@blamejs/pki 0.8.26 → 0.8.28

package/lib/lint.js

@@ -43,6 +43,7 @@ var pkix = require("./schema-pkix");
 var pkiBuild = require("./pki-build");
 var schema = require("./schema-engine");
 var path = require("./path-validate");
+var compositeSig = require("./composite-sig");
 var C = require("./constants");
 var ipUtils = require("./ip-utils");
 
@@ -362,6 +363,7 @@ function _criticalityRule(name, id, severity, citation, message) {
 var RFC5280_RULES = [
   {
     id: "lint/rfc5280/signature-empty", severity: "error", source: "rfc5280", citation: "RFC 5280 4.1.1.3",
+    readsSignatureValue: true,
     /** @internal The strict parser admits an empty BIT STRING, since one is well-formed DER; a
      * signatureValue that contains no signature is not the field section 4.1.1.3 defines. */
     message: "the signatureValue contains no signature",
@@ -3913,8 +3915,59 @@ function _pqcSigKeyUsageRule(id, source, citation, family, appliesTo) {
     check: _pqcSigKeyUsage,
   };
 }
+/** @internal The FIPS 204 public-key size of each ML-DSA parameter set, keyed by the identifier a
+ *  certificate names it with, read from the composite module's own table so one figure serves the
+ *  arms that sign with it and the row that reads it. */
+var ML_DSA_PK_LEN = Object.create(null);
+var ML_DSA_SIG_LEN = Object.create(null);
+Object.keys(compositeSig.MLDSA_COMPONENT).forEach(function (name) {
+  var row = compositeSig.MLDSA_COMPONENT[name];
+  ML_DSA_PK_LEN[oid.byName(row.oid)] = row.pk;
+  ML_DSA_SIG_LEN[oid.byName(row.oid)] = row.sig;
+});
+
 var RFC9881_RULES = [
   _pqcSigKeyUsageRule("lint/rfc9881/mldsa-key-usage", "rfc9881", "RFC 9881 5", "ML-DSA", _isMlDsa),
+  {
+    id: "lint/rfc9881/mldsa-key-length", severity: "error", source: "rfc9881",
+    citation: "RFC 9881 4 / FIPS 204",
+    /** @internal Sec. 4: the subjectPublicKey is "the raw octet string" of the ML-DSA public key, whose
+     * length FIPS 204 fixes per parameter set. An identifier names one set, so bytes of any other
+     * length are not the key the identifier claims, and the OID alone would accept them. The ML-KEM
+     * row beside this one reads its own sizes the same way. */
+    message: "an ML-DSA subjectPublicKey must be the raw public key at its exact FIPS 204 size for the OID, in a byte-aligned BIT STRING",
+    appliesTo: function (cert) {
+      var spki = cert.subjectPublicKeyInfo;
+      return !!(spki && spki.algorithm && ML_DSA_PK_LEN[spki.algorithm.oid] !== undefined);
+    },
+    check: function (cert) {
+      var spki = cert.subjectPublicKeyInfo;
+      var want = ML_DSA_PK_LEN[spki.algorithm.oid];
+      var pub = spki.publicKey;
+      return (guard.crypto.isOctetAligned(pub) && pub.bytes.length === want) ? null
+        : { context: { expected: want, got: pub.bytes.length, unusedBits: pub.unusedBits } };
+    },
+  },
+  {
+    id: "lint/rfc9881/mldsa-signature-length", severity: "error", source: "rfc9881",
+    citation: "RFC 9881 4 / FIPS 204", readsSignatureValue: true,
+    /** @internal The signature is the FIPS 204 value carried directly in the BIT STRING, and FIPS 204
+     * fixes its length per parameter set as it fixes the public key's. So a signatureValue of any other
+     * length is not a signature of the algorithm the identifier names, whatever a verifier would later
+     * make of it, and reading the identifier alone accepted it. This reads the SIGNATURE algorithm
+     * rather than the subject key, since the two name different things about one certificate. */
+    message: "an ML-DSA signatureValue must be the signature at its exact FIPS 204 size for the OID, in a byte-aligned BIT STRING",
+    appliesTo: function (cert) {
+      var sig = cert.signatureAlgorithm;
+      return !!(sig && ML_DSA_SIG_LEN[sig.oid] !== undefined);
+    },
+    check: function (cert) {
+      var want = ML_DSA_SIG_LEN[cert.signatureAlgorithm.oid];
+      var value = cert.signatureValue;
+      return (guard.crypto.isOctetAligned(value) && value.bytes.length === want) ? null
+        : { context: { expected: want, got: value.bytes.length, unusedBits: value.unusedBits } };
+    },
+  },
 ];
 var RFC9909_RULES = [
   _pqcSigKeyUsageRule("lint/rfc9909/slhdsa-key-usage", "rfc9909", "RFC 9909 6", "SLH-DSA", _isSlhDsa),
@@ -4166,6 +4219,7 @@ function _criticalityRows(list, table, what) {
 var RFC5280_CRL_RULES = [
   {
     id: "lint/rfc5280-crl/signature-empty", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.1.1.3",
+    readsSignatureValue: true,
     message: "the signatureValue contains no signature",
     check: function (crl) { return crl.signatureValue.bytes.length === 0 ? true : null; },
   },
@@ -4615,8 +4669,72 @@ var RFC5280_CRL_RULES = [
   },
 ];
 
-var CRL_PROFILES = Object.assign(Object.create(null), { "rfc5280-crl": RFC5280_CRL_RULES });
-var ALL_CRL_RULES = RFC5280_CRL_RULES;
+/** @internal Sec. 8: "The signatures on CRLs in this profile MUST follow the same rules from this
+ *  profile that apply to signatures in the certificates", and sec. 9 asks the same of an OCSP
+ *  response. It is ONE rule, so the row is written once and each artifact's registry takes it with the
+ *  reader its own parse result needs. The rule's citation names sec. 4 and 6.1, where the rule is,
+ *  beside the section that carries it here.
+ *  ONE IDENTIFIER ANSWERS FOR BOTH. Sec. 6.1 names the inner `signature` field of a TBSCertificate or
+ *  TBSCertList as well as the outer `signatureAlgorithm`, and both parsers refuse an artifact whose two
+ *  fields disagree, each as `<domain>/bad-signature-algorithm`. So by the time a row reads one, the other cannot differ, and a vector asserts that
+ *  verdict rather than a second row reading the same OID twice.
+ *  Sec. 6.2 sends the reader to RFC 9881 for the signature value, whose length FIPS 204 fixes per
+ *  parameter set, and that document's own row reports one of another length wherever it runs.
+ *  Sec. 9's second requirement, RFC 6960 sec. 4.2.2.2, is responder authorization, which is a trust
+ *  decision over a chain rather than a property of these bytes, and `pki.ocsp.verify` owns it. */
+function _cnsaSignatureRow(id, citation, reader) {
+  return {
+    id: id, severity: "error", source: "cnsa-2.0", citation: citation,
+    message: "the signature algorithm is not id-ml-dsa-87",
+    appliesTo: _isCnsa,
+    check: function (artifact) {
+      var sig = reader(artifact);
+      var o = sig && sig.oid;
+      return o === CNSA_ML_DSA_87 ? null : { context: { signatureAlgorithm: (sig && sig.name) || o } };
+    },
+  };
+}
+
+/** @internal The other half of the same sentence, for the two artifacts whose own registries carry no
+ *  RFC 9881 rows: FIPS 204 fixes the signature's length per parameter set, so a value of another length
+ *  is not a signature of the algorithm the identifier names. A certificate is told this by the RFC 9881
+ *  row its profile already runs, and a CRL and an OCSP response are told it here, because sec. 8 and
+ *  sec. 9 give them a certificate's signature rules and one of the two halves reached them. The value
+ *  arrives as a decoded BIT STRING from one parser and as its bytes from the other, so the reader each
+ *  registry passes returns the length and whether it is octet-aligned. */
+function _cnsaSignatureLengthRow(id, citation, algReader, lengthReader) {
+  return {
+    id: id, severity: "error", source: "cnsa-2.0", citation: citation, readsSignatureValue: true,
+    message: "the signature is not the length FIPS 204 fixes for its algorithm",
+    appliesTo: function (artifact, ctx) {
+      var sig = algReader(artifact);
+      return _isCnsa(artifact, ctx) && !!(sig && ML_DSA_SIG_LEN[sig.oid] !== undefined);
+    },
+    check: function (artifact) {
+      var want = ML_DSA_SIG_LEN[algReader(artifact).oid];
+      var got = lengthReader(artifact);
+      return (got.aligned && got.length === want) ? null
+        : { context: { expected: want, got: got.length, unusedBits: got.unusedBits } };
+    },
+  };
+}
+function _crlSignatureAlgorithm(crl) { return crl.signatureAlgorithm; }
+var CNSA2_CRL_RULES = [
+  _cnsaSignatureRow("lint/cnsa-2.0/crl-signature-not-ml-dsa-87",
+    "draft-jenkins-cnsa2-pkix-profile-05 sec. 8 (sec. 4 / 6.1)", _crlSignatureAlgorithm),
+  _cnsaSignatureLengthRow("lint/cnsa-2.0/crl-signature-length",
+    "draft-jenkins-cnsa2-pkix-profile-05 sec. 8 (RFC 9881 4 / FIPS 204)", _crlSignatureAlgorithm,
+    function (crl) {
+      var v = crl.signatureValue;
+      return { length: v.bytes.length, unusedBits: v.unusedBits, aligned: guard.crypto.isOctetAligned(v) };
+    }),
+];
+
+var CRL_PROFILES = Object.assign(Object.create(null), {
+  "rfc5280-crl": RFC5280_CRL_RULES,
+  "cnsa-2.0": CNSA2_CRL_RULES,
+});
+var ALL_CRL_RULES = RFC5280_CRL_RULES.concat(CNSA2_CRL_RULES);
 
