@blamejs/pki 0.9.1 → 0.9.3

package/lib/est.js

@@ -1513,7 +1513,7 @@ function _fullcmcResult(res, opts, wanted, sent) {
       bound: { transactionId: false, senderNonce: false, dataReturn: false, bodyPartIDs: false },
       boundToRequest: false });
   }
-  return cmcVerify.verify(der, sent).then(function (verdict) {
+  return intrinsic.chain(cmcVerify.verify(der, sent), function (verdict) {
     if (verdict.outcome !== "issued") return verdict;
     if (!wanted.length) { verdict.issuedCertificates = []; return verdict; }
     var issuedCerts = _correlateIssued(verdict.certificates, wanted, "CMC-response");
@@ -1524,12 +1524,12 @@ function _fullcmcResult(res, opts, wanted, sent) {
 }
 
 function _tryDecodeCmcFault(res, sent) {
-  return _promiseResolve(_Promise, undefined).then(function () {
+  return intrinsic.chain(intrinsic.chain(_promiseResolve(_Promise, undefined), function () {
     var pt = _partMediaType(_ciHeader(res.headers, "content-type"));
     if (pt.media !== "application/pkcs7-mime") return null;
     if (pt.ambiguous) return null;
     if (String(pt.smimeType || "").toLowerCase() !== "cmc-response") return null;
-    return cmcVerify.verify(transferDecode(res.body), sent).then(function (verdict) {
+    return intrinsic.chain(cmcVerify.verify(transferDecode(res.body), sent), function (verdict) {
       if (verdict.outcome !== "rejected") return null;
       var e = E("est/cmc-failed",
         "the EST server rejected the Full PKI Request: " + verdict.outcome +
@@ -1538,7 +1538,7 @@ function _tryDecodeCmcFault(res, sent) {
       e.httpStatus = res.status;
       return e;
     });
-  }).then(null, function () { return null; });
+  }), null, function () { return null; });
 }
 
 function _isTypedError(e) {

package/lib/guard-identifier.js

@@ -31,6 +31,7 @@ var _mapSet = intrinsic.mapSet;
 var _mapHas = intrinsic.mapHas;
 var _Set = intrinsic.Set;
 var _Map = intrinsic.Map;
+var _ObjectProto = intrinsic.ObjectProto;
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSplit = intrinsic.uncurry(String.prototype.split);
 var _fnToString = intrinsic.uncurry(Function.prototype.toString);
@@ -92,6 +93,54 @@ function assertKnownKeys(obj, known, E, code, message) {
   });
 }
 
