@blamejs/pki 0.8.52 → 0.8.54

package/lib/guard-der.js

@@ -8,23 +8,42 @@ var _forEach = require("./guard-intrinsic").forEach;
 var _sizeOf = require("./guard-intrinsic").sizeOf;
 var _create = require("./guard-intrinsic").create;
 var _isBuffer = require("./guard-intrinsic").isBuffer;
+var _isArray = require("./guard-intrinsic").isArray;
 
 var asn1 = null;
 function _asn1() { if (asn1 === null) asn1 = require("./asn1-der"); return asn1; }
 
-var VALUE_READERS = null;
-function _readers() {
-  if (VALUE_READERS !== null) return VALUE_READERS;
-  var asn1 = _asn1();
-  var m = _create(null), R = asn1.read, T = asn1.TAGS;
-  m[T.BOOLEAN] = R.boolean; m[T.INTEGER] = R.integer; m[T.ENUMERATED] = R.enumerated;
-  m[T.BIT_STRING] = R.bitString; m[T.OCTET_STRING] = R.octetString; m[T.NULL] = R.nullValue;
-  m[T.OBJECT_IDENTIFIER] = R.oid; m[T.UTC_TIME] = R.time; m[T.GENERALIZED_TIME] = R.time;
-  m[T.NUMERIC_STRING] = R.numericString;
+/** @internal Everything this file needs from the codec, captured in ONE step on first use: the two
+ *  functions it calls, the two tag NUMBERS it compares against, and the reader table. Read per call
+ *  instead, each is a property of a module object anything sharing the process can assign to, and
+ *  the verdict follows the assignment: `reservedUniversalTag` replaced by a function answering
+ *  `true` made `tlv` refuse a valid NULL, and `TAGS.SEQUENCE` reassigned made both `element` and
+ *  `tlv` refuse a valid empty SEQUENCE. The tag numbers are copied out rather than the table kept,
+ *  because freezing a record holding a reference leaves what it points at writable. One step rather
+ *  than two because two initialize at different first calls, and the gap between them was itself a
+ *  window: warming the codec through a context node left the readers uncaptured, and `read.nullValue`
+ *  replaced in between turned a NULL with content from refused into accepted. The capture is lazy
+ *  because the codec requires this file, so neither can be required at the other's load. */
+var CODEC = null;
+function _codec() {
+  if (CODEC !== null) return CODEC;
+  var m = _asn1();
+  var R = m.read, T = m.TAGS;
+  var readers = _create(null);
+  readers[T.BOOLEAN] = R.boolean; readers[T.INTEGER] = R.integer; readers[T.ENUMERATED] = R.enumerated;
+  readers[T.BIT_STRING] = R.bitString; readers[T.OCTET_STRING] = R.octetString;
+  readers[T.NULL] = R.nullValue; readers[T.OBJECT_IDENTIFIER] = R.oid; readers[T.UTC_TIME] = R.time;
+  readers[T.GENERALIZED_TIME] = R.time; readers[T.NUMERIC_STRING] = R.numericString;
   _forEach([T.UTF8_STRING, T.PRINTABLE_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING,
-    T.BMP_STRING, T.UNIVERSAL_STRING], function (t) { m[t] = R.string; });
-  VALUE_READERS = m;
-  return VALUE_READERS;
+    T.BMP_STRING, T.UNIVERSAL_STRING], function (t) { readers[t] = R.string; });
+  CODEC = _freeze({
+    decode: m.decode,
+    reservedUniversalTag: m.reservedUniversalTag,
+    SEQUENCE: T.SEQUENCE,
+    SET: T.SET,
+    readers: _freeze(readers),
+  });
+  return CODEC;
 }
 
 var TAG_CLASS_RANK = _create(null);
@@ -48,30 +67,69 @@ function setOrderOk(kids) {
   return dup ? octetAsc : (octetAsc || tagAsc);
 }
 
