDate: APPLE_EKU_FROM,
+    check: function (cert, ctx) { return ctx.raw("extKeyUsage") ? null : true; },
+  },
+  {
+    id: "lint/apple-root/subordinate-ca-eku-any", severity: "error", source: "apple-root", citation: "Apple Root Program Policy 1.7",
+    message: "a subordinate CA certificate must not assert anyExtendedKeyUsage",
+    appliesTo: _isAppleSubordinate,
+    effectiveDate: APPLE_EKU_FROM,
+    check: function (cert, ctx) {
+      var purposes = _applePurposes(ctx);
+      if (purposes === null) return null;
+      return purposes.indexOf(oid.byName("anyExtendedKeyUsage")) !== -1 ? true : null;
+    },
+  },
+  {
+    id: "lint/apple-root/subordinate-ca-mixes-trust-purposes", severity: "error", source: "apple-root", citation: "Apple Root Program Policy 1.7",
+    /** @internal In this window the clause admits (a) dedication to a single Trust Purpose, or (b)
+     * three conditions together, of which one is in the bytes: "it contains no Extended Key Usage
+     * associated with a Trust Purpose defined in Appendix A". A certificate naming one of those
+     * identifiers has failed (b) already, and if its set is not within a single purpose it has
+     * failed (a) as well, so both arms fail on the bytes alone. A certificate naming none of them
+     * is passed over here, because (b)'s other two conditions are the issuing root's configuration
+     * and a CP/CPS, and the row below picks it up once (b) is gone. */
+    message: "a subordinate CA certificate names extended key usages spanning more than one trust purpose",
+    appliesTo: _isAppleSubordinate,
+    effectiveDate: APPLE_EKU_FROM,
+    check: function (cert, ctx) {
+      if (!_appleSignedBefore(cert, APPLE_SINGLE_PURPOSE_FROM)) return null;
+      var purposes = _applePurposes(ctx);
+      if (!_appleNamesAPurpose(purposes)) return null;
+      return _appleIsDedicated(purposes)
+        ? null : { context: { extKeyUsage: _appleEkuLabels(purposes) } };
+    },
+  },
+  {
+    id: "lint/apple-root/subordinate-ca-not-single-purpose", severity: "error", source: "apple-root", citation: "Apple Root Program Policy 1.7",
+    /** @internal "A Subordinate CA Certificate signed on or after 2027-07-01 MUST be dedicated to a
+     * single Trust Purpose." Arm (b) is gone, so the set must be within one purpose whatever it
+     * names, and the certificate the row above passes over is reported here. Two rows rather than
+     * one, because the two windows differ in what fixes them. */
+    message: "a subordinate CA certificate must be dedicated to a single trust purpose",
+    appliesTo: _isAppleSubordinate,
+    effectiveDate: APPLE_SINGLE_PURPOSE_FROM,
+    check: function (cert, ctx) {
+      var purposes = _applePurposes(ctx);
+      if (purposes === null) return null;
+      return _appleIsDedicated(purposes)
+        ? null : { context: { extKeyUsage: _appleEkuLabels(purposes) } };
+    },
+  },
+  {
+    id: "lint/apple-root/smime-subscriber-without-rfc822-name", severity: "error", source: "apple-root", citation: "Apple Root Program Policy 2.3",
+    /** @internal "Effective 2027-02-01, all newly signed Subscriber certificates that contain the
+     * id-kp-emailProtection EKU MUST include at least one rfc822Name in the subjectAltName
+     * extension." */
+    message: "a subscriber certificate carrying id-kp-emailProtection must name at least one rfc822Name in its subjectAltName",
+    appliesTo: function (cert, ctx) {
+      var purposes = _applePurposes(ctx);
+      return _isAppleSubscriber(cert, ctx) && !!purposes &&
+        purposes.indexOf(oid.byName("emailProtection")) !== -1;
+    },
+    effectiveDate: APPLE_SMIME_SAN_FROM,
+    check: function (cert, ctx) {
+      var san = ctx.decode("subjectAltName");
+      var names = san && san.value && san.value.names;
+      if (!Array.isArray(names)) return true;
+      for (var i = 0; i < names.length; i++) {
+        if (names[i] && names[i].tagNumber === 1 && typeof names[i].value === "string" &&
+          names[i].value.length) { return null; }
+      }
+      return true;
+    },
+  },
+  {
+    id: "lint/apple-root/subscriber-mixes-trust-purposes", severity: "error", source: "apple-root", citation: "Apple Root Program Policy appendix A",
+    /** @internal The appendix's last note is a dated PERMISSION rather than a prohibition:
+     * "Subscriber certificates issued under a Trust Purpose ... and signed before 2027-07-01 MAY
+     * contain EKU combinations that do not conform to the single Trust Purpose scoping defined in
+     * this Appendix". The permission is bounded by its date, so the scoping binds once it passes.
+     * A subscriber naming none of the appendix's identifiers is under no Trust Purpose and is
+     * passed over, which is the reading sec. 1.7 arm (b) takes of the same shape. */
+    message: "a subscriber certificate names extended key usages spanning more than one trust purpose",
+    appliesTo: _isAppleSubscriber,
+    effectiveDate: APPLE_SINGLE_PURPOSE_FROM,
+    check: function (cert, ctx) {
+      var purposes = _applePurposes(ctx);
+      if (!_appleNamesAPurpose(purposes)) return null;
+      return _appleIsDedicated(purposes)
+        ? null : { context: { extKeyUsage: _appleEkuLabels(purposes) } };
+    },
+  },
+];
+
 /** @internal The three purposes ETSI EN 319 412-5 clause 4.2.3 names, of which a QcType declares
  *  "one and only one". The ASN.1 carries an extension marker, so an identifier outside the three
  *  is admitted and is not one of the purposes being counted. */
@@ -4402,6 +4618,421 @@ var RFC5280_CRL_RULES = [
 var CRL_PROFILES = Object.assign(Object.create(null), { "rfc5280-crl": RFC5280_CRL_RULES });
 var ALL_CRL_RULES = RFC5280_CRL_RULES;
 
+/** @internal The RFC 5652 profile is SHORT, and the reason is worth stating where the rows are:
+ *  this toolkit's CMS parser already refuses nearly everything sections 5 and 11 require, so those
+ *  clauses reach an operator as `lint/unparseable` carrying the parser's own code rather than as a
+ *  row here. A row for one of them would be a branch no input can drive. Probed against the
+ *  shipped parser, the SignedData and SignerInfo versions, the presence of signedAttrs when the
+ *  content type is not id-data, the content-type and message-digest attributes and their binding
+ *  to eContentType, every attribute's cardinality and placement, a countersignature's own
+ *  restrictions, and a time carrying no seconds, fractional seconds or a local offset are all
+ *  refused before a rule sees them. What is left is below.
