@blamejs/pki 0.8.51 → 0.8.53

package/lib/constants.js

@@ -293,6 +293,21 @@ var NAMES = Object.assign(Object.create(null), {
    * this length: an OCSP CertID's issuer hashes, a timestamp's messageImprint. The XOFs (SHAKE) have
    * no single length and are absent. */
   DIGEST_OCTETS: { sha1: 20, sha256: 32, sha384: 48, sha512: 64, "sha3-256": 32, "sha3-512": 64 },
+  /** @internal The digests a verify path refuses by default and admits only under an explicit
+   *  opt-in, by the OID registry's name, with the WebCrypto hash name each maps to. A digest is weak
+   *  once a collision is reachable, which breaks the binding of every structure that carries "the
+   *  hash of X": a signature's message digest, a timestamp's messageImprint, an ESS certificate
+   *  identifier. Membership is defined once here, so a path that refuses one refuses all of them and
+   *  a path that admits them under an opt-in admits the same set. A digest no path will compute at
+   *  all is not listed; it is absent from DIGEST_HASH instead. */
+  WEAK_DIGESTS: { sha1: "SHA-1" },
+  /** @internal The digests an RFC 3161 message imprint may name in this build, by the OID registry's
+   *  name, with the node name each computes under. One table for the whole timestamp round trip: a
+   *  verb that TAKES an imprint, a verb that attaches a token over one, and the verifier that reads
+   *  it all answer from this, so none of them can produce an imprint another would refuse. SHA-1 is
+   *  listed because archived tokens carry it and the verifier admits it under an explicit opt-in;
+   *  WEAK_DIGESTS is what decides that, not absence from here. */
+  TIMESTAMP_IMPRINT_DIGESTS: { sha1: "sha1", sha256: "sha256", sha384: "sha384", sha512: "sha512" },
 });
 
 /** @internal Each inner table is looked up by a name a certificate supplies, so it answers from

package/lib/ct.js

@@ -2177,7 +2177,7 @@ function _b64Array(obj, name, code, label, exactLen, maxCount) {
  * @opts headers OPTIONAL extra request headers (the request-framing headers are stripped; the verb owns the GET method).
  * @opts timeout OPTIONAL ms budget, default 30s (cap-validated).
  * @opts maxResponseBytes OPTIONAL per-GET size cap, default 4 MiB, tightenable DOWNWARD only.
- * @opts requireJsonContentType OPTIONAL boolean (default false) -- opt in to a strict `ct/bad-content-type` gate on the JSON GET.
+ * @opts requireJsonContentType OPTIONAL boolean (default false) -- opt in to a strict `ct/bad-content-type` gate on the JSON GET. A value other than `true`, `false`, `null` or an absent option is refused `ct/bad-input` before the request goes out.
  * @example
  *   // a live distributor uses the default pki.transport.https; here an injected transport returns the pair
  *   var r = await pki.ct.fetchLogList({ url: "https://ct.example/log_list.json", signerKey: googleSignerSpki,
@@ -2241,7 +2241,8 @@ async function fetchLogList(opts) {
   var req = { headers: headers, tls: fetchTls, timeout: timeout, maxResponseBytes: maxResponseBytes };
   /** @internal Read before the request goes out, so the option that decides the check is the one the call
    *  was made with rather than whatever it says once the response is back. */
-  var requireJsonContentType = opts.requireJsonContentType === true;
+  var requireJsonContentType = guard.identifier.booleanOption(opts.requireJsonContentType, _ctErr,
+    "ct/bad-input", "fetchLogList opts.requireJsonContentType");
   var jsonRes = await _fetchBody(transport, jsonUrl, req, "CT log-list JSON");
   if (requireJsonContentType && jsonRes.contentType !== "application/json") throw _ctErr("ct/bad-content-type", "the CT log-list JSON GET returned content-type " + JSON.stringify(jsonRes.contentType || null) + " (opts.requireJsonContentType is set)");
   var sigRes = await _fetchBody(transport, sigUrl, req, "CT log-list signature");

package/lib/guard-der.js

@@ -96,6 +96,31 @@ function paramsAbsentOrNull(params) {
   return params === null || params === undefined || isNull(params);
 }
 
+/** Whether two decoded `AlgorithmIdentifier` records name the same algorithm with the same
+ *  parameters, comparing the parameters AS THEY ARE: absent equals absent, and an explicit DER NULL
+ *  is a different identifier from one with no parameters field.
+ *
+ *  This is the comparison for an identifier whose parameters carry meaning. A digest identifier has
+ *  the opposite rule, because RFC 3370 clause 2.1 and RFC 5754 clause 2 require an implementation to
+ *  accept both spellings of the same digest, and `schema-cms.sameDigestAlgorithm` grants that. A
+ *  signature identifier does not: RFC 4055 requires the `*WithRSAEncryption` identifiers to carry a
+ *  NULL, RFC 5758 and RFC 8410 require the `ecdsaWith*` and the Edwards and post-quantum ones to omit
+ *  the field, and RSASSA-PSS carries its hash, mask generator, salt length and trailer field there
+ *  under RFC 4056 clause 2.2. Collapsing the two spellings for one of those is admitting a different
+ *  algorithm, which is why the grant does not travel.
+ *
+ * @enforced-by behavioral -- an equality that is too permissive has no rename-proof shape; the RED
+ * vector is an identifier pair differing only in an explicit NULL, which must compare unequal here
+ * and equal through the digest helper.
+ */
+function sameAlgorithmExactly(a, c) {
+  if (!a || !c || a.oid !== c.oid) return false;
+  var ap = a.parameters === undefined ? null : a.parameters;
+  var cp = c.parameters === undefined ? null : c.parameters;
+  if (ap === null || cp === null) return ap === cp;
+  return _isBuffer(ap) && _isBuffer(cp) && _sizeOf(ap) === _sizeOf(cp) && _compare(ap, cp) === 0;
+}
+
 // @enforced-by behavioral -- see paramsAbsentOrNull.
 function assertParams(params, shape, E, code, label) {
   var ok = shape === "null" ? isNull(params) : (shape === "absent"
@@ -109,4 +134,5 @@ function assertParams(params, shape, E, code, label) {
 module.exports = _freeze({
   element: element, tlv: tlv,
   isNull: isNull, paramsAbsentOrNull: paramsAbsentOrNull, assertParams: assertParams,
+  sameAlgorithmExactly: sameAlgorithmExactly,
 });

