@blamejs/pki 0.8.50 → 0.8.52

package/lib/est.js

@@ -85,6 +85,15 @@ var _Promise = intrinsic.Promise;
  *  is handed is taken with it, since a replacement answers with a host of its own. */
 var _URL = intrinsic.URL;
 var _stringOf = intrinsic.String;
+/** @internal And the accessors its result is read through: capturing the constructor does not capture
+ *  the prototype the value reads its parts off, and each part here decides something, the scheme
+ *  whether the request is allowed, the origin whether credentials may still be sent after a redirect. */
+var _urlHref = intrinsic.urlHref;
+var _urlOrigin = intrinsic.urlOrigin;
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlPathname = intrinsic.urlPathname;
+var _urlSearch = intrinsic.urlSearch;
+var _urlHash = intrinsic.urlHash;
 var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
 var pkix = require("./schema-pkix");
@@ -810,7 +819,8 @@ function _parseUrl(urlStr) {
   var url;
   try { url = new _URL(_stringOf(urlStr)); }
   catch (e) { throw E("est/bad-url", "the EST server URL did not parse: " + String(urlStr), e); }
-  if (url.protocol !== "https:") throw E("est/insecure-url", "EST requires https (RFC 7030 sec. 3.3), got " + url.protocol + " for " + urlStr);
+  var scheme = _urlProtocol(url);
+  if (scheme !== "https:") throw E("est/insecure-url", "EST requires https (RFC 7030 sec. 3.3), got " + scheme + " for " + urlStr);
   return url;
 }
 
@@ -823,11 +833,12 @@ function _tlsForRequest(opts) {
 function _redirectTarget(current, location, method, opts) {
   if (location == null || String(location).trim() === "") throw E("est/http-error", "a redirect response carried no Location header");
   var resolved;
-  try { resolved = new _URL(_stringOf(location), current.href); }
+  try { resolved = new _URL(_stringOf(location), _urlHref(current)); }
   catch (e) { throw E("est/bad-url", "a redirect Location did not parse: " + location, e); }
-  if (resolved.protocol !== "https:") throw E("est/insecure-redirect", "a redirect to a non-https URL is refused (RFC 7030 sec. 3.2.1): " + resolved.protocol);
+  var resolvedScheme = _urlProtocol(resolved);
+  if (resolvedScheme !== "https:") throw E("est/insecure-redirect", "a redirect to a non-https URL is refused (RFC 7030 sec. 3.2.1): " + resolvedScheme);
   var safeMethod = method === "GET" || method === "HEAD";
-  if (resolved.origin !== current.origin && !safeMethod && !opts.allowCrossOriginRedirect) {
+  if (_urlOrigin(resolved) !== _urlOrigin(current) && !safeMethod && !opts.allowCrossOriginRedirect) {
     throw E("est/cross-origin-redirect", "a cross-origin redirect on a " + method + " needs opts.allowCrossOriginRedirect (RFC 7030 sec. 3.2.1)");
   }
   return resolved;
@@ -890,10 +901,10 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   var staleRetries = 0;
   var authSpaces = 0;
   var lastDigestNonce = null;
-  var initialOrigin = url.origin;
+  var initialOrigin = _urlOrigin(url);
   function _tlsFor(u) {
     var t = budgets.tls;
-    if (t && u.origin !== initialOrigin) {
+    if (t && _urlOrigin(u) !== initialOrigin) {
       t = Object.assign({}, t);
       t.cert = null; t.key = null; t.servername = null;
     }
@@ -905,20 +916,26 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   var digestSent = false;
   function _headersFor(u) {
     digestSent = false;
-    if (u.origin !== initialOrigin || (!authValue && !digestChallenge)) return headers;
+    /** @internal The origin and the request target are each read ONCE and both the protection-space
+     *  test and the answer are built from those locals: the credential is bound to the target it is
+     *  computed over, so a part answering two reads differently would answer for one target and be
+     *  sent to another. */
+    var uOrigin = _urlOrigin(u);
+    var uTarget = _urlPathname(u) + _urlSearch(u);
+    if (uOrigin !== initialOrigin || (!authValue && !digestChallenge)) return headers;
