@blamejs/pki 0.9.0 → 0.9.3

package/lib/cms-sign.js

@@ -205,6 +205,19 @@ function _assertAlgorithmProtectionPairs(pairs, digestAlgId, armAlgId, armTag) {
 function _resolveSignerContext(signer, opts) {
   var so = signer || intrinsic.create(null);
   var keyOnly = so.cert == null && so.spki != null;
+  /** @internal A descriptor names the digest and the padding the signature is made under, so a field
+   *  this verb does not read is a request that was never carried out: measured, a `digestAlgoritm`
+   *  typo signed under sha256 while the caller believed they had asked for sha384, and the same
+   *  misspelling one argument along in `opts` was already a refusal. The two key sets below have
+   *  described this shape since they were written, and `pkcs12-build` already holds the same
+   *  descriptors to them; this is the module that owns them doing the same. */
+  guard.identifier.assertKnownDescriptorKeys(so, keyOnly ? KNOWN_SIGNER_KEY_ONLY_KEYS : KNOWN_SIGNER_CERT_KEYS,
+    _err, "cms/bad-input", function (k) {
+      return "unknown signer field " + guard.text.showValue(k) + " for the " + (keyOnly
+        ? "key-only form; it takes { key, spki, keyIdentifier } plus the signature parameters"
+        : "certificate form; it takes { key, cert } plus the signature parameters") +
+        " (pss, digestAlgorithm, combinedRsaSig)";
+    });
   var soKey = so.key;
   var soSpki = keyOnly ? guard.bytes.snapshotSource(so.spki, CmsError, "cms/bad-input", "a key-only signer's spki") : null;
   var certDer = keyOnly ? null : _normCertDer(so.cert);
@@ -534,6 +547,14 @@ function _resolveSignerIndices(spec, n) {
 
 function _buildCountersignature(targetSigOctets, countersigner, opts) {
   var so = countersigner || intrinsic.create(null);
+  /** @internal A countersignature is a SignerInfo (RFC 5652 sec. 11.4) and its descriptor names the
+   *  same signature parameters, so a field this reader does not read is the same dropped request it
+   *  is at `sign`. This reader is its own, so the gate at the other one did not cover it. A
+   *  countersignature is always the certificate form, which is the `cert` read below. */
+  guard.identifier.assertKnownDescriptorKeys(so, KNOWN_SIGNER_CERT_KEYS, _err, "cms/bad-input", function (k) {
+    return "unknown countersigner field " + guard.text.showValue(k) +
+      "; it takes { key, cert } plus the signature parameters (pss, digestAlgorithm, combinedRsaSig)";
+  });
   var certDer = _normCertDer(so.cert);
   var cert = x509.parse(certDer);
   var scheme = signScheme.resolveSignScheme(cert, so, opts.signedAttributes === false, _signE);

package/lib/cms-verify.js

@@ -1170,10 +1170,12 @@ function _snapshotTimestampTrust(opts, allowWeakDigests) {
   };
 }
 
-/** @internal A signature over content is authorized by digitalSignature, contentCommitment or
- *  nonRepudiation alike; the shared helper carries the rest of the rule. */
+/** @internal The decoder emits the RFC 5280 sec. 4.2.1.3 bit name `nonRepudiation`, never the X.509
+ *  spelling `contentCommitment`, so naming the latter here asked for a name nothing defines.
+ *  A signature over content is authorized by digitalSignature or nonRepudiation alike; the shared
+ *  helper carries the rest of the rule. */
 var _permitsSigning = pkix.keyUsagePermits(pkix.makeNS("cms", CmsError, oid),
-  ["digitalSignature", "contentCommitment", "nonRepudiation"]);
+  ["digitalSignature", "nonRepudiation"]);
 
 function _keyUsagePermitsSigning(parsedCerts, der) {
   var entry = guard.list.firstMatch(parsedCerts, function (c) { return intrinsic.bufferEquals(c.der, der); });

package/lib/constants.js

@@ -189,6 +189,9 @@ var LIMITS = Object.assign(Object.create(null), {
   PBKDF2_MAX_SALT: 1024,
   MIME_MAX_BYTES: BYTES.mib(16),
   HEADER_LINE_MAX_OCTETS: 998,
+  MIME_MAX_PARTS: 1024,
+  MIME_MAX_HEADERS: 1024,
+  MIME_MAX_PARAMS: 256,
   COMPRESS_MAX_BYTES: BYTES.mib(16),
   TLS_CERT_MSG_MAX_BYTES: BYTES.mib(16) - 1,
   TLS_CERT_MAX_ENTRIES: 100,

