@blamejs/pki 0.8.25 → 0.8.27

package/lib/lint.js

@@ -36,10 +36,14 @@ var x509 = require("./schema-x509");
 var crlSchema = require("./schema-crl");
 var csrSchema = require("./schema-csr");
 var ocspSchema = require("./schema-ocsp");
+var cmsSchema = require("./schema-cms");
+var tspSchema = require("./schema-tsp");
+var acSchema = require("./schema-attrcert");
 var pkix = require("./schema-pkix");
 var pkiBuild = require("./pki-build");
 var schema = require("./schema-engine");
 var path = require("./path-validate");
+var compositeSig = require("./composite-sig");
 var C = require("./constants");
 var ipUtils = require("./ip-utils");
 
@@ -3910,8 +3914,59 @@ function _pqcSigKeyUsageRule(id, source, citation, family, appliesTo) {
     check: _pqcSigKeyUsage,
   };
 }
+/** @internal The FIPS 204 public-key size of each ML-DSA parameter set, keyed by the identifier a
+ *  certificate names it with, read from the composite module's own table so one figure serves the
+ *  arms that sign with it and the row that reads it. */
+var ML_DSA_PK_LEN = Object.create(null);
+var ML_DSA_SIG_LEN = Object.create(null);
+Object.keys(compositeSig.MLDSA_COMPONENT).forEach(function (name) {
+  var row = compositeSig.MLDSA_COMPONENT[name];
+  ML_DSA_PK_LEN[oid.byName(row.oid)] = row.pk;
+  ML_DSA_SIG_LEN[oid.byName(row.oid)] = row.sig;
+});
+
 var RFC9881_RULES = [
   _pqcSigKeyUsageRule("lint/rfc9881/mldsa-key-usage", "rfc9881", "RFC 9881 5", "ML-DSA", _isMlDsa),
+  {
+    id: "lint/rfc9881/mldsa-key-length", severity: "error", source: "rfc9881",
+    citation: "RFC 9881 4 / FIPS 204",
+    /** @internal Sec. 4: the subjectPublicKey is "the raw octet string" of the ML-DSA public key, whose
+     * length FIPS 204 fixes per parameter set. An identifier names one set, so bytes of any other
+     * length are not the key the identifier claims, and the OID alone would accept them. The ML-KEM
+     * row beside this one reads its own sizes the same way. */
+    message: "an ML-DSA subjectPublicKey must be the raw public key at its exact FIPS 204 size for the OID, in a byte-aligned BIT STRING",
+    appliesTo: function (cert) {
+      var spki = cert.subjectPublicKeyInfo;
+      return !!(spki && spki.algorithm && ML_DSA_PK_LEN[spki.algorithm.oid] !== undefined);
+    },
+    check: function (cert) {
+      var spki = cert.subjectPublicKeyInfo;
+      var want = ML_DSA_PK_LEN[spki.algorithm.oid];
+      var pub = spki.publicKey;
+      return (guard.crypto.isOctetAligned(pub) && pub.bytes.length === want) ? null
+        : { context: { expected: want, got: pub.bytes.length, unusedBits: pub.unusedBits } };
+    },
+  },
+  {
+    id: "lint/rfc9881/mldsa-signature-length", severity: "error", source: "rfc9881",
+    citation: "RFC 9881 4 / FIPS 204",
+    /** @internal The signature is the FIPS 204 value carried directly in the BIT STRING, and FIPS 204
+     * fixes its length per parameter set as it fixes the public key's. So a signatureValue of any other
+     * length is not a signature of the algorithm the identifier names, whatever a verifier would later
+     * make of it, and reading the identifier alone accepted it. This reads the SIGNATURE algorithm
+     * rather than the subject key, since the two name different things about one certificate. */
+    message: "an ML-DSA signatureValue must be the signature at its exact FIPS 204 size for the OID, in a byte-aligned BIT STRING",
+    appliesTo: function (cert) {
+      var sig = cert.signatureAlgorithm;
+      return !!(sig && ML_DSA_SIG_LEN[sig.oid] !== undefined);
+    },
+    check: function (cert) {
+      var want = ML_DSA_SIG_LEN[cert.signatureAlgorithm.oid];
+      var value = cert.signatureValue;
+      return (guard.crypto.isOctetAligned(value) && value.bytes.length === want) ? null
+        : { context: { expected: want, got: value.bytes.length, unusedBits: value.unusedBits } };
+    },
+  },
 ];
 var RFC9909_RULES = [
   _pqcSigKeyUsageRule("lint/rfc9909/slhdsa-key-usage", "rfc9909", "RFC 9909 6", "SLH-DSA", _isSlhDsa),
@@ -4612,8 +4667,487 @@ var RFC5280_CRL_RULES = [
   },
 ];
 