package/lib/guard-identifier.js

@@ -600,6 +600,32 @@ function assertCallableOption(opts, key, E, code, label, shape) {
   return assertCallable(opts[key], E, code, label, shape);
 }
 
+/** @internal How a switch is read: as the boolean it documents, with an absent value standing for
+ * off and every other value refused. A switch that turns a requirement on is the case that decides
+ * the shape. `requireRevocation: "true"` out of a config file is truthy to JavaScript and unequal
+ * to `true`, so a boundary testing `=== true` runs without the requirement and says nothing, while
+ * one testing truthiness turns the requirement on for `0` and `""` as well. The value is rendered
+ * from its own type rather than coerced, so a caller value with a throwing `toString` reports the
+ * typed refusal. A boundary that reads `null` as a value its caller supplied keeps its own check:
+ * this one reads it as absence. */
+// @enforced-by behavioral -- reading a caller switch has no rename-proof code shape; `=== true` is
+// @enforced-by behavioral -- the correct read for a switch that turns a control OFF, so a lexical
+// @enforced-by behavioral -- rule would flag the safe direction. The per-verb vectors are the
+// @enforced-by behavioral -- guard: each drives the shipped verb with a non-boolean and asserts the
+// @enforced-by behavioral -- typed refusal, and with false and absence to pin the two off forms.
+function booleanOption(value, E, code, label) {
+  if (value === undefined || value === null) return false;
+  if (value === true || value === false) return value;
+  throw E(code, label + " must be true or false, got " + _showSwitch(value));
+}
+
+/** @internal The value's own type, for the message above. Nothing here calls into the value. */
+function _showSwitch(value) {
+  if (typeof value === "string") return _stringify(value);
+  if (typeof value === "number" || typeof value === "bigint") return _String(value);
+  return typeof value;
+}
+
 /** @internal Whether a caller's object says something about itself, as opposed to inheriting the
  * answer. A declaration is a promise the author of that object made, so it has to sit on the object
  * they wrote: reading the flag through the object finds a value on `Function.prototype` that every
@@ -619,6 +645,7 @@ function declaresOwn(obj, name) {
 
 module.exports = intrinsic.freeze({
   assertCallable: assertCallable,
+  booleanOption: booleanOption,
   declaresOwn: declaresOwn,
   assertCallableOption: assertCallableOption,
   assertCanonicalOid: assertCanonicalOid,

package/lib/guard-time.js

@@ -19,17 +19,112 @@ var _dateGetUTCMinutes = require("./guard-intrinsic").uncurry(Date.prototype.get
 var _dateGetUTCSeconds = require("./guard-intrinsic").uncurry(Date.prototype.getUTCSeconds);
 var _dateGetUTCMilliseconds = require("./guard-intrinsic").uncurry(Date.prototype.getUTCMilliseconds);
 var _dateSetUTCFullYear = require("./guard-intrinsic").uncurry(Date.prototype.setUTCFullYear);
+var _dateToISOString = require("./guard-intrinsic").uncurry(Date.prototype.toISOString);
+var _charCodeAt = require("./guard-intrinsic").uncurry(String.prototype.charCodeAt);
+var _Number = require("./guard-intrinsic").Number;
+var constants = require("./constants");
+/** @internal RFC 3161 clause 2.4.2 states an Accuracy's third field in microseconds, which no
+ *  `C.TIME` scale names because no PKI structure carries a microsecond duration anywhere else. */
+var MICROS_PER_MILLISECOND = 1000;
 var _dateUTC = Date.UTC;
 var _floor = Math.floor;
 var _ceil = Math.ceil;
 /** @internal A DER GeneralizedTime carries a four-digit year and a UTCTime a narrower one, so a Date
  *  outside 0000..9999 has no PKI encoding. */
 var DER_YEAR_MIN = 0, DER_YEAR_MAX = 9999;
+/** @internal The widest accuracy a date comparison can use, the DER year range in seconds, and the
+ *  instant a wider one saturates to: the last instant a DER time can carry, which is past every
+ *  certificate date and, unlike an arbitrary ceiling, is a `Date` a verdict can render. Declared
+ *  after the range it derives from, since a `var` read above its own initializer is `undefined`. */
+var MAX_ACCURACY_SECONDS = constants.TIME.days((DER_YEAR_MAX + 1) * 366) / constants.TIME.seconds(1);
+var MAX_INSTANT = _dateUTC(DER_YEAR_MAX, 11, 31, 23, 59, 59, 999);
 
 // @enforced-by guard-shape-reinlined
 // @guard-shape \.getTime\s*\(
 function instantOf(value) { return _dateGetTime(value); }
 