package/lib/crl-sign.js

@@ -682,7 +682,7 @@ function _verify(crl, issuer) {
   var parsed = _coerceCrl(crl);
   var resolved = _resolveIssuer(issuer);
   var issuerMaySign = resolved.cert ? _issuerMaySign(parsed, resolved.cert) : true;
-  return crlVerify.verifyCrlSignature(parsed, resolved.spki).then(function (sigOk) {
+  return intrinsic.chain(crlVerify.verifyCrlSignature(parsed, resolved.spki), function (sigOk) {
     var signatureValid = sigOk === true;
     var valid = issuerMaySign && signatureValid;
     return guard.verdict.of(

package/lib/crmf-sign.js

@@ -1255,7 +1255,7 @@ function _build(spec, key, opts) {
  * `Buffer`; a malformed template throws a typed `CrmfError`.
  *
  * @example
- *   var tpl = pki.crmf.buildCertTemplate({ serialNumber: 42n, issuer: "CN=CA" });
+ *   var tpl = pki.crmf.buildCertTemplate({ serialNumber: 42n, issuer: "CA" });
  *   pki.asn1.decode(tpl).tagNumber === pki.asn1.TAGS.SEQUENCE;   // the CertTemplate SEQUENCE
  */
 function buildCertTemplate(template) { return _encodeCertTemplate(template, { revocation: true }).der; }

package/lib/csr-sign.js

@@ -338,8 +338,10 @@ function _coerceCsr(request) {
  *   var req = await pki.csr.sign({ subject: "device-42", subjectPublicKey: spki }, { key: pkcs8 });
  *   var r = await pki.csr.verify(req);
  *   // Issue from r.subject / r.subjectPublicKeyInfo / r.attributes, which are the verified fields.
+ *   // `r.subject.bytes` is the request's own Name DER, so the issued subject is the requested one
+ *   // byte for byte. `r.subject.dn` is its text form, which a builder reads as a common name.
  *   var issued = r.verified
- *     ? await pki.x509.sign({ subject: r.subject.dn, subjectPublicKey: r.subjectPublicKeyInfo.bytes,
+ *     ? await pki.x509.sign({ subject: r.subject.bytes, subjectPublicKey: r.subjectPublicKeyInfo.bytes,
  *         notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2027-01-01T00:00:00Z") },
  *       { key: pkcs8 })
  *     : null;
@@ -347,7 +349,7 @@ function _coerceCsr(request) {
 function verify(request) { return guard.async.deferred(function () { return _verify(request); }); }
 function _verify(request) {
   var parsed = _coerceCsr(request);
-  return _promiseResolve(_Promise, csrVerify.verifyCsrSignature(parsed)).then(function (ok) {
+  return intrinsic.chain(_promiseResolve(_Promise, csrVerify.verifyCsrSignature(parsed)), function (ok) {
     return guard.verdict.of({
       valid: ok === true,
       verified: ok === true,