 /** @internal The RFC 5652 profile is SHORT, and the reason is worth stating where the rows are:
  *  this toolkit's CMS parser already refuses nearly everything sections 5 and 11 require, so those
@@ -5144,6 +5262,7 @@ function _placementRow(name, placed, where) {
 var RFC6960_OCSP_RULES = [
   {
     id: "lint/rfc6960/signature-empty", severity: "error", source: "rfc6960", citation: "RFC 6960 2.2",
+    readsSignatureValue: true,
     message: "a definitive response shall be digitally signed; the signature BIT STRING is empty",
     check: function (resp) { return _ocspBasic(resp).signature.length === 0 ? true : null; },
   },
@@ -5420,8 +5539,28 @@ var RFC5019_OCSP_RULES = [
   },
 ];
 
-var OCSP_PROFILES = Object.assign(Object.create(null), { "rfc6960": RFC6960_OCSP_RULES, "rfc5019": RFC5019_OCSP_RULES });
-var ALL_OCSP_RULES = RFC6960_OCSP_RULES.concat(RFC5019_OCSP_RULES);
+/** @internal Sec. 9: "an OCSP response MUST be signed conformant with Section 4", which is the rule
+ *  the certificate and CRL rows read, over the signature the basic response carries. */
+function _ocspSignatureAlgorithm(resp) { return _ocspBasic(resp).signatureAlgorithm; }
+var CNSA2_OCSP_RULES = [
+  _cnsaSignatureRow("lint/cnsa-2.0/response-signature-not-ml-dsa-87",
+    "draft-jenkins-cnsa2-pkix-profile-05 sec. 9 (sec. 4 / 6.1)", _ocspSignatureAlgorithm),
+  /** @internal The response parser surfaces the signature as its bytes, having read the BIT STRING, so
+   * there are no unused bits left to ask about and the length is the whole answer. */
+  _cnsaSignatureLengthRow("lint/cnsa-2.0/response-signature-length",
+    "draft-jenkins-cnsa2-pkix-profile-05 sec. 9 (RFC 9881 4 / FIPS 204)", _ocspSignatureAlgorithm,
+    function (resp) {
+      var sig = _ocspBasic(resp).signature;
+      return { length: sig.length, unusedBits: 0, aligned: true };
+    }),
+];
+
+var OCSP_PROFILES = Object.assign(Object.create(null), {
+  "rfc6960": RFC6960_OCSP_RULES,
+  "rfc5019": RFC5019_OCSP_RULES,
+  "cnsa-2.0": CNSA2_OCSP_RULES,
+});
+var ALL_OCSP_RULES = RFC6960_OCSP_RULES.concat(RFC5019_OCSP_RULES).concat(CNSA2_OCSP_RULES);
 
 /** @internal The extensions an issuer determines, which a request may carry and a CA does not take
  *  from one. subjectKeyIdentifier and authorityKeyIdentifier are computed from the keys, and the
@@ -5580,6 +5719,602 @@ var CABF_TLS_CSR_RULE_IDS = [
   "lint/cabf-tls/weak-key",
 ];
 