-var CRL_PROFILES = Object.assign(Object.create(null), { "rfc5280-crl": RFC5280_CRL_RULES });
-var ALL_CRL_RULES = RFC5280_CRL_RULES;
+/** @internal Sec. 8: "The signatures on CRLs in this profile MUST follow the same rules from this
+ *  profile that apply to signatures in the certificates", and sec. 9 asks the same of an OCSP
+ *  response. It is ONE rule, so the row is written once and each artifact's registry takes it with the
+ *  reader its own parse result needs. The rule's citation names sec. 4 and 6.1, where the rule is,
+ *  beside the section that carries it here.
+ *  ONE IDENTIFIER ANSWERS FOR BOTH. Sec. 6.1 names the inner `signature` field of a TBSCertificate or
+ *  TBSCertList as well as the outer `signatureAlgorithm`, and both parsers refuse an artifact whose two
+ *  fields disagree, each as `<domain>/bad-signature-algorithm`. So by the time a row reads one, the other cannot differ, and a vector asserts that
+ *  verdict rather than a second row reading the same OID twice.
+ *  Sec. 6.2 sends the reader to RFC 9881 for the signature value, whose length FIPS 204 fixes per
+ *  parameter set, and that document's own row reports one of another length wherever it runs.
+ *  Sec. 9's second requirement, RFC 6960 sec. 4.2.2.2, is responder authorization, which is a trust
+ *  decision over a chain rather than a property of these bytes, and `pki.ocsp.verify` owns it. */
+function _cnsaSignatureRow(id, citation, reader) {
+  return {
+    id: id, severity: "error", source: "cnsa-2.0", citation: citation,
+    message: "the signature algorithm is not id-ml-dsa-87",
+    appliesTo: _isCnsa,
+    check: function (artifact) {
+      var sig = reader(artifact);
+      var o = sig && sig.oid;
+      return o === CNSA_ML_DSA_87 ? null : { context: { signatureAlgorithm: (sig && sig.name) || o } };
+    },
+  };
+}
+
+/** @internal The other half of the same sentence, for the two artifacts whose own registries carry no
+ *  RFC 9881 rows: FIPS 204 fixes the signature's length per parameter set, so a value of another length
+ *  is not a signature of the algorithm the identifier names. A certificate is told this by the RFC 9881
+ *  row its profile already runs, and a CRL and an OCSP response are told it here, because sec. 8 and
+ *  sec. 9 give them a certificate's signature rules and one of the two halves reached them. The value
+ *  arrives as a decoded BIT STRING from one parser and as its bytes from the other, so the reader each
+ *  registry passes returns the length and whether it is octet-aligned. */
+function _cnsaSignatureLengthRow(id, citation, algReader, lengthReader) {
+  return {
+    id: id, severity: "error", source: "cnsa-2.0", citation: citation,
+    message: "the signature is not the length FIPS 204 fixes for its algorithm",
+    appliesTo: function (artifact, ctx) {
+      var sig = algReader(artifact);
+      return _isCnsa(artifact, ctx) && !!(sig && ML_DSA_SIG_LEN[sig.oid] !== undefined);
+    },
+    check: function (artifact) {
+      var want = ML_DSA_SIG_LEN[algReader(artifact).oid];
+      var got = lengthReader(artifact);
+      return (got.aligned && got.length === want) ? null
+        : { context: { expected: want, got: got.length, unusedBits: got.unusedBits } };
+    },
+  };
+}
+function _crlSignatureAlgorithm(crl) { return crl.signatureAlgorithm; }
+var CNSA2_CRL_RULES = [
+  _cnsaSignatureRow("lint/cnsa-2.0/crl-signature-not-ml-dsa-87",
+    "draft-jenkins-cnsa2-pkix-profile-05 sec. 8 (sec. 4 / 6.1)", _crlSignatureAlgorithm),
+  _cnsaSignatureLengthRow("lint/cnsa-2.0/crl-signature-length",
+    "draft-jenkins-cnsa2-pkix-profile-05 sec. 8 (RFC 9881 4 / FIPS 204)", _crlSignatureAlgorithm,
+    function (crl) {
+      var v = crl.signatureValue;
+      return { length: v.bytes.length, unusedBits: v.unusedBits, aligned: guard.crypto.isOctetAligned(v) };
+    }),
+];
+
+var CRL_PROFILES = Object.assign(Object.create(null), {
+  "rfc5280-crl": RFC5280_CRL_RULES,
+  "cnsa-2.0": CNSA2_CRL_RULES,
+});
+var ALL_CRL_RULES = RFC5280_CRL_RULES.concat(CNSA2_CRL_RULES);
+
+/** @internal The RFC 5652 profile is SHORT, and the reason is worth stating where the rows are:
+ *  this toolkit's CMS parser already refuses nearly everything sections 5 and 11 require, so those
+ *  clauses reach an operator as `lint/unparseable` carrying the parser's own code rather than as a
+ *  row here. A row for one of them would be a branch no input can drive. Probed against the
+ *  shipped parser, the SignedData and SignerInfo versions, the presence of signedAttrs when the
+ *  content type is not id-data, the content-type and message-digest attributes and their binding
+ *  to eContentType, every attribute's cardinality and placement, a countersignature's own
+ *  restrictions, and a time carrying no seconds, fractional seconds or a local offset are all
+ *  refused before a rule sees them. What is left is below.
+ *  The UTCTime alternative of sec. 11.3 carries two year digits, which the clause reads as 19YY
+ *  for YY >= 50 and 20YY otherwise, so every UTCTime names a year inside 1950..2049 and only the
+ *  GeneralizedTime direction of that clause can be broken. */
+var OID_SIGNING_TIME = oid.byName("signingTime");
+var OID_SIGNED_DATA = oid.byName("signedData");
+
+/** @internal The content type decides which of these rows apply, and the parser sets `contentType`
+ *  as an own property on every content it builds. A content type that carries no signers has no own
+ *  `signerInfos`, so testing for that field answers from whatever the prototype chain holds. */
+function _isSignedData(cms) { return cms.contentType === OID_SIGNED_DATA; }
+var OID_COUNTERSIGNATURE = oid.byName("countersignature");
+/** @internal Every SignerInfo a message carries: its own signers, and the countersignatures their
+ *  unsigned attributes hold, which sec. 11.4 defines as SignerInfo values and which carry their own
+ *  signedAttrs. A rule about a signed attribute governs one wherever it appears, so a message
+ *  cannot put the shape a clause forbids one level down and escape it. The parser validates each
+ *  countersignature's shape without keeping the result, so it is decoded here, and a nested one is
+ *  reached by the same walk. */
+function _cmsAllSignerInfos(cms) {
+  var out = [];
+  /** @internal Each entry keeps the index of the message's OWN signer it hangs from, not a
+   *  position in this walk: a reader given a flattened index would look up a signer that is not
+   *  the one at fault, or one that does not exist. Whether the attribute sat on a countersignature
+   *  under that signer is the other half of the answer. */
+  function visit(signerInfos, signerIndex, isCounter, depth) {
+    if (!Array.isArray(signerInfos) || depth > C.LIMITS.CMS_MAX_COUNTERSIGNATURE_DEPTH) return;
+    signerInfos.forEach(function (si, i) {
+      var index = isCounter ? signerIndex : i;
+      out.push({ signerInfo: si, signerIndex: index, countersignature: isCounter });
+      (Array.isArray(si.unsignedAttrs) ? si.unsignedAttrs : []).forEach(function (attr) {
+        if (attr.type !== OID_COUNTERSIGNATURE) return;
+        if (!Array.isArray(attr.values)) return;
+        attr.values.forEach(function (value) {
+          var nested;
+          // allow:swallow-unverified the parser already walked this value, so a fault here leaves the countersignature unread rather than reported
+          try { nested = cmsSchema.walkCountersignature(asn1.decode(value), null); }
+          catch (_e) { return; }
+          if (nested) visit([nested], index, true, depth + 1);
+        });
+      });
+    });
+  }
+  visit(cms.signerInfos, 0, false, 0);
+  return out;
+}
+function _cmsSignedAttr(signerInfo, dotted) {
+  var attrs = signerInfo.signedAttrs;
+  if (!Array.isArray(attrs)) return null;
+  for (var i = 0; i < attrs.length; i++) {
+    if (attrs[i].type === dotted) return attrs[i];
+  }
+  return null;
+}
+/** @internal Whether two DIGEST AlgorithmIdentifiers name one algorithm, under RFC 5754 sec. 2. The
+ *  rule lives in the schema module because the set this row reads is also WRITTEN there, by the verb
+ *  that adds a countersigner's digest to it, and a set written under one rule and read under another
+ *  would list one algorithm twice. Only digest identifiers pass through here, so no row is loosened
+ *  for an algorithm whose parameters carry meaning. */
+var _cmsSameAlgorithm = cmsSchema.sameDigestAlgorithm;
+
+var RFC5652_CMS_RULES = [
+  {
+    id: "lint/rfc5652/signing-time-encoding", severity: "error", source: "rfc5652", citation: "RFC 5652 11.3",
+    /** @internal "Dates between 1 January 1950 and 31 December 2049 (inclusive) MUST be encoded as
+     * UTCTime. Any dates with year values before 1950 or after 2049 MUST be encoded as
+     * GeneralizedTime." The value is held as its DER bytes, so the encoding is the first byte and
+     * the year is what the value decodes to. */
+    message: "a signing-time naming a year from 1950 to 2049 must be encoded as UTCTime, not GeneralizedTime",
+    appliesTo: _isSignedData,
+    check: function (cms) {
+      var out = [];
+      _cmsAllSignerInfos(cms).forEach(function (entry) {
+        var attr = _cmsSignedAttr(entry.signerInfo, OID_SIGNING_TIME);
+        if (!attr || !Array.isArray(attr.values) || !attr.values.length) return;
+        var value = attr.values[0];
+        if (!Buffer.isBuffer(value) || value.length < 2) return;
+        if (value[0] !== asn1.TAGS.GENERALIZED_TIME) return;
+        var when;
+        // allow:swallow-unverified the parser already read this value as a Time, so a fault here answers for no signer
+        try { when = asn1.read.time(asn1.decode(value)); } catch (_e) { return; }
+        var year = when.getUTCFullYear();
+        if (year >= 1950 && year <= 2049) {
+          out.push({ context: { signerIndex: entry.signerIndex,
+            countersignature: entry.countersignature, year: year } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5652/signer-digest-not-listed", severity: "warn", source: "rfc5652", citation: "RFC 5652 5.3",
+    /** @internal "The message digest algorithm SHOULD be among those listed in the digestAlgorithms
+     * field of the associated SignerData. Implementations MAY fail to validate signatures that use
+     * a digest algorithm that is not included in the SignedData digestAlgorithms set." A SHOULD
+     * whose cost is a verifier that declines, so a warning.
+     * Sec. 11.4 makes a countersignature a SignerInfo and does not except it from this clause, and
+     * sec. 5.1 has the collection list the digests "employed by all of the signers", so the walk is
+     * the same one the signing-time rule uses and the finding says which signer it hangs from. */
+    message: "a signer's digest algorithm is not among those the SignedData digestAlgorithms set lists",
+    appliesTo: _isSignedData,
+    check: function (cms) {
+      var listed = Array.isArray(cms.digestAlgorithms) ? cms.digestAlgorithms : [];
+      var out = [];
+      _cmsAllSignerInfos(cms).forEach(function (entry) {
+        var mine = entry.signerInfo.digestAlgorithm;
+        if (!mine) return;
+        var found = listed.some(function (alg) { return _cmsSameAlgorithm(alg, mine); });
+        if (!found) {
+          out.push({ context: { signerIndex: entry.signerIndex, countersignature: entry.countersignature,
+            digestAlgorithm: mine.name || mine.oid } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5652/attribute-certificate-v1", severity: "warn", source: "rfc5652", citation: "RFC 5652 5.1",
+    /** @internal "The use of version 1 attribute certificates is strongly discouraged." The
+     * certificates field is a CertificateChoices SET, whose `[1]` alternative is the v1 attribute
+     * certificate; the parser keeps each element's outer tag for exactly this kind of question. */
+    message: "the certificates field carries a version 1 attribute certificate, whose use this section strongly discourages",
+    appliesTo: _isSignedData,
+    check: function (cms) {
+      var certs = Array.isArray(cms.certificates) ? cms.certificates : [];
+      var count = 0;
+      certs.forEach(function (c) {
+        if (c && c.tagClass === "context" && c.tagNumber === 1) count += 1;
+      });
+      return count ? { context: { count: count } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5652/no-signers", severity: "notice", source: "rfc5652", citation: "RFC 5652 5.1",
+    /** @internal "There MAY be any number of elements in the collection, including zero", so a
+     * SignedData with no signers is conformant. It is also a message carrying certificates and
+     * nothing signed, which is worth naming to whoever expected a signature. */
+    message: "the SignedData carries no signers, so it signs nothing and only conveys its certificates and revocation lists",
+    appliesTo: _isSignedData,
+    check: function (cms) { return cms.signerInfos.length === 0 ? true : null; },
+  },
+  {
+    id: "lint/rfc5652/detached-content", severity: "notice", source: "rfc5652", citation: "RFC 5652 5.2",
+    /** @internal eContent is optional, and its absence means a verifier must be handed the content
+     * by another route. The row reads a SignedData that HAS a signer, since the notice exists for
+     * whoever must verify one: a message with no signers has nothing to supply content for. */
+    message: "the SignedData is detached, so verifying it needs the content supplied separately",
+    appliesTo: function (cms) { return _isSignedData(cms) && cms.signerInfos.length > 0; },
+    check: function (cms) {
+      var encap = cms.encapContentInfo;
+      return (encap && encap.eContent) ? null : true;
+    },
+  },
+];
+
+var CMS_PROFILES = Object.assign(Object.create(null), { "rfc5652": RFC5652_CMS_RULES });
+var ALL_CMS_RULES = RFC5652_CMS_RULES;
+
+/** @internal The RFC 3161 profile is the shortest of the three, for the reason the CMS one is
+ *  short: `schema.tsp.parseToken` refuses nearly everything sec. 2.4.2 requires of a token before a
+ *  rule sees it, each with its own code. A token that is not a CMS SignedData, encapsulates
+ *  something other than id-ct-TSTInfo, carries detached content, carries more than the TSA's own
+ *  signerInfo, or omits the SigningCertificate attribute the section requires arrives as
+ *  `lint/unparseable`. The TSTInfo version reader admits v1 alone, and the Accuracy field bounds,
+ *  the DEFAULT FALSE omissions and the PKIStatus range are all enforced too. */
+var TSP_SERIAL_MAX_BITS = 160;
+
+/** @internal The tsa hint as a DECODED GeneralName. The TSTInfo keeps it raw, and the shared
+ *  GeneralNames decoder is what the rest of this file reads a name with, so the hint is wrapped in
+ *  a one-element SEQUENCE and walked through it rather than compared as bytes: two encodings of one
+ *  distinguished name are the same name, and an error-severity row must not say otherwise. */
+function _tspDecodedHint(hint) {
+  if (!hint || !Buffer.isBuffer(hint.bytes)) return null;
+  var names = _generalNamesOf(asn1.build.sequence([asn1.build.raw(hint.bytes)]));
+  return (names && names.length === 1) ? names[0] : null;
+}
+/** @internal Every GeneralName the certificate's subjectAltName carries, decoded, each entry
+ *  keeping the raw TLV beside its value so a form with no useful decoded form can still be
+ *  compared. */
+function _tspSanNames(parsedCert) {
+  var raw = null;
+  (parsedCert.extensions || []).forEach(function (e) {
+    if (e.oid === oid.byName("subjectAltName")) raw = e.value;
+  });
+  if (!Buffer.isBuffer(raw)) return [];
+  return _generalNamesOf(raw) || [];
+}
+/** @internal Each form of GeneralName carrying text is compared under the RFC 5280 sec. 7 rule for
+ *  that form, and each rule lives in `guard.name` so this row and the AC target comparison read one
+ *  definition. A dNSName is case-insensitive throughout (sec. 7.2). A mailbox is not: sec. 7.5 has
+ *  the local part match exactly and the host part match without regard to ASCII case. A URI is not
+ *  either: sec. 7.4 prepares both values, lowercasing only the scheme and host, and then calls for a
+ *  "case-sensitive exact match". Folding case over a whole mailbox or URI read two names differing
+ *  only in a local part or a path as one, so a hint naming neither went unreported.
+ *  A verdict of null says the rule reached none, which the caller reports as nothing rather than as a
+ *  mismatch it did not establish. */
+function _tspSameGeneralName(a, c) {
+  if (!a || !c || a.tagNumber !== c.tagNumber) return false;
+  if (typeof a.value === "string" && typeof c.value === "string") {
+    if (a.tagNumber === 2) return guard.name.lowerAscii(a.value) === guard.name.lowerAscii(c.value);
+    if (a.tagNumber === 1 || a.tagNumber === 6) {
+      var verdict = a.tagNumber === 1 ? guard.name.emailEqual(a.value, c.value)
+        : guard.name.uriEqual(a.value, c.value);
+      if (verdict === "match") return true;
+      if (verdict === "no-match") return false;
+      /** @internal A value neither rule can read is compared as its own encoding, which answers the
+       * one case that is certain: identical bytes are one name. */
+      return a.value === c.value ? true : null;
+    }
+  }
+  if (Buffer.isBuffer(a.value) && Buffer.isBuffer(c.value)) return a.value.equals(c.value);
+  /** @internal Anything else, including an otherName's structure and a form this profile leaves
+   * undecoded, is compared as its own encoding: two decoded structures would compare by identity
+   * and never match, and two undecoded ones both read as null and would compare equal. */
+  return Buffer.isBuffer(a.bytes) && Buffer.isBuffer(c.bytes) && a.bytes.equals(c.bytes);
+}
+/** @internal "one of the subject names included in the certificate", which is the subject AND
+ *  every subjectAltName entry: the clause says names, plural, and a hint the subject does not
+ *  carry but an alternative name does is one of them. A directoryName is compared under the
+ *  RFC 5280 sec. 7.1 rules wherever it appears, since two encodings of one distinguished name are
+ *  one name; any other form is compared as its exact encoding. */
+/** @internal The certificate the token names as the one "to be used to verify the token", or null
+ *  when the token does not carry it. Carrying ONE certificate is not that fact: a token may embed an
+ *  intermediate and leave the signer's certificate to be supplied out of band, and comparing a hint
+ *  against an intermediate reports a conforming token. Which certificate it is comes from the ESS
+ *  certHash the schema module resolves, because that value names exactly one certificate while the
+ *  SignerInfo sid names none uniquely. */
+function _tspSignerCertificate(token) {
+  var der = tspSchema.signerCertificateDer(token);
+  if (der === null) return null;
+  // allow:swallow-unverified an element this profile cannot read as a certificate names no subject, so the row passes over the token as it does when the signer is absent
+  try { return x509.parse(der); } catch (_e) { return null; }
+}
+function _tspHintMatchesCert(hint, parsedCert) {
+  var decoded = _tspDecodedHint(hint);
+  if (decoded === null) return false;
+  if (decoded.tagNumber === 4 && _sameName(decoded.value, parsedCert.subject)) return true;
+  var san = _tspSanNames(parsedCert), undecided = false;
+  for (var i = 0; i < san.length; i++) {
+    if (decoded.tagNumber === 4) {
+      if (san[i].tagNumber === 4 && _sameName(decoded.value, san[i].value)) return true;
+      continue;
+    }
+    var verdict = _tspSameGeneralName(decoded, san[i]);
+    if (verdict === true) return true;
+    if (verdict === null) undecided = true;
+  }
+  /** @internal A name the comparison rule could not read leaves the row with no verdict on this
+   * certificate, which is reported as nothing rather than as the mismatch it did not establish. */
+  return undecided ? null : false;
+}
+
+var RFC3161_TSP_RULES = [
+  {
+    id: "lint/rfc3161/tsa-name-mismatch", severity: "error", source: "rfc3161", citation: "RFC 3161 2.4.2",
+    /** @internal "The purpose of the tsa field is to give a hint in identifying the name of the
+     * TSA. If present, it MUST correspond to one of the subject names included in the certificate
+     * that is to be used to verify the token."
+     * WHICH certificate verifies the token is what the SignerInfo's own identifier names, so the
+     * row resolves it rather than assuming the token carries one certificate and that it is the
+     * signer's. A token that leaves the signer's certificate to be supplied out of band is passed
+     * over, which is the honest edge of reading a hint against bytes that do not hold the answer. */
+    message: "the tsa hint names a subject the signer's own certificate does not carry",
+    appliesTo: function (token) {
+      return !!(token.tstInfo && token.tstInfo.tsa) && _tspSignerCertificate(token) !== null;
+    },
+    check: function (token) {
+      var signerCert = _tspSignerCertificate(token);
+      if (signerCert === null) return null;
+      var hint = token.tstInfo.tsa;
+      if (_tspHintMatchesCert(hint, signerCert) !== false) return null;
+      return { context: { tagNumber: hint.tagNumber } };
+    },
+  },
+  {
+    id: "lint/rfc3161/serial-over-160-bits", severity: "warn", source: "rfc3161", citation: "RFC 3161 2.4.2",
+    /** @internal "Time-Stamping users MUST be ready to accommodate integers up to 160 bits", which
+     * is what a conforming consumer owes and therefore all a TSA may count on. */
+    message: "the serial number is wider than the 160 bits a conforming consumer must accommodate",
+    appliesTo: function (token) { return typeof token.tstInfo.serialNumber === "bigint"; },
+    check: function (token) {
+      var n = token.tstInfo.serialNumber;
+      var magnitude = n < 0n ? -n : n;
+      var bits = magnitude === 0n ? 0 : magnitude.toString(2).length;
+      return bits > TSP_SERIAL_MAX_BITS ? { context: { bits: bits } } : null;
+    },
+  },
+  {
+    id: "lint/rfc3161/accuracy-absent", severity: "notice", source: "rfc3161", citation: "RFC 3161 2.4.2",
+    /** @internal "When the accuracy optional field is not present, then the accuracy may be
+     * available through other means, e.g., the TSAPolicyId." So its absence is conformant and
+     * leaves whoever must order two tokens reading the policy instead. */
+    message: "the token states no accuracy, so bounding its genTime needs the TSA policy instead",
+    check: function (token) {
+      return (token.tstInfo.accuracy === null || token.tstInfo.accuracy === undefined) ? true : null;
+    },
+  },
+];
+
+var TSP_PROFILES = Object.assign(Object.create(null), { "rfc3161": RFC3161_TSP_RULES });
+var ALL_TSP_RULES = RFC3161_TSP_RULES;
+
+/** @internal Sec. 4.3's six and the ProxyInfo of sec. 7.2, read from the schema module's row set
+ *  rather than restated here, so the criticality this profile reports, the one the AC signer writes
+ *  and the deviation the extension door reports cannot disagree. The keys are also what this profile
+ *  means by membership, which the outside-profile rule below reads. */
+var AC_FIXED_CRITICALITY = acSchema.extensionCriticality(oid);
+
+/** @internal The parser has already refused sec. 4.2's structural MUSTs by the time a rule sees an
+ *  attribute certificate: the version being v2, the issuer being a v2Form carrying one non-empty
+ *  directoryName with no baseCertificateID or objectDigestInfo beside it, a serial that is not a
+ *  positive integer or runs past 20 octets, a repeated attribute type, an empty attribute sequence,
+ *  and a GeneralizedTime carrying no seconds or a fraction. Those reach an operator as
+ *  `lint/unparseable` with the parser's code, or are refused by the builder first. */
+var RFC5755_AC_RULES = [
+  {
+    id: "lint/rfc5755/extension-criticality", severity: "error", source: "rfc5755", citation: "RFC 5755 4.3",
+    message: "an extension this profile defines does not carry the criticality its clause states",
+    check: function (ac) {
+      var out = [];
+      (ac.extensions || []).forEach(function (x) {
+        var row = AC_FIXED_CRITICALITY[x.oid];
+        if (!row) return;
+        if (x.critical !== row.critical) {
+          out.push({ context: { extension: row.name, clause: row.clause, critical: x.critical === true } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5755/critical-extension-outside-profile", severity: "error", source: "rfc5755", citation: "RFC 5755 4.2.9",
+    /** @internal "If any other critical extension is used, the AC does not conform to this
+     * profile." What counts as "other" is membership in the PROFILE, which is the table above:
+     * sec. 4.3's six and the ProxyInfo of sec. 7.2. Whether this toolkit happens to decode a value
+     * is a different question and answers it wrongly in both directions, since the AC decoder also
+     * reads AAControls, which sec. 7.4 places in "CA and AC issuer PKCs" rather than in an
+     * attribute certificate. A non-critical extension outside the profile is conformant and draws
+     * nothing, which the clause says outright. */
+    message: "a critical extension this profile does not define makes the attribute certificate non-conforming",
+    check: function (ac) {
+      var out = [];
+      (ac.extensions || []).forEach(function (x) {
+        if (x.critical !== true) return;
+        if (AC_FIXED_CRITICALITY[x.oid]) return;
+        out.push({ context: { oid: x.oid, name: x.name || null } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/rfc5755/holder-multiple-options", severity: "warn", source: "rfc5755", citation: "RFC 5755 4.2.2",
+    /** @internal "where more than one option is used, there is a potential for confusion as to
+     * which option is 'normative', which is a 'hint' ... this specification RECOMMENDS that only
+     * one of the options be used in any given AC." A RECOMMENDS, so a warning. */
+    message: "the Holder names more than one option, which leaves which of them is normative unstated",
+    check: function (ac) {
+      var holder = ac.holder;
+      if (!holder) return null;
+      var named = [];
+      ["baseCertificateID", "entityName", "objectDigestInfo"].forEach(function (k) {
+        if (holder[k] !== null && holder[k] !== undefined) named.push(k);
+      });
+      return named.length > 1 ? { context: { options: named } } : null;
+    },
+  },
+  {
+    id: "lint/rfc5755/holder-entity-name-multiple", severity: "warn", source: "rfc5755", citation: "RFC 5755 4.2.2",
+    /** @internal "In any other case where the Holder field uses the entityName option, only one name
+     * SHOULD be present." A SHOULD, so a warning. This counts the NAMES inside the one entityName
+     * option, which the sibling row above does not: that one counts how many of the three options
+     * the Holder names, and an entityName carrying several GeneralNames is still one option. */
+    message: "the Holder entityName carries more than one name, where this clause asks for one",
+    check: function (ac) {
+      var entity = ac.holder && ac.holder.entityName;
+      if (!entity || !Array.isArray(entity.names) || entity.names.length <= 1) return null;
+      return { context: { names: entity.names.length } };
+    },
+  },
+  {
+    id: "lint/rfc5755/holder-issuer-uid-present", severity: "warn", source: "rfc5755", citation: "RFC 5755 4.2.2",
+    /** @internal "The AC holder.baseCertificateID.issuerUID field MUST only be used if the holder's
+     * PKC contains an issuerUniqueID field." Whether the certificate the baseCertificateID names
+     * carries one is a fact about another certificate, so this reports below error and names the
+     * condition, the way the sec. 4.2.8 row does for the AC's own issuerUniqueID. The three sec. 4.2.2
+     * requirements that ARE answerable from these bytes are refused by the parser instead. */
+    message: "the Holder baseCertificateID carries an issuerUID, which this clause permits only where the certificate it names carries an issuerUniqueID",
+    check: function (ac) {
+      var base = ac.holder && ac.holder.baseCertificateID;
+      if (!base) return null;
+      return (base.issuerUID === null || base.issuerUID === undefined) ? null : true;
+    },
+  },
+  {
+    id: "lint/rfc5755/issuer-unique-id-present", severity: "warn", source: "rfc5755", citation: "RFC 5755 4.2.8",
+    /** @internal "This field MUST NOT be used unless it is also used in the AC issuer's PKC, in
+     * which case it MUST be used." Whether the issuer's own certificate carries one is a fact about
+     * another certificate, so the row reports below error and its message names the condition. */
+    message: "an issuerUniqueID is present, which this clause permits only where the AC issuer's own certificate carries one",
+    check: function (ac) {
+      return (ac.issuerUniqueID === null || ac.issuerUniqueID === undefined) ? null : true;
+    },
+  },
+];
+
+var AC_PROFILES = Object.assign(Object.create(null), { "rfc5755": RFC5755_AC_RULES });
+var ALL_AC_RULES = RFC5755_AC_RULES;
 