package/lib/est.js

@@ -281,8 +281,14 @@ function _matchDelimAt(text, ls, boundary) {
   if (_charCodeAt(text, q) === 0x0d && q + 1 < n && _charCodeAt(text, q + 1) === 0x0a) return { end: q + 2, close: close };
   return null;
 }
+/** @internal The delimiter count is bounded before the list is built, since one mark is appended per
+ *  delimiter found anywhere in the body and the scan does not stop at the terminal one. The bound is
+ *  the part cap plus that terminal delimiter, and it is the same `C.LIMITS` row the MIME reader
+ *  counts parts against, so the two doors hold a multipart body to one number. */
 function _findMultipartMarks(text, boundary) {
   var marks = [], n = text.length, searchStart = 0, p;
+  var counted = guard.limits.counter(constants.LIMITS.MIME_MAX_PARTS, E, "est/bad-multipart",
+    "the multipart body part");
   while (searchStart <= n) {
     var found = null, foundAt = -1;
     for (p = searchStart; p <= n; p++) {
@@ -293,7 +299,15 @@ function _findMultipartMarks(text, boundary) {
       if (lsN !== -1) { var r1 = _matchDelimAt(text, lsN, boundary); if (r1) { found = r1; foundAt = p; break; } }
     }
     if (!found) break;
+    /** @internal The closing delimiter opens no part, so it is not charged and the cap counts the
+     *  parts an operator is told it counts. */
+    if (!found.close) counted.tick();
     guard.list.append(marks, { at: foundAt, bodyStart: found.end, close: found.close });
+    /** @internal RFC 2046 sec. 5.1.1 discards everything after the closing delimiter, and the caller
+     *  reads no mark past the first one that closes, so the scan stops there. Running on charged the
+     *  epilogue against the part budget: a body at the cap was refused for text it never reads, while
+     *  the same body without that epilogue was accepted. */
+    if (found.close) break;
     searchStart = found.end === foundAt ? found.end + 1 : found.end;
   }
   return marks;
@@ -314,18 +328,29 @@ function _stripOneTrailingEol(seg, end) {
   }
   return end;
 }
-function _unfoldHeaders(raw) {
-  var out = "", last = 0, i = 0, n = raw.length;
+/** @internal Every line break in the part's header area is charged as the scan passes it, before the
+ *  unfolded text is split, so the refusal costs the cap rather than the input. Counting the split
+ *  lines afterwards instead read 2,000,000 one-line headers in 425 ms and 172 MiB of resident memory
+ *  before refusing, and never reached two on 1,500,000 continuation lines, which fold into one line. */
+function _unfoldHeaders(raw, counted) {
+  var out = "", last = 0, i = 0, n = raw.length, afterLastBreak = 0;
   while (i < n) {
     var nlLen = 0;
     if (_charCodeAt(raw, i) === 0x0d && i + 1 < n && _charCodeAt(raw, i + 1) === 0x0a) nlLen = 2;
     else if (_charCodeAt(raw, i) === 0x0a) nlLen = 1;
-    if (nlLen > 0) {
-      var after = i + nlLen;
-      if (after < n && (_charCodeAt(raw, after) === 0x20 || _charCodeAt(raw, after) === 0x09)) { out += _strSlice(raw, last, i); last = after; i = after; continue; }
-    }
-    i += 1;
+    if (nlLen === 0) { i += 1; continue; }
+    /** @internal The scan steps PAST the whole break rather than one byte into it, so a CRLF is one
+     *  line and not two: stepping one byte left the LF to be read as a second break on the next pass,
+     *  which charged every CRLF twice and halved the cap a part was actually held to. */
+    counted.tick();
+    var after = i + nlLen;
+    afterLastBreak = after;
+    if (after < n && (_charCodeAt(raw, after) === 0x20 || _charCodeAt(raw, after) === 0x09)) { out += _strSlice(raw, last, i); last = after; i = after; continue; }
+    i = after;
   }
+  /** @internal The run after the last break is a line as well, and a header area that ends at a break
+   *  has no run after it, so the charge is the LINE count the cap is stated in and not one less. */
+  if (afterLastBreak < n) counted.tick();
   return out + _strSlice(raw, last, n);
 }
 function _splitCrlf(s) {
@@ -359,7 +384,9 @@ function splitMultipartMixed(body, contentType) {
     var rawHeaders = _strSlice(seg, 0, sep);
     var partBody = _strSlice(seg, _stripTwoLeadingEol(seg, sep), _stripOneTrailingEol(seg, seg.length));
     var headers = intrinsic.create(null);
-    var lines = _splitCrlf(_unfoldHeaders(rawHeaders));
+    var countedHeaders = guard.limits.counter(constants.LIMITS.MIME_MAX_HEADERS, E, "est/bad-multipart",
+      "the multipart part header line");
+    var lines = _splitCrlf(_unfoldHeaders(rawHeaders, countedHeaders));
     for (var li = 0; li < lines.length; li++) {
       var line = lines[li];
       /** @internal A part's header name and value are cut, trimmed and folded through the captured
@@ -367,7 +394,20 @@ function splitMultipartMixed(body, contentType) {
        *  its body goes to: measured, a part stating `application/pkcs8` was read as
        *  `application/pkcs7-mime` with a `smime-type` of `certs-only`. */
       var col = _estIndexOf(line, ":");
-      if (col > 0) headers[_toLowerCase(_estTrim(_strSlice(line, 0, col)))] = _estTrim(_strSlice(line, col + 1));
+      if (col <= 0) continue;
+      var fname = _toLowerCase(_estTrim(_strSlice(line, 0, col)));
+      /** @internal A repeat is refused rather than overwritten. Storing each value in turn left the
+       *  LAST line deciding the field, and the field this decides is the part's own content type,
+       *  which selects the reader its body goes to: measured, the same two Content-Type lines swapped
+       *  reported `application/pkcs7-mime; smime-type=certs-only` one way and `application/pkcs8` the
+       *  other, which is which part is the private key and which is the certificate. RFC 5322 sec. 3.6
+       *  gives a singleton field one occurrence, and taking the first is as conforming as taking the
+       *  last, so there is no value here to resolve to. */
+      if (intrinsic.hasOwn(headers, fname)) {
+        throw E("est/bad-multipart", "a multipart part declares the " + guard.text.showValue(fname) +
+          " header field more than once, so the value it resolves to is ambiguous (RFC 5322 sec. 3.6)");
+      }
+      headers[fname] = _estTrim(_strSlice(line, col + 1));
     }
     var partCt = headers["content-type"] || "";
     if (_ciStartsWith(partCt, "MULTIPART/")) throw E("est/bad-multipart", "a nested multipart part is not permitted");
@@ -471,36 +511,58 @@ function _recipientMatches(recipientInfos, opts) {
  *  replacement decides which segments a parameter is then looked for in, and one of those parameters
  *  is the multipart boundary a response body is divided on: measured, a `boundary=wire` header
  *  yielded `forged`. */
+/** @internal The first segment is the media type rather than a parameter, so it is not charged, and
+ *  the charge comes BEFORE the segment is stored, so a refusal costs the cap and not the input: with
+ *  no cap here a 3.8 MiB Content-Type carrying 1,000,000 parameters was accepted in 194 ms and 100 MiB
+ *  of resident memory, and a part's media type splits the same value a second time. The bound is the
+ *  `C.LIMITS` row the MIME reader counts parameters against, so both doors hold one media type to one
+ *  number. */
+function _pushCtSegment(segs, seg, counted) {
+  if (segs.length > 0) counted.tick();
+  intrinsic.append(segs, seg);
+}
+
 function _splitContentTypeParams(s) {
   var segs = [], cur = "", inQuote = false;
+  var counted = guard.limits.counter(constants.LIMITS.MIME_MAX_PARAMS, E, "est/bad-multipart",
+    "the Content-Type parameter");
   for (var i = 0; i < s.length; i++) {
     var ch = _estCharAt(s, i);
     if (ch === '"') { inQuote = !inQuote; cur += ch; }
-    else if (ch === ";" && !inQuote) { intrinsic.append(segs, cur); cur = ""; }
+    else if (ch === ";" && !inQuote) { _pushCtSegment(segs, cur, counted); cur = ""; }
     else cur += ch;
   }
-  intrinsic.append(segs, cur);
+  _pushCtSegment(segs, cur, counted);
   return segs;
 }
 