+/** The instant an error message or a verdict names, rendered through the operation captured at load.
+ *  A replaced `toISOString` chooses the time a refusal reports, which is what an operator reads when
+ *  deciding whether the refusal was right, so the rendering is taken from the same place every other
+ *  read of a Date is.
+ *
+ * @enforced-by behavioral -- the live-read budget each module declares is what holds a call-time
+ * `toISOString` out of a converted file; a `@guard-shape` here would name the read in every module
+ * that renders a date and the budget already answers for those.
+ */
+function isoOf(value) { return _dateToISOString(value); }
+
+/** The instant a DER GeneralizedTime names, rounded UP to the next whole millisecond where its
+ *  fractional seconds carry a digit a `Date` cannot hold. `fraction` is the fraction's digit string;
+ *  the first three digits ARE the milliseconds, so a nonzero digit after them puts the real instant
+ *  strictly between `value` and `value + 1ms`.
+ *
+ *  An upper bound is decided against this rather than against the Date, because the Date truncates:
+ *  a time stamped at `...000000.000001Z` reads as `...000000.000Z`, which compares equal to a bound
+ *  of `...000000Z` and so passes an "after the bound" test it is on the wrong side of. The two
+ *  consumers are the timestamp verifier's own check of the authority's certificate window and the
+ *  signature-timestamp row's check of the signing certificate's expiry.
+ *
+ * @enforced-by behavioral -- a truncating comparison has no rename-proof shape; the RED vector is a
+ * token minted with a sub-millisecond fraction one tick past a certificate's notAfter.
+ */
+function ceilInstantOf(value, fraction) { return latestInstantOf(value, fraction, null); }
+
+/** @internal The part of a DER GeneralizedTime's fractional seconds a `Date` cannot hold, in whole
+ *  microseconds. The first three digits ARE the milliseconds; the next three are microseconds, and
+ *  anything finer than a microsecond counts as one, since a bound is only a bound if it is not
+ *  exceeded. Read digit by digit through the captured accessor: a fraction is caller bytes. */
+function _fractionMicros(fraction) {
+  if (typeof fraction !== "string" || fraction.length <= 3) return 0;
+  var micros = 0;
+  var finer = false;
+  for (var i = 3; i < fraction.length; i++) {
+    var c = _charCodeAt(fraction, i);
+    if (c < 48 || c > 57) break;
+    var digit = c - 48;
+    if (i === 3) micros += digit * 100;
+    else if (i === 4) micros += digit * 10;
+    else if (i === 5) micros += digit;
+    else if (digit > 0) finer = true;
+  }
+  return finer ? micros + 1 : micros;
+}
+
+/** The LATEST instant a timestamp could have been created at: its `genTime` ceiling plus the
+ *  accuracy the token states. RFC 3161 clause 2.4.2 defines accuracy as the bound on the difference
+ *  between the stated time and the real one, so a token saying it is accurate to two seconds places
+ *  its creation anywhere in a four-second window, and an upper bound that reads only `genTime`
+ *  concludes something the token does not establish. `accuracy` is the parsed `{ seconds, millis,
+ *  micros }` or null; `seconds` arrives as a BigInt, the other two as numbers, and a micros
+ *  remainder rounds up because a bound is only a bound if it is not exceeded.
+ *
+ * @enforced-by behavioral -- a bound that ignores a field has no rename-proof shape; the RED vector
+ * is a token whose genTime precedes a certificate's notAfter while its accuracy window does not.
+ */
+function latestInstantOf(value, fraction, accuracy) {
+  var at = instantOf(value);
+  var ms = 0;
+  /** @internal The sub-millisecond parts are summed and rounded ONCE. Rounding the genTime fraction
+   *  and the accuracy up separately overstates the bound by a millisecond when both carry one, which
+   *  refuses a token whose real window ends before the instant it is compared against. */
+  var micros = _fractionMicros(fraction);
+  if (accuracy !== null && typeof accuracy === "object") {
+    /** @internal An Accuracy's seconds field is an arbitrary-size INTEGER, so it is bounded BEFORE
+     *  it is scaled: a token claiming more than the DER time range can hold is saturated to the
+     *  widest instant rather than scaled into a value the scale helper refuses. The refusal would
+     *  escape the row this builds and take the whole verify call down, where what the token has
+     *  established is nothing about which side of any certificate date it falls on, which is the
+     *  answer a saturated bound gives. */
+    if (accuracy.seconds > MAX_ACCURACY_SECONDS) return MAX_INSTANT;
+    if (typeof accuracy.seconds === "bigint") ms += constants.TIME.seconds(_Number(accuracy.seconds));
+    else if (typeof accuracy.seconds === "number") ms += constants.TIME.seconds(accuracy.seconds);
+    if (typeof accuracy.millis === "number") ms += constants.TIME.milliseconds(accuracy.millis);
+    if (typeof accuracy.micros === "number") micros += accuracy.micros;
+  }
+  if (micros > 0) ms += _ceil(micros / MICROS_PER_MILLISECOND);
+  return ms > 0 ? at + ms : at;
+}
+
 // @enforced-by nan-date-comparison-unguarded
 function assertValid(value, E, code, label) {
   if (!util.types.isDate(value) || _isNaN(instantOf(value))) {
@@ -120,6 +215,9 @@ module.exports = _freeze({
   assertEncodable: assertEncodable,
   addMonths: addMonths,
   instantOf: instantOf,
+  isoOf: isoOf,
+  ceilInstantOf: ceilInstantOf,
+  latestInstantOf: latestInstantOf,
   isDate: isDate,
   toDate: toDate,
   within: within,

package/lib/lint.js

@@ -4929,12 +4929,21 @@ var ALL_CRL_RULES = RFC5280_CRL_RULES.concat(CNSA2_CRL_RULES);
  *  for YY >= 50 and 20YY otherwise, so every UTCTime names a year inside 1950..2049 and only the
  *  GeneralizedTime direction of that clause can be broken. */
 var OID_SIGNING_TIME = oid.byName("signingTime");
+/** @internal The two identifiers RFC 6211's attribute is assigned, both read: the body's PKCS 9 leaf
+ *  and the S/MIME attribute arc value the IANA registry and the update draft give it. */
+var OID_ALG_PROTECTION = oid.byName("cmsAlgorithmProtection");
+var OID_ALG_PROTECTION_AA = oid.byName("cmsAlgorithmProtect");
 var OID_SIGNED_DATA = oid.byName("signedData");
 