 
 /** @internal The extensions RFC 6960 and RFC 9654 place on a response, by the list each belongs
@@ -5002,8 +5536,28 @@ var RFC5019_OCSP_RULES = [
   },
 ];
 
-var OCSP_PROFILES = Object.assign(Object.create(null), { "rfc6960": RFC6960_OCSP_RULES, "rfc5019": RFC5019_OCSP_RULES });
-var ALL_OCSP_RULES = RFC6960_OCSP_RULES.concat(RFC5019_OCSP_RULES);
+/** @internal Sec. 9: "an OCSP response MUST be signed conformant with Section 4", which is the rule
+ *  the certificate and CRL rows read, over the signature the basic response carries. */
+function _ocspSignatureAlgorithm(resp) { return _ocspBasic(resp).signatureAlgorithm; }
+var CNSA2_OCSP_RULES = [
+  _cnsaSignatureRow("lint/cnsa-2.0/response-signature-not-ml-dsa-87",
+    "draft-jenkins-cnsa2-pkix-profile-05 sec. 9 (sec. 4 / 6.1)", _ocspSignatureAlgorithm),
+  /** @internal The response parser surfaces the signature as its bytes, having read the BIT STRING, so
+   * there are no unused bits left to ask about and the length is the whole answer. */
+  _cnsaSignatureLengthRow("lint/cnsa-2.0/response-signature-length",
+    "draft-jenkins-cnsa2-pkix-profile-05 sec. 9 (RFC 9881 4 / FIPS 204)", _ocspSignatureAlgorithm,
+    function (resp) {
+      var sig = _ocspBasic(resp).signature;
+      return { length: sig.length, unusedBits: 0, aligned: true };
+    }),
+];
+
+var OCSP_PROFILES = Object.assign(Object.create(null), {
+  "rfc6960": RFC6960_OCSP_RULES,
+  "rfc5019": RFC5019_OCSP_RULES,
+  "cnsa-2.0": CNSA2_OCSP_RULES,
+});
+var ALL_OCSP_RULES = RFC6960_OCSP_RULES.concat(RFC5019_OCSP_RULES).concat(CNSA2_OCSP_RULES);
 
 /** @internal The extensions an issuer determines, which a request may carry and a CA does not take
  *  from one. subjectKeyIdentifier and authorityKeyIdentifier are computed from the keys, and the
@@ -5162,6 +5716,602 @@ var CABF_TLS_CSR_RULE_IDS = [
   "lint/cabf-tls/weak-key",
 ];
 