 function _ctParam(contentType, name) {
   var segs = _splitContentTypeParams(_stringOf(contentType || ""));
-  var value = null, count = 0;
+  var value = null, plain = 0, starred = 0;
   /** @internal Each parameter is read through the captured operations. The name decides which
    *  parameter this is, and the value it returns is the one a caller acts on: for the RFC 7030
    *  multipart boundary, it is where a response body is split. */
   for (var i = 1; i < segs.length; i++) {
     var seg = segs[i];
     var eq = _estIndexOf(seg, "=");
-    if (eq === -1) continue;
-    if (_toLowerCase(_estTrim(_strSlice(seg, 0, eq))) !== name) continue;
-    count++;
-    if (count > 1) continue;
+    /** @internal An occurrence counts whether or not it carries a value, which is why a bare
+     *  attribute is counted: skipping it let `boundary; boundary="b"` through while
+     *  `boundary="a"; boundary="b"` was refused. The plain and the starred RFC 2231 spellings are
+     *  counted apart, because what has to be refused is two readings carrying DIFFERENT values.
+     *  `boundary*=us-ascii''DECOY; boundary=REAL` is read here as REAL and by an RFC 2231 reader as
+     *  DECOY, while continuation segments alone leave this reader no boundary at all, which the
+     *  caller already refuses (RFC 2231 sec. 3, sec. 4, sec. 7). */
+    var attr = _toLowerCase(_estTrim(eq === -1 ? seg : _strSlice(seg, 0, eq)));
+    var star = _estIndexOf(attr, "*");
+    if ((star > 0 ? _strSlice(attr, 0, star) : attr) !== name) continue;
+    if (star > 0) { starred++; continue; }
+    plain++;
+    if (eq === -1 || plain > 1) continue;
     var val = _estTrim(_strSlice(seg, eq + 1));
     if (val.length >= 2 && _estCharAt(val, 0) === '"' && _estCharAt(val, val.length - 1) === '"') val = _strSlice(val, 1, -1);
     value = val;
   }
-  return { value: value, duplicated: count > 1 };
+  return { value: value, duplicated: plain > 1 || (plain > 0 && starred > 0) };
 }
 
 var _MT_FIRST = pkix.charTable("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
@@ -1451,7 +1513,7 @@ function _fullcmcResult(res, opts, wanted, sent) {
       bound: { transactionId: false, senderNonce: false, dataReturn: false, bodyPartIDs: false },
       boundToRequest: false });
   }
-  return cmcVerify.verify(der, sent).then(function (verdict) {
+  return intrinsic.chain(cmcVerify.verify(der, sent), function (verdict) {
     if (verdict.outcome !== "issued") return verdict;
     if (!wanted.length) { verdict.issuedCertificates = []; return verdict; }
     var issuedCerts = _correlateIssued(verdict.certificates, wanted, "CMC-response");
@@ -1462,12 +1524,12 @@ function _fullcmcResult(res, opts, wanted, sent) {
 }
 