+/** @internal The dates NIST IR 8547 sets, read as whole years: "deprecated after 2030" and
+ *  "disallowed after 2035" name the years themselves, so each transition begins on 1 January of the
+ *  year that follows. The engine compares the certificate's own notBefore, which is the issuance date
+ *  the transition governs. */
+var NIST_DEPRECATED_FROM = new Date("2031-01-01T00:00:00Z");
+var NIST_DISALLOWED_FROM = new Date("2036-01-01T00:00:00Z");
+
+function _isNistTransition(cert, ctx) { return ctx.profile === "nist-pqc-transition"; }
+
+/** @internal An identifier the OID registry names that is NOT an algorithm either of a certificate's
+ *  two algorithm fields can carry, so no family is read onto it: a digest, an attribute carrying a key
+ *  length, a CMS content-encryption algorithm, a message authentication code, and the two
+ *  proof-of-possession algorithms. Each carries a family's word in its name and none is a signature or
+ *  a subject key. */
+var NIST_NOT_AN_ALGORITHM = Object.assign(Object.create(null), {
+  sha1: 1, rsaKeyLen: 1, rsaKeyTransport: 1, dhBasedMac: 1,
+  "id-alg-dhPOP": 1, "id-dhPop-static-HMAC-SHA1": 1, "id-alg-noSignature": 1,
+});
+
+/** @internal Which family of IR 8547's tables an algorithm belongs to. Table 2 lists RSA, ECDSA and
+ *  EdDSA; Table 4 lists finite-field DH and MQV, elliptic-curve DH and MQV, and RSA key transport.
+ *  `pqc` and `hybrid` mark what the transition moves TO, which no row reports, and an identifier the
+ *  registry does not name is undefined, which both rows also pass over.
+ *  THE ORDER IS THE MECHANISM. Each test is anchored at the start of the name or is an equality, and
+ *  the families whose names contain another family's word are claimed first, so by the time the RSA
+ *  test runs there is no `ecdsaWith` or `dsaWith` name left for it to take. A single unordered
+ *  substring test reads `ecdsaWithSHA256` as a DSA algorithm; a table of exact names owes an entry for
+ *  every spelling the registry knows, which is how `sha1WithRSAEncryption` came to be read as no family
+ *  at all; and the algorithm a VERIFIER resolves is a third question, since that table holds what this
+ *  toolkit will check a signature with and excludes SHA-1 by policy, so reading the family off it let
+ *  every SHA-1 signature past the disallowance date.
+ *  `lint-nist-transition.test.js` drives every identifier the registry names through the shipped verb,
+ *  so a family this fails to claim is reported by a test rather than by silence. */
+function _nistKindOf(alg) {
+  var name = alg && typeof alg.name === "string" ? alg.name : "";
+  if (name === "" || NIST_NOT_AN_ALGORITHM[name]) return undefined;
+  /** @internal A composite arm names a post-quantum algorithm AND a traditional one, so it is neither
+   * of the other answers. It is given its own, rather than sharing the undefined an unnamed identifier
+   * returns, so a reader can tell a deliberate exclusion from an omission. Both rows pass over it: the
+   * tables list pure families, and the same guidance endorses this construction for the transition
+   * these dates mark. */
+  if (name.indexOf("id-MLDSA") === 0 || name.indexOf("id-MLKEM") === 0) return "hybrid";
+  if (name.indexOf("ML-DSA") === 0 || name.indexOf("ML-KEM") === 0 || name.indexOf("SLH-DSA") === 0 ||
+    name.indexOf("id-ml-dsa-") === 0 || name.indexOf("id-ml-kem-") === 0 ||
+    name.indexOf("id-slh-dsa-") === 0 || name.indexOf("id-hash-") === 0) return "pqc";
+  /** @internal A key-agreement scheme names a key-derivation function for CMS rather than an algorithm
+   * a certificate declares, and its name opens with the family word. */
+  if (name.indexOf("dhSinglePass-") === 0) return undefined;
+  if (name === "ecPublicKey" || name.indexOf("ecdsaWith") === 0 ||
+    name === "X25519" || name === "X448") return "ecc";
+  if (name === "Ed25519" || name === "Ed448") return "eddsa";
+  if (name === "dsa" || name.indexOf("dsaWith") === 0 ||
+    name === "dhpublicnumber" || name === "dhKeyAgreement") return "ffc";
+  return _nistNameCarriesRsa(name) ? "ifc" : undefined;
+}
+
+/** @internal Whether a name carries the RSA family's word, asked only after every other family has
+ *  claimed its own names, so the one reading that made this ambiguous cannot arise. */
+function _nistNameCarriesRsa(name) {
+  var lower = guard.name.lowerAscii(name);
+  return lower.indexOf("rsa") !== -1;
+}
+/** @internal Whether a classification names one of the families the tables date. `pqc` and `hybrid` are
+ *  what the transition moves TO, and an unclassified name is one the registry does not know, so none of
+ *  the three is a family these rows report. */
+function _nistIsClassical(kind) {
+  return kind === "ifc" || kind === "ecc" || kind === "eddsa" || kind === "ffc";
+}
+
+/** @internal Every classical algorithm a certificate declares, as `{ field, kind, name }` per field.
+ *  Both fields are read because both outlive the issuance: a post-quantum subject key signed with a
+ *  classical algorithm still leaves a classical signature for a relying party to verify.
+ *  A COMPOSITE is passed over, in both fields. `path.signatureAlgorithmName` answers null for a
+ *  composite identifier because it names two algorithms, and a composite subject key carries the arm's
+ *  own name, which neither table lists. That is the reading the IR asks for rather than a gap: its
+ *  tables list pure families, and sec. 3 of the same document endorses hybrid and dual-algorithm
+ *  operation through the transition, so reporting the traditional half would report the construction
+ *  these dates exist to carry. */
+function _nistClassicalDeclarations(cert) {
+  var out = [];
+  var keyAlg = (cert.subjectPublicKeyInfo && cert.subjectPublicKeyInfo.algorithm) || null;
+  var keyKind = _nistKindOf(keyAlg);
+  if (_nistIsClassical(keyKind)) {
+    out.push({ field: "subjectPublicKey", kind: keyKind, name: _spkiAlgName(cert) || (keyAlg && keyAlg.oid) });
+  }
+  var sigAlg = cert.signatureAlgorithm || null;
+  var sigKind = _nistKindOf(sigAlg);
+  if (_nistIsClassical(sigKind)) {
+    out.push({ field: "signature", kind: sigKind, name: (sigAlg && (sigAlg.name || sigAlg.oid)) });
+  }
+  return out;
+}
+
+/** @internal Whether a declared subject key sits at the 112-bit security strength, which is the level
+ *  the 2030 deprecation applies to. IR 8547 gives no mapping from a strength to a key size; SP 800-57
+ *  Part 1 Rev 5 Table 2 does: 112 bits is an RSA modulus of 2048, a finite-field group with L = 2048,
+ *  and a curve whose field is 224 to 255 bits. A key WEAKER than that level is weaker than the level
+ *  the clause deprecates, so it is reported by the same row rather than passed over. All three
+ *  families the tables list are read: an RSA modulus, an elliptic curve's field, and a finite-field
+ *  group's prime. Reading two of them left every DSA and Diffie-Hellman key silently outside the
+ *  deprecation the row promises.
+ *  EdDSA IS DELIBERATELY ABSENT. Ed25519's field is 255 bits, which SP 800-57's ECC column puts in the
+ *  112-bit row, so reading the two documents together would deprecate it after 2030. IR 8547's own
+ *  EdDSA row carries a 128-bit entry alone, with no 112-bit entry and no 2030 date, and this profile
+ *  cites IR 8547. A reader who reaches for SP 800-57 will find the other answer. */
+var NIST_112_ECC_FIELD_MAX = 255;
+function _nistAt112OrBelow(cert, declaration) {
+  var spki = cert.subjectPublicKeyInfo;
+  if (declaration.kind === "ifc") {
+    var bits = _rsaModulusBits(spki);
+    return bits !== null && bits <= 2048 ? { rsaBits: bits } : null;
+  }
+  if (declaration.kind === "ecc") {
+    /** @internal X25519 and X448 are read the way their signing siblings are. RFC 8410 encodes them as
+     * a raw coordinate with no format byte, so there is no SEC1 point to measure, and the field size
+     * SP 800-57's ECC column would place at the 112-bit level, 255 bits for X25519, is the same figure
+     * IR 8547's own EdDSA row answers at 128 bits. The profile follows IR 8547 for that family, so it
+     * follows it here, and both are reported by the 2036 row rather than this one. */
+    if (declaration.name === "X25519" || declaration.name === "X448") return null;
+    var field = _eccFieldBits(spki);
+    return (field !== null && field <= NIST_112_ECC_FIELD_MAX)
+      ? { curve: _ecCurveName(spki), fieldBits: field } : null;
+  }
+  if (declaration.kind === "ffc") {
+    var ffc = _ffcParameterBits(cert, spki);
+    if (ffc === null) return null;
+    /** @internal SP 800-57 Table 2 states the finite-field level as a PAIR, L = 2048 with N = 224 at
+     * 112 bits and L = 3072 with N = 256 at 128, so either parameter caps the strength: a group with
+     * a 3072-bit prime and a 224-bit subgroup is a 112-bit key. Reading the prime alone left that key
+     * outside the deprecation. A shape carrying no subgroup order settles the question on the prime,
+     * which is all it states. */
+    var atLevel = ffc.primeBits <= 2048 ||
+      (ffc.subgroupBits !== null && ffc.subgroupBits <= 224);
+    return atLevel ? { ffcPrimeBits: ffc.primeBits, ffcSubgroupBits: ffc.subgroupBits } : null;
+  }
+  return null;
+}
+
+/** @internal Where each finite-field parameter shape carries its subgroup order, as the index of the
+ *  INTEGER that holds it, or null for a shape that carries none. The prime is first in all three, and
+ *  the subgroup order is NOT: RFC 3279's `Dss-Parms ::= SEQUENCE { p, q, g }` puts it second, its
+ *  `DomainParameters ::= SEQUENCE { p, g, q OPTIONAL, j OPTIONAL, validationParms OPTIONAL }` third and
+ *  optional, and PKCS#3's `DHParameter ::= SEQUENCE { prime, base, privateValueLength OPTIONAL }`
+ *  states no subgroup at all. So the position is read per algorithm rather than by counting fields,
+ *  which would read a generator as a subgroup order. */
+var FFC_SUBGROUP_INDEX = Object.assign(Object.create(null), {
+  dsa: 1, dhpublicnumber: 2, dhKeyAgreement: null,
+});
+
+/** @internal A finite-field key's L and N, the pair SP 800-57 Table 2's FFC column is stated in, as
+ *  `{ primeBits, subgroupBits }` with `subgroupBits` null where the shape carries no subgroup order.
+ *  A parameters field this cannot read answers null, which leaves the row silent rather than reporting
+ *  a strength it did not establish. */
+function _ffcParameterBits(cert, spki) {
+  // allow:swallow-unverified the ingest door has already produced a parsed certificate, so this reads bytes the parser accepted and a shape it cannot read answers null
+  try {
+    var alg = spki.algorithm;
+    var params = alg && alg.parameters;
+    if (!Buffer.isBuffer(params)) return null;
+    var seq = asn1.decode(params);
+    if (!seq.children || !seq.children.length) return null;
+    var p = asn1.read.integer(seq.children[0]);
+    if (p <= 0n) return null;
+    var at = FFC_SUBGROUP_INDEX[alg.name];
+    var q = null;
+    var node = typeof at === "number" ? seq.children[at] : null;
+    if (node && node.tagClass === "universal" && node.tagNumber === asn1.TAGS.INTEGER) {
+      var read = asn1.read.integer(node);
+      if (read > 0n) q = read.toString(2).length;
+    }
+    return { primeBits: p.toString(2).length, subgroupBits: q };
+  } catch (_e) { return null; }
+}
+
+/** @internal The field size of a SEC1 elliptic-curve subject key, which is what SP 800-57 Table 2's ECC
+ *  column is stated in, read from THE KEY rather than from a table of curves. RFC 5480 sec. 2.2 encodes
+ *  the point as `0x04 || X || Y` with each coordinate padded to the field's whole octets, so its length
+ *  gives the field size for any curve, including the ones a table would have to list and the ones a
+ *  registry gains later. A table of curve names left every certificate on a curve nobody had added,
+ *  `sect233r1` and `brainpoolP224r1` among them, outside the deprecation.
+ *  ONLY AN `ecPublicKey` REACHES THIS. RFC 8410 encodes X25519 and X448 as a raw coordinate carrying no
+ *  format byte, so reading one here would read key material as a format and answer differently for two
+ *  keys of one algorithm; the caller answers for those two before calling.
+ *  A CERTIFICATE WHOSE NAMED CURVE AND POINT WIDTH DISAGREE is answered on its point, which is the
+ *  key's own size, and the disagreement itself is not this row's to report: the two fields state
+ *  different things and nothing here can say which the issuer meant. Such a key is not usable in any
+ *  case, since `pki.path.validate` refuses it as `path/bad-input` when it imports the key.
+ *  The answer is the field rounded up to whole octets, which is what the encoding states: a 521-bit
+ *  field is carried in 66 octets and reads as 528. That is exact for every curve whose field is a whole
+ *  number of octets and rounds away from the threshold for the rest, so the only field sizes it could
+ *  misread are 249 through 255, which no standard curve uses. */
+function _eccFieldBits(spki) {
+  var pk = spki && spki.publicKey && (spki.publicKey.bytes || spki.publicKey);
+  if (!Buffer.isBuffer(pk) || pk.length < 2) return null;
+  var form = pk[0];
+  if (form === 0x04) {
+    return (pk.length - 1) % 2 === 0 ? ((pk.length - 1) / 2) * 8 : null;
+  }
+  /** @internal RFC 5480 sec. 2.2 permits the compressed form, which carries one coordinate. */
+  if (form === 0x02 || form === 0x03) return (pk.length - 1) * 8;
+  return null;
+}
+
+var NIST_TRANSITION_RULES = [
+  {
+    id: "lint/nist-pqc-transition/classical-disallowed-after-2035", severity: "error",
+    source: "nist-pqc-transition", citation: "NIST IR 8547 ipd Table 2 / Table 4",
+    /** @internal Every classical family the two tables list is "Disallowed after 2035" at the
+     * parameter sets they list, so this row needs no strength mapping: whether the algorithm is one of
+     * those families is the whole question, and the registry answers it. */
+    message: "a classical algorithm is disallowed for a certificate issued after 2035",
+    appliesTo: _isNistTransition,
+    effectiveDate: NIST_DISALLOWED_FROM,
+    check: function (cert) {
+      var found = _nistClassicalDeclarations(cert);
+      return found.length ? found.map(function (d) {
+        return { context: { field: d.field, family: d.kind, algorithm: d.name } };
+      }) : null;
+    },
+  },
+  {
+    id: "lint/nist-pqc-transition/classical-deprecated-after-2030", severity: "warn",
+    source: "nist-pqc-transition", citation: "NIST IR 8547 ipd Table 2 / Table 4",
+    /** @internal The 112-bit rows are "Deprecated after 2030", which SP 800-131A and sec. 4.1 of the
+     * IR define as still usable with the risk accepted, so the severity is a warning where the 2035
+     * row is an error. Only the subject key's own parameters are readable here: a signature
+     * identifier names a hash and a family, not the issuer's key size, so the strength of the
+     * signing key is in the ISSUER's certificate rather than this one. */
+    message: "a classical algorithm at or below the 112-bit security strength is deprecated for a certificate issued after 2030",
+    appliesTo: _isNistTransition,
+    effectiveDate: NIST_DEPRECATED_FROM,
+    check: function (cert) {
+      var out = [];
+      _nistClassicalDeclarations(cert).forEach(function (d) {
+        if (d.field !== "subjectPublicKey") return;
+        var at = _nistAt112OrBelow(cert, d);
+        if (at) out.push({ context: Object.assign({ family: d.kind, algorithm: d.name }, at) });
+      });
+      return out.length ? out : null;
+    },
+  },
+];
+
+/** @internal The CNSA 2.0 suite, from `draft-jenkins-cnsa2-pkix-profile-05` (M. Jenkins, NSA-CCSS,
+ *  5 July 2026, Informational, obsoletes RFC 8603 if approved). The NSA notice lists algorithms; this
+ *  document states what a CERTIFICATE must carry, which is what a profile can read, so it is the
+ *  citation and it is cited as a draft. Sec. 3 fixes the suite: ML-DSA-87 for signing and ML-KEM-1024
+ *  for key establishment.
+ *  A certificate declares WHICH kind it is through its own subject public key, which is what makes the
+ *  end-entity key-usage rows readable.
+ *  THE PROFILE IS A PROFILE OF RFC 5280 (sec. 6), so a clause it prefixes "in adherence with
+ *  [RFC5280]" is RFC 5280's requirement as well. Where the document restates one as its own MUST, it
+ *  gets a row here, so an operator who names this profile alone still sees it; the default rule set
+ *  reports the RFC 5280 rows themselves. */
+var CNSA_ML_DSA_87 = oid.byName("id-ml-dsa-87");
+var CNSA_ML_KEM_1024 = oid.byName("id-ml-kem-1024");
+
+function _isCnsa(cert, ctx) { return ctx.profile === "cnsa-2.0"; }
+/** @internal Sec. 7.1 governs a SELF-SIGNED CA certificate, and sec. 7.2 every other CA. Matching
+ *  issuer and subject names make a certificate self-ISSUED, which is not the same thing: a CA reissued
+ *  in its own name under a new key carries both names and was signed by its predecessor, so sec. 7.2
+ *  governs it, and sec. 7.2 permits the pathLenConstraint sec. 7.1 forbids. The key identifiers
+ *  separate the two without a signature check, which this synchronous surface cannot make, and
+ *  `_selfSignedIdentifiers` is where that reading already lives. Reading the names alone reported a
+ *  rollover CA for a field its own section allows. */
+/** @internal Whether this certificate is one of the CA kinds sec. 7.1 and 7.2 govern. A basicConstraints
+ *  with cA set says so, and so does a keyUsage asserting keyCertSign: RFC 5280 sec. 4.2.1.3 requires the
+ *  cA boolean of any certificate whose keyUsage asserts that bit, so a certificate asserting it is
+ *  claiming to be a CA whether or not it carries the extension.
+ *  READING ONLY THE EXTENSION MADE ONE CLAUSE UNREPORTABLE. Both CA sections require basicConstraints by
+ *  name, and a certificate that omits it is exactly the one that breaks them; deciding the scope on that
+ *  same extension graded it as an end entity instead, so the operator saw extended-key-usage findings
+ *  written for a different kind of certificate and not the requirement it actually broke. An end entity
+ *  does not assert keyCertSign, so nothing that belongs to sec. 7.3 is drawn in by this. */
+function _cnsaIsCa(cert, ctx) {
+  if (ctx.isCaCert) return true;
+  var ku = ctx.decode("keyUsage");
+  return !!(ku && ku.value && ku.value.keyCertSign === true);
+}
+/** @internal Whether a self-ISSUED CA is one sec. 7.1 governs. A rollover CA reissued in its own name
+ *  under a new key names its predecessor's key in its authorityKeyIdentifier, and its own key in its
+ *  subjectKeyIdentifier, so the two identifiers DISAGREEING is what says sec. 7.2 governs it.
+ *  ANYTHING ELSE READS AS SELF-SIGNED, including a certificate that carries no subjectKeyIdentifier for
+ *  the comparison to read. That extension is one sec. 7.1 requires by name, so a certificate omitting it
+ *  is one this section is about, and letting its absence move the certificate to sec. 7.2 left it with no
+ *  finding at all. `_selfSignedIdentifiers` takes the opposite default, because the row that reads it
+ *  rests on having settled the question; here the stricter scope is the one that reports the omission.
+ *  THE RESIDUAL IS A ROLLOVER CA CARRYING NO authorityKeyIdentifier AT ALL, which reads as a root here