+/**
+ * @internal
+ * Whether `k` is `v`'s function machinery, owned or reached from its prototype chain. A check that
+ * walks the chain asks this; a reader that copies one LEVEL at a time asks `isOwnMachineryName`.
+ *
+ * Which of the two a given name is depends on the function and the engine. A STRICT function, which
+ * is every function in an ES module or a `"use strict"` file, owns neither `arguments` nor `caller`,
+ * and `Function.prototype` carries both as the restricted accessors, so a chain walk finds them
+ * there. On the Node 24.21.0 floor a non-strict function owns both outright. Measured before this
+ * covered the inherited side: a plain strict callable descriptor was refused for `arguments` by
+ * `pki.cms.sign` and `pki.cms.countersign`, while the minted floor shape passed, which is the shape
+ * the vectors were written on.
+ */
+// @enforced-by behavioral -- the vectors that drive a PLAIN callable and a floor-shaped one through
+// @enforced-by behavioral -- each door are the guard; the name set has no rename-proof code shape
+function isMachineryName(v, k) {
+  if (v === null || v === undefined) return false;
+  if (isOwnMachineryName(v, k)) return true;
+  if (typeof v !== "function" || !_CALLABLE_MACHINERY.has(k)) return false;
+  /** @internal Not owned, so `readableNames` reached it through the prototype chain. A caller's own
+   *  property of that name is theirs and stays refused by name, which `isOwnMachineryName` above
+   *  decides; making one takes `defineProperty`, since assigning `fn.arguments` reaches the
+   *  restricted setter and throws. */
+  return _getOwnPropertyDescriptor(v, k) === undefined;
+}
+
+/**
+ * @internal
+ * `assertKnownKeys` for a bag a verb documents as acceptably CALLABLE, where the names a function
+ * carries by construction are not fields the caller named. The exemption belongs at the door that
+ * refuses, not only at a reader that copies: `pki.smime.sign` snapshots a descriptor before handing
+ * it on, so excluding the machinery there left a caller going straight to `pki.cms.sign` with the
+ * same callable refused for `length`.
+ *
+ * It is not `assertKnownKeys`'s own rule, because a bare function handed in where an OPTIONS BAG
+ * belongs is refused for exactly those names, which is a contract of its own.
+ */
+// @enforced-by behavioral -- the vectors that drive a callable descriptor through each door are the
+// @enforced-by behavioral -- guard; the exemption has no rename-proof code shape
+function assertKnownDescriptorKeys(obj, known, E, code, message) {
+  _refuseUnenumerable(obj, E, code, "the options");
+  var describe = typeof message === "function" ? message : function (k) { return message + _stringify(k); };
+  _forEach(_readableNames(obj), function (k) {
+    if (_hasOwn(known, k) || isMachineryName(obj, k)) return;
+    throw E(code, describe(typeof k === "symbol" ? _String(k) : k));
+  });
+}
+
 // @enforced-by behavioral -- reading a property twice has no rename-proof code shape; the RED
 // @enforced-by behavioral -- vectors that drive an accessor-backed option are the guard
 function snapshotOptions(obj, known) {
@@ -320,6 +369,64 @@ function _kindMembers(v) {
   return [];
 }
 
+/** @internal The names a callable carries before a caller assigns a field, asked of the engine
+ *  rather than listed here: a function's own names, plus `Function.prototype`'s, which is where the
+ *  restricted `arguments` and `caller` accessors live. Which of them a given function makes OWN
+ *  depends on the engine. Measured: on Node 24.21.0, the version `engines.node` floors at, every
+ *  non-strict function carries own `arguments` and `caller`; on 26.9.0 none does, for a declaration
+ *  and for `new Function` alike. A list written against one of those refuses a legitimate callable