 function _tryDecodeCmcFault(res, sent) {
-  return _promiseResolve(_Promise, undefined).then(function () {
+  return intrinsic.chain(intrinsic.chain(_promiseResolve(_Promise, undefined), function () {
     var pt = _partMediaType(_ciHeader(res.headers, "content-type"));
     if (pt.media !== "application/pkcs7-mime") return null;
     if (pt.ambiguous) return null;
     if (String(pt.smimeType || "").toLowerCase() !== "cmc-response") return null;
-    return cmcVerify.verify(transferDecode(res.body), sent).then(function (verdict) {
+    return intrinsic.chain(cmcVerify.verify(transferDecode(res.body), sent), function (verdict) {
       if (verdict.outcome !== "rejected") return null;
       var e = E("est/cmc-failed",
         "the EST server rejected the Full PKI Request: " + verdict.outcome +
@@ -1476,7 +1538,7 @@ function _tryDecodeCmcFault(res, sent) {
       e.httpStatus = res.status;
       return e;
     });
-  }).then(null, function () { return null; });
+  }), null, function () { return null; });
 }
 
 function _isTypedError(e) {
@@ -1777,6 +1839,16 @@ function _ciHeader(headers, name) {
       "the response carries more than one " + lname + " header field, so what the body is cannot be told " +
       "from it (RFC 9110 sec. 5.1: field names are case-insensitive)");
   }
+  /** @internal One key can still hold SEVERAL values, which is how `node:http` reports a field that
+   *  arrived more than once, and these three fields each carry one value. Counting keys alone left a
+   *  two-element array to be read as one string: measured, the two orders of the same pair gave
+   *  `est/bad-content-type` one way and an accepted classification the other, because the joined text
+   *  parsed as a media type in one order and not in the other. */
+  if (intrinsic.isArray(found) && found.length > 1) {
+    throw E("est/bad-content-type",
+      "the response carries " + found.length + " values for " + lname + ", so what the body is cannot be " +
+      "told from it (RFC 9110 sec. 5.1)");
+  }
   return n === 0 ? null : found;
 }
 

package/lib/guard-identifier.js

@@ -31,6 +31,7 @@ var _mapSet = intrinsic.mapSet;
 var _mapHas = intrinsic.mapHas;
 var _Set = intrinsic.Set;
 var _Map = intrinsic.Map;
+var _ObjectProto = intrinsic.ObjectProto;
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSplit = intrinsic.uncurry(String.prototype.split);
 var _fnToString = intrinsic.uncurry(Function.prototype.toString);
@@ -92,6 +93,54 @@ function assertKnownKeys(obj, known, E, code, message) {
   });
 }
 
+/**
+ * @internal
+ * Whether `k` is `v`'s function machinery, owned or reached from its prototype chain. A check that
+ * walks the chain asks this; a reader that copies one LEVEL at a time asks `isOwnMachineryName`.
+ *
+ * Which of the two a given name is depends on the function and the engine. A STRICT function, which
+ * is every function in an ES module or a `"use strict"` file, owns neither `arguments` nor `caller`,
+ * and `Function.prototype` carries both as the restricted accessors, so a chain walk finds them
+ * there. On the Node 24.21.0 floor a non-strict function owns both outright. Measured before this
+ * covered the inherited side: a plain strict callable descriptor was refused for `arguments` by
+ * `pki.cms.sign` and `pki.cms.countersign`, while the minted floor shape passed, which is the shape
+ * the vectors were written on.
+ */
+// @enforced-by behavioral -- the vectors that drive a PLAIN callable and a floor-shaped one through
+// @enforced-by behavioral -- each door are the guard; the name set has no rename-proof code shape
+function isMachineryName(v, k) {
+  if (v === null || v === undefined) return false;
+  if (isOwnMachineryName(v, k)) return true;
+  if (typeof v !== "function" || !_CALLABLE_MACHINERY.has(k)) return false;
+  /** @internal Not owned, so `readableNames` reached it through the prototype chain. A caller's own
+   *  property of that name is theirs and stays refused by name, which `isOwnMachineryName` above
+   *  decides; making one takes `defineProperty`, since assigning `fn.arguments` reaches the
+   *  restricted setter and throws. */
+  return _getOwnPropertyDescriptor(v, k) === undefined;
+}
+
+/**
+ * @internal
+ * `assertKnownKeys` for a bag a verb documents as acceptably CALLABLE, where the names a function
+ * carries by construction are not fields the caller named. The exemption belongs at the door that
+ * refuses, not only at a reader that copies: `pki.smime.sign` snapshots a descriptor before handing
+ * it on, so excluding the machinery there left a caller going straight to `pki.cms.sign` with the
+ * same callable refused for `length`.
+ *
+ * It is not `assertKnownKeys`'s own rule, because a bare function handed in where an OPTIONS BAG
+ * belongs is refused for exactly those names, which is a contract of its own.
+ */
+// @enforced-by behavioral -- the vectors that drive a callable descriptor through each door are the
+// @enforced-by behavioral -- guard; the exemption has no rename-proof code shape
+function assertKnownDescriptorKeys(obj, known, E, code, message) {
+  _refuseUnenumerable(obj, E, code, "the options");
+  var describe = typeof message === "function" ? message : function (k) { return message + _stringify(k); };
+  _forEach(_readableNames(obj), function (k) {
+    if (_hasOwn(known, k) || isMachineryName(obj, k)) return;
+    throw E(code, describe(typeof k === "symbol" ? _String(k) : k));
+  });
+}
+
 // @enforced-by behavioral -- reading a property twice has no rename-proof code shape; the RED
 // @enforced-by behavioral -- vectors that drive an accessor-backed option are the guard
 function snapshotOptions(obj, known) {
@@ -320,6 +369,64 @@ function _kindMembers(v) {
   return [];
 }
 