+ *  The UTCTime alternative of sec. 11.3 carries two year digits, which the clause reads as 19YY
+ *  for YY >= 50 and 20YY otherwise, so every UTCTime names a year inside 1950..2049 and only the
+ *  GeneralizedTime direction of that clause can be broken. */
+var OID_SIGNING_TIME = oid.byName("signingTime");
+var OID_SIGNED_DATA = oid.byName("signedData");
+
+/** @internal The content type decides which of these rows apply, and the parser sets `contentType`
+ *  as an own property on every content it builds. A content type that carries no signers has no own
+ *  `signerInfos`, so testing for that field answers from whatever the prototype chain holds. */
+function _isSignedData(cms) { return cms.contentType === OID_SIGNED_DATA; }
+var OID_COUNTERSIGNATURE = oid.byName("countersignature");
+/** @internal Every SignerInfo a message carries: its own signers, and the countersignatures their
+ *  unsigned attributes hold, which sec. 11.4 defines as SignerInfo values and which carry their own
+ *  signedAttrs. A rule about a signed attribute governs one wherever it appears, so a message
+ *  cannot put the shape a clause forbids one level down and escape it. The parser validates each
+ *  countersignature's shape without keeping the result, so it is decoded here, and a nested one is
+ *  reached by the same walk. */
+function _cmsAllSignerInfos(cms) {
+  var out = [];
+  /** @internal Each entry keeps the index of the message's OWN signer it hangs from, not a
+   *  position in this walk: a reader given a flattened index would look up a signer that is not
+   *  the one at fault, or one that does not exist. Whether the attribute sat on a countersignature
+   *  under that signer is the other half of the answer. */
+  function visit(signerInfos, signerIndex, isCounter, depth) {
+    if (!Array.isArray(signerInfos) || depth > C.LIMITS.CMS_MAX_COUNTERSIGNATURE_DEPTH) return;
+    signerInfos.forEach(function (si, i) {
+      var index = isCounter ? signerIndex : i;
+      out.push({ signerInfo: si, signerIndex: index, countersignature: isCounter });
+      (Array.isArray(si.unsignedAttrs) ? si.unsignedAttrs : []).forEach(function (attr) {
+        if (attr.type !== OID_COUNTERSIGNATURE) return;
+        if (!Array.isArray(attr.values)) return;
+        attr.values.forEach(function (value) {
+          var nested;
+          // allow:swallow-unverified the parser already walked this value, so a fault here leaves the countersignature unread rather than reported
+          try { nested = cmsSchema.walkCountersignature(asn1.decode(value), null); }
+          catch (_e) { return; }
+          if (nested) visit([nested], index, true, depth + 1);
+        });
+      });
+    });
+  }
+  visit(cms.signerInfos, 0, false, 0);
+  return out;
+}
+function _cmsSignedAttr(signerInfo, dotted) {
+  var attrs = signerInfo.signedAttrs;
+  if (!Array.isArray(attrs)) return null;
+  for (var i = 0; i < attrs.length; i++) {
+    if (attrs[i].type === dotted) return attrs[i];
+  }
+  return null;
+}
+/** @internal Whether two DIGEST AlgorithmIdentifiers name one algorithm, under RFC 5754 sec. 2. The
+ *  rule lives in the schema module because the set this row reads is also WRITTEN there, by the verb
+ *  that adds a countersigner's digest to it, and a set written under one rule and read under another
+ *  would list one algorithm twice. Only digest identifiers pass through here, so no row is loosened
+ *  for an algorithm whose parameters carry meaning. */
+var _cmsSameAlgorithm = cmsSchema.sameDigestAlgorithm;
+
+var RFC5652_CMS_RULES = [
+  {
+    id: "lint/rfc5652/signing-time-encoding", severity: "error", source: "rfc5652", citation: "RFC 5652 11.3",
+    /** @internal "Dates between 1 January 1950 and 31 December 2049 (inclusive) MUST be encoded as
+     * UTCTime. Any dates with year values before 1950 or after 2049 MUST be encoded as
+     * GeneralizedTime." The value is held as its DER bytes, so the encoding is the first byte and
+     * the year is what the value decodes to. */
+    message: "a signing-time naming a year from 1950 to 2049 must be encoded as UTCTime, not GeneralizedTime",
+    appliesTo: _isSignedData,
+    check: function (cms) {
+      var out = [];
+      _cmsAllSignerInfos(cms).forEach(function (entry) {
+        var attr = _cmsSignedAttr(entry.signerInfo, OID_SIGNING_TIME);
+        if (!attr || !Array.isArray(attr.values) || !attr.values.length) return;
+        var value = attr.values[0];
+        if (!Buffer.isBuffer(value) || value.length < 2) return;
+        if (value[0] !== asn1.TAGS.GENERALIZED_TIME) return;
+        var when;
+        // allow:swallow-unverified the parser already read this value as a Time, so a fault here answers for no signer
+        try { when = asn1.read.time(asn1.decode(value)); } catch (_e) { return; }
+        var year = when.getUTCFullYear();
+        if (year >= 1950 && year <= 2049) {
+          out.push({ context: { signerIndex: entry.signerIndex,
+            countersignature: entry.countersignature, year: year } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5652/signer-digest-not-listed", severity: "warn", source: "rfc5652", citation: "RFC 5652 5.3",
+    /** @internal "The message digest algorithm SHOULD be among those listed in the digestAlgorithms
+     * field of the associated SignerData. Implementations MAY fail to validate signatures that use
+     * a digest algorithm that is not included in the SignedData digestAlgorithms set." A SHOULD
+     * whose cost is a verifier that declines, so a warning.