+/** @internal The dates NIST IR 8547 sets, read as whole years: "deprecated after 2030" and
+ *  "disallowed after 2035" name the years themselves, so each transition begins on 1 January of the
+ *  year that follows. The engine compares the certificate's own notBefore, which is the issuance date
+ *  the transition governs. */
+var NIST_DEPRECATED_FROM = new Date("2031-01-01T00:00:00Z");
+var NIST_DISALLOWED_FROM = new Date("2036-01-01T00:00:00Z");
+
+function _isNistTransition(cert, ctx) { return ctx.profile === "nist-pqc-transition"; }
+
+/** @internal An identifier the OID registry names that is NOT an algorithm either of a certificate's
+ *  two algorithm fields can carry, so no family is read onto it: a digest, an attribute carrying a key
+ *  length, a CMS content-encryption algorithm, a message authentication code, and the two
+ *  proof-of-possession algorithms. Each carries a family's word in its name and none is a signature or
+ *  a subject key. */
+var NIST_NOT_AN_ALGORITHM = Object.assign(Object.create(null), {
+  sha1: 1, rsaKeyLen: 1, rsaKeyTransport: 1, dhBasedMac: 1,
+  "id-alg-dhPOP": 1, "id-dhPop-static-HMAC-SHA1": 1, "id-alg-noSignature": 1,
+});
+
+/** @internal Which family of IR 8547's tables an algorithm belongs to. Table 2 lists RSA, ECDSA and
+ *  EdDSA; Table 4 lists finite-field DH and MQV, elliptic-curve DH and MQV, and RSA key transport.
+ *  `pqc` and `hybrid` mark what the transition moves TO, which no row reports, and an identifier the
+ *  registry does not name is undefined, which both rows also pass over.
+ *  THE ORDER IS THE MECHANISM. Each test is anchored at the start of the name or is an equality, and
+ *  the families whose names contain another family's word are claimed first, so by the time the RSA
+ *  test runs there is no `ecdsaWith` or `dsaWith` name left for it to take. A single unordered
+ *  substring test reads `ecdsaWithSHA256` as a DSA algorithm; a table of exact names owes an entry for
+ *  every spelling the registry knows, which is how `sha1WithRSAEncryption` came to be read as no family
+ *  at all; and the algorithm a VERIFIER resolves is a third question, since that table holds what this
+ *  toolkit will check a signature with and excludes SHA-1 by policy, so reading the family off it let
+ *  every SHA-1 signature past the disallowance date.
+ *  `lint-nist-transition.test.js` drives every identifier the registry names through the shipped verb,
+ *  so a family this fails to claim is reported by a test rather than by silence. */
+function _nistKindOf(alg) {
+  var name = alg && typeof alg.name === "string" ? alg.name : "";
+  if (name === "" || NIST_NOT_AN_ALGORITHM[name]) return undefined;
+  /** @internal A composite arm names a post-quantum algorithm AND a traditional one, so it is neither
+   * of the other answers. It is given its own, rather than sharing the undefined an unnamed identifier
+   * returns, so a reader can tell a deliberate exclusion from an omission. Both rows pass over it: the
+   * tables list pure families, and the same guidance endorses this construction for the transition
+   * these dates mark. */
+  if (name.indexOf("id-MLDSA") === 0 || name.indexOf("id-MLKEM") === 0) return "hybrid";
+  if (name.indexOf("ML-DSA") === 0 || name.indexOf("ML-KEM") === 0 || name.indexOf("SLH-DSA") === 0 ||
+    name.indexOf("id-ml-dsa-") === 0 || name.indexOf("id-ml-kem-") === 0 ||
+    name.indexOf("id-slh-dsa-") === 0 || name.indexOf("id-hash-") === 0) return "pqc";
+  /** @internal A key-agreement scheme names a key-derivation function for CMS rather than an algorithm
+   * a certificate declares, and its name opens with the family word. */
+  if (name.indexOf("dhSinglePass-") === 0) return undefined;
+  if (name === "ecPublicKey" || name.indexOf("ecdsaWith") === 0 ||
+    name === "X25519" || name === "X448") return "ecc";
+  if (name === "Ed25519" || name === "Ed448") return "eddsa";
+  if (name === "dsa" || name.indexOf("dsaWith") === 0 ||
+    name === "dhpublicnumber" || name === "dhKeyAgreement") return "ffc";
+  return _nistNameCarriesRsa(name) ? "ifc" : undefined;
+}
+
+/** @internal Whether a name carries the RSA family's word, asked only after every other family has
+ *  claimed its own names, so the one reading that made this ambiguous cannot arise. */
+function _nistNameCarriesRsa(name) {
+  var lower = guard.name.lowerAscii(name);
+  return lower.indexOf("rsa") !== -1;
+}
+/** @internal Whether a classification names one of the families the tables date. `pqc` and `hybrid` are
+ *  what the transition moves TO, and an unclassified name is one the registry does not know, so none of
+ *  the three is a family these rows report. */
+function _nistIsClassical(kind) {
+  return kind === "ifc" || kind === "ecc" || kind === "eddsa" || kind === "ffc";
+}
+
+/** @internal Every classical algorithm a certificate declares, as `{ field, kind, name }` per field.
+ *  Both fields are read because both outlive the issuance: a post-quantum subject key signed with a
+ *  classical algorithm still leaves a classical signature for a relying party to verify.
+ *  A COMPOSITE is passed over, in both fields. `path.signatureAlgorithmName` answers null for a
+ *  composite identifier because it names two algorithms, and a composite subject key carries the arm's
+ *  own name, which neither table lists. That is the reading the IR asks for rather than a gap: its
+ *  tables list pure families, and sec. 3 of the same document endorses hybrid and dual-algorithm
+ *  operation through the transition, so reporting the traditional half would report the construction
+ *  these dates exist to carry. */
+function _nistClassicalDeclarations(cert) {
+  var out = [];
+  var keyAlg = (cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.algorithm) || null;
+  var keyKind = _nistKindOf(keyAlg);
+  if (_nistIsClassical(keyKind)) {
+    out.push({ field: "subjectPublicKey", kind: keyKind, name: _spkiAlgName(cert) || (keyAlg && keyAlg.oid) });
+  }
+  var sigAlg = cert.signatureAlgorithm || null;
+  var sigKind = _nistKindOf(sigAlg);
+  if (_nistIsClassical(sigKind)) {
+    out.push({ field: "signature", kind: sigKind, name: (sigAlg && (sigAlg.name || sigAlg.oid)) });
+  }
+  return out;
+}
+
+/** @internal Whether a declared subject key sits at the 112-bit security strength, which is the level
+ *  the 2030 deprecation applies to. IR 8547 gives no mapping from a strength to a key size; SP 800-57
+ *  Part 1 Rev 5 Table 2 does: 112 bits is an RSA modulus of 2048, a finite-field group with L = 2048,
+ *  and a curve whose field is 224 to 255 bits. A key WEAKER than that level is weaker than the level
+ *  the clause deprecates, so it is reported by the same row rather than passed over. All three
+ *  families the tables list are read: an RSA modulus, an elliptic curve's field, and a finite-field
+ *  group's prime. Reading two of them left every DSA and Diffie-Hellman key silently outside the
+ *  deprecation the row promises.
+ *  EdDSA IS DELIBERATELY ABSENT. Ed25519's field is 255 bits, which SP 800-57's ECC column puts in the
+ *  112-bit row, so reading the two documents together would deprecate it after 2030. IR 8547's own
+ *  EdDSA row carries a 128-bit entry alone, with no 112-bit entry and no 2030 date, and this profile
+ *  cites IR 8547. A reader who reaches for SP 800-57 will find the other answer. */
+var NIST_112_ECC_FIELD_MAX = 255;
+function _nistAt112OrBelow(cert, declaration) {
+  var spki = cert.subjectPublicKeyInfo;
+  if (declaration.kind === "ifc") {
+    var bits = _rsaModulusBits(spki);
+    return bits !== null && bits <= 2048 ? { rsaBits: bits } : null;
+  }
+  if (declaration.kind === "ecc") {
+    /** @internal X25519 and X448 are read the way their signing siblings are. RFC 8410 encodes them as
+     * a raw coordinate with no format byte, so there is no SEC1 point to measure, and the field size
+     * SP 800-57's ECC column would place at the 112-bit level, 255 bits for X25519, is the same figure
+     * IR 8547's own EdDSA row answers at 128 bits. The profile follows IR 8547 for that family, so it
+     * follows it here, and both are reported by the 2036 row rather than this one. */
+    if (declaration.name === "X25519" || declaration.name === "X448") return null;
+    var field = _eccFieldBits(spki);
+    return (field !== null && field <= NIST_112_ECC_FIELD_MAX)
+      ? { curve: _ecCurveName(spki), fieldBits: field } : null;
+  }
+  if (declaration.kind === "ffc") {
+    var ffc = _ffcParameterBits(cert, spki);
+    if (ffc === null) return null;
+    /** @internal SP 800-57 Table 2 states the finite-field level as a PAIR, L = 2048 with N = 224 at
+     * 112 bits and L = 3072 with N = 256 at 128, so either parameter caps the strength: a group with
+     * a 3072-bit prime and a 224-bit subgroup is a 112-bit key. Reading the prime alone left that key
+     * outside the deprecation. A shape carrying no subgroup order settles the question on the prime,
+     * which is all it states. */
+    var atLevel = ffc.primeBits <= 2048 ||
+      (ffc.subgroupBits !== null && ffc.subgroupBits <= 224);
+    return atLevel ? { ffcPrimeBits: ffc.primeBits, ffcSubgroupBits: ffc.subgroupBits } : null;
+  }
+  return null;
+}
+
+/** @internal Where each finite-field parameter shape carries its subgroup order, as the index of the
+ *  INTEGER that holds it, or null for a shape that carries none. The prime is first in all three, and
+ *  the subgroup order is NOT: RFC 3279's `Dss-Parms ::= SEQUENCE { p, q, g }` puts it second, its
+ *  `DomainParameters ::= SEQUENCE { p, g, q OPTIONAL, j OPTIONAL, validationParms OPTIONAL }` third and
+ *  optional, and PKCS#3's `DHParameter ::= SEQUENCE { prime, base, privateValueLength OPTIONAL }`
+ *  states no subgroup at all. So the position is read per algorithm rather than by counting fields,
+ *  which would read a generator as a subgroup order. */
+var FFC_SUBGROUP_INDEX = Object.assign(Object.create(null), {
+  dsa: 1, dhpublicnumber: 2, dhKeyAgreement: null,
+});
+
+/** @internal A finite-field key's L and N, the pair SP 800-57 Table 2's FFC column is stated in, as
+ *  `{ primeBits, subgroupBits }` with `subgroupBits` null where the shape carries no subgroup order.
+ *  A parameters field this cannot read answers null, which leaves the row silent rather than reporting
+ *  a strength it did not establish. */
+function _ffcParameterBits(cert, spki) {
+  // allow:swallow-unverified the ingest door has already produced a parsed certificate, so this reads bytes the parser accepted and a shape it cannot read answers null
+  try {
+    var alg = spki.algorithm;
+    var params = alg && alg.parameters;
+    if (!Buffer.isBuffer(params)) return null;
+    var seq = asn1.decode(params);
+    if (!seq.children || !seq.children.length) return null;
+    var p = asn1.read.integer(seq.children[0]);
+    if (p <= 0n) return null;
+    var at = FFC_SUBGROUP_INDEX[alg.name];
+    var q = null;
+    var node = typeof at === "number" ? seq.children[at] : null;
+    if (node && node.tagClass === "universal" && node.tagNumber === asn1.TAGS.INTEGER) {
+      var read = asn1.read.integer(node);
+      if (read > 0n) q = read.toString(2).length;
+    }
+    return { primeBits: p.toString(2).length, subgroupBits: q };
+  } catch (_e) { return null; }
+}
+
+/** @internal The field size of a SEC1 elliptic-curve subject key, which is what SP 800-57 Table 2's ECC
+ *  column is stated in, read from THE KEY rather than from a table of curves. RFC 5480 sec. 2.2 encodes
+ *  the point as `0x04 || X || Y` with each coordinate padded to the field's whole octets, so its length
+ *  gives the field size for any curve, including the ones a table would have to list and the ones a
+ *  registry gains later. A table of curve names left every certificate on a curve nobody had added,
+ *  `sect233r1` and `brainpoolP224r1` among them, outside the deprecation.
+ *  ONLY AN `ecPublicKey` REACHES THIS. RFC 8410 encodes X25519 and X448 as a raw coordinate carrying no
+ *  format byte, so reading one here would read key material as a format and answer differently for two
+ *  keys of one algorithm; the caller answers for those two before calling.
+ *  A CERTIFICATE WHOSE NAMED CURVE AND POINT WIDTH DISAGREE is answered on its point, which is the
+ *  key's own size, and the disagreement itself is not this row's to report: the two fields state
+ *  different things and nothing here can say which the issuer meant. Such a key is not usable in any
+ *  case, since `pki.path.validate` refuses it as `path/bad-input` when it imports the key.
+ *  The answer is the field rounded up to whole octets, which is what the encoding states: a 521-bit
+ *  field is carried in 66 octets and reads as 528. That is exact for every curve whose field is a whole
+ *  number of octets and rounds away from the threshold for the rest, so the only field sizes it could
+ *  misread are 249 through 255, which no standard curve uses. */
+function _eccFieldBits(spki) {
+  var pk = spki && spki.publicKey && (spki.publicKey.bytes || spki.publicKey);
+  if (!Buffer.isBuffer(pk) || pk.length < 2) return null;
+  var form = pk[0];
+  if (form === 0x04) {
+    return (pk.length - 1) % 2 === 0 ? ((pk.length - 1) / 2) * 8 : null;
+  }
+  /** @internal RFC 5480 sec. 2.2 permits the compressed form, which carries one coordinate. */
+  if (form === 0x02 || form === 0x03) return (pk.length - 1) * 8;
+  return null;
+}
+
+var NIST_TRANSITION_RULES = [
+  {
+    id: "lint/nist-pqc-transition/classical-disallowed-after-2035", severity: "error",
+    source: "nist-pqc-transition", citation: "NIST IR 8547 ipd Table 2 / Table 4",
+    /** @internal Every classical family the two tables list is "Disallowed after 2035" at the
+     * parameter sets they list, so this row needs no strength mapping: whether the algorithm is one of
+     * those families is the whole question, and the registry answers it. */
+    message: "a classical algorithm is disallowed for a certificate issued after 2035",
+    appliesTo: _isNistTransition,
+    effectiveDate: NIST_DISALLOWED_FROM,
+    check: function (cert) {
+      var found = _nistClassicalDeclarations(cert);
+      return found.length ? found.map(function (d) {
+        return { context: { field: d.field, family: d.kind, algorithm: d.name } };
+      }) : null;
+    },
+  },
+  {
+    id: "lint/nist-pqc-transition/classical-deprecated-after-2030", severity: "warn",
+    source: "nist-pqc-transition", citation: "NIST IR 8547 ipd Table 2 / Table 4",
+    /** @internal The 112-bit rows are "Deprecated after 2030", which SP 800-131A and sec. 4.1 of the
+     * IR define as still usable with the risk accepted, so the severity is a warning where the 2035
+     * row is an error. Only the subject key's own parameters are readable here: a signature
+     * identifier names a hash and a family, not the issuer's key size, so the strength of the
+     * signing key is in the ISSUER's certificate rather than this one. */
+    message: "a classical algorithm at or below the 112-bit security strength is deprecated for a certificate issued after 2030",
+    appliesTo: _isNistTransition,
+    effectiveDate: NIST_DEPRECATED_FROM,
+    check: function (cert) {
+      var out = [];
+      _nistClassicalDeclarations(cert).forEach(function (d) {
+        if (d.field !== "subjectPublicKey") return;
+        var at = _nistAt112OrBelow(cert, d);
+        if (at) out.push({ context: Object.assign({ family: d.kind, algorithm: d.name }, at) });
+      });
+      return out.length ? out : null;
+    },
+  },
+];
+
+/** @internal The CNSA 2.0 suite, from `draft-jenkins-cnsa2-pkix-profile-05` (M. Jenkins, NSA-CCSS,
+ *  5 July 2026, Informational, obsoletes RFC 8603 if approved). The NSA notice lists algorithms; this
+ *  document states what a CERTIFICATE must carry, which is what a profile can read, so it is the
+ *  citation and it is cited as a draft. Sec. 3 fixes the suite: ML-DSA-87 for signing and ML-KEM-1024
+ *  for key establishment.
+ *  A certificate declares WHICH kind it is through its own subject public key, which is what makes the
+ *  end-entity key-usage rows readable.
+ *  THE PROFILE IS A PROFILE OF RFC 5280 (sec. 6), so a clause it prefixes "in adherence with
+ *  [RFC5280]" is RFC 5280's requirement as well. Where the document restates one as its own MUST, it
+ *  gets a row here, so an operator who names this profile alone still sees it; the default rule set
+ *  reports the RFC 5280 rows themselves. */
+var CNSA_ML_DSA_87 = oid.byName("id-ml-dsa-87");
+var CNSA_ML_KEM_1024 = oid.byName("id-ml-kem-1024");
+
+function _isCnsa(cert, ctx) { return ctx.profile === "cnsa-2.0"; }
+/** @internal Sec. 7.1 governs a SELF-SIGNED CA certificate, and sec. 7.2 every other CA. Matching
+ *  issuer and subject names make a certificate self-ISSUED, which is not the same thing: a CA reissued
+ *  in its own name under a new key carries both names and was signed by its predecessor, so sec. 7.2
+ *  governs it, and sec. 7.2 permits the pathLenConstraint sec. 7.1 forbids. The key identifiers
+ *  separate the two without a signature check, which this synchronous surface cannot make, and
+ *  `_selfSignedIdentifiers` is where that reading already lives. Reading the names alone reported a
+ *  rollover CA for a field its own section allows. */
+/** @internal Whether this certificate is one of the CA kinds sec. 7.1 and 7.2 govern. A basicConstraints
+ *  with cA set says so, and so does a keyUsage asserting keyCertSign: RFC 5280 sec. 4.2.1.3 requires the
+ *  cA boolean of any certificate whose keyUsage asserts that bit, so a certificate asserting it is
+ *  claiming to be a CA whether or not it carries the extension.
+ *  READING ONLY THE EXTENSION MADE ONE CLAUSE UNREPORTABLE. Both CA sections require basicConstraints by
+ *  name, and a certificate that omits it is exactly the one that breaks them; deciding the scope on that
+ *  same extension graded it as an end entity instead, so the operator saw extended-key-usage findings
+ *  written for a different kind of certificate and not the requirement it actually broke. An end entity
+ *  does not assert keyCertSign, so nothing that belongs to sec. 7.3 is drawn in by this. */
+function _cnsaIsCa(cert, ctx) {
+  if (ctx.isCaCert) return true;
+  var ku = ctx.decode("keyUsage");
+  return !!(ku && ku.value && ku.value.keyCertSign === true);
+}
+/** @internal Whether a self-ISSUED CA is one sec. 7.1 governs. A rollover CA reissued in its own name
+ *  under a new key names its predecessor's key in its authorityKeyIdentifier, and its own key in its
+ *  subjectKeyIdentifier, so the two identifiers DISAGREEING is what says sec. 7.2 governs it.
+ *  ANYTHING ELSE READS AS SELF-SIGNED, including a certificate that carries no subjectKeyIdentifier for
+ *  the comparison to read. That extension is one sec. 7.1 requires by name, so a certificate omitting it
+ *  is one this section is about, and letting its absence move the certificate to sec. 7.2 left it with no
+ *  finding at all. `_selfSignedIdentifiers` takes the opposite default, because the row that reads it
+ *  rests on having settled the question; here the stricter scope is the one that reports the omission.
+ *  THE RESIDUAL IS A ROLLOVER CA CARRYING NO authorityKeyIdentifier AT ALL, which reads as a root here