+/** @internal The names a callable carries before a caller assigns a field, asked of the engine
+ *  rather than listed here: a function's own names, plus `Function.prototype`'s, which is where the
+ *  restricted `arguments` and `caller` accessors live. Which of them a given function makes OWN
+ *  depends on the engine. Measured: on Node 24.21.0, the version `engines.node` floors at, every
+ *  non-strict function carries own `arguments` and `caller`; on 26.9.0 none does, for a declaration
+ *  and for `new Function` alike. A list written against one of those refuses a legitimate callable
+ *  descriptor on the other, and a caller's non-strict CommonJS module is where the shape comes
+ *  from. */
+var _CALLABLE_MACHINERY = (function () {
+  var names = _create(null), symbols = new _Set();
+  /** @internal One pristine probe per callable KIND, because the kinds do not share a prototype: an
+   *  async function, a generator and an async generator each sit on their own intrinsic prototype
+   *  carrying `Symbol.toStringTag`, which an ordinary function's chain never reaches. Measured
+   *  before the probes were per-kind: `pki.cms.sign` refused all three for
+   *  `Symbol(Symbol.toStringTag)` while an ordinary function passed. Symbol keys are collected too,
+   *  since that is the name that was missing. */
+  /** @internal Every kind, not the subset that happens to suffice: the four intrinsic prototypes
+   *  carry the SAME well-known `Symbol.toStringTag` under different values, so dropping the async
+   *  generator still passes today and would not if a kind ever carried a key of its own. */
+  var probes = [function () {}, function* () {}, async function () {}, async function* () {}, class {}];
+  _forEach(probes, function (p) {
+    for (var o = p; o !== null && o !== _ObjectProto; o = _getPrototypeOf(o)) {
+      _forEach(_ownKeys(o), function (k) {
+        if (typeof k === "symbol") _setAdd(symbols, k); else names[k] = true;
+      });
+    }
+  });
+  return {
+    has: function (k) { return typeof k === "symbol" ? _setHas(symbols, k) : names[k] === true; },
+  };
+})();
+
+/**
+ * @internal
+ * Whether `k` is part of `v`'s own machinery rather than a field a caller named: a RegExp's
+ * `lastIndex`, the non-thenable mask's `then`, and a callable's own function machinery, which is
+ * non-enumerable where a field a caller assigned is enumerable.
+ *
+ * A reader that COPIES a descriptor's own keys asks this, so it copies what the caller wrote and
+ * nothing else. The name checks do not: a bare function handed in where an options bag belongs is
+ * refused for the names it carries, which is a contract of its own, so the callable rule lives here
+ * rather than in `_isOwnStructuralName`.
+ */
+// @enforced-by behavioral -- a per-kind name set has no rename-proof code shape; the vectors
+// @enforced-by behavioral -- that drive a callable descriptor through a copying door are the guard
+function isOwnMachineryName(v, k) {
+  if (v === null || v === undefined) return false;
+  var d = _getOwnPropertyDescriptor(v, k);
+  /** @internal A DATA property, because that is what the machinery is: measured on both Node
+   *  24.21.0 and 26.9.0, every one of these names a function owns is a non-enumerable data
+   *  property. An accessor a caller installed under one of those names is therefore theirs, and it
+   *  reaches the unknown-field refusal by its name rather than being exempted and ignored. Asking
+   *  the descriptor rather than reading the property leaves the getter uninvoked either way. */
+  if (typeof v === "function" && !!d && d.enumerable === false && _hasOwn(d, "value") &&
+      _CALLABLE_MACHINERY.has(k)) return true;
+  return _isOwnStructuralName(v, k, d, false);
+}
+
 function _isOwnStructuralName(v, k, d, inherited) {
   if (util.types.isRegExp(v) && k === "lastIndex") return true;
   /** @internal The non-thenable mask `guard.verdict.shield` leaves on a value the toolkit hands back:
@@ -680,6 +787,9 @@ module.exports = intrinsic.freeze({
   snapshotOptions: snapshotOptions,
   snapshotPresentOptions: snapshotPresentOptions,
   optionNames: optionNames,
+  isOwnMachineryName: isOwnMachineryName,
+  isMachineryName: isMachineryName,
+  assertKnownDescriptorKeys: assertKnownDescriptorKeys,
   ownOptions: ownOptions,
   pickSettings: pickSettings,
   readableNames: readableNames,