+ *  and so is not asked for the extension sec. 7.2 requires. The bytes do not settle it: a root omits
+ *  that extension legitimately, and RFC 5280 sec. 4.2.1.1 permits its absence only in a self-signed
+ *  certificate, which is the rule the rfc5280 rows report on their own. Inventing a rule that reported
+ *  every root for omitting an extension its own section does not ask for would be worse than the gap. */
+function _cnsaSelfIssuedIsRoot(cert, ctx) {
+  var aki = ctx.decode("authorityKeyIdentifier");
+  var kid = aki && aki.value ? aki.value.keyIdentifier : null;
+  if (!Buffer.isBuffer(kid)) return true;
+  var ski = ctx.decode("subjectKeyIdentifier");
+  if (!Buffer.isBuffer(ski && ski.value)) return true;
+  return kid.equals(ski.value);
+}
+function _cnsaSelfSignedCa(cert, ctx) {
+  return _isCnsa(cert, ctx) && _cnsaIsCa(cert, ctx) && _sameName(cert.issuer, cert.subject) &&
+    _cnsaSelfIssuedIsRoot(cert, ctx);
+}
+function _cnsaOtherCa(cert, ctx) {
+  return _isCnsa(cert, ctx) && _cnsaIsCa(cert, ctx) &&
+    !(_sameName(cert.issuer, cert.subject) && _cnsaSelfIssuedIsRoot(cert, ctx));
+}
+function _cnsaAnyCa(cert, ctx) { return _isCnsa(cert, ctx) && _cnsaIsCa(cert, ctx); }
+function _cnsaEndEntity(cert, ctx) { return _isCnsa(cert, ctx) && !_cnsaIsCa(cert, ctx); }
+
+/** @internal Which kind of CNSA certificate this is, from the subject public key sec. 4 fixes: an
+ *  ML-DSA-87 key makes it a signature certificate and an ML-KEM-1024 key a key-establishment one.
+ *  A key outside the suite has no kind, and the row that reports the key answers for it rather than
+ *  the rows that read a kind. */
+function _cnsaKind(cert) {
+  var spki = cert.subjectPublicKeyInfo;
+  var o = spki && spki.algorithm && spki.algorithm.oid;
+  if (o === CNSA_ML_DSA_87) return "signature";
+  if (o === CNSA_ML_KEM_1024) return "key-establishment";
+  return null;
+}
+
+/** @internal The nine bits RFC 5280 sec. 4.2.1.3 defines, so a closed set stated as "all other bits
+ *  MUST NOT be set" is read as the bits outside the named ones rather than as a boolean. */
+var CNSA_KEY_USAGE_BITS = ["digitalSignature", "nonRepudiation", "keyEncipherment",
+  "dataEncipherment", "keyAgreement", "keyCertSign", "cRLSign", "encipherOnly", "decipherOnly"];
+/** @internal Sec. 7.1 and 7.2 for a CA, sec. 7.3 for each kind of end entity. `required` must be set,
+ *  `optional` may be, and every other bit must not. */
+var CNSA_KEY_USAGE_SETS = Object.assign(Object.create(null), {
+  ca: { required: ["keyCertSign", "cRLSign"], optional: ["digitalSignature", "nonRepudiation"] },
+  signature: { required: ["digitalSignature"], optional: ["nonRepudiation"] },
+  "key-establishment": { required: ["keyEncipherment"], optional: [] },
+});
+/** @internal Every way one keyUsage departs from one of those sets, as a finding each: a required bit
+ *  that is not set and a bit outside the set that is. One finding per bit, because a certificate that
+ *  sets two forbidden bits has two faults and an operator fixing one would otherwise not see the
+ *  other. */
+function _cnsaKeyUsageFindings(ctx, setName) {
+  var set = CNSA_KEY_USAGE_SETS[setName];
+  var ku = ctx.decode("keyUsage");
+  if (!set || !ku || !ku.value) return null;
+  var v = ku.value, out = [];
+  set.required.forEach(function (bit) {
+    if (v[bit] !== true) out.push({ context: { bit: bit, fault: "required bit not set", set: setName } });
+  });
+  CNSA_KEY_USAGE_BITS.forEach(function (bit) {
+    if (v[bit] !== true) return;
+    if (set.required.indexOf(bit) !== -1 || set.optional.indexOf(bit) !== -1) return;
+    out.push({ context: { bit: bit, fault: "bit outside the set this profile fixes", set: setName } });
+  });
+  /** @internal "All other bits MUST NOT be set" reaches past the nine RFC 5280 sec. 4.2.1.3 names: a
+   * bit beyond them is one of the others. The decoder reports those as one flag rather than by
+   * position, so they are one finding. Reading only the nine left a certificate asserting them
+   * conforming under a clause that closes the set. */
+  if (v.reservedBitsSet === true) {
+    out.push({ context: { bit: "beyond the nine named positions", fault: "bit outside the set this profile fixes", set: setName } });
+  }
+  return out.length ? out : null;
+}
+
+/** @internal An extension this profile requires by name, reported one finding per absent one. The
+ *  shared syntax row answers for an extension whose value does not decode, so absence here is
+ *  absence. */
+function _cnsaMissingExtensions(ctx, names) {
+  var out = [];
+  names.forEach(function (name) {
+    if (!ctx.raw(name)) out.push({ context: { extension: name } });
+  });
+  return out.length ? out : null;
+}
+
+var CNSA2_RULES = [
+  {
+    id: "lint/cnsa-2.0/spki-not-suite", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 4 / 6.4",
+    /** @internal "Every CNSA Suite certificate MUST use the X.509 v3 format and contain one of the
+     * following as its subject public key: A ML-DSA-87 signature verification key. A ML-KEM-1024
+     * public encapsulation key." Sec. 6.4's "the contents of the parameters component ... MUST be
+     * absent" has no row: the shared AlgorithmIdentifier decoder refuses a present field on both
+     * OIDs, so an operator sees `x509/bad-algorithm-parameters` instead. */
+    message: "the subject public key is not one of the two the suite fixes (ML-DSA-87 or ML-KEM-1024)",
+    appliesTo: _isCnsa,
+    check: function (cert) {
+      return _cnsaKind(cert) === null
+        ? { context: { algorithm: _spkiAlgName(cert) || (cert.subjectPublicKeyInfo &&
+            cert.subjectPublicKeyInfo.algorithm && cert.subjectPublicKeyInfo.algorithm.oid) } }
+        : null;
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/version-not-3", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 6.3",
+    /** @internal "For this profile, the version field MUST be set to INTEGER value 0x02, indicating
+     * that the certificate conforms to X.509 version 3", which sec. 4 repeats as "Every CNSA Suite
+     * certificate MUST use the X.509 v3 format". A version 1 or 2 certificate carrying no extensions
+     * is well-formed and parses, since RFC 5280 sec. 4.1.2.1 puts the field at DEFAULT v1 and the
+     * parser refuses only an extensions field beneath those versions, so this clause needs a row. */
+    message: "a CNSA Suite certificate must be X.509 version 3",
+    appliesTo: _isCnsa,
+    check: function (cert) {
+      return cert.version === 3 ? null : { context: { version: cert.version } };
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/signature-not-ml-dsa-87", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 4 / 6.1",
+    /** @internal "The signature applied to all CNSA Suite certificates and CRLs MUST be made with a
+     * ML-DSA-87 signing key", and sec. 6.1 names id-ml-dsa-87 as the identifier for it. The same
+     * sentence that fixes the algorithm also says "HashML-DSA is not permitted", which this row
+     * reports without a second one: a HashML-DSA identifier is not id-ml-dsa-87. */
+    message: "the certificate signature algorithm is not id-ml-dsa-87",
+    appliesTo: _isCnsa,
+    check: function (cert) {
+      var sig = cert.signatureAlgorithm;
+      var o = sig && sig.oid;
+      return o === CNSA_ML_DSA_87 ? null : { context: { signatureAlgorithm: (sig && sig.name) || o } };
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/key-usage-not-critical", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1 / 7.2 / 7.3",
+    /** @internal "The keyUsage extension MUST be marked as critical", said in each of the three
+     * sections, so one row serves all three scopes rather than three saying the same thing. */
+    message: "the keyUsage extension must be marked critical",
+    appliesTo: _isCnsa,
+    check: function (cert, ctx) {
+      var ku = ctx.decode("keyUsage");
+      if (!ku) return null;
+      return ku.critical === true ? null : true;
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/self-signed-ca-missing-extension", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1",
+    /** @internal "self-signed CA certificates in this profile MUST contain the subjectKeyIdentifier,
+     * keyUsage, and basicConstraints extensions." All three are reported, including the third: the
+     * scope reads a keyUsage asserting keyCertSign as a CA as well, so a certificate that omits
+     * basicConstraints is still read here and told which extension it owes. */
+    message: "a self-signed CA certificate must carry this extension",
+    appliesTo: _cnsaSelfSignedCa,
+    check: function (cert, ctx) {
+      return _cnsaMissingExtensions(ctx, ["subjectKeyIdentifier", "keyUsage", "basicConstraints"]);
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/ca-missing-extension", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.2",
+    /** @internal "Non-self-signed CA Certificates in this profile MUST contain the
+     * authorityKeyIdentifier, keyUsage, and basicConstraints extensions." A self-signed one is
+     * governed by sec. 7.1 instead, which asks for a subjectKeyIdentifier rather than an authority
+     * one, so the two scopes carry their own rows and a certificate draws one set. */
+    message: "a non-self-signed CA certificate must carry this extension",
+    appliesTo: _cnsaOtherCa,
+    check: function (cert, ctx) {
+      return _cnsaMissingExtensions(ctx, ["authorityKeyIdentifier", "keyUsage", "basicConstraints"]);
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/ca-key-usage-bits", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1 / 7.2",
+    /** @internal "The keyCertSign and cRLSign bits MUST be set. The digitalSignature and
+     * nonRepudiation bits MAY be set. All other bits MUST NOT be set." Both CA sections say it. */
+    message: "a CA certificate's keyUsage departs from the bits this profile fixes",
+    appliesTo: _cnsaAnyCa,
+    check: function (cert, ctx) { return _cnsaKeyUsageFindings(ctx, "ca"); },
+  },
+  {
+    id: "lint/cnsa-2.0/basic-constraints-not-critical", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1 / 7.2",
+    /** @internal "the basicConstraints extension MUST be marked as critical", in both CA sections. */
+    message: "a CA certificate's basicConstraints extension must be marked critical",
+    appliesTo: _cnsaAnyCa,
+    check: function (cert, ctx) {
+      var bc = ctx.decode("basicConstraints");
+      if (!bc) return null;
+      return bc.critical === true ? null : true;
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/ca-boolean-not-set", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1 / 7.2",
+    /** @internal "The cA boolean MUST be set to indicate that the subject is a CA", in both CA
+     * sections. A certificate reaches this scope by carrying that boolean or by asserting keyCertSign,
+     * so the boolean CAN be read as unset here: a certificate whose keyUsage claims the CA role while
+     * its basicConstraints denies it says both things and breaks this clause. The absent extension is
+     * the missing-extension row's answer, so this one reads only an extension that is present. */
+    message: "a CA certificate's basicConstraints must set the cA boolean",
+    appliesTo: _cnsaAnyCa,
+    check: function (cert, ctx) {
+      var bc = ctx.decode("basicConstraints");
+      if (!bc || !bc.value) return null;
+      return bc.value.cA === true ? null : { context: { cA: bc.value.cA === true } };
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/self-signed-ca-path-len-present", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.1",
+    /** @internal "the pathLenConstraint MUST NOT be present", for a self-signed CA alone: sec. 7.2
+     * calls the same field OPTIONAL for a non-self-signed one. */
+    message: "a self-signed CA certificate must not carry a pathLenConstraint",
+    appliesTo: _cnsaSelfSignedCa,
+    check: function (cert, ctx) {
+      var bc = ctx.decode("basicConstraints");
+      if (!bc || !bc.value) return null;
+      var n = bc.value.pathLenConstraint;
+      return (n === null || n === undefined) ? null : { context: { pathLenConstraint: n } };
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/end-entity-missing-extension", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.3",
+    /** @internal "end-entity certificates in this profile MUST contain the authorityKeyIdentifier
+     * and keyUsage extensions." */
+    message: "an end entity certificate must carry this extension",
+    appliesTo: _cnsaEndEntity,
+    check: function (cert, ctx) {
+      return _cnsaMissingExtensions(ctx, ["authorityKeyIdentifier", "keyUsage"]);
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/end-entity-no-subject-key-identifier", severity: "warn", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.3",
+    /** @internal "End-entity certificates SHOULD contain the subjectKeyIdentifier extension", which
+     * is a recommendation rather than a requirement, so the severity follows the clause. */
+    message: "an end entity certificate should carry a subjectKeyIdentifier extension",
+    appliesTo: _cnsaEndEntity,
+    check: function (cert, ctx) { return ctx.raw("subjectKeyIdentifier") ? null : true; },
+  },
+  {
+    id: "lint/cnsa-2.0/end-entity-key-usage-bits", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.3",
+    /** @internal Which bits are fixed follows the KIND the subject key declares: "For end-entity
+     * digital signature certificates, the keyUsage extension MUST be set for digitalSignature. The
+     * nonRepudiation bit MAY be set. All other bits ... MUST NOT be set. For end-entity key
+     * establishment certificates, the keyUsage extension MUST be set for keyEncipherment. All other
+     * bits ... MUST NOT be set." A key outside the suite has no kind and is reported by the subject
+     * key row instead, rather than being held to one of the two tables. */
+    message: "an end entity certificate's keyUsage departs from the bits this profile fixes for its key",
+    appliesTo: function (cert, ctx) { return _cnsaEndEntity(cert, ctx) && _cnsaKind(cert) !== null; },
+    check: function (cert, ctx) { return _cnsaKeyUsageFindings(ctx, _cnsaKind(cert)); },
+  },
+  {
+    id: "lint/cnsa-2.0/end-entity-eku-missing", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.3",
+    /** @internal "For all end-entity certificates, the extended key usage extension MUST be present
+     * to indicate the intended use of the certificate." The sentence that follows, "The intended use
+     * MUST be consistent with the keyUsage extension", has no row: which key purposes are consistent
+     * with which bits is not enumerated anywhere in the document, so a table here would be invented
+     * rather than cited. */
+    message: "an end entity certificate must carry an extKeyUsage extension",
+    appliesTo: _cnsaEndEntity,
+    check: function (cert, ctx) { return ctx.raw("extKeyUsage") ? null : true; },
+  },
+  {
+    id: "lint/cnsa-2.0/end-entity-eku-any", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.3",
+    /** @internal "The anyExtendedKeyUsage MUST NOT be asserted." */
+    message: "an end entity certificate's extKeyUsage must not name anyExtendedKeyUsage",
+    appliesTo: _cnsaEndEntity,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      return d.value.indexOf(oid.byName("anyExtendedKeyUsage")) !== -1 ? true : null;
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/certificate-policies-critical", severity: "error", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.2 / 7.3",
+    /** @internal "If a policy is asserted, the certificatePolicies extension MUST be marked as
+     * non-critical", said in both sections. The same sentence's "MUST contain the OIDs for the
+     * applicable certificate policies" is what RFC 5280 already requires of the syntax, and "If a
+     * policy is not asserted, the certificatePolicies extension MUST be omitted" cannot be read from
+     * the bytes: an extension that is present asserts a policy. Sec. 7.1 says neither of a
+     * self-signed CA, so this row leaves one alone. */
+    message: "a certificatePolicies extension must be marked non-critical",
+    appliesTo: function (cert, ctx) { return _cnsaOtherCa(cert, ctx) || _cnsaEndEntity(cert, ctx); },
+    check: function (cert, ctx) {
+      var cp = ctx.decode("certificatePolicies");
+      if (!cp) return null;
+      return cp.critical === true ? true : null;
+    },
+  },
+  {
+    id: "lint/cnsa-2.0/certificate-policies-qualifiers", severity: "warn", source: "cnsa-2.0",
+    citation: "draft-jenkins-cnsa2-pkix-profile-05 sec. 7.2 / 7.3",
+    /** @internal "SHOULD NOT use the policyQualifiers option", a recommendation, so a warning. */
+    message: "a certificatePolicies extension should not carry policy qualifiers",
+    appliesTo: function (cert, ctx) { return _cnsaOtherCa(cert, ctx) || _cnsaEndEntity(cert, ctx); },
+    check: function (cert, ctx) {
+      var ids = _policyQualifierIds(ctx);
+      return ids.length ? { context: { qualifiers: ids } } : null;
+    },
+  },
+];
+
 /** @internal RFC 5280 sec. 4.2 fixes each extension's syntax wherever it is carried. Every row in
  *  every profile below asks for an extension BY NAME, and the shared decoder returns null both for
  *  one that is absent and for one whose value does not decode, so without this row a malformed
@@ -5602,12 +6337,25 @@ var PROFILES = Object.assign(Object.create(null), {
   "chrome-root": CHROME_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "microsoft-root": MICROSOFT_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "apple-root": APPLE_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "nist-pqc-transition": NIST_TRANSITION_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  /** @internal Sec. 4 of the draft names RFC 9881 and RFC 9935 for "the algorithm identifier, and the
+   *  syntax and semantics for the Subject Public Key Information field" of the two keys the suite
+   *  fixes, so those documents' subject-key rows ARE this profile's rules for them. Without them the
+   *  profile read the algorithm OID alone: bytes claiming to be an ML-KEM-1024 key while being the
+   *  wrong size for one are not the encapsulation key sec. 4 requires, and were reported as
+   *  conforming. The rows are reused rather than restated, so one clause has one row and one citation
+   *  wherever it is read. Their key-usage rows govern the same bits this profile's own rows do, at the
+   *  same strength, so a certificate breaking both is told twice from two documents rather than once
+   *  from a rule that quietly replaced the other. */
+  "cnsa-2.0": CNSA2_RULES.concat(RFC9881_RULES).concat(RFC9935_RULES)
+    .concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
 var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
   .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES).concat(CABF_CS_RULES).concat(ETSI_QC_RULES)
   /** @internal The root-program rows are in the registry so `rules()` enumerates them, and stay
    * inert under the default set because each one asks whether the caller named the profile. */
-  .concat(MOZILLA_RULES).concat(CHROME_RULES).concat(MICROSOFT_RULES).concat(APPLE_RULES);
+  .concat(MOZILLA_RULES).concat(CHROME_RULES).concat(MICROSOFT_RULES).concat(APPLE_RULES)
+  .concat(NIST_TRANSITION_RULES).concat(CNSA2_RULES);
 