+     * Sec. 11.4 makes a countersignature a SignerInfo and does not except it from this clause, and
+     * sec. 5.1 has the collection list the digests "employed by all of the signers", so the walk is
+     * the same one the signing-time rule uses and the finding says which signer it hangs from. */
+    message: "a signer's digest algorithm is not among those the SignedData digestAlgorithms set lists",
+    appliesTo: _isSignedData,
+    check: function (cms) {
+      var listed = Array.isArray(cms.digestAlgorithms) ? cms.digestAlgorithms : [];
+      var out = [];
+      _cmsAllSignerInfos(cms).forEach(function (entry) {
+        var mine = entry.signerInfo.digestAlgorithm;
+        if (!mine) return;
+        var found = listed.some(function (alg) { return _cmsSameAlgorithm(alg, mine); });
+        if (!found) {
+          out.push({ context: { signerIndex: entry.signerIndex, countersignature: entry.countersignature,
+            digestAlgorithm: mine.name || mine.oid } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5652/attribute-certificate-v1", severity: "warn", source: "rfc5652", citation: "RFC 5652 5.1",
+    /** @internal "The use of version 1 attribute certificates is strongly discouraged." The
+     * certificates field is a CertificateChoices SET, whose `[1]` alternative is the v1 attribute
+     * certificate; the parser keeps each element's outer tag for exactly this kind of question. */
+    message: "the certificates field carries a version 1 attribute certificate, whose use this section strongly discourages",
+    appliesTo: _isSignedData,
+    check: function (cms) {
+      var certs = Array.isArray(cms.certificates) ? cms.certificates : [];
+      var count = 0;
+      certs.forEach(function (c) {
+        if (c && c.tagClass === "context" && c.tagNumber === 1) count += 1;
+      });
+      return count ? { context: { count: count } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5652/no-signers", severity: "notice", source: "rfc5652", citation: "RFC 5652 5.1",
+    /** @internal "There MAY be any number of elements in the collection, including zero", so a
+     * SignedData with no signers is conformant. It is also a message carrying certificates and
+     * nothing signed, which is worth naming to whoever expected a signature. */
+    message: "the SignedData carries no signers, so it signs nothing and only conveys its certificates and revocation lists",
+    appliesTo: _isSignedData,
+    check: function (cms) { return cms.signerInfos.length === 0 ? true : null; },
+  },
+  {
+    id: "lint/rfc5652/detached-content", severity: "notice", source: "rfc5652", citation: "RFC 5652 5.2",
+    /** @internal eContent is optional, and its absence means a verifier must be handed the content
+     * by another route. The row reads a SignedData that HAS a signer, since the notice exists for
+     * whoever must verify one: a message with no signers has nothing to supply content for. */
+    message: "the SignedData is detached, so verifying it needs the content supplied separately",
+    appliesTo: function (cms) { return _isSignedData(cms) && cms.signerInfos.length > 0; },
+    check: function (cms) {
+      var encap = cms.encapContentInfo;
+      return (encap && encap.eContent) ? null : true;
+    },
+  },
+];
+
+var CMS_PROFILES = Object.assign(Object.create(null), { "rfc5652": RFC5652_CMS_RULES });
+var ALL_CMS_RULES = RFC5652_CMS_RULES;
+
+/** @internal The RFC 3161 profile is the shortest of the three, for the reason the CMS one is
+ *  short: `schema.tsp.parseToken` refuses nearly everything sec. 2.4.2 requires of a token before a
+ *  rule sees it, each with its own code. A token that is not a CMS SignedData, encapsulates
+ *  something other than id-ct-TSTInfo, carries detached content, carries more than the TSA's own
+ *  signerInfo, or omits the SigningCertificate attribute the section requires arrives as
+ *  `lint/unparseable`. The TSTInfo version reader admits v1 alone, and the Accuracy field bounds,
+ *  the DEFAULT FALSE omissions and the PKIStatus range are all enforced too. */
+var TSP_SERIAL_MAX_BITS = 160;
+
+/** @internal The tsa hint as a DECODED GeneralName. The TSTInfo keeps it raw, and the shared
+ *  GeneralNames decoder is what the rest of this file reads a name with, so the hint is wrapped in
+ *  a one-element SEQUENCE and walked through it rather than compared as bytes: two encodings of one
+ *  distinguished name are the same name, and an error-severity row must not say otherwise. */
+function _tspDecodedHint(hint) {
+  if (!hint || !Buffer.isBuffer(hint.bytes)) return null;
+  var names = _generalNamesOf(asn1.build.sequence([asn1.build.raw(hint.bytes)]));
+  return (names && names.length === 1) ? names[0] : null;
+}
+/** @internal Every GeneralName the certificate's subjectAltName carries, decoded, each entry
+ *  keeping the raw TLV beside its value so a form with no useful decoded form can still be
+ *  compared. */
+function _tspSanNames(parsedCert) {
+  var raw = null;
+  (parsedCert.extensions || []).forEach(function (e) {
+    if (e.oid === oid.byName("subjectAltName")) raw = e.value;
+  });
+  if (!Buffer.isBuffer(raw)) return [];
+  return _generalNamesOf(raw) || [];
+}
+/** @internal Each form of GeneralName carrying text is compared under the RFC 5280 sec. 7 rule for
+ *  that form, and each rule lives in `guard.name` so this row and the AC target comparison read one
+ *  definition. A dNSName is case-insensitive throughout (sec. 7.2). A mailbox is not: sec. 7.5 has
+ *  the local part match exactly and the host part match without regard to ASCII case. A URI is not
+ *  either: sec. 7.4 prepares both values, lowercasing only the scheme and host, and then calls for a
+ *  "case-sensitive exact match". Folding case over a whole mailbox or URI read two names differing
+ *  only in a local part or a path as one, so a hint naming neither went unreported.