 /** @internal The content type decides which of these rows apply, and the parser sets `contentType`
  *  as an own property on every content it builds. A content type that carries no signers has no own
  *  `signerInfos`, so testing for that field answers from whatever the prototype chain holds. */
 function _isSignedData(cms) { return cms.contentType === OID_SIGNED_DATA; }
+var OID_AUTH_DATA = oid.byName("authData");
+/** @internal The other content type whose originator carries attributes, and the one whose algorithm
+ *  fields nothing else covers: RFC 5652 sec. 9.2 makes the MAC input the DER encoding of `authAttrs`
+ *  alone, so `digestAlgorithm` and `macAlgorithm` sit outside it. */
+function _isAuthData(cms) { return cms.contentType === OID_AUTH_DATA; }
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
 /** @internal Every SignerInfo a message carries: its own signers, and the countersignatures their
  *  unsigned attributes hold, which sec. 11.4 defines as SignerInfo values and which carry their own
@@ -4969,14 +4978,16 @@ function _cmsAllSignerInfos(cms) {
   visit(cms.signerInfos, 0, false, 0);
   return out;
 }
-function _cmsSignedAttr(signerInfo, dotted) {
-  var attrs = signerInfo.signedAttrs;
+function _cmsAttrInList(attrs, dotted) {
   if (!Array.isArray(attrs)) return null;
   for (var i = 0; i < attrs.length; i++) {
     if (attrs[i].type === dotted) return attrs[i];
   }
   return null;
 }
+function _cmsSignedAttr(signerInfo, dotted) {
+  return _cmsAttrInList(signerInfo.signedAttrs, dotted);
+}
 /** @internal Whether two DIGEST AlgorithmIdentifiers name one algorithm, under RFC 5754 sec. 2. The
  *  rule lives in the schema module because the set this row reads is also WRITTEN there, by the verb
  *  that adds a countersigner's digest to it, and a set written under one rule and read under another
@@ -5078,8 +5089,50 @@ var RFC5652_CMS_RULES = [
   },
 ];
 
-var CMS_PROFILES = Object.assign(Object.create(null), { "rfc5652": RFC5652_CMS_RULES });
-var ALL_CMS_RULES = RFC5652_CMS_RULES;
+/** @internal RFC 8933 updates RFC 5652 rather than restating it, so its rows are their own profile:
+ *  `pki.lint.cms(der, { profile: "rfc8933" })` asks only what that document added. */
+var RFC8933_CMS_RULES = [
+  {
+    id: "lint/rfc8933/algorithm-protection-absent", severity: "notice", source: "rfc8933", citation: "RFC 8933 4.1",
+    /** @internal "the originator of a signed-data content type that includes signed attributes
+     * SHOULD include the CMSAlgorithmProtection attribute [RFC6211] as one of the signed
+     * attributes.  Likewise, the originator of an authenticated-data content type that includes
+     * authenticated attributes SHOULD include the CMSAlgorithmProtection attribute [RFC6211] as one
+     * of the authenticated attributes." RFC 9882 sec. 4 and RFC 9814 sec. 5 repeat the signed-data
+     * half for ML-DSA and SLH-DSA. Both content types are read, and the authenticated-data one is
+     * where the exposure is widest: sec. 9.2 makes the MAC input `authAttrs` alone, so the two outer
+     * algorithm fields are covered by nothing. The SHOULD is conditioned on attributes being
+     * present, so an originator that signs or authenticates the content directly has nowhere to
+     * carry it and draws no finding. Both identifiers count, since the two spell one attribute. A
+     * notice rather than a warning: it is a SHOULD, and most CMS in the field carries no such
+     * attribute. */
+    message: "an originator with signed or authenticated attributes carries no CMSAlgorithmProtection attribute, which this section says it should include",
+    appliesTo: function (cms) { return _isSignedData(cms) || _isAuthData(cms); },
+    check: function (cms) {
+      var out = [];
+      if (_isAuthData(cms)) {
+        var authAttrs = cms.authAttrs;
+        if (!Array.isArray(authAttrs) || !authAttrs.length) return null;
+        if (_cmsAttrInList(authAttrs, OID_ALG_PROTECTION) ||
+            _cmsAttrInList(authAttrs, OID_ALG_PROTECTION_AA)) return null;
+        return { context: { placement: "authAttrs" } };
+      }
+      _cmsAllSignerInfos(cms).forEach(function (entry) {
+        if (!Array.isArray(entry.signerInfo.signedAttrs) || !entry.signerInfo.signedAttrs.length) return;
+        if (_cmsSignedAttr(entry.signerInfo, OID_ALG_PROTECTION) ||
+            _cmsSignedAttr(entry.signerInfo, OID_ALG_PROTECTION_AA)) return;
+        out.push({ context: { signerIndex: entry.signerIndex, countersignature: entry.countersignature } });
+      });
+      return out.length ? out : null;
+    },
+  },
+];
+
+var CMS_PROFILES = Object.assign(Object.create(null), {
+  "rfc5652": RFC5652_CMS_RULES,
+  "rfc8933": RFC8933_CMS_RULES,
+});
+var ALL_CMS_RULES = RFC5652_CMS_RULES.concat(RFC8933_CMS_RULES);
 