     var hh = guard.identifier.ownOptions(headers);
     if (digestChallenge) {
-      if (!httpDigest.inProtectionSpace(digestChallenge, u.origin, u.pathname + u.search)) return headers;
+      if (!httpDigest.inProtectionSpace(digestChallenge, uOrigin, uTarget)) return headers;
       var nkey = digestChallenge.nonce;
       digestNcByNonce[nkey] = (digestNcByNonce[nkey] || 0) + 1;
-      hh.authorization = httpDigest.answer(digestChallenge, { method: method, uri: u.pathname + u.search, username: _authUser(opts), password: _authPass(opts), body: body, nc: digestNcByNonce[nkey], policy: _digestPolicy(opts) }, E);
+      hh.authorization = httpDigest.answer(digestChallenge, { method: method, uri: uTarget, username: _authUser(opts), password: _authPass(opts), body: body, nc: digestNcByNonce[nkey], policy: _digestPolicy(opts) }, E);
       digestSent = true;
     } else { hh.authorization = authValue; }
     return hh;
   }
   function step() {
     var hopBody = (typeof body === "function" && budgets.onAttempt) ? budgets.onAttempt() : body;
-    return guard.async.invoked(transport, [{ method: method, url: url.href, headers: _headersFor(url), body: hopBody, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "est/bad-input", "opts.transport").then(function (res) {
+    return guard.async.invoked(transport, [{ method: method, url: _urlHref(url), headers: _headersFor(url), body: hopBody, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "est/bad-input", "opts.transport").then(function (res) {
       res = res || {};
       var blen = _bodyLen(res);
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
@@ -939,7 +956,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
         return step();
       }
       if (status === 401) {
-        if (url.origin !== initialOrigin) throw E("est/auth-required", "refusing to send HTTP credentials to a redirected origin (RFC 7030 sec. 3.6)");
+        if (_urlOrigin(url) !== initialOrigin) throw E("est/auth-required", "refusing to send HTTP credentials to a redirected origin (RFC 7030 sec. 3.6)");
         var www = String(h["www-authenticate"] || "");
         if (www.length > constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES) throw E("est/auth-required", "the WWW-Authenticate header exceeds the " + constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES + "-byte cap (RFC 7030 sec. 3.2.3)");
         var scheme = _authScheme(opts);
@@ -951,8 +968,8 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
           selPol.preferStale = digestSent;
           selPol.priorNonce = lastDigestNonce;
           selPol.priorRealm = digestChallenge && digestChallenge.realm;
-          selPol.requestOrigin = url.origin;
-          selPol.requestTarget = url.pathname + url.search;
+          selPol.requestOrigin = _urlOrigin(url);
+          selPol.requestTarget = _urlPathname(url) + _urlSearch(url);
           var ch = httpDigest.parseChallenge(www, E, "est/digest-bad-challenge", selPol);
           if (!ch) throw E("est/auth-required", "the server offered no usable Digest challenge: " + www);
           if (digestSent && digestChallenge && ch.realm === digestChallenge.realm) {
@@ -988,7 +1005,7 @@ function _client(op, method, baseUrl, body, headers, opts, proxySnap, onAttempt,
   var base;
   try { base = new _URL(_stringOf(baseUrl)); }
   catch (e) { throw E("est/bad-url", "the EST base URL did not parse: " + guard.text.showValue(baseUrl), e); }
-  if (base.search || base.hash) throw E("est/bad-url", "the EST base URL must not carry a query or fragment component (RFC 7030 sec. 3.2.2)");
+  if (_urlSearch(base) || _urlHash(base)) throw E("est/bad-url", "the EST base URL must not carry a query or fragment component (RFC 7030 sec. 3.2.2)");
   var url = _parseUrl(paths(baseUrl, { label: opts.label })[op]);
   var transport = checked !== undefined ? checked : _assertTransport(opts);
   if (!transport) {