+ *  A verdict of null says the rule reached none, which the caller reports as nothing rather than as a
+ *  mismatch it did not establish. */
+function _tspSameGeneralName(a, c) {
+  if (!a || !c || a.tagNumber !== c.tagNumber) return false;
+  if (typeof a.value === "string" && typeof c.value === "string") {
+    if (a.tagNumber === 2) return guard.name.lowerAscii(a.value) === guard.name.lowerAscii(c.value);
+    if (a.tagNumber === 1 || a.tagNumber === 6) {
+      var verdict = a.tagNumber === 1 ? guard.name.emailEqual(a.value, c.value)
+        : guard.name.uriEqual(a.value, c.value);
+      if (verdict === "match") return true;
+      if (verdict === "no-match") return false;
+      /** @internal A value neither rule can read is compared as its own encoding, which answers the
+       * one case that is certain: identical bytes are one name. */
+      return a.value === c.value ? true : null;
+    }
+  }
+  if (Buffer.isBuffer(a.value) && Buffer.isBuffer(c.value)) return a.value.equals(c.value);
+  /** @internal Anything else, including an otherName's structure and a form this profile leaves
+   * undecoded, is compared as its own encoding: two decoded structures would compare by identity
+   * and never match, and two undecoded ones both read as null and would compare equal. */
+  return Buffer.isBuffer(a.bytes) && Buffer.isBuffer(c.bytes) && a.bytes.equals(c.bytes);
+}
+/** @internal "one of the subject names included in the certificate", which is the subject AND
+ *  every subjectAltName entry: the clause says names, plural, and a hint the subject does not
+ *  carry but an alternative name does is one of them. A directoryName is compared under the
+ *  RFC 5280 sec. 7.1 rules wherever it appears, since two encodings of one distinguished name are
+ *  one name; any other form is compared as its exact encoding. */
+/** @internal The certificate the token names as the one "to be used to verify the token", or null
+ *  when the token does not carry it. Carrying ONE certificate is not that fact: a token may embed an
+ *  intermediate and leave the signer's certificate to be supplied out of band, and comparing a hint
+ *  against an intermediate reports a conforming token. Which certificate it is comes from the ESS
+ *  certHash the schema module resolves, because that value names exactly one certificate while the
+ *  SignerInfo sid names none uniquely. */
+function _tspSignerCertificate(token) {
+  var der = tspSchema.signerCertificateDer(token);
+  if (der === null) return null;
+  // allow:swallow-unverified an element this profile cannot read as a certificate names no subject, so the row passes over the token as it does when the signer is absent
+  try { return x509.parse(der); } catch (_e) { return null; }
+}
+function _tspHintMatchesCert(hint, parsedCert) {
+  var decoded = _tspDecodedHint(hint);
+  if (decoded === null) return false;
+  if (decoded.tagNumber === 4 && _sameName(decoded.value, parsedCert.subject)) return true;
+  var san = _tspSanNames(parsedCert), undecided = false;
+  for (var i = 0; i < san.length; i++) {
+    if (decoded.tagNumber === 4) {
+      if (san[i].tagNumber === 4 && _sameName(decoded.value, san[i].value)) return true;
+      continue;
+    }
+    var verdict = _tspSameGeneralName(decoded, san[i]);
+    if (verdict === true) return true;
+    if (verdict === null) undecided = true;
+  }
+  /** @internal A name the comparison rule could not read leaves the row with no verdict on this
+   * certificate, which is reported as nothing rather than as the mismatch it did not establish. */
+  return undecided ? null : false;
+}
+
+var RFC3161_TSP_RULES = [
+  {
+    id: "lint/rfc3161/tsa-name-mismatch", severity: "error", source: "rfc3161", citation: "RFC 3161 2.4.2",
+    /** @internal "The purpose of the tsa field is to give a hint in identifying the name of the
+     * TSA. If present, it MUST correspond to one of the subject names included in the certificate
+     * that is to be used to verify the token."
+     * WHICH certificate verifies the token is what the SignerInfo's own identifier names, so the
+     * row resolves it rather than assuming the token carries one certificate and that it is the
+     * signer's. A token that leaves the signer's certificate to be supplied out of band is passed
+     * over, which is the honest edge of reading a hint against bytes that do not hold the answer. */
+    message: "the tsa hint names a subject the signer's own certificate does not carry",
+    appliesTo: function (token) {
+      return !!(token.tstInfo && token.tstInfo.tsa) && _tspSignerCertificate(token) !== null;
+    },
+    check: function (token) {
+      var signerCert = _tspSignerCertificate(token);
+      if (signerCert === null) return null;
+      var hint = token.tstInfo.tsa;
+      if (_tspHintMatchesCert(hint, signerCert) !== false) return null;
+      return { context: { tagNumber: hint.tagNumber } };
+    },
+  },
+  {
+    id: "lint/rfc3161/serial-over-160-bits", severity: "warn", source: "rfc3161", citation: "RFC 3161 2.4.2",
+    /** @internal "Time-Stamping users MUST be ready to accommodate integers up to 160 bits", which
+     * is what a conforming consumer owes and therefore all a TSA may count on. */
+    message: "the serial number is wider than the 160 bits a conforming consumer must accommodate",
+    appliesTo: function (token) { return typeof token.tstInfo.serialNumber === "bigint"; },
+    check: function (token) {
+      var n = token.tstInfo.serialNumber;
+      var magnitude = n < 0n ? -n : n;
+      var bits = magnitude === 0n ? 0 : magnitude.toString(2).length;
+      return bits > TSP_SERIAL_MAX_BITS ? { context: { bits: bits } } : null;
+    },
+  },
+  {
+    id: "lint/rfc3161/accuracy-absent", severity: "notice", source: "rfc3161", citation: "RFC 3161 2.4.2",
+    /** @internal "When the accuracy optional field is not present, then the accuracy may be
+     * available through other means, e.g., the TSAPolicyId." So its absence is conformant and
+     * leaves whoever must order two tokens reading the policy instead. */
+    message: "the token states no accuracy, so bounding its genTime needs the TSA policy instead",
+    check: function (token) {
+      return (token.tstInfo.accuracy === null || token.tstInfo.accuracy === undefined) ? true : null;
+    },
+  },
+];
+
+var TSP_PROFILES = Object.assign(Object.create(null), { "rfc3161": RFC3161_TSP_RULES });
+var ALL_TSP_RULES = RFC3161_TSP_RULES;
+
+/** @internal Sec. 4.3's six and the ProxyInfo of sec. 7.2, read from the schema module's row set
+ *  rather than restated here, so the criticality this profile reports, the one the AC signer writes
+ *  and the deviation the extension door reports cannot disagree. The keys are also what this profile
+ *  means by membership, which the outside-profile rule below reads. */
+var AC_FIXED_CRITICALITY = acSchema.extensionCriticality(oid);
+
+/** @internal The parser has already refused sec. 4.2's structural MUSTs by the time a rule sees an
+ *  attribute certificate: the version being v2, the issuer being a v2Form carrying one non-empty