+ *  descriptor on the other, and a caller's non-strict CommonJS module is where the shape comes
+ *  from. */
+var _CALLABLE_MACHINERY = (function () {
+  var names = _create(null), symbols = new _Set();
+  /** @internal One pristine probe per callable KIND, because the kinds do not share a prototype: an
+   *  async function, a generator and an async generator each sit on their own intrinsic prototype
+   *  carrying `Symbol.toStringTag`, which an ordinary function's chain never reaches. Measured
+   *  before the probes were per-kind: `pki.cms.sign` refused all three for
+   *  `Symbol(Symbol.toStringTag)` while an ordinary function passed. Symbol keys are collected too,
+   *  since that is the name that was missing. */
+  /** @internal Every kind, not the subset that happens to suffice: the four intrinsic prototypes
+   *  carry the SAME well-known `Symbol.toStringTag` under different values, so dropping the async
+   *  generator still passes today and would not if a kind ever carried a key of its own. */
+  var probes = [function () {}, function* () {}, async function () {}, async function* () {}, class {}];
+  _forEach(probes, function (p) {
+    for (var o = p; o !== null && o !== _ObjectProto; o = _getPrototypeOf(o)) {
+      _forEach(_ownKeys(o), function (k) {
+        if (typeof k === "symbol") _setAdd(symbols, k); else names[k] = true;
+      });
+    }
+  });
+  return {
+    has: function (k) { return typeof k === "symbol" ? _setHas(symbols, k) : names[k] === true; },
+  };
+})();
+
+/**
+ * @internal
+ * Whether `k` is part of `v`'s own machinery rather than a field a caller named: a RegExp's
+ * `lastIndex`, the non-thenable mask's `then`, and a callable's own function machinery, which is
+ * non-enumerable where a field a caller assigned is enumerable.
+ *
+ * A reader that COPIES a descriptor's own keys asks this, so it copies what the caller wrote and
+ * nothing else. The name checks do not: a bare function handed in where an options bag belongs is
+ * refused for the names it carries, which is a contract of its own, so the callable rule lives here
+ * rather than in `_isOwnStructuralName`.
+ */
+// @enforced-by behavioral -- a per-kind name set has no rename-proof code shape; the vectors
+// @enforced-by behavioral -- that drive a callable descriptor through a copying door are the guard
+function isOwnMachineryName(v, k) {
+  if (v === null || v === undefined) return false;
+  var d = _getOwnPropertyDescriptor(v, k);
+  /** @internal A DATA property, because that is what the machinery is: measured on both Node
+   *  24.21.0 and 26.9.0, every one of these names a function owns is a non-enumerable data
+   *  property. An accessor a caller installed under one of those names is therefore theirs, and it
+   *  reaches the unknown-field refusal by its name rather than being exempted and ignored. Asking
+   *  the descriptor rather than reading the property leaves the getter uninvoked either way. */
+  if (typeof v === "function" && !!d && d.enumerable === false && _hasOwn(d, "value") &&
+      _CALLABLE_MACHINERY.has(k)) return true;
+  return _isOwnStructuralName(v, k, d, false);
+}
+
 function _isOwnStructuralName(v, k, d, inherited) {
   if (util.types.isRegExp(v) && k === "lastIndex") return true;
   /** @internal The non-thenable mask `guard.verdict.shield` leaves on a value the toolkit hands back:
@@ -680,6 +787,9 @@ module.exports = intrinsic.freeze({
   snapshotOptions: snapshotOptions,
   snapshotPresentOptions: snapshotPresentOptions,
   optionNames: optionNames,
+  isOwnMachineryName: isOwnMachineryName,
+  isMachineryName: isMachineryName,
+  assertKnownDescriptorKeys: assertKnownDescriptorKeys,
   ownOptions: ownOptions,
   pickSettings: pickSettings,
   readableNames: readableNames,