-// @enforced-by guard-shape-reinlined
-// @guard-shape _ANY_VALUE_READERS\[
-function element(node, E, code, label) {
-  if (node.tagClass === "universal" && node.tagNumber === 0) {
+// @enforced-by behavioral -- validating a universal element's content through the codec's own reader
+// @enforced-by behavioral -- for its tag has no rename-proof shape: a re-inline builds a table keyed
+// @enforced-by behavioral -- by a TAGS member under any local name, and an anchor on one name goes
+// @enforced-by behavioral -- silently green on a rename. The RED vectors in guard-der.test.js are the
+// @enforced-by behavioral -- guard, and every format parser's strict-DER vectors route through tlv.
+function element(node, E, code, label) { _element(node, E, code, label); }
+
+/** @internal Every field of the node is taken ONCE, into the plain record every rule below decides
+ *  on, every reader is handed, and the SET-order check compares. Read per rule instead, a node whose
+ *  `tagNumber` answers from a getter clears one check as the tag it is not and is then handled as the
+ *  tag it is: a node answering 15 and then 5 was ACCEPTED, over four reads. A Proxy saw two reads of
+ *  each field, the content validator was handed the caller's object rather than what was checked, and
+ *  a SET member's getter answered the order comparison with a value the member's own validation never
+ *  saw. The record is TYPED because each field is read as something: the tag becomes a property key at
+ *  the reader lookup, which runs a `Symbol.toPrimitive` an object carries, and the form decides a
+ *  branch a truthy non-boolean enters. `decode` answers every field with a plain value for every
+ *  input it accepts, so this refuses only a node the codec did not produce. The node `tlv` passes
+ *  holds plain values; what the record closes is the next caller, which hands this a node it decoded
+ *  elsewhere or built itself. Returned so the caller's walk compares the members it validated. */
+function _element(node, E, code, label) {
+  if (!node || typeof node !== "object") throw E(code, label + " must be a decoded DER node");
+  var s = {
+    tagClass: node.tagClass,
+    tagNumber: node.tagNumber,
+    constructed: node.constructed,
+    content: node.content,
+    bytes: node.bytes,
+  };
+  var kids = s.constructed === true ? node.children : null;
+  if (typeof s.tagClass !== "string" || typeof s.tagNumber !== "number" ||
+      typeof s.constructed !== "boolean" || (s.constructed && !_isArray(kids))) {
+    throw E(code, label + " must be a node this codec decoded, carrying a tag class, a tag number, " +
+      "a form, and members when it is constructed");
+  }
+  var cls = s.tagClass, tag = s.tagNumber, C = _codec();
+  if (cls === "universal" && tag === 0) {
     throw E(code, label + " must not use the reserved end-of-contents encoding (tag 0)");
   }
-  var T = _asn1().TAGS;
-  if (node.constructed) {
-    if (node.tagClass === "universal" && node.tagNumber !== T.SEQUENCE && node.tagNumber !== T.SET) {
-      throw E(code, label + " of universal constructed type " + node.tagNumber + " has no strict DER structure validator here");
+  /** @internal The other reserved rows, asked of the codec's own predicate so the two cannot
+   *  disagree about which universal tags X.680 Table 1 assigns to no type. The codec door refuses
+   *  these before a node exists, so this answers for a node that reached here by another route. */
+  if (cls === "universal" && C.reservedUniversalTag(tag)) {
+    throw E(code, label + " must not use universal tag " + tag +
+      ", which X.680 Table 1 reserves and assigns to no type");
+  }
+  if (s.constructed) {
+    if (cls === "universal" && tag !== C.SEQUENCE && tag !== C.SET) {
+      throw E(code, label + " of universal constructed type " + tag + " has no strict DER structure validator here");
     }
-    var kids = node.children;
-    for (var i = 0; i < kids.length; i++) element(kids[i], E, code, label);
-    if (node.tagClass === "universal" && node.tagNumber === T.SET && !setOrderOk(kids)) {
+    var n = kids.length, members = [];
+    for (var i = 0; i < n; i++) members[i] = _element(kids[i], E, code, label);
+    if (cls === "universal" && tag === C.SET && !setOrderOk(members)) {
       throw E(code, label + " has a SET whose members are in no canonical DER order (X.690 sec. 11.6 / X.680 sec. 8.6)");
     }
-    return;
+    return s;
   }
-  if (node.tagClass === "universal") {
-    var reader = _readers()[node.tagNumber];
-    if (!reader) throw E(code, label + " of universal type " + node.tagNumber + " has no strict DER content validator here");
-    try { reader(node); }
+  if (cls === "universal") {
+    var reader = C.readers[tag];
+    if (!reader) throw E(code, label + " of universal type " + tag + " has no strict DER content validator here");
+    try { reader(s); }
     catch (e) { throw E(code, label + " is not a valid DER element for its type", e); }
   }
+  return s;
 }
 