+ *  and so is not asked for the extension sec. 7.2 requires. The bytes do not settle it: a root omits
+ *  that extension legitimately, and RFC 5280 sec. 4.2.1.1 permits its absence only in a self-signed
+ *  certificate, which is the rule the rfc5280 rows report on their own. Inventing a rule that reported
+ *  every root for omitting an extension its own section does not ask for would be worse than the gap. */
+function _cnsaSelfIssuedIsRoot(cert, ctx) {
+  var aki = ctx.decode("authorityKeyIdentifier");
+  var kid = aki && aki.value ? aki.value.keyIdentifier : null;
+  if (!Buffer.isBuffer(kid)) return true;
+  var ski = ctx.decode("subjectKeyIdentifier");
+  if (!Buffer.isBuffer(ski && ski.value)) return true;
+  return kid.equals(ski.value);
+}
+function _cnsaSelfSignedCa(cert, ctx) {
+  return _isCnsa(cert, ctx) && _cnsaIsCa(cert, ctx) && _sameName(cert.issuer, cert.subject) &&
+    _cnsaSelfIssuedIsRoot(cert, ctx);
+}
+function _cnsaOtherCa(cert, ctx) {
+  return _isCnsa(cert, ctx) && _cnsaIsCa(cert, ctx) &&
+    !(_sameName(cert.issuer, cert.subject) && _cnsaSelfIssuedIsRoot(cert, ctx));
+}
+function _cnsaAnyCa(cert, ctx) { return _isCnsa(cert, ctx) && _cnsaIsCa(cert, ctx); }
+function _cnsaEndEntity(cert, ctx) { return _isCnsa(cert, ctx) && !_cnsaIsCa(cert, ctx); }
+
+/** @internal Which kind of CNSA certificate this is, from the subject public key sec. 4 fixes: an
+ *  ML-DSA-87 key makes it a signature certificate and an ML-KEM-1024 key a key-establishment one.
+ *  A key outside the suite has no kind, and the row that reports the key answers for it rather than
+ *  the rows that read a kind. */
+function _cnsaKind(cert) {
+  var spki = cert.subjectPublicKeyInfo;
+  var o = spki && spki.algorithm && spki.algorithm.oid;
+  if (o === CNSA_ML_DSA_87) return "signature";
+  if (o === CNSA_ML_KEM_1024) return "key-establishment";
+  return null;
+}
+
+/** @internal The nine bits RFC 5280 sec. 4.2.1.3 defines, so a closed set stated as "all other bits
+ *  MUST NOT be set" is read as the bits outside the named ones rather than as a boolean. */
+var CNSA_KEY_USAGE_BITS = ["digitalSignature", "nonRepudiation", "keyEncipherment",
+  "dataEncipherment", "keyAgreement", "keyCertSign", "cRLSign", "encipherOnly", "decipherOnly"];
+/** @internal Sec. 7.1 and 7.2 for a CA, sec. 7.3 for each kind of end entity. `required` must be set,
+ *  `optional` may be, and every other bit must not. */
+var CNSA_KEY_USAGE_SETS = Object.assign(Object.create(null), {
+  ca: { required: ["keyCertSign", "cRLSign"], optional: ["digitalSignature", "nonRepudiation"] },
+  signature: { required: ["digitalSignature"], optional: ["nonRepudiation"] },
+  "key-establishment": { required: ["keyEncipherment"], optional: [] },
+});
+/** @internal Every way one keyUsage departs from one of those sets, as a finding each: a required bit
+ *  that is not set and a bit outside the set that is. One finding per bit, because a certificate that
+ *  sets two forbidden bits has two faults and an operator fixing one would otherwise not see the
+ *  other. */
+function _cnsaKeyUsageFindings(ctx, setName) {
+  var set = CNSA_KEY_USAGE_SETS[setName];
+  var ku = ctx.decode("keyUsage");
+  if (!set || !ku || !ku.value) return null;
+  var v = ku.value, out = [];
+  set.required.forEach(function (bit) {
+    if (v[bit] !== true) out.push({ context: { bit: bit, fault: "required bit not set", set: setName } });
+  });
+  CNSA_KEY_USAGE_BITS.forEach(function (bit) {
+    if (v[bit] !== true) return;
+    if (set.required.indexOf(bit) !== -1 || set.optional.indexOf(bit) !== -1) return;
+    out.push({ context: { bit: bit, fault: "bit outside the set this profile fixes", set: setName } });
+  });
+  /** @internal "All other bits MUST NOT be set" reaches past the nine RFC 5280 sec. 4.2.1.3 names: a
+   * bit beyond them is one of the others. The decoder reports those as one flag rather than by
+   * position, so they are one finding. Reading only the nine left a certificate asserting them
+   * conforming under a clause that closes the set. */
+  if (v.reservedBitsSet === true) {
+    out.push({ context: { bit: "beyond the nine named positions", fault: "bit outside the set this profile fixes", set: setName } });
+  }
+  return out.length ? out : null;
+}
+
+/** @internal An extension this profile requires by name, reported one finding per absent one. The
+ *  shared syntax row answers for an extension whose value does not decode, so absence here is
+ *  absence. */
+function _cnsaMissingExtensions(ctx, names) {
+  var out = [];
+  names.forEach(function (name) {
+    if (!ctx.raw(name)) out.push({ context: { extension: name } });
+  });
+  return out.length ? out : null;
+}
+
+var CNSA2_RULES = [
+  {
+    id: "lint/cnsa-2.0/spki-not-suite", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 4 / 6.4",
+    /** @internal "Every CNSA Suite certificate MUST use the X.509 v3 format and contain one of the
+     * following as its subject public key: A ML-DSA-87 signature verification key. A ML-KEM-1024
+     * public encapsulation key." Sec. 6.4's "the contents of the parameters component ... MUST be
+     * absent" has no row: the shared AlgorithmIdentifier decoder refuses a present field on both
+     * OIDs, so an operator sees `x509/bad-algorithm-parameters` instead. */
+    message: "the subject public key is not one of the two the suite fixes (ML-DSA-87 or ML-KEM-1024)",
+    appliesTo: _isCnsa,
+    check: function (cert) {
+      return _cnsaKind(cert) === null
+        ? { context: { algorithm: _spkiAlgName(cert) || (cert.subjectPublicKeyInfo &&
+            cert.subjectPublicKeyInfo.algorithm && cert.subjectPublicKeyInfo.algorithm.oid) } }
+        : null;
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/version-not-3", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 6.3",
+    /** @internal "For this profile, the version field MUST be set to INTEGER value 0x02, indicating
+     * that the certificate conforms to X.509 version 3", which sec. 4 repeats as "Every CNSA Suite
+     * certificate MUST use the X.509 v3 format". A version 1 or 2 certificate carrying no extensions
+     * is well-formed and parses, since RFC 5280 sec. 4.1.2.1 puts the field at DEFAULT v1 and the
+     * parser refuses only an extensions field beneath those versions, so this clause needs a row. */
+    message: "a CNSA Suite certificate must be X.509 version 3",
+    appliesTo: _isCnsa,
+    check: function (cert) {
+      return cert.version === 3 ? null : { context: { version: cert.version } };
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/signature-not-ml-dsa-87", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 4 / 6.1",
+    /** @internal "The signature applied to all CNSA Suite certificates and CRLs MUST be made with a
+     * ML-DSA-87 signing key", and sec. 6.1 names id-ml-dsa-87 as the identifier for it. The same
+     * sentence that fixes the algorithm also says "HashML-DSA is not permitted", which this row
+     * reports without a second one: a HashML-DSA identifier is not id-ml-dsa-87. */
+    message: "the certificate signature algorithm is not id-ml-dsa-87",
+    appliesTo: _isCnsa,
+    check: function (cert) {
+      var sig = cert.signatureAlgorithm;
+      var o = sig && sig.oid;
+      return o === CNSA_ML_DSA_87 ? null : { context: { signatureAlgorithm: (sig && sig.name) || o } };
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/key-usage-not-critical", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1 / 7.2 / 7.3",
+    /** @internal "The keyUsage extension MUST be marked as critical", said in each of the three
+     * sections, so one row serves all three scopes rather than three saying the same thing. */
+    message: "the keyUsage extension must be marked critical",
+    appliesTo: _isCnsa,
+    check: function (cert, ctx) {
+      var ku = ctx.decode("keyUsage");
+      if (!ku) return null;
+      return ku.critical === true ? null : true;
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/self-signed-ca-missing-extension", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1",
+    /** @internal "self-signed CA certificates in this profile MUST contain the subjectKeyIdentifier,
+     * keyUsage, and basicConstraints extensions." All three are reported, including the third: the
+     * scope reads a keyUsage asserting keyCertSign as a CA as well, so a certificate that omits
+     * basicConstraints is still read here and told which extension it owes. */
+    message: "a self-signed CA certificate must carry this extension",
+    appliesTo: _cnsaSelfSignedCa,
+    check: function (cert, ctx) {
+      return _cnsaMissingExtensions(ctx, ["subjectKeyIdentifier", "keyUsage", "basicConstraints"]);
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/ca-missing-extension", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.2",
+    /** @internal "Non-self-signed CA Certificates in this profile MUST contain the
+     * authorityKeyIdentifier, keyUsage, and basicConstraints extensions." A self-signed one is
+     * governed by sec. 7.1 instead, which asks for a subjectKeyIdentifier rather than an authority
+     * one, so the two scopes carry their own rows and a certificate draws one set. */
+    message: "a non-self-signed CA certificate must carry this extension",
+    appliesTo: _cnsaOtherCa,
+    check: function (cert, ctx) {
+      return _cnsaMissingExtensions(ctx, ["authorityKeyIdentifier", "keyUsage", "basicConstraints"]);
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/ca-key-usage-bits", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1 / 7.2",
+    /** @internal "The keyCertSign and cRLSign bits MUST be set. The digitalSignature and
+     * nonRepudiation bits MAY be set. All other bits MUST NOT be set." Both CA sections say it. */
+    message: "a CA certificate's keyUsage departs from the bits this profile fixes",
+    appliesTo: _cnsaAnyCa,
+    check: function (cert, ctx) { return _cnsaKeyUsageFindings(ctx, "ca"); },
+  },
+  {
+    id: "lint/cnsa-2.0/basic-constraints-not-critical", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1 / 7.2",
+    /** @internal "the basicConstraints extension MUST be marked as critical", in both CA sections. */
+    message: "a CA certificate's basicConstraints extension must be marked critical",
+    appliesTo: _cnsaAnyCa,
+    check: function (cert, ctx) {
+      var bc = ctx.decode("basicConstraints");
+      if (!bc) return null;
+      return bc.critical === true ? null : true;
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/ca-boolean-not-set", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1 / 7.2",
+    /** @internal "The cA boolean MUST be set to indicate that the subject is a CA", in both CA
+     * sections. A certificate reaches this scope by carrying that boolean or by asserting keyCertSign,
+     * so the boolean CAN be read as unset here: a certificate whose keyUsage claims the CA role while
+     * its basicConstraints denies it says both things and breaks this clause. The absent extension is
+     * the missing-extension row's answer, so this one reads only an extension that is present. */
+    message: "a CA certificate's basicConstraints must set the cA boolean",
+    appliesTo: _cnsaAnyCa,
+    check: function (cert, ctx) {
+      var bc = ctx.decode("basicConstraints");
+      if (!bc || !bc.value) return null;
+      return bc.value.cA === true ? null : { context: { cA: bc.value.cA === true } };
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/self-signed-ca-path-len-present", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1",
+    /** @internal "the pathLenConstraint MUST NOT be present", for a self-signed CA alone: sec. 7.2
+     * calls the same field OPTIONAL for a non-self-signed one. */
+    message: "a self-signed CA certificate must not carry a pathLenConstraint",
+    appliesTo: _cnsaSelfSignedCa,
+    check: function (cert, ctx) {
+      var bc = ctx.decode("basicConstraints");
+      if (!bc || !bc.value) return null;
+      var n = bc.value.pathLenConstraint;
+      return (n === null || n === undefined) ? null : { context: { pathLenConstraint: n } };
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/end-entity-missing-extension", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.3",
+    /** @internal "end-entity certificates in this profile MUST contain the authorityKeyIdentifier
+     * and keyUsage extensions." */
+    message: "an end entity certificate must carry this extension",
+    appliesTo: _cnsaEndEntity,
+    check: function (cert, ctx) {
+      return _cnsaMissingExtensions(ctx, ["authorityKeyIdentifier", "keyUsage"]);
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/end-entity-no-subject-key-identifier", severity: "warn", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.3",
+    /** @internal "End-entity certificates SHOULD contain the subjectKeyIdentifier extension", which
+     * is a recommendation rather than a requirement, so the severity follows the clause. */
+    message: "an end entity certificate should carry a subjectKeyIdentifier extension",
+    appliesTo: _cnsaEndEntity,
+    check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },
+  },
+  {
+    id: "lint/cnsa-2.0/end-entity-key-usage-bits", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.3",
+    /** @internal Which bits are fixed follows the KIND the subject key declares: "For end-entity
+     * digital signature certificates, the keyUsage extension MUST be set for digitalSignature. The
+     * nonRepudiation bit MAY be set. All other bits ... MUST NOT be set. For end-entity key
+     * establishment certificates, the keyUsage extension MUST be set for keyEncipherment. All other
+     * bits ... MUST NOT be set." A key outside the suite has no kind and is reported by the subject
+     * key row instead, rather than being held to one of the two tables. */
+    message: "an end entity certificate's keyUsage departs from the bits this profile fixes for its key",
+    appliesTo: function (cert, ctx) { return _cnsaEndEntity(cert, ctx) && _cnsaKind(cert) !== null; },
+    check: function (cert, ctx) { return _cnsaKeyUsageFindings(ctx, _cnsaKind(cert)); },
+  },
+  {
+    id: "lint/cnsa-2.0/end-entity-eku-missing", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.3",
+    /** @internal "For all end-entity certificates, the extended key usage extension MUST be present
+     * to indicate the intended use of the certificate." The sentence that follows, "The intended use
+     * MUST be consistent with the keyUsage extension", has no row: which key purposes are consistent
+     * with which bits is not enumerated anywhere in the document, so a table here would be invented
+     * rather than cited. */
+    message: "an end entity certificate must carry an extKeyUsage extension",
+    appliesTo: _cnsaEndEntity,
+    check: function (cert, ctx) { return ctx.raw("extKeyUsage") ? null : true; },
+  },
+  {
+    id: "lint/cnsa-2.0/end-entity-eku-any", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.3",
+    /** @internal "The anyExtendedKeyUsage MUST NOT be asserted." */
+    message: "an end entity certificate's extKeyUsage must not name anyExtendedKeyUsage",
+    appliesTo: _cnsaEndEntity,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      return d.value.indexOf(oid.byName("anyExtendedKeyUsage")) !== -1 ? true : null;
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/certificate-policies-critical", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.2 / 7.3",
+    /** @internal "If a policy is asserted, the certificatePolicies extension MUST be marked as
+     * non-critical", said in both sections. The same sentence's "MUST contain the OIDs for the
+     * applicable certificate policies" is what RFC 5280 already requires of the syntax, and "If a
+     * policy is not asserted, the certificatePolicies extension MUST be omitted" cannot be read from
+     * the bytes: an extension that is present asserts a policy. Sec. 7.1 says neither of a
+     * self-signed CA, so this row leaves one alone. */
+    message: "a certificatePolicies extension must be marked non-critical",
+    appliesTo: function (cert, ctx) { return _cnsaOtherCa(cert, ctx) || _cnsaEndEntity(cert, ctx); },
+    check: function (cert, ctx) {
+      var cp = ctx.decode("certificatePolicies");
+      if (!cp) return null;
+      return cp.critical === true ? true : null;
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/certificate-policies-qualifiers", severity: "warn", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.2 / 7.3",
+    /** @internal "SHOULD NOT use the policyQualifiers option", a recommendation, so a warning. */
+    message: "a certificatePolicies extension should not carry policy qualifiers",
+    appliesTo: function (cert, ctx) { return _cnsaOtherCa(cert, ctx) || _cnsaEndEntity(cert, ctx); },
+    check: function (cert, ctx) {
+      var ids = _policyQualifierIds(ctx);
+      return ids.length ? { context: { qualifiers: ids } } : null;
+    },
+  },
+];
+
 /** @internal RFC 5280 sec. 4.2 fixes each extension's syntax wherever it is carried. Every row in
  *  every profile below asks for an extension BY NAME, and the shared decoder returns null both for
  *  one that is absent and for one whose value does not decode, so without this row a malformed
@@ -5184,12 +6334,25 @@ var PROFILES = Object.assign(Object.create(null), {
   "chrome-root": CHROME_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "microsoft-root": MICROSOFT_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "apple-root": APPLE_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "nist-pqc-transition": NIST_TRANSITION_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  /** @internal Sec. 4 of the draft names RFC 9881 and RFC 9935 for "the algorithm identifier, and the
+   *  syntax and semantics for the Subject Public Key Information field" of the two keys the suite
+   *  fixes, so those documents' subject-key rows ARE this profile's rules for them. Without them the
+   *  profile read the algorithm OID alone: bytes claiming to be an ML-KEM-1024 key while being the
+   *  wrong size for one are not the encapsulation key sec. 4 requires, and were reported as
+   *  conforming. The rows are reused rather than restated, so one clause has one row and one citation
+   *  wherever it is read. Their key-usage rows govern the same bits this profile's own rows do, at the
+   *  same strength, so a certificate breaking both is told twice from two documents rather than once
+   *  from a rule that quietly replaced the other. */
+  "cnsa-2.0": CNSA2_RULES.concat(RFC9881_RULES).concat(RFC9935_RULES)
+    .concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
 var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
   .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES).concat(CABF_CS_RULES).concat(ETSI_QC_RULES)
   /** @internal The root-program rows are in the registry so `rules()` enumerates them, and stay
    * inert under the default set because each one asks whether the caller named the profile. */
-  .concat(MOZILLA_RULES).concat(CHROME_RULES).concat(MICROSOFT_RULES).concat(APPLE_RULES);
+  .concat(MOZILLA_RULES).concat(CHROME_RULES).concat(MICROSOFT_RULES).concat(APPLE_RULES)
+  .concat(NIST_TRANSITION_RULES).concat(CNSA2_RULES);
 