package/lib/guard-intrinsic.js

@@ -85,6 +85,7 @@ var _urlOrigin = getter(URL.prototype, "origin", "URL.prototype");
 var _urlProtocol = getter(URL.prototype, "protocol", "URL.prototype");
 var _urlPathname = getter(URL.prototype, "pathname", "URL.prototype");
 var _urlSearch = getter(URL.prototype, "search", "URL.prototype");
+var _urlHash = getter(URL.prototype, "hash", "URL.prototype");
 var _urlHostname = getter(URL.prototype, "hostname", "URL.prototype");
 var _urlPort = getter(URL.prototype, "port", "URL.prototype");
 var _urlUsername = getter(URL.prototype, "username", "URL.prototype");
@@ -92,6 +93,7 @@ var _urlPassword = getter(URL.prototype, "password", "URL.prototype");
 var _urlSearchParams = getter(URL.prototype, "searchParams", "URL.prototype");
 var _urlSetPathname = setter(URL.prototype, "pathname", "URL.prototype");
 var _urlSetSearch = setter(URL.prototype, "search", "URL.prototype");
+var _urlSetHash = setter(URL.prototype, "hash", "URL.prototype");
 var _asyncIterator = Symbol.asyncIterator;
 
 var _arrForEach = uncurry(Array.prototype.forEach);
@@ -275,6 +277,7 @@ module.exports = Object.freeze({
   urlProtocol: _urlProtocol,
   urlPathname: _urlPathname,
   urlSearch: _urlSearch,
+  urlHash: _urlHash,
   urlHostname: _urlHostname,
   urlPort: _urlPort,
   urlUsername: _urlUsername,
@@ -282,6 +285,7 @@ module.exports = Object.freeze({
   urlSearchParams: _urlSearchParams,
   urlSetPathname: _urlSetPathname,
   urlSetSearch: _urlSetSearch,
+  urlSetHash: _urlSetHash,
   asyncIterator: _asyncIterator,
   forEach: _arrForEach,
   map: _arrMap,

package/lib/guard-time.js

@@ -19,17 +19,112 @@ var _dateGetUTCMinutes = require("./guard-intrinsic").uncurry(Date.prototype.get
 var _dateGetUTCSeconds = require("./guard-intrinsic").uncurry(Date.prototype.getUTCSeconds);
 var _dateGetUTCMilliseconds = require("./guard-intrinsic").uncurry(Date.prototype.getUTCMilliseconds);
 var _dateSetUTCFullYear = require("./guard-intrinsic").uncurry(Date.prototype.setUTCFullYear);
+var _dateToISOString = require("./guard-intrinsic").uncurry(Date.prototype.toISOString);
+var _charCodeAt = require("./guard-intrinsic").uncurry(String.prototype.charCodeAt);
+var _Number = require("./guard-intrinsic").Number;
+var constants = require("./constants");
+/** @internal RFC 3161 clause 2.4.2 states an Accuracy's third field in microseconds, which no
+ *  `C.TIME` scale names because no PKI structure carries a microsecond duration anywhere else. */
+var MICROS_PER_MILLISECOND = 1000;
 var _dateUTC = Date.UTC;
 var _floor = Math.floor;
 var _ceil = Math.ceil;
 /** @internal A DER GeneralizedTime carries a four-digit year and a UTCTime a narrower one, so a Date
  *  outside 0000..9999 has no PKI encoding. */
 var DER_YEAR_MIN = 0, DER_YEAR_MAX = 9999;
+/** @internal The widest accuracy a date comparison can use, the DER year range in seconds, and the
+ *  instant a wider one saturates to: the last instant a DER time can carry, which is past every
+ *  certificate date and, unlike an arbitrary ceiling, is a `Date` a verdict can render. Declared
+ *  after the range it derives from, since a `var` read above its own initializer is `undefined`. */
+var MAX_ACCURACY_SECONDS = constants.TIME.days((DER_YEAR_MAX + 1) * 366) / constants.TIME.seconds(1);
+var MAX_INSTANT = _dateUTC(DER_YEAR_MAX, 11, 31, 23, 59, 59, 999);
 
 // @enforced-by guard-shape-reinlined
 // @guard-shape \.getTime\s*\(
 function instantOf(value) { return _dateGetTime(value); }
 