 /** @internal The RFC 3161 profile is the shortest of the three, for the reason the CMS one is
  *  short: `schema.tsp.parseToken` refuses nearly everything sec. 2.4.2 requires of a token before a
@@ -6978,9 +7031,10 @@ function _ingestCrl(input) {
  * `lint/rfc2986/extension-request-ambiguous`; every one of them is read, so nothing a later
  * attribute asks for escapes the rows below.
  *
- * @opts  profile   `"rfc2986"` for the structural rows alone, or `"cabf-tls"` to add the TLS rows
- *                  (default runs the structural rows). A certificate, CRL or OCSP profile name is
- *                  refused rather than run against a request.
+ * @opts  profile   `"rfc2986"` for the structural rows alone, `"cabf-tls"` to add the TLS rows, or
+ *                  `"rfc9883"` for the rows about a request carrying a possession statement
+ *                  (default runs the structural rows and the rfc9883 rows). A certificate, CRL
+ *                  or OCSP profile name is refused rather than run against a request.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
  *                  always reflect the complete, unfiltered result.
  * @example
@@ -7217,8 +7271,9 @@ function _ingestCms(input) {
  * `pki.cms.verify`'s, and the certificates a message carries are linted with
  * `pki.lint.certificate`.
  *
- * @opts  profile   `"rfc5652"`, which is also what the default runs. A certificate, CRL or OCSP
- *                  profile name is refused rather than run against a message.
+ * @opts  profile   `"rfc5652"`, or `"rfc8933"` for the rows that update it (default runs both).
+ *                  A certificate, CRL or OCSP profile name is refused rather than run against a
+ *                  message.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
  *                  always reflect the complete, unfiltered result.
  * @example
@@ -7517,10 +7572,11 @@ function rules(profile, artifact) {
  * and `"default"`, are not among them.
  * @example
  *   pki.lint.profiles();
- *   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "cabf-smime", "cabf-cs",
- *   //     "etsi-qc", "mozilla-root", "chrome-root", "microsoft-root", "apple-root",
- *   //     "nist-pqc-transition", "cnsa-2.0", "rfc2986", "rfc5280-crl", "rfc6960", "rfc5019",
- *   //     "rfc5652", "rfc3161", "rfc5755"]
+ *   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "rfc9763", "rfc7633", "x509-altsig",
+ *   //     "cabf-tls", "cabf-smime", "cabf-cs", "etsi-qc", "mozilla-root", "chrome-root",
+ *   //     "microsoft-root", "apple-root", "nist-pqc-transition", "cnsa-2.0", "rfc2986",
+ *   //     "rfc9883", "rfc5280-crl", "rfc6960", "rfc5019", "rfc5652", "rfc8933", "rfc3161",
+ *   //     "rfc5755"]
  */
 /** @internal `cabf-tls` names the certificate profile in this list and is not repeated for the
  *  request form: `pki.lint.csr` takes the same name and runs those rows against what a request

package/lib/oid.js

@@ -232,7 +232,14 @@ var FAMILIES = Object.assign(Object.create(null), {
   pkcs9: { base: [1, 2, 840, 113549, 1, 9], of: {
     emailAddress: 1, contentType: 3, messageDigest: 4, signingTime: 5,
     countersignature: 6, challengePassword: 7, extensionRequest: 14,
-    smimeCapabilities: 15, friendlyName: 20, localKeyId: 21 } },
+    smimeCapabilities: 15, friendlyName: 20, localKeyId: 21,
+    /** @internal RFC 6211 sec. 2 and Appendix A both state the CMS algorithm protection attribute
+     *  here, directly under PKCS 9, and that is the value OpenSSL and Bouncy Castle register. The
+     *  same document's sec. 4 says "All identifiers are assigned out of the S/MIME OID arc", which
+     *  the IANA registry, errata 9144 and 9145, and draft-ietf-lamps-rfc6211-update-03 read as
+     *  `1.2.840.113549.1.9.16.2.52`, registered beside it as `cmsAlgorithmProtect`. Both are
+     *  accepted on parse, because a mismatched identifier is equivalent to no protection. */
+    cmsAlgorithmProtection: 52 } },
 
   keyPackageContentTypes: { base: [2, 16, 840, 1, 101, 2, 1, 2, 78], of: { aKeyPackage: 5 } },
 
@@ -324,6 +331,9 @@ var FAMILIES = Object.assign(Object.create(null), {
     cmcUnsignedData: 34,
     binarySigningTime: 46,
     asymmDecryptKeyID: 54, relatedCertRequest: 60,
+    /** @internal The second value the CMS algorithm protection attribute is identified by. See
+     *  `pkcs9.cmsAlgorithmProtection` for which document states which, and why both are read. */
+    cmsAlgorithmProtect: 52,
     certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
 
   ansiX962: { base: [1, 2, 840, 10045], of: {

package/lib/path-validate.js

@@ -945,16 +945,20 @@ function _flagSet(callerValue, anchorFlags, name) {
   return anchorFlags !== null && anchorFlags[name] === true;
 }
 
-function initialize(certs, params, seeds, anchor, ta) {
+/** @internal `policySwitches` carries the three sec. 6.1.1 inputs as the door read and typed them.
+ *  They are not read off `params` here: normalizing an anchor runs caller accessors for its name,
+ *  key and algorithm, so an options object the caller still holds can carry a different value by
+ *  the time this runs, and the state would be built from a value nothing typed. */
+function initialize(certs, params, seeds, anchor, ta, policySwitches) {
   var n = certs.length;
-  var state = _initialState(certs, params, seeds, anchor, n, ta);
+  var state = _initialState(certs, params, seeds, anchor, n, ta, policySwitches);
   /** @internal The root is the depth-zero anyPolicy node, and it is indexed like any other, so the
    * "is there a node at this depth for this policy" lookup answers for depth zero too. */
   policyLayer(state, 0)[OID.anyPolicy] = state.validPolicyGraph;
   return state;
 }
 