+ *  directoryName with no baseCertificateID or objectDigestInfo beside it, a serial that is not a
+ *  positive integer or runs past 20 octets, a repeated attribute type, an empty attribute sequence,
+ *  and a GeneralizedTime carrying no seconds or a fraction. Those reach an operator as
+ *  `lint/unparseable` with the parser's code, or are refused by the builder first. */
+var RFC5755_AC_RULES = [
+  {
+    id: "lint/rfc5755/extension-criticality", severity: "error", source: "rfc5755", citation: "RFC 5755 4.3",
+    message: "an extension this profile defines does not carry the criticality its clause states",
+    check: function (ac) {
+      var out = [];
+      (ac.extensions || []).forEach(function (x) {
+        var row = AC_FIXED_CRITICALITY[x.oid];
+        if (!row) return;
+        if (x.critical !== row.critical) {
+          out.push({ context: { extension: row.name, clause: row.clause, critical: x.critical === true } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5755/critical-extension-outside-profile", severity: "error", source: "rfc5755", citation: "RFC 5755 4.2.9",
+    /** @internal "If any other critical extension is used, the AC does not conform to this
+     * profile." What counts as "other" is membership in the PROFILE, which is the table above:
+     * sec. 4.3's six and the ProxyInfo of sec. 7.2. Whether this toolkit happens to decode a value
+     * is a different question and answers it wrongly in both directions, since the AC decoder also
+     * reads AAControls, which sec. 7.4 places in "CA and AC issuer PKCs" rather than in an
+     * attribute certificate. A non-critical extension outside the profile is conformant and draws
+     * nothing, which the clause says outright. */
+    message: "a critical extension this profile does not define makes the attribute certificate non-conforming",
+    check: function (ac) {
+      var out = [];
+      (ac.extensions || []).forEach(function (x) {
+        if (x.critical !== true) return;
+        if (AC_FIXED_CRITICALITY[x.oid]) return;
+        out.push({ context: { oid: x.oid, name: x.name || null } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5755/holder-multiple-options", severity: "warn", source: "rfc5755", citation: "RFC 5755 4.2.2",
+    /** @internal "where more than one option is used, there is a potential for confusion as to
+     * which option is 'normative', which is a 'hint' ... this specification RECOMMENDS that only
+     * one of the options be used in any given AC." A RECOMMENDS, so a warning. */
+    message: "the Holder names more than one option, which leaves which of them is normative unstated",
+    check: function (ac) {
+      var holder = ac.holder;
+      if (!holder) return null;
+      var named = [];
+      ["baseCertificateID", "entityName", "objectDigestInfo"].forEach(function (k) {
+        if (holder[k] !== null && holder[k] !== undefined) named.push(k);
+      });
+      return named.length > 1 ? { context: { options: named } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5755/holder-entity-name-multiple", severity: "warn", source: "rfc5755", citation: "RFC 5755 4.2.2",
+    /** @internal "In any other case where the Holder field uses the entityName option, only one name
+     * SHOULD be present." A SHOULD, so a warning. This counts the NAMES inside the one entityName
+     * option, which the sibling row above does not: that one counts how many of the three options
+     * the Holder names, and an entityName carrying several GeneralNames is still one option. */
+    message: "the Holder entityName carries more than one name, where this clause asks for one",
+    check: function (ac) {
+      var entity = ac.holder && ac.holder.entityName;
+      if (!entity || !Array.isArray(entity.names) || entity.names.length <= 1) return null;
+      return { context: { names: entity.names.length } };
+    },
+  },
+  {
+    id: "lint/rfc5755/holder-issuer-uid-present", severity: "warn", source: "rfc5755", citation: "RFC 5755 4.2.2",
+    /** @internal "The AC holder.baseCertificateID.issuerUID field MUST only be used if the holder's
+     * PKC contains an issuerUniqueID field." Whether the certificate the baseCertificateID names
+     * carries one is a fact about another certificate, so this reports below error and names the
+     * condition, the way the sec. 4.2.8 row does for the AC's own issuerUniqueID. The three sec. 4.2.2
+     * requirements that ARE answerable from these bytes are refused by the parser instead. */
+    message: "the Holder baseCertificateID carries an issuerUID, which this clause permits only where the certificate it names carries an issuerUniqueID",
+    check: function (ac) {
+      var base = ac.holder && ac.holder.baseCertificateID;
+      if (!base) return null;
+      return (base.issuerUID === null || base.issuerUID === undefined) ? null : true;
+    },
+  },
+  {
+    id: "lint/rfc5755/issuer-unique-id-present", severity: "warn", source: "rfc5755", citation: "RFC 5755 4.2.8",
+    /** @internal "This field MUST NOT be used unless it is also used in the AC issuer's PKC, in
+     * which case it MUST be used." Whether the issuer's own certificate carries one is a fact about
+     * another certificate, so the row reports below error and its message names the condition. */
+    message: "an issuerUniqueID is present, which this clause permits only where the AC issuer's own certificate carries one",
+    check: function (ac) {
+      return (ac.issuerUniqueID === null || ac.issuerUniqueID === undefined) ? null : true;
+    },
+  },
+];
+
+var AC_PROFILES = Object.assign(Object.create(null), { "rfc5755": RFC5755_AC_RULES });
+var ALL_AC_RULES = RFC5755_AC_RULES;
+
 
 /** @internal The extensions RFC 6960 and RFC 9654 place on a response, by the list each belongs
  * in. The nonce and the extended revoked definition are response extensions; the archive cutoff and
@@ -4970,12 +5601,13 @@ var PROFILES = Object.assign(Object.create(null), {
   "mozilla-root": MOZILLA_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "chrome-root": CHROME_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "microsoft-root": MICROSOFT_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "apple-root": APPLE_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
 var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
   .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES).concat(CABF_CS_RULES).concat(ETSI_QC_RULES)
   /** @internal The root-program rows are in the registry so `rules()` enumerates them, and stay
    * inert under the default set because each one asks whether the caller named the profile. */
-  .concat(MOZILLA_RULES).concat(CHROME_RULES).concat(MICROSOFT_RULES);
+  .concat(MOZILLA_RULES).concat(CHROME_RULES).concat(MICROSOFT_RULES).concat(APPLE_RULES);
 
 var CABF_TLS_CSR_RULES = CABF_TLS_RULES.filter(function (r) {
   return CABF_TLS_CSR_RULE_IDS.indexOf(r.id) !== -1;
@@ -5479,6 +6111,286 @@ function ocsp(input, opts) {
   return report;
 }
 
+var _CMS_OPTS = Object.assign(Object.create(null), { profile: 1, severity: 1 });
+var _CMS_CLAIM = ["contentType", "signerInfos", "encapContentInfo"];
+