 // @enforced-by guard-shape-reinlined
@@ -79,7 +137,7 @@ function element(node, E, code, label) {
 function tlv(content, E, code, label) {
   if (!content || _sizeOf(content) === 0) throw E(code, label + " must be a non-empty DER element");
   var node;
-  try { node = _asn1().decode(content); }
+  try { node = _codec().decode(content); }
   catch (e) { throw E(code, label + " must be exactly one well-formed DER element (no trailing data)", e); }
   element(node, E, code, label);
   return content;
@@ -96,6 +154,36 @@ function paramsAbsentOrNull(params) {
   return params === null || params === undefined || isNull(params);
 }
 
+/** Whether two decoded `AlgorithmIdentifier` records name the same algorithm with the same
+ *  parameters, comparing the parameters AS THEY ARE: absent equals absent, and an explicit DER NULL
+ *  is a different identifier from one with no parameters field.
+ *
+ *  This is the comparison for an identifier whose parameters carry meaning. A digest identifier has
+ *  the opposite rule, because RFC 3370 clause 2.1 and RFC 5754 clause 2 require an implementation to
+ *  accept both spellings of the same digest, and `schema-cms.sameDigestAlgorithm` grants that. A
+ *  signature identifier does not: RFC 4055 requires the `*WithRSAEncryption` identifiers to carry a
+ *  NULL, RFC 5758 and RFC 8410 require the `ecdsaWith*` and the Edwards and post-quantum ones to omit
+ *  the field, and RSASSA-PSS carries its hash, mask generator, salt length and trailer field there
+ *  under RFC 4056 clause 2.2. Collapsing the two spellings for one of those is admitting a different
+ *  algorithm, which is why the grant does not travel.
+ *
+ * @enforced-by behavioral -- an equality that is too permissive has no rename-proof shape; the RED
+ * vector is an identifier pair differing only in an explicit NULL, which must compare unequal here
+ * and equal through the digest helper.
+ */
+function sameAlgorithmExactly(a, c) {
+  if (!a || !c || a.oid !== c.oid) return false;
+  /** @internal Each operand's `parameters` is read ONCE, into the value the absence test and the
+   *  comparison share. Read twice, the first value decided which branch ran and the second was the
+   *  one compared, so a getter answering a DER NULL and then `null` made an algorithm carrying
+   *  parameters compare EQUAL to one carrying none. */
+  var araw = a.parameters, craw = c.parameters;
+  var ap = araw === undefined ? null : araw;
+  var cp = craw === undefined ? null : craw;
+  if (ap === null || cp === null) return ap === cp;
+  return _isBuffer(ap) && _isBuffer(cp) && _sizeOf(ap) === _sizeOf(cp) && _compare(ap, cp) === 0;
+}
+
 // @enforced-by behavioral -- see paramsAbsentOrNull.
 function assertParams(params, shape, E, code, label) {
   var ok = shape === "null" ? isNull(params) : (shape === "absent"
@@ -109,4 +197,5 @@ function assertParams(params, shape, E, code, label) {
 module.exports = _freeze({
   element: element, tlv: tlv,
   isNull: isNull, paramsAbsentOrNull: paramsAbsentOrNull, assertParams: assertParams,
+  sameAlgorithmExactly: sameAlgorithmExactly,
 });

package/lib/guard-encoding.js

@@ -171,7 +171,8 @@ function _rawError(E) {
  * characters passes a URL the rule was meant to refuse.
  *
  * @enforced-by guard-shape-reinlined
- * @guard-shape /charCodeAt\s*\(\s*[\w$]+\s*,\s*[\w$]+\s*\)\s*>\s*(?:0x7f|127)\b/ */
+ * @guard-shape charCodeAt\s*\(\s*[\w$]+\s*,\s*[\w$]+\s*\)\s*>\s*(?:0x7f|127)\b
+ */
 function isAsciiText(s) {
   if (typeof s !== "string") return false;
   for (var i = 0; i < s.length; i++) {

package/lib/guard-identifier.js

@@ -600,6 +600,32 @@ function assertCallableOption(opts, key, E, code, label, shape) {
   return assertCallable(opts[key], E, code, label, shape);
 }
 