+/** The instant an error message or a verdict names, rendered through the operation captured at load.
+ *  A replaced `toISOString` chooses the time a refusal reports, which is what an operator reads when
+ *  deciding whether the refusal was right, so the rendering is taken from the same place every other
+ *  read of a Date is.
+ *
+ * @enforced-by behavioral -- the live-read budget each module declares is what holds a call-time
+ * `toISOString` out of a converted file; a `@guard-shape` here would name the read in every module
+ * that renders a date and the budget already answers for those.
+ */
+function isoOf(value) { return _dateToISOString(value); }
+
+/** The instant a DER GeneralizedTime names, rounded UP to the next whole millisecond where its
+ *  fractional seconds carry a digit a `Date` cannot hold. `fraction` is the fraction's digit string;
+ *  the first three digits ARE the milliseconds, so a nonzero digit after them puts the real instant
+ *  strictly between `value` and `value + 1ms`.
+ *
+ *  An upper bound is decided against this rather than against the Date, because the Date truncates:
+ *  a time stamped at `...000000.000001Z` reads as `...000000.000Z`, which compares equal to a bound
+ *  of `...000000Z` and so passes an "after the bound" test it is on the wrong side of. The two
+ *  consumers are the timestamp verifier's own check of the authority's certificate window and the
+ *  signature-timestamp row's check of the signing certificate's expiry.
+ *
+ * @enforced-by behavioral -- a truncating comparison has no rename-proof shape; the RED vector is a
+ * token minted with a sub-millisecond fraction one tick past a certificate's notAfter.
+ */
+function ceilInstantOf(value, fraction) { return latestInstantOf(value, fraction, null); }
+
+/** @internal The part of a DER GeneralizedTime's fractional seconds a `Date` cannot hold, in whole
+ *  microseconds. The first three digits ARE the milliseconds; the next three are microseconds, and
+ *  anything finer than a microsecond counts as one, since a bound is only a bound if it is not
+ *  exceeded. Read digit by digit through the captured accessor: a fraction is caller bytes. */
+function _fractionMicros(fraction) {
+  if (typeof fraction !== "string" || fraction.length <= 3) return 0;
+  var micros = 0;
+  var finer = false;
+  for (var i = 3; i < fraction.length; i++) {
+    var c = _charCodeAt(fraction, i);
+    if (c < 48 || c > 57) break;
+    var digit = c - 48;
+    if (i === 3) micros += digit * 100;
+    else if (i === 4) micros += digit * 10;
+    else if (i === 5) micros += digit;
+    else if (digit > 0) finer = true;
+  }
+  return finer ? micros + 1 : micros;
+}
+
+/** The LATEST instant a timestamp could have been created at: its `genTime` ceiling plus the
+ *  accuracy the token states. RFC 3161 clause 2.4.2 defines accuracy as the bound on the difference
+ *  between the stated time and the real one, so a token saying it is accurate to two seconds places
+ *  its creation anywhere in a four-second window, and an upper bound that reads only `genTime`
+ *  concludes something the token does not establish. `accuracy` is the parsed `{ seconds, millis,
+ *  micros }` or null; `seconds` arrives as a BigInt, the other two as numbers, and a micros
+ *  remainder rounds up because a bound is only a bound if it is not exceeded.
+ *
+ * @enforced-by behavioral -- a bound that ignores a field has no rename-proof shape; the RED vector
+ * is a token whose genTime precedes a certificate's notAfter while its accuracy window does not.
+ */
+function latestInstantOf(value, fraction, accuracy) {
+  var at = instantOf(value);
+  var ms = 0;
+  /** @internal The sub-millisecond parts are summed and rounded ONCE. Rounding the genTime fraction
+   *  and the accuracy up separately overstates the bound by a millisecond when both carry one, which
+   *  refuses a token whose real window ends before the instant it is compared against. */
+  var micros = _fractionMicros(fraction);
+  if (accuracy !== null && typeof accuracy === "object") {
+    /** @internal An Accuracy's seconds field is an arbitrary-size INTEGER, so it is bounded BEFORE
+     *  it is scaled: a token claiming more than the DER time range can hold is saturated to the
+     *  widest instant rather than scaled into a value the scale helper refuses. The refusal would
+     *  escape the row this builds and take the whole verify call down, where what the token has
+     *  established is nothing about which side of any certificate date it falls on, which is the
+     *  answer a saturated bound gives. */
+    if (accuracy.seconds > MAX_ACCURACY_SECONDS) return MAX_INSTANT;
+    if (typeof accuracy.seconds === "bigint") ms += constants.TIME.seconds(_Number(accuracy.seconds));
+    else if (typeof accuracy.seconds === "number") ms += constants.TIME.seconds(accuracy.seconds);
+    if (typeof accuracy.millis === "number") ms += constants.TIME.milliseconds(accuracy.millis);
+    if (typeof accuracy.micros === "number") micros += accuracy.micros;
+  }
+  if (micros > 0) ms += _ceil(micros / MICROS_PER_MILLISECOND);
+  return ms > 0 ? at + ms : at;
+}
+
 // @enforced-by nan-date-comparison-unguarded
 function assertValid(value, E, code, label) {
   if (!util.types.isDate(value) || _isNaN(instantOf(value))) {
@@ -120,6 +215,9 @@ module.exports = _freeze({
   assertEncodable: assertEncodable,
   addMonths: addMonths,
   instantOf: instantOf,
+  isoOf: isoOf,
+  ceilInstantOf: ceilInstantOf,
+  latestInstantOf: latestInstantOf,
   isDate: isDate,
   toDate: toDate,
   within: within,

package/lib/http-digest.js

@@ -7,8 +7,13 @@ var crypto = require("crypto");
 var constants = require("./constants");
 var intrinsic = require("./guard-intrinsic");
 var _hasOwn = intrinsic.hasOwn;
-/** @internal The URL parser, taken at load: the origin it reports is what a challenge is bound to. */
+/** @internal The URL parser, taken at load: the origin it reports is what a challenge is bound to.
+ *  Its accessors are taken with it, since the constructor's capture does not cover the prototype the
+ *  value reads its parts off and this origin is what a credential is scoped by. */
 var _URL = intrinsic.URL;
+var _urlOrigin = intrinsic.urlOrigin;
+var _urlPathname = intrinsic.urlPathname;
+var _urlSearch = intrinsic.urlSearch;
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _fromCharCode = intrinsic.fromCharCode;
@@ -295,7 +300,7 @@ function answer(challenge, params, E) {
 function _domainEntry(d) {
   d = String(d == null ? "" : d);
   if (d.charAt(0) === "/") return { origin: null, full: d };
-  try { var u = new _URL(d); return { origin: u.origin.toLowerCase(), full: (u.pathname || "/") + (u.search || "") }; }
+  try { var u = new _URL(d); return { origin: _urlOrigin(u).toLowerCase(), full: (_urlPathname(u) || "/") + (_urlSearch(u) || "") }; }
   catch (_e) { return null; }
 }
 