+function _ingestCms(input) {
+  var der;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
+  else if (typeof input === "string") {
+    try { der = cmsSchema.pemDecode(input); }
+    catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER CMS ContentInfo", context: { code: e.code } } }; }
+  } else if (input !== null && typeof input === "object" && !guard.bytes.isByteSource(input)) {
+    return { cms: guard.parsed.fromTrustedSource(input, "cms", _CMS_CLAIM, function (src) {
+      if (!Buffer.isBuffer(src) && typeof src !== "string") throw _cfg("lint/bad-input", "pki.lint.cms input must be a parsed CMS ContentInfo, a DER Buffer, or a PEM string");
+      return cmsSchema.parse(src);
+    }, _cfg, "lint/bad-input",
+    "pki.lint.cms input must be its DER bytes, a PEM string, or an unmodified pki.schema.cms.parse result: the signed attribute bytes, the signature and the fields those bytes encode are separate properties of a parsed object, so a rebuilt structure could have them describe different messages") };
+  } else {
+    throw _cfg("lint/bad-input", "pki.lint.cms input must be a parsed CMS ContentInfo, a DER Buffer, or a PEM string");
+  }
+  try { return { cms: cmsSchema.parse(der) }; }
+  catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "RFC 5652", message: "input is not a well-formed CMS ContentInfo", context: { code: e.code } } }; }
+}
+
+/**
+ * @primitive  pki.lint.cms
+ * @signature  pki.lint.cms(pem | der | parsed, opts?) -> LintReport
+ * @since      0.8.26
+ * @status     stable
+ * @spec       RFC 5652
+ * @related    pki.lint.certificate, pki.lint.tsp, pki.schema.cms.parse, pki.cms.sign, pki.cms.verify
+ *
+ * Lint a CMS ContentInfo against the RFC 5652 profile. `input` is a PEM string (`CMS`), a DER
+ * `Buffer`, or an already-parsed `pki.schema.cms.parse` object. It returns the same `LintReport`
+ * shape `pki.lint.certificate` returns, and it never throws on the data path: bytes that are not a
+ * well-formed ContentInfo produce a single `fatal` finding `lint/unparseable` carrying the strict
+ * parser's own code. A content type other than signed-data carries no signerInfos, so every row is
+ * not applicable to it.
+ *
+ * The profile is short, and what makes it short is that the strict parser has already refused most
+ * of what sections 5 and 11 require. The SignedData and SignerInfo versions against their contents,
+ * signedAttrs being present when the content type is not id-data, the content-type and
+ * message-digest attributes and the binding of the first to eContentType, every attribute's
+ * cardinality and placement, a countersignature's own restrictions, and a time carrying no seconds,
+ * fractional seconds or a local offset all arrive as `lint/unparseable` with the parser's code.
+ *
+ * What the rows cover is what survives that: a signing-time naming a year from 1950 to 2049 encoded
+ * as GeneralizedTime where section 11.3 requires UTCTime, a signer whose digest algorithm the
+ * digestAlgorithms set does not list, a version 1 attribute certificate in the certificates field,
+ * and two structural notices, a SignedData carrying no signers and a detached signature whose
+ * content a verifier must be handed separately.
+ *
+ * Verifying a signature, resolving a signer to a certificate and checking a message digest are
+ * `pki.cms.verify`'s, and the certificates a message carries are linted with
+ * `pki.lint.certificate`.
+ *
+ * @opts  profile   `"rfc5652"`, which is also what the default runs. A certificate, CRL or OCSP
+ *                  profile name is refused rather than run against a message.
+ * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
+ *                  always reflect the complete, unfiltered result.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "Example Signer", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
+ *     extensions: { subjectKeyIdentifier: true } }, { key: key });
+ *   var der = await pki.cms.sign(Buffer.from("hello"), { cert: cert, key: key });
+ *   pki.lint.cms(der).findings.length;                                    // -> 0
+ *   pki.lint.cms(await pki.cms.sign(Buffer.from("hello"), { cert: cert, key: key }, { detached: true })).worst;
+ *                                                                         // -> "notice"
+ */
+function cms(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
+  guard.identifier.assertKnownKeys(opts, _CMS_OPTS, _cfg, "lint/bad-input",
+    "pki.lint.cms has an unknown option: ");
+  if (opts.severity != null && VALID_SEVERITY.indexOf(opts.severity) === -1) {
+    throw _cfg("lint/bad-severity", "unknown severity threshold \"" + opts.severity + "\" (known: " + VALID_SEVERITY.join(", ") + ")");
+  }
+  var profile = opts.profile;
+  var rules_;
+  if (profile == null || profile === "all" || profile === "default") rules_ = ALL_CMS_RULES;
+  else if (CMS_PROFILES[profile]) rules_ = CMS_PROFILES[profile];
+  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
+  else if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
+  else if (OCSP_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is an OCSP profile; lint a response with pki.lint.ocsp");
+  else throw _cfg("lint/unknown-profile", "unknown CMS lint profile \"" + profile + "\" (known: " + Object.keys(CMS_PROFILES).join(", ") + ")");
+
+  var ingested = _ingestCms(input);
+  var report;
+  if (ingested.fatal) {
+    report = { findings: [ingested.fatal], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
+  } else {
+    report = _runLints(rules_, ingested.cms, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
+  }
+  report.worst = _worst(report.findings);
+  report.findings = _applyThreshold(report, opts.severity);
+  return report;
+}
+
+var _TSP_OPTS = Object.assign(Object.create(null), { profile: 1, severity: 1 });
+
+function _ingestTsp(input) {
+  var der;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
+  else if (typeof input === "string") {
+    try { der = tspSchema.pemDecode(input); }
+    catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER timestamp token", context: { code: e.code } } }; }
+  } else {
+    throw _cfg("lint/bad-input", "pki.lint.tsp input must be a DER Buffer or a PEM string");
+  }
+  try { return { token: tspSchema.parseToken(der) }; }
+  catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "RFC 3161", message: "input is not a well-formed RFC 3161 timestamp token", context: { code: e.code } } }; }
+}
+
+/**
+ * @primitive  pki.lint.tsp
+ * @signature  pki.lint.tsp(pem | der, opts?) -> LintReport
+ * @since      0.8.26
+ * @status     stable
+ * @spec       RFC 3161
+ * @related    pki.lint.cms, pki.schema.tsp.parseToken, pki.tsp.sign, pki.tsp.verify
+ *
+ * Lint an RFC 3161 timestamp token against the section 2.4.2 profile. `input` is a PEM string or a
+ * DER `Buffer` holding a TimeStampToken, which is a CMS SignedData encapsulating a TSTInfo. It
+ * returns the same `LintReport` shape `pki.lint.certificate` returns and never throws on the data
+ * path: bytes that are not a well-formed token produce a single `fatal` finding `lint/unparseable`
+ * carrying the strict parser's own code.