+/** @internal How a switch is read: as the boolean it documents, with an absent value standing for
+ * off and every other value refused. A switch that turns a requirement on is the case that decides
+ * the shape. `requireRevocation: "true"` out of a config file is truthy to JavaScript and unequal
+ * to `true`, so a boundary testing `=== true` runs without the requirement and says nothing, while
+ * one testing truthiness turns the requirement on for `0` and `""` as well. The value is rendered
+ * from its own type rather than coerced, so a caller value with a throwing `toString` reports the
+ * typed refusal. A boundary that reads `null` as a value its caller supplied keeps its own check:
+ * this one reads it as absence. */
+// @enforced-by behavioral -- reading a caller switch has no rename-proof code shape; `=== true` is
+// @enforced-by behavioral -- the correct read for a switch that turns a control OFF, so a lexical
+// @enforced-by behavioral -- rule would flag the safe direction. The per-verb vectors are the
+// @enforced-by behavioral -- guard: each drives the shipped verb with a non-boolean and asserts the
+// @enforced-by behavioral -- typed refusal, and with false and absence to pin the two off forms.
+function booleanOption(value, E, code, label) {
+  if (value === undefined || value === null) return false;
+  if (value === true || value === false) return value;
+  throw E(code, label + " must be true or false, got " + _showSwitch(value));
+}
+
+/** @internal The value's own type, for the message above. Nothing here calls into the value. */
+function _showSwitch(value) {
+  if (typeof value === "string") return _stringify(value);
+  if (typeof value === "number" || typeof value === "bigint") return _String(value);
+  return typeof value;
+}
+
 /** @internal Whether a caller's object says something about itself, as opposed to inheriting the
  * answer. A declaration is a promise the author of that object made, so it has to sit on the object
  * they wrote: reading the flag through the object finds a value on `Function.prototype` that every
@@ -608,7 +634,8 @@ function assertCallableOption(opts, key, E, code, label, shape) {
  * the object, so an accessor further up the chain cannot answer either.
  *
  * @enforced-by guard-shape-reinlined
- * @guard-shape /\.\s*blocksPrivateAddresses\s*===\s*true/ */
+ * @guard-shape \.\s*blocksPrivateAddresses\s*===\s*true
+ */
 function declaresOwn(obj, name) {
   if (obj === null || obj === undefined) return false;
   var d;
@@ -619,6 +646,7 @@ function declaresOwn(obj, name) {
 
 module.exports = intrinsic.freeze({
   assertCallable: assertCallable,
+  booleanOption: booleanOption,
   declaresOwn: declaresOwn,
   assertCallableOption: assertCallableOption,
   assertCanonicalOid: assertCanonicalOid,

package/lib/guard-name.js

@@ -198,6 +198,7 @@ function escapeControlBytes(str) {
 var DN_SPECIAL = intrinsic.assign(intrinsic.create(null), { 0x2c: 1, 0x2b: 1, 0x22: 1, 0x5c: 1, 0x3c: 1, 0x3e: 1, 0x3b: 1 });
 
 var _hexNibble = require("./guard-encoding").hexNibble;
+var _isAsciiText = require("./guard-encoding").isAsciiText;
 function _isAttrTypeStart(c) { return (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a); }
 function _isAttrTypeChar(c) { return _isAttrTypeStart(c) || (c >= 0x30 && c <= 0x39) || c === 0x2d; }
 function _isDigit(c) { return c >= 0x30 && c <= 0x39; }
@@ -335,10 +336,12 @@ function emailEqual(a, b) {
   return lowerAscii(aHost) === lowerAscii(bHost) ? "match" : "no-match";
 }
 
+/** @internal An all-ASCII host, asked of the one place that scans for a byte above 0x7f, with the
+ *  non-empty requirement kept here because a host part is not optional and `isAsciiText` answers
+ *  `true` of the empty string. */
+// @guard-via guard.encoding.isAsciiText
 function _asciiHost(h) {
-  if (h.length === 0) return false;
-  for (var i = 0; i < h.length; i++) if (_charCodeAt(h, i) > 0x7f) return false;
-  return true;
+  return h.length > 0 && _isAsciiText(h);
 }
 