 var CABF_TLS_CSR_RULES = CABF_TLS_RULES.filter(function (r) {
   return CABF_TLS_CSR_RULE_IDS.indexOf(r.id) !== -1;
@@ -5313,13 +6476,50 @@ function _ingestCsr(input) {
   catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "RFC 2986", message: "input is not a well-formed PKCS#10 certification request", context: { code: e.code } } }; }
 }
 
+/** @internal The noun each verb's refusal calls its own artifact. The keys are `BY_ARTIFACT`'s, and
+ *  each one is also its verb's name under `pki.lint`, so a message can name the verb from the key. */
+var ARTIFACT_NOUN = Object.assign(Object.create(null), {
+  certificate: "certificate", csr: "certification-request", crl: "CRL", ocsp: "OCSP",
+  cms: "CMS", tsp: "timestamp", attrcert: "attribute-certificate",
+});
+
+/** @internal The refusal a verb gives for a profile name it does not run, read from the SAME
+ *  registry-of-registries `rules` dispatches on. So a name carried by more than one artifact names
+ *  every verb that runs it, and every verb answers the same way about it. Each verb used to carry its
+ *  own chain of `else if`, naming one artifact per branch in a different order, which made the answer
+ *  for a name in two registries depend on which verb was asked, and each chain omitted the registries
+ *  nobody had added a branch for: a CMS profile name reached `pki.lint.crl` as simply unknown. */
+/** @internal "a" or "an" for a noun this file names, decided by the sound its first letter carries:
+ *  each of these nouns reads as a vowel exactly when it begins with one, since `CRL` and `CMS` are
+ *  read letter by letter and begin with a consonant sound. */
+function _article(noun) {
+  var c = noun.charAt(0);
+  return (c === "a" || c === "e" || c === "i" || c === "o" || c === "u" ||
+    c === "A" || c === "E" || c === "I" || c === "O" || c === "U") ? "an" : "a";
+}
+function _joinAnd(list) {
+  if (list.length <= 1) return list.join("");
+  return list.slice(0, -1).join(", ") + " and " + list[list.length - 1];
+}
+function _profileRefusal(profile, mine) {
+  var homes = Object.keys(BY_ARTIFACT).filter(function (a) {
+    return a !== mine && Object.prototype.hasOwnProperty.call(BY_ARTIFACT[a], profile);
+  });
+  var label = _article(ARTIFACT_NOUN[mine]) + " " + ARTIFACT_NOUN[mine] + " lint profile";
+  if (!homes.length) {
+    return _cfg("lint/unknown-profile", "unknown " + ARTIFACT_NOUN[mine] + " lint profile \"" +
+      profile + "\" (known: " + Object.keys(BY_ARTIFACT[mine]).join(", ") + ")");
+  }
+  var nouns = homes.map(function (a) { return ARTIFACT_NOUN[a]; });
+  var verbs = homes.map(function (a) { return "pki.lint." + a; });
+  return _cfg("lint/unknown-profile", "\"" + profile + "\" is not " + label + "; it is " +
+    _article(nouns[0]) + " " + _joinAnd(nouns) + " profile, which " + _joinAnd(verbs) +
+    (verbs.length === 1 ? " runs" : " run"));
+}
+
 function _selectRules(profile) {
   if (profile == null || profile === "all" || profile === "default") return ALL_RULES;
-  if (!PROFILES[profile]) {
-    if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
-    if (OCSP_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is an OCSP profile; lint a response with pki.lint.ocsp");
-    throw _cfg("lint/unknown-profile", "unknown lint profile \"" + profile + "\" (known: " + Object.keys(PROFILES).join(", ") + ")");
-  }
+  if (!PROFILES[profile]) throw _profileRefusal(profile, "certificate");
   return PROFILES[profile];
 }
 