 var CABF_TLS_CSR_RULES = CABF_TLS_RULES.filter(function (r) {
   return CABF_TLS_CSR_RULE_IDS.indexOf(r.id) !== -1;
@@ -5731,13 +6479,50 @@ function _ingestCsr(input) {
   catch (e) { return { fatal: { id: "lint/unparseable", severity: "fatal", source: "engine", citation: "RFC 2986", message: "input is not a well-formed PKCS#10 certification request", context: { code: e.code } } }; }
 }
 
+/** @internal The noun each verb's refusal calls its own artifact. The keys are `BY_ARTIFACT`'s, and
+ *  each one is also its verb's name under `pki.lint`, so a message can name the verb from the key. */
+var ARTIFACT_NOUN = Object.assign(Object.create(null), {
+  certificate: "certificate", csr: "certification-request", crl: "CRL", ocsp: "OCSP",
+  cms: "CMS", tsp: "timestamp", attrcert: "attribute-certificate",
+});
+
+/** @internal The refusal a verb gives for a profile name it does not run, read from the SAME
+ *  registry-of-registries `rules` dispatches on. So a name carried by more than one artifact names
+ *  every verb that runs it, and every verb answers the same way about it. Each verb used to carry its
+ *  own chain of `else if`, naming one artifact per branch in a different order, which made the answer
+ *  for a name in two registries depend on which verb was asked, and each chain omitted the registries
+ *  nobody had added a branch for: a CMS profile name reached `pki.lint.crl` as simply unknown. */
+/** @internal "a" or "an" for a noun this file names, decided by the sound its first letter carries:
+ *  each of these nouns reads as a vowel exactly when it begins with one, since `CRL` and `CMS` are
+ *  read letter by letter and begin with a consonant sound. */
+function _article(noun) {
+  var c = noun.charAt(0);
+  return (c === "a" || c === "e" || c === "i" || c === "o" || c === "u" ||
+    c === "A" || c === "E" || c === "I" || c === "O" || c === "U") ? "an" : "a";
+}
+function _joinAnd(list) {
+  if (list.length <= 1) return list.join("");
+  return list.slice(0, -1).join(", ") + " and " + list[list.length - 1];
+}
+function _profileRefusal(profile, mine) {
+  var homes = Object.keys(BY_ARTIFACT).filter(function (a) {
+    return a !== mine && Object.prototype.hasOwnProperty.call(BY_ARTIFACT[a], profile);
+  });
+  var label = _article(ARTIFACT_NOUN[mine]) + " " + ARTIFACT_NOUN[mine] + " lint profile";
+  if (!homes.length) {
+    return _cfg("lint/unknown-profile", "unknown " + ARTIFACT_NOUN[mine] + " lint profile \"" +
+      profile + "\" (known: " + Object.keys(BY_ARTIFACT[mine]).join(", ") + ")");
+  }
+  var nouns = homes.map(function (a) { return ARTIFACT_NOUN[a]; });
+  var verbs = homes.map(function (a) { return "pki.lint." + a; });
+  return _cfg("lint/unknown-profile", "\"" + profile + "\" is not " + label + "; it is " +
+    _article(nouns[0]) + " " + _joinAnd(nouns) + " profile, which " + _joinAnd(verbs) +
+    (verbs.length === 1 ? " runs" : " run"));
+}
+
 function _selectRules(profile) {
   if (profile == null || profile === "all" || profile === "default") return ALL_RULES;
-  if (!PROFILES[profile]) {
-    if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
-    if (OCSP_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is an OCSP profile; lint a response with pki.lint.ocsp");
-    throw _cfg("lint/unknown-profile", "unknown lint profile \"" + profile + "\" (known: " + Object.keys(PROFILES).join(", ") + ")");
-  }
+  if (!PROFILES[profile]) throw _profileRefusal(profile, "certificate");
   return PROFILES[profile];
 }
 