package/lib/inspect.js

@@ -449,8 +449,9 @@ var EXT_RENDERERS = Object.assign(Object.create(null), {
     }
     return akiLines.length ? akiLines.join("\n") : inner + "keyid:(none)";
   },
-  /** @internal RFC 7633 sec. 6 carries TLS ExtensionType values, so each is named from the registry
-   *  where the toolkit knows it and printed as its number where it does not. */
+  /** @internal RFC 7633 sec. 4.1 binds these values to the IANA TLS Extensions registry, so each is
+   *  named from the registry where the toolkit knows it and printed as its number where it does not.
+   *  sec. 6 is IANA Considerations and registers the extension's own OID; it carries no value. */
   tlsFeature: function (decoded, inner) {
     return (decoded.features || []).map(function (f) {
       var text = String(f);

package/lib/lint.js

@@ -303,9 +303,16 @@ var OID_CPS = oid.byName("cps");
 /** @internal The extensions RFC 5280 says a conforming CA SHOULD mark non-critical, keyed by OID
  *  with the clause; the MUSTs live in the shared CERT_FIXED_CRITICALITY table. The subjectAltName
  *  and extKeyUsage recommendations are conditional and have their own rules. */
+/** @internal The per-extension citation travels with the finding, so a row here may come from a
+ *  document other than RFC 5280: RFC 7633 sec. 4 states the same shape of recommendation for the TLS
+ *  feature extension, and its clause closes by naming the case where critical is what the caller
+ *  wants, so this grades it rather than refusing it. Adding a row here grades the extension in the
+ *  DEFAULT set, which a named profile would not; it does not feed `_isUnknownExtension`, so the
+ *  unknown-critical verdict a critical one draws is unaffected. */
 var CERT_RECOMMENDED_NON_CRITICAL = Object.create(null);
 CERT_RECOMMENDED_NON_CRITICAL[oid.byName("issuerAltName")] = "RFC 5280 sec. 4.2.1.7";
 CERT_RECOMMENDED_NON_CRITICAL[oid.byName("cRLDistributionPoints")] = "RFC 5280 sec. 4.2.1.13";
+CERT_RECOMMENDED_NON_CRITICAL[oid.byName("tlsFeature")] = "RFC 7633 sec. 4";
 var _T_BMP = asn1.TAGS.BMP_STRING, _T_VISIBLE = asn1.TAGS.VISIBLE_STRING, _T_UTF8 = asn1.TAGS.UTF8_STRING;
 function _hasControlChar(str) {
   for (var i = 0; i < str.length; i++) {
@@ -488,7 +495,7 @@ var RFC5280_RULES = [
   _criticalityRule("keyUsage", "lint/rfc5280/key-usage-not-critical", "warn",
     "RFC 5280 4.2.1.3", "the keyUsage extension should be marked critical"),
   {
-    id: "lint/rfc5280/recommended-criticality", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.7 / 4.2.1.13",
+    id: "lint/rfc5280/recommended-criticality", severity: "warn", source: "rfc5280", citation: "RFC 5280 4.2.1.7 / 4.2.1.13, RFC 7633 sec. 4",
     message: "an extension a conforming CA should mark non-critical is marked critical",
     check: function (cert) {
       var rows = [];
@@ -4056,6 +4063,96 @@ var RFC9763_RULES = [
   },
 ];
 