@@ -5355,7 +6555,9 @@ function _applyThreshold(report, severity) {
  *                  a CA certificate reports that CA against subscriber requirements. The CA
  *                  profiles of section 7.1.2.10 are a separate set this does not yet carry. Left
  *                  unnamed, a certificate is held to those rows only where it asserts
- *                  id-kp-serverAuth and is not a CA.
+ *                  id-kp-serverAuth and is not a CA. `"nist-pqc-transition"` and `"cnsa-2.0"` are
+ *                  named the same way: which algorithm policy a certificate is held to is the
+ *                  caller's assertion, so neither is detected and both are inert until named.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and
  *                  `worst` always reflect the complete, unfiltered result.
  * @example
@@ -5454,8 +6656,10 @@ function _ingestCrl(input) {
  * extension repeated on the CRL or on an entry (section 4.2) each arrive as `lint/unparseable`
  * carrying the parser's own code.
  *
- * @opts  profile   `"rfc5280-crl"`, the only CRL profile (default runs every CRL rule). A
- *                  certificate profile name is refused rather than run against a CRL.
+ * @opts  profile   `"rfc5280-crl"`, or `"cnsa-2.0"` for the one rule that profile states about a
+ *                  CRL's signature (default runs every CRL rule, and the `cnsa-2.0` rule is inert
+ *                  unless named). A profile name this verb does not run is refused, and the refusal
+ *                  names the verb that does.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
  *                  always reflect the complete, unfiltered result.
  * @example
@@ -5528,10 +6732,7 @@ function csr(input, opts) {
   var rules_;
   if (profile == null || profile === "all" || profile === "default") rules_ = ALL_CSR_RULES;
   else if (CSR_PROFILES[profile]) rules_ = CSR_PROFILES[profile];
-  else if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
-  else if (OCSP_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is an OCSP profile; lint a response with pki.lint.ocsp");
-  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
-  else throw _cfg("lint/unknown-profile", "unknown certification-request lint profile \"" + profile + "\" (known: " + Object.keys(CSR_PROFILES).join(", ") + ")");
+  else throw _profileRefusal(profile, "csr");
 
   var ingested = _ingestCsr(input);
   var report;
@@ -5559,9 +6760,7 @@ function crl(input, opts) {
   var rules_;
   if (profile == null || profile === "all" || profile === "default") rules_ = ALL_CRL_RULES;
   else if (CRL_PROFILES[profile]) rules_ = CRL_PROFILES[profile];
-  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
-  else if (OCSP_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is an OCSP profile; lint a response with pki.lint.ocsp");
-  else throw _cfg("lint/unknown-profile", "unknown CRL lint profile \"" + profile + "\" (known: " + Object.keys(CRL_PROFILES).join(", ") + ")");
+  else throw _profileRefusal(profile, "crl");
 
   var ingested = _ingestCrl(input);
   var report;
@@ -5640,8 +6839,9 @@ function _ingestOcsp(input) {
  * is `pki.ocsp.verify`'s, and the certificates in `certs` are linted with `pki.lint.certificate`.
  *
  * @opts  profile   `"rfc6960"` or `"rfc5019"` (default runs the rfc6960 rows and marks the rfc5019
- *                  rows not applicable). A certificate or CRL profile name is refused rather than
- *                  run against a response.
+ *                  rows not applicable), or `"cnsa-2.0"` for the one rule that profile states about
+ *                  a response's signature. A profile name this verb does not run is refused, and the
+ *                  refusal names the verb that does.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
  *                  always reflect the complete, unfiltered result.
  * @example
@@ -5671,9 +6871,7 @@ function ocsp(input, opts) {
   var rules_;
   if (profile == null || profile === "all" || profile === "default") rules_ = ALL_OCSP_RULES;
   else if (OCSP_PROFILES[profile]) rules_ = OCSP_PROFILES[profile];
-  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
-  else if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
-  else throw _cfg("lint/unknown-profile", "unknown OCSP lint profile \"" + profile + "\" (known: " + Object.keys(OCSP_PROFILES).join(", ") + ")");
+  else throw _profileRefusal(profile, "ocsp");
 
   var ingested = _ingestOcsp(input);
   var report;
@@ -5693,6 +6891,279 @@ function ocsp(input, opts) {
   return report;
 }
 