package/lib/guard-name.js

@@ -65,7 +65,51 @@ function assertPrintableIa5(buf, E, code, label) {
 }
 
 function _isSpace(c) { return c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d; }
-function _canonAttrValue(v, E, code, label) {
+/** @internal The attribute types whose EQUALITY rule is not case-ignoring, resolved once to their
+ *  object identifiers. An equality rule belongs to the attribute, and folding case on one whose rule
+ *  is case-exact makes two distinct names compare as one name: measured through `pki.x509.parseDn`,
+ *  `challengePassword=Secret` and `challengePassword=secret` encode differently and compared EQUAL,
+ *  as did `localKeyId=AB` against `ab` and a `role` URI against its lowercase form.
+ *
+ *  Only the exceptions are listed. caseIgnoreMatch under the RFC 4518 preparation is the correct
+ *  rule for every attribute RFC 5280 sec. 4.1.2.4 requires support for, so a conforming PKIX name
+ *  compares as it did and an attribute the registry does not name keeps that default rather than
+ *  being given a rule nothing states.
+ *
+ *  The identifiers are resolved rather than written, since a dotted-decimal literal is never the
+ *  identity a module carries. */
+/** @internal RFC 2985 sec. 5.4.1 gives challengePassword caseExactMatch, sec. 5.5.2 gives localKeyId
+ *  octetStringMatch, and RFC 5755 sec. 4.4.5 makes a role a URI. */
+var _CASE_EXACT_NAMES = ["challengePassword", "localKeyId", "role"];
+var _caseExactOids = null;
+function _isCaseExactType(type) {
+  if (typeof type !== "string") return false;
+  if (_caseExactOids === null) {
+    var oid = require("./oid");   // allow:inline-require -- circular load: oid -> guard-all -> this module
+    _caseExactOids = _create(null);
+    for (var i = 0; i < _CASE_EXACT_NAMES.length; i++) {
+      var o = oid.byName(_CASE_EXACT_NAMES[i]);
+      if (typeof o === "string") _caseExactOids[o] = true;
+    }
+  }
+  return _caseExactOids[type] === true;
+}
+
+/** @internal The registry's own reading of a dotted-decimal object identifier, taken from there
+ *  rather than re-derived: `numericoid` is RFC 4512's production and one definition of it decides
+ *  both what the registry resolves and what opens a distinguished name. */
+var _isDottedOid = null;
+function _opensAsNumericOid(run) {
+  if (_isDottedOid === null) {
+    var oid = require("./oid");   // allow:inline-require -- circular load: oid -> guard-all -> this module
+    _isDottedOid = oid.isDottedDecimal;
+  }
+  return _isDottedOid(run) === true;
+}
+
+/** @internal The RFC 4518 insignificant-space preparation, which every equality rule here applies.
+ *  The case fold is the caller's to add, because that step is the one the attribute's rule decides. */
+function _prepAttrValue(v, E, code, label) {
   if (typeof v !== "string") return v;
   assertNoControlBytes(v, E, code, label);
   var out = "", lastWasSpace = true;
@@ -75,8 +119,9 @@ function _canonAttrValue(v, E, code, label) {
     lastWasSpace = false;
     out += _charAt(v, i);
   }
-  return _toLowerCase(out);
+  return out;
 }
+
 /** @internal Both lengths are NARROWED where they are taken, and every test and walk below asks the
  * local. `Array.isArray` is true for a Proxy whose target is an array and a `get` trap answers `length`
  * afresh on each read, so the equality test and the walk that follows it could see two different counts:
@@ -114,14 +159,25 @@ function rdnEqual(a, b, E, code, label) {
      *  comparison's one unacceptable answer, since it is what chains a certificate to its issuer. */
     var ea = a[i];
     var typeA = ea == null ? undefined : ea.type;
-    var valueA = _canonAttrValue(ea == null ? undefined : ea.value, E, code, label);
+    /** @internal Prepared once without the fold, and folded once, so the attribute's own rule picks
+     *  between them without reading the element again. */
+    var prepA = _prepAttrValue(ea == null ? undefined : ea.value, E, code, label);
+    var foldedA = typeof prepA === "string" ? _toLowerCase(prepA) : prepA;
+    var exactA = _isCaseExactType(typeA);
     var found = false;
     for (var j = 0; j < n.b; j++) {
       if (used[j]) continue;
       var eb = b[j];
       var typeB = eb == null ? undefined : eb.type;
       if (typeA !== typeB) continue;
-      if (valueA === _canonAttrValue(eb == null ? undefined : eb.value, E, code, label)) {
+      var prepB = _prepAttrValue(eb == null ? undefined : eb.value, E, code, label);
+      /** @internal Either side naming a case-exact attribute decides it. The types already matched,
+       *  so the two can disagree only through an object answering differently per read, and the
+       *  exact comparison is the one that cannot make two distinct names equal. */
+      var same = exactA || _isCaseExactType(typeB)
+        ? prepA === prepB
+        : foldedA === (typeof prepB === "string" ? _toLowerCase(prepB) : prepB);
+      if (same) {
         used[j] = true; found = true; break;
       }
     }
@@ -213,6 +269,36 @@ function isAttributeDescriptor(name) {
   return true;
 }
 