@@ -5773,7 +6558,9 @@ function _applyThreshold(report, severity) {
  *                  a CA certificate reports that CA against subscriber requirements. The CA
  *                  profiles of section 7.1.2.10 are a separate set this does not yet carry. Left
  *                  unnamed, a certificate is held to those rows only where it asserts
- *                  id-kp-serverAuth and is not a CA.
+ *                  id-kp-serverAuth and is not a CA. `"nist-pqc-transition"` and `"cnsa-2.0"` are
+ *                  named the same way: which algorithm policy a certificate is held to is the
+ *                  caller's assertion, so neither is detected and both are inert until named.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and
  *                  `worst` always reflect the complete, unfiltered result.
  * @example
@@ -5872,8 +6659,10 @@ function _ingestCrl(input) {
  * extension repeated on the CRL or on an entry (section 4.2) each arrive as `lint/unparseable`
  * carrying the parser's own code.
  *
- * @opts  profile   `"rfc5280-crl"`, the only CRL profile (default runs every CRL rule). A
- *                  certificate profile name is refused rather than run against a CRL.
+ * @opts  profile   `"rfc5280-crl"`, or `"cnsa-2.0"` for the one rule that profile states about a
+ *                  CRL's signature (default runs every CRL rule, and the `cnsa-2.0` rule is inert
+ *                  unless named). A profile name this verb does not run is refused, and the refusal
+ *                  names the verb that does.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
  *                  always reflect the complete, unfiltered result.
  * @example
@@ -5946,10 +6735,7 @@ function csr(input, opts) {
   var rules_;
   if (profile == null || profile === "all" || profile === "default") rules_ = ALL_CSR_RULES;
   else if (CSR_PROFILES[profile]) rules_ = CSR_PROFILES[profile];
-  else if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
-  else if (OCSP_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is an OCSP profile; lint a response with pki.lint.ocsp");
-  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
-  else throw _cfg("lint/unknown-profile", "unknown certification-request lint profile \"" + profile + "\" (known: " + Object.keys(CSR_PROFILES).join(", ") + ")");
+  else throw _profileRefusal(profile, "csr");
 