-function _initialState(certs, params, seeds, anchor, n, ta) {
+function _initialState(certs, params, seeds, anchor, n, ta, policySwitches) {
   /** @internal The anchor's constraints are read HERE rather than merged into a copy of `params`,
    * because a copy answers only for the own properties the copy loop enumerated. A caller option
    * defined non-enumerably would be dropped by the copy and the anchor would then WIDEN the
@@ -969,9 +973,9 @@ function _initialState(certs, params, seeds, anchor, n, ta) {
     minRsaModulusBits: params.minRsaModulusBits !== undefined ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
     permittedGenerations: intrinsic.filter(seeds.permittedGenerations, function (g) { return g.length > 0; }),
     excludedSubtrees: seeds.excluded,
-    explicitPolicy: _flagSet(params.initialExplicitPolicy, ta.policyFlags, "requireExplicitPolicy") ? 0 : n + 1,
-    inhibitAnyPolicy: _flagSet(params.initialAnyPolicyInhibit, ta.policyFlags, "inhibitAnyPolicy") ? 0 : n + 1,
-    policyMapping: _flagSet(params.initialPolicyMappingInhibit, ta.policyFlags, "inhibitPolicyMapping") ? 0 : n + 1,
+    explicitPolicy: _flagSet(policySwitches.initialExplicitPolicy, ta.policyFlags, "requireExplicitPolicy") ? 0 : n + 1,
+    inhibitAnyPolicy: _flagSet(policySwitches.initialAnyPolicyInhibit, ta.policyFlags, "inhibitAnyPolicy") ? 0 : n + 1,
+    policyMapping: _flagSet(policySwitches.initialPolicyMappingInhibit, ta.policyFlags, "inhibitPolicyMapping") ? 0 : n + 1,
     workingPublicKeyAlgorithm: anchor.algorithm,
     workingPublicKey: anchor.publicKey,
     workingPublicKeyParameters: anchor.parameters || null,
@@ -1286,7 +1290,12 @@ function _revocationRow(row, rv) {
  * The value-carrying options (`time`, `maxPathCerts`,
  * `maxPolicyNodes`, `minRsaModulusBits`, the subtree seeds, `userInitialPolicySet`, `requiredEku`)
  * are validated at the entry point. A mis-shaped value throws `path/bad-input`,
- * so it cannot silently go unapplied. Returns `{ valid, revocationChecked, anchorConstraints,
+ * so it cannot silently go unapplied. `requireRevocation` makes the revocation
+ * determination mandatory, failing the path with `path/revocation-undetermined`
+ * where it could not be made. It and the three sec. 6.1.1 policy inputs
+ * (`initialExplicitPolicy`, `initialAnyPolicyInhibit`,
+ * `initialPolicyMappingInhibit`) each take `true`, `false`, `null` or an absent
+ * option, and any other value throws `path/bad-input` for the same reason. Returns `{ valid, revocationChecked, anchorConstraints,
  * path, results, workingPublicKey, workingPublicKeyAlgorithm,
  * workingPublicKeyParameters, validPolicyGraph, userConstrainedPolicySet }` where `results[i].checks`
  * carries a per-check reason code (`path/*`) for every step. Pure and
@@ -1473,6 +1482,23 @@ async function _validate(path, opts, run, scope) {
   var certs = path.map(function (c, ci) { return coerceCert(c, "validate: path[" + ci + "]"); });
   var n = certs.length;
   if (n < 1) throw E("path/empty-path", "validate: the certification path is empty");
+  /** @internal The four switches that turn a requirement on, each read as the boolean it documents
+   * and read HERE, before any anchor is normalized. An anchor's own copies of the three policy
+   * flags are typed where they are copied, and `_flagSet` compares the caller's value with the
+   * anchor's, so typing one side and not the other would accept at the door what the comparison
+   * refuses. Normalizing an anchor reads its name, key and algorithm, and those reads run caller
+   * code when the anchor carries accessors: the typed values below are what every anchor attempt
+   * is handed, so a requirement cannot be turned off between the attempts. */
+  var policySwitches = {
+    requireRevocation: guard.identifier.booleanOption(opts.requireRevocation, E,
+      "path/bad-input", "validate: opts.requireRevocation"),
+    initialExplicitPolicy: guard.identifier.booleanOption(opts.initialExplicitPolicy, E,
+      "path/bad-input", "validate: opts.initialExplicitPolicy"),
+    initialAnyPolicyInhibit: guard.identifier.booleanOption(opts.initialAnyPolicyInhibit, E,
+      "path/bad-input", "validate: opts.initialAnyPolicyInhibit"),
+    initialPolicyMappingInhibit: guard.identifier.booleanOption(opts.initialPolicyMappingInhibit, E,
+      "path/bad-input", "validate: opts.initialPolicyMappingInhibit"),
+  };
   /** @internal Captured before any anchor is normalized: an anchor field may be an accessor, and
    * that getter runs caller code which could otherwise clear these lists first. */
   var callerPermitted = checkedSubtreeSeeds(opts.initialPermittedSubtrees, "initialPermittedSubtrees");
@@ -1506,6 +1532,14 @@ async function _validate(path, opts, run, scope) {
        * question the caller asked. Copying `opts.identity` across would have each attempt read
        * the caller's own list again, after the awaits the earlier attempts spent. */
       if (identityRefs !== null) o.identity = identityRefs;
+      /** @internal The four switches as this call typed them, carried into every attempt rather
+       * than copied from an options object the caller still holds: the tuples above were built by
+       * reading each anchor, which runs the caller's accessors, so a value copied here would be
+       * whatever those left behind. */
+      o.requireRevocation = policySwitches.requireRevocation;
+      o.initialExplicitPolicy = policySwitches.initialExplicitPolicy;
+      o.initialAnyPolicyInhibit = policySwitches.initialAnyPolicyInhibit;
+      o.initialPolicyMappingInhibit = policySwitches.initialPolicyMappingInhibit;
       return o;
     };
     var lastMatched = null, anyMatched = false;
@@ -1538,7 +1572,7 @@ async function _validate(path, opts, run, scope) {
   var requiredEku = purposeOpts.requiredEku;
   var checkPurpose = purposeOpts.checkPurpose;
 