+ *
+ * This profile is the shortest the toolkit ships, and the reason is that `pki.schema.tsp.parseToken`
+ * already refuses what the section requires. A token that is not a CMS SignedData, encapsulates
+ * something other than id-ct-TSTInfo, carries detached content, carries a signature other than the
+ * TSA's own, or omits the SigningCertificate attribute the section names arrives as
+ * `lint/unparseable` with the parser's code rather than as a row, and so do a TSTInfo version other
+ * than v1, an Accuracy field outside its stated bounds and a DEFAULT FALSE written out.
+ *
+ * What the rows cover is what survives that: a tsa hint naming a subject the signer's own
+ * certificate does not carry, a serial number wider than the 160 bits a conforming consumer must
+ * accommodate, and a token stating no accuracy. The tsa row resolves which certificate verifies the
+ * token from the SignerInfo's own identifier, and passes over a token that leaves that certificate
+ * to be supplied out of band.
+ *
+ * Verifying the signature, resolving the TSA certificate and comparing the imprint against content
+ * are `pki.tsp.verify`'s.
+ *
+ * @opts  profile   `"rfc3161"`, which is also what the default runs.
+ * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
+ *                  always reflect the complete, unfiltered result.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "Example TSA", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
+ *     extensions: { subjectKeyIdentifier: true, keyUsage: ["digitalSignature"],
+ *       extendedKeyUsage: ["timeStamping"], extendedKeyUsageCritical: true } }, { key: key });
+ *   var imprint = { hashAlgorithm: "sha256", hashedMessage: Buffer.alloc(32, 7) };
+ *   var token = await pki.tsp.sign(imprint, { cert: cert, key: key }, { policy: "1.2.3", serialNumber: 1 });
+ *   pki.lint.tsp(token).worst;       // -> "notice", since the token states no accuracy
+ */
+function tsp(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
+  guard.identifier.assertKnownKeys(opts, _TSP_OPTS, _cfg, "lint/bad-input",
+    "pki.lint.tsp has an unknown option: ");
+  if (opts.severity != null && VALID_SEVERITY.indexOf(opts.severity) === -1) {
+    throw _cfg("lint/bad-severity", "unknown severity threshold \"" + opts.severity + "\" (known: " + VALID_SEVERITY.join(", ") + ")");
+  }
+  var profile = opts.profile;
+  var rules_;
+  if (profile == null || profile === "all" || profile === "default") rules_ = ALL_TSP_RULES;
+  else if (TSP_PROFILES[profile]) rules_ = TSP_PROFILES[profile];
+  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
+  else if (CMS_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CMS profile; lint a message with pki.lint.cms");
+  else throw _cfg("lint/unknown-profile", "unknown timestamp lint profile \"" + profile + "\" (known: " + Object.keys(TSP_PROFILES).join(", ") + ")");
+
+  var ingested = _ingestTsp(input);
+  var report;
+  if (ingested.fatal) {
+    report = { findings: [ingested.fatal], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
+  } else {
+    report = _runLints(rules_, ingested.token, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
+  }
+  report.worst = _worst(report.findings);
+  report.findings = _applyThreshold(report, opts.severity);
+  return report;
+}
+
+var _AC_OPTS = Object.assign(Object.create(null), { profile: 1, severity: 1 });
+
+function _ingestAttrCert(input) {
+  var der;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
+  else if (typeof input === "string") {
+    try { der = acSchema.pemDecode(input); }
+    catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER attribute certificate", context: { code: e.code } } }; }
+  } else {
+    throw _cfg("lint/bad-input", "pki.lint.attrcert input must be a DER Buffer or a PEM string");
+  }
+  try { return { ac: acSchema.parse(der) }; }
+  catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "RFC 5755", message: "input is not a well-formed X.509 attribute certificate", context: { code: e.code } } }; }
+}
+
+/**
+ * @primitive  pki.lint.attrcert
+ * @signature  pki.lint.attrcert(pem | der, opts?) -> LintReport
+ * @since      0.8.26
+ * @status     stable
+ * @spec       RFC 5755
+ * @related    pki.lint.certificate, pki.schema.attrcert.parse, pki.attrcert.sign, pki.attrcert.verify
+ *
+ * Lint an X.509 attribute certificate against the RFC 5755 profile. `input` is a PEM string
+ * (`ATTRIBUTE CERTIFICATE`) or a DER `Buffer`. It returns the same `LintReport` shape
+ * `pki.lint.certificate` returns and never throws on the data path: bytes that are not a
+ * well-formed attribute certificate produce a single `fatal` finding `lint/unparseable` carrying
+ * the strict parser's own code.
+ *
+ * Section 4.2's structural requirements are already refused at parse and so carry no rows: the
+ * version being v2, the issuer being a v2Form carrying one non-empty directoryName with no
+ * baseCertificateID or objectDigestInfo beside it, a serial that is not a positive integer or runs
+ * past 20 octets, a repeated attribute type, an empty attribute sequence, a GeneralizedTime carrying
+ * no seconds or a fractional part, and a Holder baseCertificateID whose issuer is anything other than
+ * one non-empty directoryName, which section 4.2.2 requires in the same words section 4.2.3 uses for
+ * the issuer.
+ *
+ * The rows are the clauses left, which are the ones these bytes cannot settle alone or that state a
+ * recommendation rather than a requirement: the criticality section 4.3 fixes for each extension it
+ * defines and the ProxyInfo of section 7.2, a critical extension the profile does not define, a
+ * Holder naming more than one of its three options, a Holder entityName carrying more than one name,
+ * a Holder baseCertificateID issuerUID, and an issuerUniqueID. The last two are permitted only where
+ * another certificate carries the matching field, so each is a warning naming that condition.
+ * Section 4.2.2's remaining requirements are about the public-key certificate the Holder names rather
+ * than about this one, so no row can answer them.
+ *
+ * Verifying the signature and resolving the holder against a public-key certificate are
+ * `pki.attrcert.verify`'s.