 // @enforced-by guard-shape-reinlined

package/lib/guard-text.js

@@ -102,13 +102,17 @@ function keyOf(v) {
  * by its type, which is what `showValue` would have said about it anyway.
  *
  * @enforced-by guard-shape-reinlined
- * @guard-shape /([\w$]+)\s*&&\s*\1\.message\s*\?\s*\1\.message\s*:|([\w$]+)\.message\s*\|\|\s*\2\b/ */
+ * @guard-shape ([\w$]+)\s*&&\s*\1\.message\s*\?\s*\1\.message\s*:|([\w$]+)\.message\s*\|\|\s*\2\b
+ */
 function describeThrown(e) {
   var m;
   try { m = e === null || e === undefined ? undefined : e.message; }
   catch (_readFailed) { return _thrownFallback(e); }
   if (typeof m === "string" && m.length > 0) return m;
-  if (m === undefined || m === null) return _thrownFallback(e);
+  /** @internal An EMPTY message answers nothing readable, so it is described by its type like any
+   *  other unreadable value. Returned as the empty string it was, it left the sentence built around
+   *  it ending at its colon with nothing after it, which tells a reader less than the type does. */
+  if (m === undefined || m === null || m === "") return _thrownFallback(e);
   try {
     if (typeof m === "symbol") return intrinsic.String(m);
     return "" + m;

package/lib/lint.js

@@ -4929,12 +4929,21 @@ var ALL_CRL_RULES = RFC5280_CRL_RULES.concat(CNSA2_CRL_RULES);
  *  for YY >= 50 and 20YY otherwise, so every UTCTime names a year inside 1950..2049 and only the
  *  GeneralizedTime direction of that clause can be broken. */
 var OID_SIGNING_TIME = oid.byName("signingTime");
+/** @internal The two identifiers RFC 6211's attribute is assigned, both read: the body's PKCS 9 leaf
+ *  and the S/MIME attribute arc value the IANA registry and the update draft give it. */
+var OID_ALG_PROTECTION = oid.byName("cmsAlgorithmProtection");
+var OID_ALG_PROTECTION_AA = oid.byName("cmsAlgorithmProtect");
 var OID_SIGNED_DATA = oid.byName("signedData");
 
 /** @internal The content type decides which of these rows apply, and the parser sets `contentType`
  *  as an own property on every content it builds. A content type that carries no signers has no own
  *  `signerInfos`, so testing for that field answers from whatever the prototype chain holds. */
 function _isSignedData(cms) { return cms.contentType === OID_SIGNED_DATA; }
+var OID_AUTH_DATA = oid.byName("authData");
+/** @internal The other content type whose originator carries attributes, and the one whose algorithm
+ *  fields nothing else covers: RFC 5652 sec. 9.2 makes the MAC input the DER encoding of `authAttrs`
+ *  alone, so `digestAlgorithm` and `macAlgorithm` sit outside it. */
+function _isAuthData(cms) { return cms.contentType === OID_AUTH_DATA; }
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
 /** @internal Every SignerInfo a message carries: its own signers, and the countersignatures their
  *  unsigned attributes hold, which sec. 11.4 defines as SignerInfo values and which carry their own
@@ -4969,14 +4978,16 @@ function _cmsAllSignerInfos(cms) {
   visit(cms.signerInfos, 0, false, 0);
   return out;
 }
-function _cmsSignedAttr(signerInfo, dotted) {
-  var attrs = signerInfo.signedAttrs;
+function _cmsAttrInList(attrs, dotted) {
   if (!Array.isArray(attrs)) return null;
   for (var i = 0; i < attrs.length; i++) {
     if (attrs[i].type === dotted) return attrs[i];
   }
   return null;
 }
+function _cmsSignedAttr(signerInfo, dotted) {
+  return _cmsAttrInList(signerInfo.signedAttrs, dotted);
+}
 /** @internal Whether two DIGEST AlgorithmIdentifiers name one algorithm, under RFC 5754 sec. 2. The
  *  rule lives in the schema module because the set this row reads is also WRITTEN there, by the verb
  *  that adds a countersigner's digest to it, and a set written under one rule and read under another
@@ -5078,8 +5089,50 @@ var RFC5652_CMS_RULES = [
   },
 ];
 