-  var state = initialize(certs, opts, seeds, anchor, taConstraints);
+  var state = initialize(certs, opts, seeds, anchor, taConstraints, policySwitches);
   state._n = n;
   state.requiredEku = requiredEku;
   /** @internal The verifier comes from the per-call scope the door built, never from `opts`: the option
@@ -1548,7 +1582,7 @@ async function _validate(path, opts, run, scope) {
   var verifierVerify = scope.verify;
   var revocationChecker = opts.revocationChecker || null;
   var softFail = opts.softFail === true;
-  var requireRevocation = opts.requireRevocation === true;
+  var requireRevocation = policySwitches.requireRevocation;
   var failed = false;
   var revocationRan = false, revocationWaived = false, revocationUndetermined = false;
   var prefixAuthentic = true;
@@ -3330,7 +3364,7 @@ async function _fetchAiaIssuers(current, aia) {
  * @opts  direction              Search direction: `"forward"` (default, from the leaf toward an anchor), `"reverse"` (from an anchor toward the leaf, RFC 4158 sec. 3.1, narrower when the anchor set is small and the leaf fans out), or `"auto"` (pick by first-hop fan-out). Reverse building is pool-only and does not combine with `fetchAia`. Every direction hands each assembled path to `validate`, so the direction changes only search order, never which paths are accepted.
  * @opts  maxDepth               Chain-length depth cap (default `C.LIMITS.PATH_BUILD_MAX_DEPTH`).
  * @opts  maxCandidatesConsidered  Total-work cap on candidate expansions (default `C.LIMITS.PATH_BUILD_MAX_CANDIDATES`).
- * @opts  validate               `false` returns the ordered path without validating (pure-builder mode; default `true`).
+ * @opts  validate               `false` returns the ordered path without validating (pure-builder mode; default `true`). It takes `true`, `false`, `null` or an absent option, and any other value is refused `path/bad-input` at the door rather than read as on.
  * @opts  fetchAia               `true` opts in to AIA caIssuers network fetching of a missing intermediate (default `false`, fully offline). Off unless set; when set, a fetch runs only on a pool miss for a non-anchor-adjacent cert, and (with validation on) every fetched cert still flows through `validate`.
  * @opts  transport              The injectable transport seam (`fn(request) -> Promise<{ status, headers, body }>`); tests drive the fetch offline. With none, the default `pki.transport.https` is used, which fails closed unless `opts.tls` carries trust. SSRF: for a caIssuers URL with a DNS hostname, a custom transport is used only if it declares `fn.blocksPrivateAddresses = true`, which vouches that it refuses (and pins) a resolved private / loopback / link-local / special-use address, as the default transport does. Without that marker a DNS-name AIA URL is fail-closed (skipped) and only an IP-literal URL (validated up front) is fetched; set the marker on your transport when it filters resolved addresses.
  * @opts  tls                    The TLS trust for the AIA HTTPS host (`{ anchors, useSystemStore, ... }`). This is distinct from `opts.trustAnchors`, the PKI trust store the path validates against. The default transport refuses an unpinned server.
@@ -3338,7 +3372,7 @@ async function _fetchAiaIssuers(current, aia) {
  * @opts  maxAiaPerCert          Cap on caIssuers URLs tried per certificate (default `C.LIMITS.PATH_AIA_MAX_PER_CERT`).
  * @opts  aiaTimeout             Per-fetch timeout in ms, forwarded to the transport.
  * @opts  maxResponseBytes       Per-fetch response size cap, forwarded to the transport (tightenable downward only).
- * @opts  (validate options)     Every `pki.path.validate` option (`requiredEku`, `revocationChecker`, `checkPurpose`, the initial policy inputs, ...) is forwarded unchanged. When `userInitialPolicySet` is supplied, build returns the accepted path whose user-constrained policy set best satisfies it (RFC 4158 sec. 4 forward policy chaining) rather than the first accepted path; `validate` still gates every path, so this changes only which valid path is chosen. The ranking explores more of the candidate graph than a first-accept build, so it is bounded by `maxCandidatesConsidered` like the rest of the search. Reaching that cap means stop looking, not nothing found: if a valid path was already accepted, build returns the best-policy one of those; it reaches `path/build-limit` only when the cap is hit before any valid path is accepted. An `anyPolicy` entry makes the set unconstrained, so ranking is skipped and the first accepted path is returned.
+ * @opts  (validate options)     Every `pki.path.validate` option (`requiredEku`, `revocationChecker`, `checkPurpose`, the initial policy inputs, ...) is forwarded unchanged. `requireRevocation` and the three policy inputs are typed at this door as well as at `validate`'s, because a build reaches an AIA fetch before it reaches `validate` and a build that assembles no path never calls it. When `userInitialPolicySet` is supplied, build returns the accepted path whose user-constrained policy set best satisfies it (RFC 4158 sec. 4 forward policy chaining) rather than the first accepted path; `validate` still gates every path, so this changes only which valid path is chosen. The ranking explores more of the candidate graph than a first-accept build, so it is bounded by `maxCandidatesConsidered` like the rest of the search. Reaching that cap means stop looking, not nothing found: if a valid path was already accepted, build returns the best-policy one of those; it reaches `path/build-limit` only when the cap is hit before any valid path is accepted. An `anyPolicy` entry makes the set unconstrained, so ranking is skipped and the first accepted path is returned.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var pemString = await pki.x509.sign({ subject: "Example Root", subjectPublicKey: await pki.key.export(pair.publicKey),
@@ -3372,6 +3406,38 @@ async function build(leaf, opts) {
    * second time and an accessor can answer differently on each read. */
   var checkedTransport = guard.identifier.assertCallableOption(opts, "transport", E, "path/bad-input",
     "build: opts.transport", "(request) -> Promise<{ status, headers, body }>");
+  /** @internal The switches build forwards to `validate` are typed at THIS door too, because build
+   * reaches the network before it reaches `validate`: with `fetchAia` on it fetches AIA issuers
+   * while assembling a chain, and a build that assembles none returns `path/no-path` with no
+   * `validate` call having read them. A door that only the successful route passes through is not
+   * a door. */
+  var FORWARDED_SWITCHES = ["requireRevocation", "initialExplicitPolicy", "initialAnyPolicyInhibit",
+    "initialPolicyMappingInhibit"];
+  var forwardedSwitches = intrinsic.create(null);
+  intrinsic.forEach(FORWARDED_SWITCHES, function (k) {
+    /** @internal Every one of the four is typed and recorded, including the ones the caller left
+     * out. An absent switch recorded as `false` is the same question answered the same way, and
+     * recording it is what stops a later read from finding one that was not there at this door:
+     * reading each anchor runs the caller's accessors, and an accessor can add an option. */
+    forwardedSwitches[k] = guard.identifier.booleanOption(opts[k], E, "path/bad-input", "build: opts." + k);
+  });
+  /** @internal `validate` defaults ON, so absence means on here and the off form is `false`. A
+   * value outside that set is a caller asking for pure-builder mode in a spelling this verb does
+   * not read, and running the validation they asked to skip is as silent as skipping it. */
+  var doValidateOpt = (opts.validate === undefined || opts.validate === null) ? true
+    : guard.identifier.booleanOption(opts.validate, E, "path/bad-input", "build: opts.validate");
+  /** @internal Pure-builder mode runs no validation, so a requirement asked for alongside it is a
+   * requirement nothing will apply. The combination is refused rather than answered with an
+   * ordered path, the same way an asked-for check that its input cannot satisfy is refused. */
+  if (!doValidateOpt) {
+    intrinsic.forEach(FORWARDED_SWITCHES, function (k) {
+      if (forwardedSwitches[k] === true) {
+        throw E("path/bad-input", "build: opts." + k + " asks for a check that only validation " +
+          "applies, and opts.validate is false, which returns the ordered path without validating; " +
+          "drop one of the two");
+      }
+    });
+  }
   var leafCert;
   try { leafCert = coerceCert(leaf); }
   catch (e) { throw E("path/bad-input", "build: the leaf certificate did not parse", e); }
@@ -3409,7 +3475,7 @@ async function build(leaf, opts) {
   // allow:guard-shape-reinlined -- opts.maxDepth here is the path-building chain depth (capped via guard.limits.cap against the PATH_BUILD_MAX_DEPTH ceiling), a different concept from the decode-recursion depth guard.limits.depthCap enforces
   var maxDepth = guard.limits.cap(opts.maxDepth, "build: opts.maxDepth", Math.min(constants.LIMITS.PATH_BUILD_MAX_DEPTH, depthCeiling), { E: E, code: "path/bad-input", min: 0, max: depthCeiling });
   var maxConsidered = guard.limits.cap(opts.maxCandidatesConsidered, "build: opts.maxCandidatesConsidered", poolCeiling, { E: E, code: "path/bad-input", min: 1 });
-  var doValidate = opts.validate !== false;
+  var doValidate = doValidateOpt;
 