package/lib/guard-name.js

@@ -65,7 +65,51 @@ function assertPrintableIa5(buf, E, code, label) {
 }
 
 function _isSpace(c) { return c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d; }
-function _canonAttrValue(v, E, code, label) {
+/** @internal The attribute types whose EQUALITY rule is not case-ignoring, resolved once to their
+ *  object identifiers. An equality rule belongs to the attribute, and folding case on one whose rule
+ *  is case-exact makes two distinct names compare as one name: measured through `pki.x509.parseDn`,
+ *  `challengePassword=Secret` and `challengePassword=secret` encode differently and compared EQUAL,
+ *  as did `localKeyId=AB` against `ab` and a `role` URI against its lowercase form.
+ *
+ *  Only the exceptions are listed. caseIgnoreMatch under the RFC 4518 preparation is the correct
+ *  rule for every attribute RFC 5280 sec. 4.1.2.4 requires support for, so a conforming PKIX name
+ *  compares as it did and an attribute the registry does not name keeps that default rather than
+ *  being given a rule nothing states.
+ *
+ *  The identifiers are resolved rather than written, since a dotted-decimal literal is never the
+ *  identity a module carries. */
+/** @internal RFC 2985 sec. 5.4.1 gives challengePassword caseExactMatch, sec. 5.5.2 gives localKeyId
+ *  octetStringMatch, and RFC 5755 sec. 4.4.5 makes a role a URI. */
+var _CASE_EXACT_NAMES = ["challengePassword", "localKeyId", "role"];
+var _caseExactOids = null;
+function _isCaseExactType(type) {
+  if (typeof type !== "string") return false;
+  if (_caseExactOids === null) {
+    var oid = require("./oid");   // allow:inline-require -- circular load: oid -> guard-all -> this module
+    _caseExactOids = _create(null);
+    for (var i = 0; i < _CASE_EXACT_NAMES.length; i++) {
+      var o = oid.byName(_CASE_EXACT_NAMES[i]);
+      if (typeof o === "string") _caseExactOids[o] = true;
+    }
+  }
+  return _caseExactOids[type] === true;
+}
+
+/** @internal The registry's own reading of a dotted-decimal object identifier, taken from there
+ *  rather than re-derived: `numericoid` is RFC 4512's production and one definition of it decides
+ *  both what the registry resolves and what opens a distinguished name. */
+var _isDottedOid = null;
+function _opensAsNumericOid(run) {
+  if (_isDottedOid === null) {
+    var oid = require("./oid");   // allow:inline-require -- circular load: oid -> guard-all -> this module
+    _isDottedOid = oid.isDottedDecimal;
+  }
+  return _isDottedOid(run) === true;
+}
+
+/** @internal The RFC 4518 insignificant-space preparation, which every equality rule here applies.
+ *  The case fold is the caller's to add, because that step is the one the attribute's rule decides. */
+function _prepAttrValue(v, E, code, label) {
   if (typeof v !== "string") return v;
   assertNoControlBytes(v, E, code, label);
   var out = "", lastWasSpace = true;
@@ -75,8 +119,9 @@ function _canonAttrValue(v, E, code, label) {
     lastWasSpace = false;
     out += _charAt(v, i);
   }
-  return _toLowerCase(out);
+  return out;
 }
+
 /** @internal Both lengths are NARROWED where they are taken, and every test and walk below asks the
  * local. `Array.isArray` is true for a Proxy whose target is an array and a `get` trap answers `length`
  * afresh on each read, so the equality test and the walk that follows it could see two different counts:
@@ -114,14 +159,25 @@ function rdnEqual(a, b, E, code, label) {
      *  comparison's one unacceptable answer, since it is what chains a certificate to its issuer. */
     var ea = a[i];
     var typeA = ea == null ? undefined : ea.type;
-    var valueA = _canonAttrValue(ea == null ? undefined : ea.value, E, code, label);
+    /** @internal Prepared once without the fold, and folded once, so the attribute's own rule picks
+     *  between them without reading the element again. */
+    var prepA = _prepAttrValue(ea == null ? undefined : ea.value, E, code, label);
+    var foldedA = typeof prepA === "string" ? _toLowerCase(prepA) : prepA;
+    var exactA = _isCaseExactType(typeA);
     var found = false;
     for (var j = 0; j < n.b; j++) {
       if (used[j]) continue;
       var eb = b[j];
       var typeB = eb == null ? undefined : eb.type;
       if (typeA !== typeB) continue;
-      if (valueA === _canonAttrValue(eb == null ? undefined : eb.value, E, code, label)) {
+      var prepB = _prepAttrValue(eb == null ? undefined : eb.value, E, code, label);
+      /** @internal Either side naming a case-exact attribute decides it. The types already matched,
+       *  so the two can disagree only through an object answering differently per read, and the
+       *  exact comparison is the one that cannot make two distinct names equal. */
+      var same = exactA || _isCaseExactType(typeB)
+        ? prepA === prepB
+        : foldedA === (typeof prepB === "string" ? _toLowerCase(prepB) : prepB);
+      if (same) {
         used[j] = true; found = true; break;
       }
     }
@@ -213,6 +269,36 @@ function isAttributeDescriptor(name) {
   return true;
 }
 