+/** @internal RFC 7633. The criticality recommendation lives in the always-on table above, because
+ * sec. 4 states it for every certificate carrying the extension. These rows read the VALUE, which
+ * RFC 7633 leaves open in three ways and another document speaks to in a fourth:
+ *
+ * sec. 4 writes `Features ::= SEQUENCE OF INTEGER` with no range, no ordering rule and no prohibition
+ * on repeats, so none of those is a conformance failure and none is refused by the encoder. What
+ * sec. 4.1 does say is that the values are "TLS extension identifiers ... as specified in the IANA
+ * Transport Layer Security (TLS) Extensions registry", and that registry is 16 bits wide, so a value
+ * outside 0..65535 names nothing in it. That is a `warn`, not an `error`: the finding rests on a
+ * reference to a registry rather than on a syntax rule, and at `error` in a named profile it would
+ * make `pki.x509.sign` refuse to emit the certificate.
+ *
+ * The transparency_info row is RFC 9162 sec. 7.2, read directly: "A certification authority SHOULD
+ * NOT issue any certificate that identifies the transparency_info TLS extension in a TLS feature
+ * extension [RFC7633], because TLS servers are not required to support the transparency_info TLS
+ * extension in order to participate in CT". That is the only clause outside RFC 7633 that constrains
+ * this field.
+ *
+ * There is NO deprecation row for status_request_v2, and the absence is deliberate. The IANA registry
+ * still lists `17 status_request_v2 [RFC 6961]` as Recommended and marks it neither obsolete nor
+ * deprecated; RFC 9846 contains no occurrence of "status_request_v2" and none of "7633", so no
+ * document states a deprecation to cite. What is true is narrower: RFC 9846 obsoletes RFC 6961, which
+ * defined the extension, and the ExtensionType enum at its sec. 4.3 does not list 17 at all, so a
+ * certificate naming feature 17 asks a TLS 1.3 server for something that version does not define
+ * while a TLS 1.2 deployment can still satisfy it. That is reported at `notice`, with the clause that
+ * supports it and nothing more. */
+var RFC7633_RULES = [
+  {
+    id: "lint/rfc7633/feature-outside-registry-width", severity: "warn", source: "rfc7633", citation: "RFC 7633 4.1",
+    message: "a TLS feature value lies outside the 16-bit width of the IANA TLS ExtensionType registry sec. 4.1 points at, so it names no extension in it",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("tlsFeature"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("tlsFeature");
+      var features = (d && d.value && d.value.features) || [];
+      var rows = [];
+      for (var i = 0; i < features.length; i++) {
+        var f = features[i];
+        if (f < 0n || f > 65535n) rows.push({ context: { feature: String(f), width: "0..65535" } });
+      }
+      return rows.length ? rows : null;
+    },
+  },
+  {
+    id: "lint/rfc7633/feature-repeated", severity: "notice", source: "rfc7633", citation: "RFC 7633 4",
+    message: "a TLS feature value appears more than once; the syntax permits it and the set it names is the same, so the repeat carries no meaning",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("tlsFeature"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("tlsFeature");
+      var features = (d && d.value && d.value.features) || [];
+      /** @internal One pass with a set of what has been seen, not a rescan of every preceding value.
+       *  This rule is in the default set and a certificate reaching it is unauthenticated, so the
+       *  pairwise form is work the input chooses: MEASURED, 20000 distinct features in an 80 KiB
+       *  certificate took 355 ms against 5 ms for 50 of them. A set compares the bigint values. */
+      var seen = new Set();
+      var rows = [];
+      for (var i = 0; i < features.length; i++) {
+        if (seen.has(features[i])) rows.push({ context: { feature: String(features[i]) } });
+        else seen.add(features[i]);
+      }
+      return rows.length ? rows : null;
+    },
+  },
+  {
+    id: "lint/rfc7633/transparency-info-feature", severity: "warn", source: "rfc7633", citation: "RFC 9162 7.2",
+    message: "a certification authority should not issue a certificate naming the transparency_info TLS extension (52) in a TLS feature extension, because a TLS server need not support it to participate in certificate transparency",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("tlsFeature"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("tlsFeature");
+      var features = (d && d.value && d.value.features) || [];
+      for (var i = 0; i < features.length; i++) {
+        if (features[i] === 52n) return { context: { feature: "52", name: "transparency_info" } };
+      }
+      return null;
+    },
+  },
+  {
+    id: "lint/rfc7633/feature-undefined-in-tls13", severity: "notice", source: "rfc7633", citation: "RFC 9846 4.3",
+    message: "a TLS feature value names status_request_v2 (17), which RFC 9846 does not list in its ExtensionType enum and whose defining document RFC 6961 it obsoletes, so a TLS 1.3 server cannot satisfy it",
+    appliesTo: function (cert, ctx) { return !!ctx.raw("tlsFeature"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("tlsFeature");
+      var features = (d && d.value && d.value.features) || [];
+      for (var i = 0; i < features.length; i++) {
+        if (features[i] === 17n) return { context: { feature: "17", name: "status_request_v2", obsoletedBy: "RFC 9846" } };
+      }
+      return null;
+    },
+  },
+];
+
 /** @internal RFC 5280 sec. 5 states the criticality of each CRL extension it profiles, and sec. 5.3
  * does the same for the entry extensions. certificateIssuer is critical (sec. 5.3.3) because a
  * consumer that ignores it attributes an entry to the wrong issuer. */
@@ -6413,6 +6510,7 @@ var PROFILES = Object.assign(Object.create(null), {
   "rfc9909": RFC9909_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "rfc9935": RFC9935_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "rfc9763": RFC9763_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "rfc7633": RFC7633_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "x509-altsig": X509_ALTSIG_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "cabf-tls": CABF_TLS_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "cabf-smime": CABF_SMIME_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
@@ -6436,7 +6534,7 @@ var PROFILES = Object.assign(Object.create(null), {
     .concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
 var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
-  .concat(RFC9763_RULES).concat(X509_ALTSIG_RULES)
+  .concat(RFC9763_RULES).concat(RFC7633_RULES).concat(X509_ALTSIG_RULES)
   .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES).concat(CABF_CS_RULES).concat(ETSI_QC_RULES)
   /** @internal The root-program rows are in the registry so `rules()` enumerates them, and stay
    * inert under the default set because each one asks whether the caller named the profile. */
@@ -6725,6 +6823,11 @@ function _applyThreshold(report, severity) {
  *                  id-kp-serverAuth and is not a CA. `"nist-pqc-transition"` and `"cnsa-2.0"` are
  *                  named the same way: which algorithm policy a certificate is held to is the
  *                  caller's assertion, so neither is detected and both are inert until named.
+ *                  `"rfc7633"` adds the rows that read a TLS Feature extension's VALUES: a feature
+ *                  outside the 16-bit width of the registry sec. 4.1 points at, a repeated feature,
+ *                  the transparency_info feature RFC 9162 sec. 7.2 asks a CA not to issue, and the
+ *                  status_request_v2 feature RFC 9846 leaves out of its ExtensionType enum. The
+ *                  criticality of that extension is graded by default and needs no profile.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and
  *                  `worst` always reflect the complete, unfiltered result.
  * @example