   var direction = opts.direction !== undefined ? opts.direction : "forward";
   if (direction !== "forward" && direction !== "reverse" && direction !== "auto") {
@@ -3448,6 +3514,10 @@ async function build(leaf, opts) {
   var forwarded = Object.create(null);
   intrinsic.forEach(intrinsic.keys(_VALIDATE_OPTS), function (k) {
     if (intrinsic.hasOwn(BUILD_ONLY_OPT, k)) return;
+    /** @internal A switch this door typed is forwarded as the value it typed. Reading it off the
+     * options object again would ask a second time, and normalizing an anchor between the two runs
+     * caller accessors, so the value `validate` is handed need not be the one that passed here. */
+    if (intrinsic.hasOwn(forwardedSwitches, k)) { forwarded[k] = forwardedSwitches[k]; return; }
     if (k in opts) forwarded[k] = opts[k];
   });
   if (buildPermRaw != null) forwarded.initialPermittedSubtrees = buildPermSeeds;

package/lib/revocation-fetch.js

@@ -192,9 +192,7 @@ function _no(why) { return { url: null, why: why }; }
  * under a `=== true` test, and the requests would go out carrying no nonce with nothing said. An
  * absent value is the documented default; anything else is a configuration fault. */
 function _booleanOption(value, label) {
-  if (value === undefined || value === null) return false;
-  if (value === true || value === false) return value;
-  throw E("path/bad-input", label + " must be true or false, got " + guard.text.showValue(value));
+  return guard.identifier.booleanOption(value, E, "path/bad-input", label);
 }
 
 /** @internal Whether this transport says it filters the address it resolved. A transport is a