   var ingested = _ingestCsr(input);
   var report;
@@ -5977,9 +6763,7 @@ function crl(input, opts) {
   var rules_;
   if (profile == null || profile === "all" || profile === "default") rules_ = ALL_CRL_RULES;
   else if (CRL_PROFILES[profile]) rules_ = CRL_PROFILES[profile];
-  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
-  else if (OCSP_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is an OCSP profile; lint a response with pki.lint.ocsp");
-  else throw _cfg("lint/unknown-profile", "unknown CRL lint profile \"" + profile + "\" (known: " + Object.keys(CRL_PROFILES).join(", ") + ")");
+  else throw _profileRefusal(profile, "crl");
 
   var ingested = _ingestCrl(input);
   var report;
@@ -6058,8 +6842,9 @@ function _ingestOcsp(input) {
  * is `pki.ocsp.verify`'s, and the certificates in `certs` are linted with `pki.lint.certificate`.
  *
  * @opts  profile   `"rfc6960"` or `"rfc5019"` (default runs the rfc6960 rows and marks the rfc5019
- *                  rows not applicable). A certificate or CRL profile name is refused rather than
- *                  run against a response.
+ *                  rows not applicable), or `"cnsa-2.0"` for the one rule that profile states about
+ *                  a response's signature. A profile name this verb does not run is refused, and the
+ *                  refusal names the verb that does.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
  *                  always reflect the complete, unfiltered result.
  * @example
@@ -6089,9 +6874,7 @@ function ocsp(input, opts) {
   var rules_;
   if (profile == null || profile === "all" || profile === "default") rules_ = ALL_OCSP_RULES;
   else if (OCSP_PROFILES[profile]) rules_ = OCSP_PROFILES[profile];
-  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
-  else if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
-  else throw _cfg("lint/unknown-profile", "unknown OCSP lint profile \"" + profile + "\" (known: " + Object.keys(OCSP_PROFILES).join(", ") + ")");
+  else throw _profileRefusal(profile, "ocsp");
 
   var ingested = _ingestOcsp(input);
   var report;
@@ -6193,10 +6976,7 @@ function cms(input, opts) {
   var rules_;
   if (profile == null || profile === "all" || profile === "default") rules_ = ALL_CMS_RULES;
   else if (CMS_PROFILES[profile]) rules_ = CMS_PROFILES[profile];
-  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
-  else if (CRL_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CRL profile; lint a CRL with pki.lint.crl");
-  else if (OCSP_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is an OCSP profile; lint a response with pki.lint.ocsp");
-  else throw _cfg("lint/unknown-profile", "unknown CMS lint profile \"" + profile + "\" (known: " + Object.keys(CMS_PROFILES).join(", ") + ")");
+  else throw _profileRefusal(profile, "cms");
 
   var ingested = _ingestCms(input);
   var report;
@@ -6283,9 +7063,7 @@ function tsp(input, opts) {
   var rules_;
   if (profile == null || profile === "all" || profile === "default") rules_ = ALL_TSP_RULES;
   else if (TSP_PROFILES[profile]) rules_ = TSP_PROFILES[profile];
-  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
-  else if (CMS_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CMS profile; lint a message with pki.lint.cms");
-  else throw _cfg("lint/unknown-profile", "unknown timestamp lint profile \"" + profile + "\" (known: " + Object.keys(TSP_PROFILES).join(", ") + ")");
+  else throw _profileRefusal(profile, "tsp");
 
   var ingested = _ingestTsp(input);
   var report;
@@ -6374,9 +7152,7 @@ function attrcert(input, opts) {
   var rules_;
   if (profile == null || profile === "all" || profile === "default") rules_ = ALL_AC_RULES;
   else if (AC_PROFILES[profile]) rules_ = AC_PROFILES[profile];
-  else if (PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a certificate profile; lint a certificate with pki.lint.certificate");
-  else if (CMS_PROFILES[profile]) throw _cfg("lint/unknown-profile", "\"" + profile + "\" is a CMS profile; lint a message with pki.lint.cms");
-  else throw _cfg("lint/unknown-profile", "unknown attribute certificate lint profile \"" + profile + "\" (known: " + Object.keys(AC_PROFILES).join(", ") + ")");
+  else throw _profileRefusal(profile, "attrcert");
 