+var _CMS_OPTS = Object.assign(Object.create(null), { profile: 1, severity: 1 });
+var _CMS_CLAIM = ["contentType", "signerInfos", "encapContentInfo"];
+
+function _ingestCms(input) {
+  var der;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
+  else if (typeof input === "string") {
+    try { der = cmsSchema.pemDecode(input); }
+    catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER CMS ContentInfo", context: { code: e.code } } }; }
+  } else if (input !== null && typeof input === "object" && !guard.bytes.isByteSource(input)) {
+    return { cms: guard.parsed.fromTrustedSource(input, "cms", _CMS_CLAIM, function (src) {
+      if (!Buffer.isBuffer(src) && typeof src !== "string") throw _cfg("lint/bad-input", "pki.lint.cms input must be a parsed CMS ContentInfo, a DER Buffer, or a PEM string");
+      return cmsSchema.parse(src);
+    }, _cfg, "lint/bad-input",
+    "pki.lint.cms input must be its DER bytes, a PEM string, or an unmodified pki.schema.cms.parse result: the signed attribute bytes, the signature and the fields those bytes encode are separate properties of a parsed object, so a rebuilt structure could have them describe different messages") };
+  } else {
+    throw _cfg("lint/bad-input", "pki.lint.cms input must be a parsed CMS ContentInfo, a DER Buffer, or a PEM string");
+  }
+  try { return { cms: cmsSchema.parse(der) }; }
+  catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "RFC 5652", message: "input is not a well-formed CMS ContentInfo", context: { code: e.code } } }; }
+}
+
+/**
+ * @primitive  pki.lint.cms
+ * @signature  pki.lint.cms(pem | der | parsed, opts?) -> LintReport
+ * @since      0.8.26
+ * @status     stable
+ * @spec       RFC 5652
+ * @related    pki.lint.certificate, pki.lint.tsp, pki.schema.cms.parse, pki.cms.sign, pki.cms.verify
+ *
+ * Lint a CMS ContentInfo against the RFC 5652 profile. `input` is a PEM string (`CMS`), a DER
+ * `Buffer`, or an already-parsed `pki.schema.cms.parse` object. It returns the same `LintReport`
+ * shape `pki.lint.certificate` returns, and it never throws on the data path: bytes that are not a
+ * well-formed ContentInfo produce a single `fatal` finding `lint/unparseable` carrying the strict
+ * parser's own code. A content type other than signed-data carries no signerInfos, so every row is
+ * not applicable to it.
+ *
+ * The profile is short, and what makes it short is that the strict parser has already refused most
+ * of what sections 5 and 11 require. The SignedData and SignerInfo versions against their contents,
+ * signedAttrs being present when the content type is not id-data, the content-type and
+ * message-digest attributes and the binding of the first to eContentType, every attribute's
+ * cardinality and placement, a countersignature's own restrictions, and a time carrying no seconds,
+ * fractional seconds or a local offset all arrive as `lint/unparseable` with the parser's code.
+ *
+ * What the rows cover is what survives that: a signing-time naming a year from 1950 to 2049 encoded
+ * as GeneralizedTime where section 11.3 requires UTCTime, a signer whose digest algorithm the
+ * digestAlgorithms set does not list, a version 1 attribute certificate in the certificates field,
+ * and two structural notices, a SignedData carrying no signers and a detached signature whose
+ * content a verifier must be handed separately.
+ *
+ * Verifying a signature, resolving a signer to a certificate and checking a message digest are
+ * `pki.cms.verify`'s, and the certificates a message carries are linted with
+ * `pki.lint.certificate`.
+ *
+ * @opts  profile   `"rfc5652"`, which is also what the default runs. A certificate, CRL or OCSP
+ *                  profile name is refused rather than run against a message.
+ * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
+ *                  always reflect the complete, unfiltered result.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "Example Signer", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
+ *     extensions: { subjectKeyIdentifier: true } }, { key: key });
+ *   var der = await pki.cms.sign(Buffer.from("hello"), { cert: cert, key: key });
+ *   pki.lint.cms(der).findings.length;                                    // -> 0
+ *   pki.lint.cms(await pki.cms.sign(Buffer.from("hello"), { cert: cert, key: key }, { detached: true })).worst;
+ *                                                                         // -> "notice"
+ */
+function cms(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
+  guard.identifier.assertKnownKeys(opts, _CMS_OPTS, _cfg, "lint/bad-input",
+    "pki.lint.cms has an unknown option: ");
+  if (opts.severity != null && VALID_SEVERITY.indexOf(opts.severity) === -1) {
+    throw _cfg("lint/bad-severity", "unknown severity threshold \"" + opts.severity + "\" (known: " + VALID_SEVERITY.join(", ") + ")");
+  }
+  var profile = opts.profile;
+  var rules_;
+  if (profile == null || profile === "all" || profile === "default") rules_ = ALL_CMS_RULES;
+  else if (CMS_PROFILES[profile]) rules_ = CMS_PROFILES[profile];
+  else throw _profileRefusal(profile, "cms");
+
+  var ingested = _ingestCms(input);
+  var report;
+  if (ingested.fatal) {
+    report = { findings: [ingested.fatal], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
+  } else {
+    report = _runLints(rules_, ingested.cms, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
+  }
+  report.worst = _worst(report.findings);
+  report.findings = _applyThreshold(report, opts.severity);
+  return report;
+}
+
+var _TSP_OPTS = Object.assign(Object.create(null), { profile: 1, severity: 1 });
+
+function _ingestTsp(input) {
+  var der;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
+  else if (typeof input === "string") {
+    try { der = tspSchema.pemDecode(input); }
+    catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER timestamp token", context: { code: e.code } } }; }
+  } else {
+    throw _cfg("lint/bad-input", "pki.lint.tsp input must be a DER Buffer or a PEM string");
+  }
+  try { return { token: tspSchema.parseToken(der) }; }
+  catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "RFC 3161", message: "input is not a well-formed RFC 3161 timestamp token", context: { code: e.code } } }; }
+}
+
+/**
+ * @primitive  pki.lint.tsp
+ * @signature  pki.lint.tsp(pem | der, opts?) -> LintReport
+ * @since      0.8.26
+ * @status     stable
+ * @spec       RFC 3161
+ * @related    pki.lint.cms, pki.schema.tsp.parseToken, pki.tsp.sign, pki.tsp.verify
+ *
+ * Lint an RFC 3161 timestamp token against the section 2.4.2 profile. `input` is a PEM string or a
+ * DER `Buffer` holding a TimeStampToken, which is a CMS SignedData encapsulating a TSTInfo. It
+ * returns the same `LintReport` shape `pki.lint.certificate` returns and never throws on the data
+ * path: bytes that are not a well-formed token produce a single `fatal` finding `lint/unparseable`
+ * carrying the strict parser's own code.
+ *
+ * This profile is the shortest the toolkit ships, and the reason is that `pki.schema.tsp.parseToken`
+ * already refuses what the section requires. A token that is not a CMS SignedData, encapsulates
+ * something other than id-ct-TSTInfo, carries detached content, carries a signature other than the
+ * TSA's own, or omits the SigningCertificate attribute the section names arrives as
+ * `lint/unparseable` with the parser's code rather than as a row, and so do a TSTInfo version other
+ * than v1, an Accuracy field outside its stated bounds and a DEFAULT FALSE written out.
+ *
+ * What the rows cover is what survives that: a tsa hint naming a subject the signer's own
+ * certificate does not carry, a serial number wider than the 160 bits a conforming consumer must
+ * accommodate, and a token stating no accuracy. The tsa row resolves which certificate verifies the
+ * token from the SignerInfo's own identifier, and passes over a token that leaves that certificate
+ * to be supplied out of band.
+ *
+ * Verifying the signature, resolving the TSA certificate and comparing the imprint against content
+ * are `pki.tsp.verify`'s.
+ *
+ * @opts  profile   `"rfc3161"`, which is also what the default runs.
+ * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
+ *                  always reflect the complete, unfiltered result.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "Example TSA", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
+ *     extensions: { subjectKeyIdentifier: true, keyUsage: ["digitalSignature"],
+ *       extendedKeyUsage: ["timeStamping"], extendedKeyUsageCritical: true } }, { key: key });
+ *   var imprint = { hashAlgorithm: "sha256", hashedMessage: Buffer.alloc(32, 7) };
+ *   var token = await pki.tsp.sign(imprint, { cert: cert, key: key }, { policy: "1.2.3", serialNumber: 1 });
+ *   pki.lint.tsp(token).worst;       // -> "notice", since the token states no accuracy
+ */
+function tsp(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
+  guard.identifier.assertKnownKeys(opts, _TSP_OPTS, _cfg, "lint/bad-input",
+    "pki.lint.tsp has an unknown option: ");
+  if (opts.severity != null && VALID_SEVERITY.indexOf(opts.severity) === -1) {
+    throw _cfg("lint/bad-severity", "unknown severity threshold \"" + opts.severity + "\" (known: " + VALID_SEVERITY.join(", ") + ")");
+  }
+  var profile = opts.profile;
+  var rules_;
+  if (profile == null || profile === "all" || profile === "default") rules_ = ALL_TSP_RULES;
+  else if (TSP_PROFILES[profile]) rules_ = TSP_PROFILES[profile];
+  else throw _profileRefusal(profile, "tsp");
+
+  var ingested = _ingestTsp(input);
+  var report;
+  if (ingested.fatal) {
+    report = { findings: [ingested.fatal], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
+  } else {
+    report = _runLints(rules_, ingested.token, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
+  }
+  report.worst = _worst(report.findings);
+  report.findings = _applyThreshold(report, opts.severity);
+  return report;
+}
+
+var _AC_OPTS = Object.assign(Object.create(null), { profile: 1, severity: 1 });
+
+function _ingestAttrCert(input) {
+  var der;
+  var bytes = _derBytesOf(input);
+  if (bytes !== null && bytes.fatal) return { fatal: bytes.fatal };
+  if (bytes !== null) der = bytes.der;
+  else if (typeof input === "string") {
+    try { der = acSchema.pemDecode(input); }
+    catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "pki.lint", message: "input is not a decodable PEM/DER attribute certificate", context: { code: e.code } } }; }
+  } else {
+    throw _cfg("lint/bad-input", "pki.lint.attrcert input must be a DER Buffer or a PEM string");
+  }
+  try { return { ac: acSchema.parse(der) }; }
+  catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "RFC 5755", message: "input is not a well-formed X.509 attribute certificate", context: { code: e.code } } }; }
+}
+
+/**
+ * @primitive  pki.lint.attrcert
+ * @signature  pki.lint.attrcert(pem | der, opts?) -> LintReport
+ * @since      0.8.26
+ * @status     stable
+ * @spec       RFC 5755
+ * @related    pki.lint.certificate, pki.schema.attrcert.parse, pki.attrcert.sign, pki.attrcert.verify
+ *
+ * Lint an X.509 attribute certificate against the RFC 5755 profile. `input` is a PEM string
+ * (`ATTRIBUTE CERTIFICATE`) or a DER `Buffer`. It returns the same `LintReport` shape
+ * `pki.lint.certificate` returns and never throws on the data path: bytes that are not a
+ * well-formed attribute certificate produce a single `fatal` finding `lint/unparseable` carrying
+ * the strict parser's own code.
+ *
+ * Section 4.2's structural requirements are already refused at parse and so carry no rows: the
+ * version being v2, the issuer being a v2Form carrying one non-empty directoryName with no
+ * baseCertificateID or objectDigestInfo beside it, a serial that is not a positive integer or runs
+ * past 20 octets, a repeated attribute type, an empty attribute sequence, a GeneralizedTime carrying
+ * no seconds or a fractional part, and a Holder baseCertificateID whose issuer is anything other than
+ * one non-empty directoryName, which section 4.2.2 requires in the same words section 4.2.3 uses for
+ * the issuer.
+ *
+ * The rows are the clauses left, which are the ones these bytes cannot settle alone or that state a
+ * recommendation rather than a requirement: the criticality section 4.3 fixes for each extension it
+ * defines and the ProxyInfo of section 7.2, a critical extension the profile does not define, a
+ * Holder naming more than one of its three options, a Holder entityName carrying more than one name,
+ * a Holder baseCertificateID issuerUID, and an issuerUniqueID. The last two are permitted only where
+ * another certificate carries the matching field, so each is a warning naming that condition.
+ * Section 4.2.2's remaining requirements are about the public-key certificate the Holder names rather
+ * than about this one, so no row can answer them.
+ *
+ * Verifying the signature and resolving the holder against a public-key certificate are
+ * `pki.attrcert.verify`'s.
+ *
+ * @opts  profile   `"rfc5755"`, which is also what the default runs.
+ * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
+ *                  always reflect the complete, unfiltered result.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "CN=Alice" } },
+ *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
+ *     attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
+ *     { name: "CN=Example AA", publicKey: await pki.key.export(pair.publicKey), key: key });
+ *   pki.lint.attrcert(der).findings.length;       // -> 0 for a conforming attribute certificate
+ */
+function attrcert(input, opts) {
+  opts = guard.identifier.optionsObject(opts, _cfg, "lint/bad-input", "pki.lint options");
+  guard.identifier.assertKnownKeys(opts, _AC_OPTS, _cfg, "lint/bad-input",
+    "pki.lint.attrcert has an unknown option: ");
+  if (opts.severity != null && VALID_SEVERITY.indexOf(opts.severity) === -1) {
+    throw _cfg("lint/bad-severity", "unknown severity threshold \"" + opts.severity + "\" (known: " + VALID_SEVERITY.join(", ") + ")");
+  }
+  var profile = opts.profile;
+  var rules_;
+  if (profile == null || profile === "all" || profile === "default") rules_ = ALL_AC_RULES;
+  else if (AC_PROFILES[profile]) rules_ = AC_PROFILES[profile];
+  else throw _profileRefusal(profile, "attrcert");
+
+  var ingested = _ingestAttrCert(input);
+  var report;
+  if (ingested.fatal) {
+    report = { findings: [ingested.fatal], ran: [],
+      counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
+  } else {
+    report = _runLints(rules_, ingested.ac, { profile: profile, decode: function () { return null; }, raw: function () { return null; } });
+  }
+  report.worst = _worst(report.findings);
+  report.findings = _applyThreshold(report, opts.severity);
+  return report;
+}
+
 /**
  * @primitive  pki.lint.rules
  * @signature  pki.lint.rules(profile?, artifact?) -> [{id, severity, source, citation}]
@@ -5718,6 +7189,7 @@ function ocsp(input, opts) {
  *  literal would answer for "constructor" and the rest of Object.prototype. */
 var BY_ARTIFACT = Object.assign(Object.create(null), {
   certificate: PROFILES, csr: CSR_PROFILES, crl: CRL_PROFILES, ocsp: OCSP_PROFILES,
+  cms: CMS_PROFILES, tsp: TSP_PROFILES, attrcert: AC_PROFILES,
 });
 
 function rules(profile, artifact) {
@@ -5739,15 +7211,17 @@ function rules(profile, artifact) {
       BY_ARTIFACT[artifact][name].forEach(function (r) { set.push(r); });
     });
   } else if (profile == null) {
-    set = ALL_RULES.concat(ALL_CRL_RULES).concat(ALL_OCSP_RULES).concat(ALL_CSR_RULES);
+    set = ALL_RULES.concat(ALL_CRL_RULES).concat(ALL_OCSP_RULES).concat(ALL_CSR_RULES)
+      .concat(ALL_CMS_RULES).concat(ALL_TSP_RULES).concat(ALL_AC_RULES);
   } else if (artifact != null) {
     set = BY_ARTIFACT[artifact][profile];
-    if (!set) {
-      throw _cfg("lint/unknown-profile", "\"" + profile + "\" is not a " + artifact +
-        " lint profile (known: " + Object.keys(BY_ARTIFACT[artifact]).join(", ") + ")");
-    }
+    /** @internal The same refusal the VERB for this artifact gives, so asking the enumerator where a
+     * profile lives and asking the verb to run it are answered by one sentence rather than two. */
+    if (!set) throw _profileRefusal(profile, artifact);
   } else {
-    set = PROFILES[profile] || CRL_PROFILES[profile] || OCSP_PROFILES[profile] || CSR_PROFILES[profile];
+    set = PROFILES[profile] || CRL_PROFILES[profile] || OCSP_PROFILES[profile] ||
+      CSR_PROFILES[profile] || CMS_PROFILES[profile] || TSP_PROFILES[profile] ||
+      AC_PROFILES[profile];
     if (!set) throw _cfg("lint/unknown-profile", "unknown lint profile \"" + profile + "\"");
   }
   /** @internal One row per id: a rule reused across artifacts, like the RFC 5280 sec. 4.2
@@ -5769,16 +7243,30 @@ function rules(profile, artifact) {
  * @status     stable
  * @spec       RFC 5280, RFC 9881, RFC 9909, RFC 9935, CA/Browser Forum TLS BR
  *
- * List the known lint-profile names.
+ * List the known lint-profile names. The two names every verb reads as naming no profile, `"all"`
+ * and `"default"`, are not among them.
  * @example
- *   pki.lint.profiles();   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "rfc5280-crl", "rfc6960", "rfc5019"]
+ *   pki.lint.profiles();
+ *   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "cabf-smime", "cabf-cs",
+ *   //     "etsi-qc", "mozilla-root", "chrome-root", "microsoft-root", "apple-root",
+ *   //     "nist-pqc-transition", "cnsa-2.0", "rfc2986", "rfc5280-crl", "rfc6960", "rfc5019",
+ *   //     "rfc5652", "rfc3161", "rfc5755"]
  */
 /** @internal `cabf-tls` names the certificate profile in this list and is not repeated for the
  *  request form: `pki.lint.csr` takes the same name and runs those rows against what a request
  *  asks for, so one name means one set of requirements whichever artifact carries it. */
+/** @internal Enumerated from the SAME registry-of-registries `rules()` dispatches on, so a profile a
+ *  verb can run is a profile this answers with. Naming the registries here instead left the three
+ *  profiles added with the CMS, timestamp and attribute-certificate verbs undiscoverable while
+ *  `rules()` returned their rows, and a fourth verb would have repeated it. The order follows
+ *  BY_ARTIFACT's, and a name reachable under two artifacts is listed once. */
 function profiles() {
-  var out = Object.keys(PROFILES).concat(Object.keys(CRL_PROFILES)).concat(Object.keys(OCSP_PROFILES));
-  Object.keys(CSR_PROFILES).forEach(function (name) { if (out.indexOf(name) === -1) out.push(name); });
+  var out = [];
+  Object.keys(BY_ARTIFACT).forEach(function (artifact) {
+    Object.keys(BY_ARTIFACT[artifact]).forEach(function (name) {
+      if (out.indexOf(name) === -1) out.push(name);
+    });
+  });
   return out;
 }
 
@@ -5787,6 +7275,9 @@ module.exports = {
   csr: csr,
   crl: crl,
   ocsp: ocsp,
+  cms: cms,
+  tsp: tsp,
+  attrcert: attrcert,
   rules: rules,
   profiles: profiles,
 };