package/lib/path-validate.js

@@ -68,8 +68,14 @@ var _reject = intrinsic.uncurry(intrinsic.promiseReject);
  * not a refusal, and this module's verdicts are what a caller acts on. */
 var _Promise = intrinsic.Promise;
 /** @internal The URL parser, taken at load: the host it reports from an access descriptor is the host a
- *  revocation fetch would be directed to. */
+ *  revocation fetch would be directed to. Its accessors are taken with it, because the constructor's
+ *  capture does not cover the prototype the value reads its parts off, and the host read here is the
+ *  one the address filter is applied to. */
 var _URL = intrinsic.URL;
+var _urlHref = intrinsic.urlHref;
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlHostname = intrinsic.urlHostname;
+var _urlSetHash = intrinsic.urlSetHash;
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
@@ -125,6 +131,7 @@ var OID = intrinsic.assign(intrinsic.create(null), {
   anyExtendedKeyUsage: oid.byName("anyExtendedKeyUsage"),
   cRLDistributionPoints: oid.byName("cRLDistributionPoints"),
   subjectKeyIdentifier: oid.byName("subjectKeyIdentifier"),
+  tlsFeature: oid.byName("tlsFeature"),
   authorityKeyIdentifier: oid.byName("authorityKeyIdentifier"),
   authorityInfoAccess: oid.byName("authorityInfoAccess"),
   caIssuers: oid.byName("caIssuers"),
@@ -300,6 +307,66 @@ function _isCaCert(cert) {
   return !!(bc && bc.value && bc.value.cA === true);
 }
 