-var CMS_PROFILES = Object.assign(Object.create(null), { "rfc5652": RFC5652_CMS_RULES });
-var ALL_CMS_RULES = RFC5652_CMS_RULES;
+/** @internal RFC 8933 updates RFC 5652 rather than restating it, so its rows are their own profile:
+ *  `pki.lint.cms(der, { profile: "rfc8933" })` asks only what that document added. */
+var RFC8933_CMS_RULES = [
+  {
+    id: "lint/rfc8933/algorithm-protection-absent", severity: "notice", source: "rfc8933", citation: "RFC 8933 4.1",
+    /** @internal "the originator of a signed-data content type that includes signed attributes
+     * SHOULD include the CMSAlgorithmProtection attribute [RFC6211] as one of the signed
+     * attributes.  Likewise, the originator of an authenticated-data content type that includes
+     * authenticated attributes SHOULD include the CMSAlgorithmProtection attribute [RFC6211] as one
+     * of the authenticated attributes." RFC 9882 sec. 4 and RFC 9814 sec. 5 repeat the signed-data
+     * half for ML-DSA and SLH-DSA. Both content types are read, and the authenticated-data one is
+     * where the exposure is widest: sec. 9.2 makes the MAC input `authAttrs` alone, so the two outer
+     * algorithm fields are covered by nothing. The SHOULD is conditioned on attributes being
+     * present, so an originator that signs or authenticates the content directly has nowhere to
+     * carry it and draws no finding. Both identifiers count, since the two spell one attribute. A
+     * notice rather than a warning: it is a SHOULD, and most CMS in the field carries no such
+     * attribute. */
+    message: "an originator with signed or authenticated attributes carries no CMSAlgorithmProtection attribute, which this section says it should include",
+    appliesTo: function (cms) { return _isSignedData(cms) || _isAuthData(cms); },
+    check: function (cms) {
+      var out = [];
+      if (_isAuthData(cms)) {
+        var authAttrs = cms.authAttrs;
+        if (!Array.isArray(authAttrs) || !authAttrs.length) return null;
+        if (_cmsAttrInList(authAttrs, OID_ALG_PROTECTION) ||
+            _cmsAttrInList(authAttrs, OID_ALG_PROTECTION_AA)) return null;
+        return { context: { placement: "authAttrs" } };
+      }
+      _cmsAllSignerInfos(cms).forEach(function (entry) {
+        if (!Array.isArray(entry.signerInfo.signedAttrs) || !entry.signerInfo.signedAttrs.length) return;
+        if (_cmsSignedAttr(entry.signerInfo, OID_ALG_PROTECTION) ||
+            _cmsSignedAttr(entry.signerInfo, OID_ALG_PROTECTION_AA)) return;
+        out.push({ context: { signerIndex: entry.signerIndex, countersignature: entry.countersignature } });
+      });
+      return out.length ? out : null;
+    },
+  },
+];
+
+var CMS_PROFILES = Object.assign(Object.create(null), {
+  "rfc5652": RFC5652_CMS_RULES,
+  "rfc8933": RFC8933_CMS_RULES,
+});
+var ALL_CMS_RULES = RFC5652_CMS_RULES.concat(RFC8933_CMS_RULES);
 