+ *
+ * @opts  profile   `"rfc5755"`, which is also what the default runs.
+ * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
+ *                  always reflect the complete, unfiltered result.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "CN=Alice" } },
+ *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
+ *     attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
+ *     { name: "CN=Example AA", publicKey: await pki.key.export(pair.publicKey), key: key });
+ *   pki.lint.attrcert(der).findings.length;       // -> 0 for a conforming attribute certificate
+ */
+function attrcert(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
+  guard.identifier.assertKnownKeys(opts, _AC_OPTS, _cfg, "lint/bad-input",
+    "pki.lint.attrcert has an unknown option: ");
+  if (opts.severity != null && VALID_SEVERITY.indexOf(opts.severity) === -1) {
+    throw _cfg("lint/bad-severity", "unknown severity threshold \"" + opts.severity + "\" (known: " + VALID_SEVERITY.join(", ") + ")");
+  }
+  var profile = opts.profile;
+  var rules_;
+  if (profile == null || profile === "all" || profile === "default") rules_ = ALL_AC_RULES;
+  else if (AC_PROFILES[profile]) rules_ = AC_PROFILES[profile];
+  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
+  else if (CMS_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CMS profile; lint a message with pki.lint.cms");
+  else throw _cfg("lint/unknown-profile", "unknown attribute certificate lint profile \"" + profile + "\" (known: " + Object.keys(AC_PROFILES).join(", ") + ")");
+
+  var ingested = _ingestAttrCert(input);
+  var report;
+  if (ingested.fatal) {
+    report = { findings: [ingested.fatal], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
+  } else {
+    report = _runLints(rules_, ingested.ac, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
+  }
+  report.worst = _worst(report.findings);
+  report.findings = _applyThreshold(report, opts.severity);
+  return report;
+}
+
 /**
  * @primitive  pki.lint.rules
  * @signature  pki.lint.rules(profile?, artifact?) -> [{id, severity, source, citation}]
@@ -5504,6 +6416,7 @@ function ocsp(input, opts) {
  *  literal would answer for "constructor" and the rest of Object.prototype. */
 var BY_ARTIFACT = Object.assign(Object.create(null), {
   certificate: PROFILES, csr: CSR_PROFILES, crl: CRL_PROFILES, ocsp: OCSP_PROFILES,
+  cms: CMS_PROFILES, tsp: TSP_PROFILES, attrcert: AC_PROFILES,
 });
 
 function rules(profile, artifact) {
@@ -5525,7 +6438,8 @@ function rules(profile, artifact) {
       BY_ARTIFACT[artifact][name].forEach(function (r) { set.push(r); });
     });
   } else if (profile == null) {
-    set = ALL_RULES.concat(ALL_CRL_RULES).concat(ALL_OCSP_RULES).concat(ALL_CSR_RULES);
+    set = ALL_RULES.concat(ALL_CRL_RULES).concat(ALL_OCSP_RULES).concat(ALL_CSR_RULES)
+      .concat(ALL_CMS_RULES).concat(ALL_TSP_RULES).concat(ALL_AC_RULES);
   } else if (artifact != null) {
     set = BY_ARTIFACT[artifact][profile];
     if (!set) {
@@ -5533,7 +6447,9 @@ function rules(profile, artifact) {
         " lint profile (known: " + Object.keys(BY_ARTIFACT[artifact]).join(", ") + ")");
     }
   } else {
-    set = PROFILES[profile] || CRL_PROFILES[profile] || OCSP_PROFILES[profile] || CSR_PROFILES[profile];
+    set = PROFILES[profile] || CRL_PROFILES[profile] || OCSP_PROFILES[profile] ||
+      CSR_PROFILES[profile] || CMS_PROFILES[profile] || TSP_PROFILES[profile] ||
+      AC_PROFILES[profile];
     if (!set) throw _cfg("lint/unknown-profile", "unknown lint profile \"" + profile + "\"");
   }
   /** @internal One row per id: a rule reused across artifacts, like the RFC 5280 sec. 4.2
@@ -5555,16 +6471,29 @@ function rules(profile, artifact) {
  * @status     stable
  * @spec       RFC 5280, RFC 9881, RFC 9909, RFC 9935, CA/Browser Forum TLS BR
  *
- * List the known lint-profile names.
+ * List the known lint-profile names. The two names every verb reads as naming no profile, `"all"`
+ * and `"default"`, are not among them.
  * @example
- *   pki.lint.profiles();   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "rfc5280-crl", "rfc6960", "rfc5019"]
+ *   pki.lint.profiles();
+ *   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "cabf-smime", "cabf-cs",
+ *   //     "etsi-qc", "mozilla-root", "chrome-root", "microsoft-root", "apple-root", "rfc2986",
+ *   //     "rfc5280-crl", "rfc6960", "rfc5019", "rfc5652", "rfc3161", "rfc5755"]
  */
 /** @internal `cabf-tls` names the certificate profile in this list and is not repeated for the
  *  request form: `pki.lint.csr` takes the same name and runs those rows against what a request
  *  asks for, so one name means one set of requirements whichever artifact carries it. */
+/** @internal Enumerated from the SAME registry-of-registries `rules()` dispatches on, so a profile a
+ *  verb can run is a profile this answers with. Naming the registries here instead left the three
+ *  profiles added with the CMS, timestamp and attribute-certificate verbs undiscoverable while
+ *  `rules()` returned their rows, and a fourth verb would have repeated it. The order follows
+ *  BY_ARTIFACT's, and a name reachable under two artifacts is listed once. */
 function profiles() {
-  var out = Object.keys(PROFILES).concat(Object.keys(CRL_PROFILES)).concat(Object.keys(OCSP_PROFILES));
-  Object.keys(CSR_PROFILES).forEach(function (name) { if (out.indexOf(name) === -1) out.push(name); });
+  var out = [];
+  Object.keys(BY_ARTIFACT).forEach(function (artifact) {
+    Object.keys(BY_ARTIFACT[artifact]).forEach(function (name) {
+      if (out.indexOf(name) === -1) out.push(name);
+    });
+  });
   return out;
 }
 
@@ -5573,6 +6502,9 @@ module.exports = {
   csr: csr,
   crl: crl,
   ocsp: ocsp,
+  cms: cms,
+  tsp: tsp,
+  attrcert: attrcert,
   rules: rules,
   profiles: profiles,
 };