+/**
+ * @internal
+ * Whether a string opens with the prefix RFC 4514 sec. 3 requires of a distinguished name: an
+ * attribute type, a descriptor or a dotted-decimal OID, immediately followed by `=`. It answers one
+ * question, whether a caller who passed a bare string meant a distinguished name rather than the
+ * single value the shorthand reads it as, and it is deliberately narrower than parsing: a value that
+ * CONTAINS an `=` further along, `Example CA (v=2)`, opens with no attribute type and is not
+ * a distinguished name.
+ *
+ * `attributeType` is `descr / numericoid`, and a `numericoid` carries at least one dot, so a numeric
+ * run without one is not an attribute type: `1=1` is a value no reader reads as a distinguished
+ * name, and refusing it would name a remedy that does not apply. The leading whitespace sec. 3
+ * admits nowhere is the same case from the other side: ` CN=Example` opens with no attribute type
+ * and is the value it says it is.
+ */
+// @enforced-by behavioral -- an opening-prefix test has no rename-proof shape distinct from
+function opensAsDnString(str) {
+  if (typeof str !== "string" || str.length === 0) return false;
+  var i = 0, n = str.length, first = _charCodeAt(str, 0);
+  if (_isDigit(first)) {
+    while (i < n && (_isDigit(_charCodeAt(str, i)) || _charCodeAt(str, i) === 0x2e)) i++;
+    if (!_opensAsNumericOid(_strSlice(str, 0, i))) return false;
+  } else if (_isAttrTypeStart(first)) {
+    while (i < n && _isAttrTypeChar(_charCodeAt(str, i))) i++;
+  } else {
+    return false;
+  }
+  return i > 0 && i < n && _charCodeAt(str, i) === 0x3d;
+}
+
 // @enforced-by behavioral -- the inverse of escapeDnValue has no rename-proof shape distinct
 function parseDnString(str, E, code, label) {
   if (typeof str !== "string") throw E(code, label + " must be a string");
@@ -1058,6 +1144,7 @@ module.exports = intrinsic.freeze({
   assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5,
   dnEqual: dnEqual, rdnEqual: rdnEqual, emailEqual: emailEqual, dpnCorresponds: dpnCorresponds,
   escapeControlBytes: escapeControlBytes, escapeDnValue: escapeDnValue, parseDnString: parseDnString,
+  opensAsDnString: opensAsDnString,
   isAttributeDescriptor: isAttributeDescriptor,
   lowerAscii: lowerAscii, uriSchemeIs: uriSchemeIs,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,

package/lib/inspect.js

@@ -1531,8 +1531,8 @@ function crmfReport(input) {
  *   var key = await pki.key.export(pair.privateKey);
  *   var cert = await pki.x509.sign({ subject: "cmp.example", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
- *   var der = await pki.cmp.build({ header: { sender: { directoryName: "CN=cmp.example" },
- *     recipient: { directoryName: "CN=A CA" } },
+ *   var der = await pki.cmp.build({ header: { sender: { directoryName: "cmp.example" },
+ *     recipient: { directoryName: "A CA" } },
  *     body: { ir: { certTemplate: { subject: [{ commonName: "cmp.example" }], publicKey: await pki.key.export(pair.publicKey) } } } },
  *     { cert: cert, key: key });
  *   pki.inspect.cmp(der).split("\n")[0];  // "CMP Message:"
@@ -1937,10 +1937,10 @@ function tspReport(input) {
  *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
- *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "CN=Alice" } },
+ *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "Alice" } },
  *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *     attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
- *     { name: "CN=An AA", publicKey: await pki.key.export(pair.publicKey), key: await pki.key.export(pair.privateKey) });
+ *     { name: "An AA", publicKey: await pki.key.export(pair.publicKey), key: await pki.key.export(pair.privateKey) });
  *   pki.inspect.attrcert(der).split("\n")[0];  // "Attribute Certificate:"
  */
 function attrCertReport(input) {

package/lib/lint.js

@@ -7556,10 +7556,10 @@ function _ingestAttrCert(input) {
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var key = await pki.key.export(pair.privateKey);
- *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "CN=Alice" } },
+ *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "Alice" } },
  *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *     attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
- *     { name: "CN=Example AA", publicKey: await pki.key.export(pair.publicKey), key: key });
+ *     { name: "Example AA", publicKey: await pki.key.export(pair.publicKey), key: key });
  *   pki.lint.attrcert(der).findings.length;       // -> 0 for a conforming attribute certificate
  */
 function attrcert(input, opts) {