   var ingested = _ingestAttrCert(input);
   var report;
@@ -6442,10 +7218,9 @@ function rules(profile, artifact) {
       .concat(ALL_CMS_RULES).concat(ALL_TSP_RULES).concat(ALL_AC_RULES);
   } else if (artifact != null) {
     set = BY_ARTIFACT[artifact][profile];
-    if (!set) {
-      throw _cfg("lint/unknown-profile", "\"" + profile + "\" is not a " + artifact +
-        " lint profile (known: " + Object.keys(BY_ARTIFACT[artifact]).join(", ") + ")");
-    }
+    /** @internal The same refusal the VERB for this artifact gives, so asking the enumerator where a
+     * profile lives and asking the verb to run it are answered by one sentence rather than two. */
+    if (!set) throw _profileRefusal(profile, artifact);
   } else {
     set = PROFILES[profile] || CRL_PROFILES[profile] || OCSP_PROFILES[profile] ||
       CSR_PROFILES[profile] || CMS_PROFILES[profile] || TSP_PROFILES[profile] ||
@@ -6476,8 +7251,9 @@ function rules(profile, artifact) {
  * @example
  *   pki.lint.profiles();
  *   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "cabf-smime", "cabf-cs",
- *   //     "etsi-qc", "mozilla-root", "chrome-root", "microsoft-root", "apple-root", "rfc2986",
- *   //     "rfc5280-crl", "rfc6960", "rfc5019", "rfc5652", "rfc3161", "rfc5755"]
+ *   //     "etsi-qc", "mozilla-root", "chrome-root", "microsoft-root", "apple-root",
+ *   //     "nist-pqc-transition", "cnsa-2.0", "rfc2986", "rfc5280-crl", "rfc6960", "rfc5019",
+ *   //     "rfc5652", "rfc3161", "rfc5755"]
  */
 /** @internal `cabf-tls` names the certificate profile in this list and is not repeated for the
  *  request form: `pki.lint.csr` takes the same name and runs those rows against what a request
@@ -6497,6 +7273,126 @@ function profiles() {
   return out;
 }
 
+/** @internal The rules the build-time gate does not refuse on because the SPEC does not place the
+ * requirement on the issuer, keyed by the last segment of the rule id so one entry answers for every
+ * profile carrying the rule: a certificate reports lint/rfc5280/unknown-critical-extension and a
+ * revocation list reports lint/rfc5280-crl/unknown-critical-extension, and the two state one
+ * requirement. The value is the reason, read by the gate's conformance vectors rather than restated.
+ *
+ * The other reason a rule cannot apply, that it reads a signature the gate has not produced yet, is
+ * not a name here: those rules declare `readsSignatureValue` where they are defined, and
+ * SIGNATURE_VALUE_RULES below derives the set from the same registries `rules()` walks. A rule that
+ * starts reading the signature value therefore exempts itself, and a vector measures the declared set
+ * against the rules whose verdict actually moves with the signature. */
+var BUILD_GATE_EXEMPT = Object.assign(Object.create(null), {
+  "unknown-critical-extension": "RFC 5280 sec. 4.2 places this requirement on \"a certificate-using system\", so the rule reports what a relying party owes rather than what an issuer does. It covers two artifacts an issuer may conform in emitting: one carrying a critical extension the specification does not identify, which the same section permits a conforming CA to support, and one carrying an extension the specification does identify but this toolkit's own path validation does not process, such as a critical policyMappings",
+});
+
+/** @internal Every rule id whose verdict reads the signature VALUE, derived at load from the rule rows
+ * themselves rather than listed. The gate runs on an artifact carrying a placeholder signature, so one
+ * of these answers about the placeholder and not about what the caller is asking to emit. */
+var SIGNATURE_VALUE_RULES = (function () {
+  var out = Object.create(null);
+  Object.keys(BY_ARTIFACT).forEach(function (artifact) {
+    Object.keys(BY_ARTIFACT[artifact]).forEach(function (name) {
+      BY_ARTIFACT[artifact][name].forEach(function (r) {
+        if (r.readsSignatureValue === true) out[r.id] = true;
+      });
+    });
+  });
+  return out;
+})();
+
+/** @internal The profile whose rows an artifact is held to whatever the caller names. RFC 5280 states
+ * the contract a certificate and a revocation list are written to and RFC 2986 the one a request is,
+ * so these run on every authoring call and `opts.profile` names rows beside them. */
+var BUILD_GATE_ALWAYS = Object.assign(Object.create(null), {
+  certificate: "rfc5280", csr: "rfc2986", crl: "rfc5280-crl",
+});
+
+var BUILD_GATE_VERB = Object.assign(Object.create(null), {
+  certificate: certificate, csr: csr, crl: crl,
+});
+
+/** @internal The profile name that runs no rules. A toolkit that cannot emit a non-conforming artifact
+ * cannot build the corpus its own linter is tested against, and an operator reproducing a real
+ * misissuance needs the same. The escape is a name the caller writes rather than an absence, so a
+ * non-conforming artifact is one somebody asked for: the gate is closed by default and every refusal
+ * names this among the profiles it would accept. */
+var BUILD_GATE_NONE = "none";
+
+/** @internal The exemption table, copied so a caller cannot edit the gate's own line. The gate's
+ * vectors read the reasons from here, which is why it is reachable at all. */
+function buildGateExemptions() {
+  return Object.assign(Object.create(null), BUILD_GATE_EXEMPT);
+}
+
+/** @internal The rule ids that declared they read the signature value, for the vector that measures
+ * this set against the rules whose verdict actually moves when the signature does. */
+function buildGateSignatureRules() {
+  return Object.assign(Object.create(null), SIGNATURE_VALUE_RULES);
+}
+
+/** @internal The profile a build-time gate always runs for this artifact, for a vector that derives
+ * the expected rule set from the same name the gate uses. */
+function buildGateProfile(artifact) {
+  return BUILD_GATE_ALWAYS[artifact] || null;
+}
+
+function _buildGateTail(id) {
+  var cut = id.lastIndexOf("/");
+  return cut === -1 ? id : id.slice(cut + 1);
+}
+
+/**
+ * @internal Refuse a profile name an authoring verb cannot run, under the CALLER's code, so
+ * `pki.x509.sign` reports an unknown profile in its own domain as it reports every other bad option.
+ * The sentence is the one `pki.lint.rules` gives for the same name, so asking the linter where a
+ * profile lives and asking a builder to hold an artifact to it are answered alike.
+ */
+function assertKnownBuildProfile(artifact, profile, E, code) {
+  if (profile == null || profile === BUILD_GATE_NONE) return;
+  if (typeof profile !== "string") {
+    throw E(code, "profile must be the name of a lint profile (known: " +
+      Object.keys(BY_ARTIFACT[artifact]).join(", ") + ", " + BUILD_GATE_NONE + ")");
+  }
+  if (!Object.prototype.hasOwnProperty.call(BY_ARTIFACT[artifact], profile)) {
+    throw E(code, _profileRefusal(profile, artifact).message + ", or \"" + BUILD_GATE_NONE +
+      "\" to emit what the spec describes without holding it to a profile");
+  }
+}
+
+/**
+ * @internal Refuse to emit an artifact this toolkit's own linter grades `error` or worse. The caller
+ * passes the artifact it is about to sign, carrying a placeholder signature, and the gate runs the
+ * always-on profile for that artifact plus the one the caller named. A finding whose rule id is in
+ * BUILD_GATE_EXEMPT is passed over, and every other one throws under the caller's code naming the
+ * rule and its citation.
+ *
+ * Standards are the contract, so this runs before the signing key is reached: a certificate that was
+ * signed and then discarded is still one a key signed and an audit log recorded. A caller naming the
+ * profile "none" gets no rules and whatever the spec describes.
+ */
+function assertBuildClean(artifact, der, profile, E, code) {
+  if (profile === BUILD_GATE_NONE) return;
+  var verb = BUILD_GATE_VERB[artifact];
+  var reports = [verb(der, { profile: BUILD_GATE_ALWAYS[artifact] })];
+  if (profile != null && profile !== BUILD_GATE_ALWAYS[artifact]) {
+    reports.push(verb(der, { profile: profile }));
+  }
+  for (var r = 0; r < reports.length; r++) {
+    var found = reports[r].findings;
+    for (var i = 0; i < found.length; i++) {
+      var f = found[i];
+      if (f.severity !== "error" && f.severity !== "fatal") continue;
+      if (SIGNATURE_VALUE_RULES[f.id]) continue;
+      if (BUILD_GATE_EXEMPT[_buildGateTail(f.id)]) continue;
+      throw E(code, "this spec describes " + _article(ARTIFACT_NOUN[artifact]) + " " +
+        ARTIFACT_NOUN[artifact] + " that violates " + f.id + " (" + f.citation + "): " + f.message);
+    }
+  }
+}
+
 module.exports = {
   certificate: certificate,
   csr: csr,
@@ -6507,4 +7403,9 @@ module.exports = {
   attrcert: attrcert,
   rules: rules,
   profiles: profiles,
+  assertBuildClean: assertBuildClean,
+  assertKnownBuildProfile: assertKnownBuildProfile,
+  buildGateExemptions: buildGateExemptions,
+  buildGateSignatureRules: buildGateSignatureRules,
+  buildGateProfile: buildGateProfile,
 };