 /** @internal The RFC 3161 profile is the shortest of the three, for the reason the CMS one is
  *  short: `schema.tsp.parseToken` refuses nearly everything sec. 2.4.2 requires of a token before a
@@ -6978,9 +7031,10 @@ function _ingestCrl(input) {
  * `lint/rfc2986/extension-request-ambiguous`; every one of them is read, so nothing a later
  * attribute asks for escapes the rows below.
  *
- * @opts  profile   `"rfc2986"` for the structural rows alone, or `"cabf-tls"` to add the TLS rows
- *                  (default runs the structural rows). A certificate, CRL or OCSP profile name is
- *                  refused rather than run against a request.
+ * @opts  profile   `"rfc2986"` for the structural rows alone, `"cabf-tls"` to add the TLS rows, or
+ *                  `"rfc9883"` for the rows about a request carrying a possession statement
+ *                  (default runs the structural rows and the rfc9883 rows). A certificate, CRL
+ *                  or OCSP profile name is refused rather than run against a request.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
  *                  always reflect the complete, unfiltered result.
  * @example
@@ -7217,8 +7271,9 @@ function _ingestCms(input) {
  * `pki.cms.verify`'s, and the certificates a message carries are linted with
  * `pki.lint.certificate`.
  *
- * @opts  profile   `"rfc5652"`, which is also what the default runs. A certificate, CRL or OCSP
- *                  profile name is refused rather than run against a message.
+ * @opts  profile   `"rfc5652"`, or `"rfc8933"` for the rows that update it (default runs both).
+ *                  A certificate, CRL or OCSP profile name is refused rather than run against a
+ *                  message.
  * @opts  severity  Suppress findings below this floor (default `"notice"`). `counts` and `worst`
  *                  always reflect the complete, unfiltered result.
  * @example
@@ -7517,10 +7572,11 @@ function rules(profile, artifact) {
  * and `"default"`, are not among them.
  * @example
  *   pki.lint.profiles();
- *   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "cabf-tls", "cabf-smime", "cabf-cs",
- *   //     "etsi-qc", "mozilla-root", "chrome-root", "microsoft-root", "apple-root",
- *   //     "nist-pqc-transition", "cnsa-2.0", "rfc2986", "rfc5280-crl", "rfc6960", "rfc5019",
- *   //     "rfc5652", "rfc3161", "rfc5755"]
+ *   // -> ["rfc5280", "rfc9881", "rfc9909", "rfc9935", "rfc9763", "rfc7633", "x509-altsig",
+ *   //     "cabf-tls", "cabf-smime", "cabf-cs", "etsi-qc", "mozilla-root", "chrome-root",
+ *   //     "microsoft-root", "apple-root", "nist-pqc-transition", "cnsa-2.0", "rfc2986",
+ *   //     "rfc9883", "rfc5280-crl", "rfc6960", "rfc5019", "rfc5652", "rfc8933", "rfc3161",
+ *   //     "rfc5755"]
  */
 /** @internal `cabf-tls` names the certificate profile in this list and is not repeated for the
  *  request form: `pki.lint.csr` takes the same name and runs those rows against what a request

package/lib/oid.js

@@ -232,7 +232,14 @@ var FAMILIES = Object.assign(Object.create(null), {
   pkcs9: { base: [1, 2, 840, 113549, 1, 9], of: {
     emailAddress: 1, contentType: 3, messageDigest: 4, signingTime: 5,
     countersignature: 6, challengePassword: 7, extensionRequest: 14,
-    smimeCapabilities: 15, friendlyName: 20, localKeyId: 21 } },
+    smimeCapabilities: 15, friendlyName: 20, localKeyId: 21,
+    /** @internal RFC 6211 sec. 2 and Appendix A both state the CMS algorithm protection attribute
+     *  here, directly under PKCS 9, and that is the value OpenSSL and Bouncy Castle register. The
+     *  same document's sec. 4 says "All identifiers are assigned out of the S/MIME OID arc", which
+     *  the IANA registry, errata 9144 and 9145, and draft-ietf-lamps-rfc6211-update-03 read as
+     *  `1.2.840.113549.1.9.16.2.52`, registered beside it as `cmsAlgorithmProtect`. Both are
+     *  accepted on parse, because a mismatched identifier is equivalent to no protection. */
+    cmsAlgorithmProtection: 52 } },
 
   keyPackageContentTypes: { base: [2, 16, 840, 1, 101, 2, 1, 2, 78], of: { aKeyPackage: 5 } },
 
@@ -324,6 +331,9 @@ var FAMILIES = Object.assign(Object.create(null), {
     cmcUnsignedData: 34,
     binarySigningTime: 46,
     asymmDecryptKeyID: 54, relatedCertRequest: 60,
+    /** @internal The second value the CMS algorithm protection attribute is identified by. See
+     *  `pkcs9.cmsAlgorithmProtection` for which document states which, and why both are read. */
+    cmsAlgorithmProtect: 52,
     certificationRequestInfoTemplate: 61, extensionReqTemplate: 62 } },
 
   ansiX962: { base: [1, 2, 840, 10045], of: {