+/** @internal RFC 7633 sec. 4.2.2, the one requirement in that document decidable from certificate
+ * bytes: "a certificate that is signed by a Certificate Signing Certificate that contains a TLS
+ * feature extension MUST contain a TLS feature extension that offers the same set or a superset of
+ * the features advertised in the signing certificate." The clause's own gate is the issuer's key
+ * usage, "Certification Authority certificate with the key usage extension value set to
+ * keyCertSign", which is a different question from its basicConstraints cA bit, so this asks
+ * keyUsage. A subject carrying NO extension under an issuer that advertises fails, because the
+ * clause says the subject MUST contain one; an issuer carrying none constrains nothing, so the
+ * constraint is one-directional.
+ *
+ * Set semantics. SEQUENCE OF fixes no order and forbids no repeat, so neither side's order nor its
+ * multiplicity may be read as meaning, and the comparison cannot stop at a first match.
+ *
+ * Returns null when there is nothing to check, so a boundary that was not checked reports no row
+ * rather than a passing one.
+ *
+ * The anchor is not read. `anchorFromCert` keeps the name, key and algorithm and drops the
+ * certificate's extensions, so a trust anchor's own advertised features cannot reach this and the
+ * rule is applied from the first certificate in the path downward. An anchor that advertises
+ * features constrains nothing here, which is stated rather than implied. */
+function tlsFeatureChainCheck(issuerCert, cert) {
+  if (!issuerCert) return null;
+  var issuerKu;
+  try { issuerKu = decodeExt(issuerCert, OID.keyUsage); }
+  // allow:swallow-unverified a keyUsage that cannot be read is refused by its own check on that certificate
+  catch (_e) { return null; }
+  if (!(issuerKu && issuerKu.value && issuerKu.value.keyCertSign === true)) return null;
+  var issuerFeatures;
+  try { issuerFeatures = decodeExt(issuerCert, OID.tlsFeature); }
+  catch (e) { return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-tls-feature") }); }
+  if (!issuerFeatures) return null;
+  /** @internal The subject's extension is read BEFORE the issuer's set is looked at, because the
+   * clause is two requirements and the first one does not mention the set: a certificate signed by a
+   * signing certificate that CONTAINS the extension MUST CONTAIN one, and what it contains must then
+   * cover the issuer's features. Testing the set first read an issuer whose Features list is EMPTY as
+   * nothing to require and returned success for a subject that carried no extension at all, which the
+   * MUST CONTAIN half forbids; it also meant a malformed subject value under such an issuer was never
+   * decoded. An empty SEQUENCE is a conforming Features, the syntax carrying no SIZE constraint. */
+  var offeredExt;
+  try { offeredExt = decodeExt(cert, OID.tlsFeature); }
+  catch (e) { return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-tls-feature") }); }
+  if (!offeredExt) return guard.verdict.of({ ok: false, code: "path/tls-feature-not-offered" });
+  var required = (issuerFeatures.value && issuerFeatures.value.features) || [];
+  if (!required.length) return guard.verdict.of({ ok: true });
+  var offered = (offeredExt.value && offeredExt.value.features) || [];
+  /** @internal Membership through a set rather than a scan of the offered list per required value.
+   * Both lists come off untrusted certificates and the syntax bounds neither, so the pairwise form is
+   * work an issuer and a subject choose together: MEASURED, 20000 values on each side is 4 x 10^8
+   * comparisons, synchronous, on a path whose signatures may already have failed. A set makes it
+   * linear in the two lengths, and the values are bigints, which a set compares by value. */
+  var offeredSet = new intrinsic.Set();
+  for (var j = 0; j < offered.length; j++) intrinsic.setAdd(offeredSet, offered[j]);
+  for (var i = 0; i < required.length; i++) {
+    if (!intrinsic.setHas(offeredSet, required[i])) {
+      return guard.verdict.of({ ok: false, code: "path/tls-feature-not-offered" });
+    }
+  }
+  return guard.verdict.of({ ok: true });
+}
+
 function statefulHbsKeyUsageCheck(cert, isCa) {
   var ku;
   try { ku = decodeExt(cert, OID.keyUsage); }
@@ -1552,6 +1619,16 @@ async function _validate(path, opts, run, scope) {
     guard.list.append(checks,{ name: "nameChaining", ok: chainOk === true, code: chainOk === true ? undefined : "path/name-chaining" });
     if (chainOk !== true) failed = true;
 
+    /** @internal In the loop body, so it runs at EVERY issuer-to-subject boundary rather than only at
+     * the target: RFC 7633 sec. 4.2.2 constrains each certificate against the one that signed it. The
+     * issuer is the previous entry, which is `null` for the first certificate because the anchor's
+     * extensions are not part of the path. */
+    var tfRes = tlsFeatureChainCheck(idx > 0 ? certs[idx - 1] : null, cert);
+    if (tfRes) {
+      guard.list.append(checks, { name: "tlsFeatureChain", ok: tfRes.ok, code: tfRes.ok ? undefined : tfRes.code });
+      if (!tfRes.ok) failed = true;
+    }
+
     if (!(selfIssued(cert) && i !== n)) {
       var ncRes;
       try { ncRes = checkNameConstraints(state, cert); }
@@ -3151,14 +3228,18 @@ async function _fetchAiaIssuers(current, aia) {
     var u;
     try { u = new _URL(ad.accessLocation.value); }
     catch (_e) { continue; }
-    if (u.protocol !== "https:") continue;
-    if (_isBlockedAiaHost(u.hostname)) continue;
-    if (net.isIP(_stripBrackets(u.hostname)) === 0 && !aia.transportGuardsAddresses) continue;
-    u.hash = "";
-    if (intrinsic.setHas(aia.fetchedUrls, u.href) || intrinsic.setHas(seenThisCert, u.href)) continue;
+    if (_urlProtocol(u) !== "https:") continue;
+    /** @internal The host read ONCE and both address tests applied to that one string: the blocklist
+     * and the literal-versus-name question have to be answered about the same host. */
+    var uHost = _urlHostname(u);
+    if (_isBlockedAiaHost(uHost)) continue;
+    if (net.isIP(_stripBrackets(uHost)) === 0 && !aia.transportGuardsAddresses) continue;
+    _urlSetHash(u, "");
+    var uHref = _urlHref(u);
+    if (intrinsic.setHas(aia.fetchedUrls, uHref) || intrinsic.setHas(seenThisCert, uHref)) continue;
     if (seenThisCert.size >= aia.maxPerCert) break;
-    intrinsic.setAdd(seenThisCert, u.href);
-    guard.list.append(uris, u.href);
+    intrinsic.setAdd(seenThisCert, uHref);
+    guard.list.append(uris, uHref);
   }
   var out = [];
   for (var k = 0; k < uris.length; k++) {