+/**
+ * @internal
+ * Whether a string opens with the prefix RFC 4514 sec. 3 requires of a distinguished name: an
+ * attribute type, a descriptor or a dotted-decimal OID, immediately followed by `=`. It answers one
+ * question, whether a caller who passed a bare string meant a distinguished name rather than the
+ * single value the shorthand reads it as, and it is deliberately narrower than parsing: a value that
+ * CONTAINS an `=` further along, `Example CA (v=2)`, opens with no attribute type and is not
+ * a distinguished name.
+ *
+ * `attributeType` is `descr / numericoid`, and a `numericoid` carries at least one dot, so a numeric
+ * run without one is not an attribute type: `1=1` is a value no reader reads as a distinguished
+ * name, and refusing it would name a remedy that does not apply. The leading whitespace sec. 3
+ * admits nowhere is the same case from the other side: ` CN=Example` opens with no attribute type
+ * and is the value it says it is.
+ */
+// @enforced-by behavioral -- an opening-prefix test has no rename-proof shape distinct from
+function opensAsDnString(str) {
+  if (typeof str !== "string" || str.length === 0) return false;
+  var i = 0, n = str.length, first = _charCodeAt(str, 0);
+  if (_isDigit(first)) {
+    while (i < n && (_isDigit(_charCodeAt(str, i)) || _charCodeAt(str, i) === 0x2e)) i++;
+    if (!_opensAsNumericOid(_strSlice(str, 0, i))) return false;
+  } else if (_isAttrTypeStart(first)) {
+    while (i < n && _isAttrTypeChar(_charCodeAt(str, i))) i++;
+  } else {
+    return false;
+  }
+  return i > 0 && i < n && _charCodeAt(str, i) === 0x3d;
+}
+
 // @enforced-by behavioral -- the inverse of escapeDnValue has no rename-proof shape distinct
 function parseDnString(str, E, code, label) {
   if (typeof str !== "string") throw E(code, label + " must be a string");
@@ -1058,6 +1144,7 @@ module.exports = intrinsic.freeze({
   assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5,
   dnEqual: dnEqual, rdnEqual: rdnEqual, emailEqual: emailEqual, dpnCorresponds: dpnCorresponds,
   escapeControlBytes: escapeControlBytes, escapeDnValue: escapeDnValue, parseDnString: parseDnString,
+  opensAsDnString: opensAsDnString,
   isAttributeDescriptor: isAttributeDescriptor,
   lowerAscii: lowerAscii, uriSchemeIs: uriSchemeIs,
   stripTrailingDot: stripTrailingDot, isFqdnHost: isFqdnHost, splitMailbox: splitMailbox,

package/lib/inspect.js

@@ -1531,8 +1531,8 @@ function crmfReport(input) {
  *   var key = await pki.key.export(pair.privateKey);
  *   var cert = await pki.x509.sign({ subject: "cmp.example", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
- *   var der = await pki.cmp.build({ header: { sender: { directoryName: "CN=cmp.example" },
- *     recipient: { directoryName: "CN=A CA" } },
+ *   var der = await pki.cmp.build({ header: { sender: { directoryName: "cmp.example" },
+ *     recipient: { directoryName: "A CA" } },
  *     body: { ir: { certTemplate: { subject: [{ commonName: "cmp.example" }], publicKey: await pki.key.export(pair.publicKey) } } } },
  *     { cert: cert, key: key });
  *   pki.inspect.cmp(der).split("\n")[0];  // "CMP Message:"
@@ -1937,10 +1937,10 @@ function tspReport(input) {
  *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
- *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "CN=Alice" } },
+ *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "Alice" } },
  *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *     attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
- *     { name: "CN=An AA", publicKey: await pki.key.export(pair.publicKey), key: await pki.key.export(pair.privateKey) });
+ *     { name: "An AA", publicKey: await pki.key.export(pair.publicKey), key: await pki.key.export(pair.privateKey) });
  *   pki.inspect.attrcert(der).split("\n")[0];  // "Attribute Certificate:"
  */
 function attrCertReport(input) {

package/lib/lint.js

@@ -7556,10 +7556,10 @@ function _ingestAttrCert(input) {
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var key = await pki.key.export(pair.privateKey);
- *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "CN=Alice" } },
+ *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "Alice" } },
  *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
  *     attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
- *     { name: "CN=Example AA", publicKey: await pki.key.export(pair.publicKey), key: key });
+ *     { name: "Example AA", publicKey: await pki.key.export(pair.publicKey), key: key });
  *   pki.lint.attrcert(der).findings.length;       // -> 0 for a conforming attribute certificate
  */
 function attrcert(input, opts) {

package/lib/ocsp-verify.js

@@ -25,7 +25,7 @@ var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
 var OID_EKU = oid.byName("extKeyUsage");
 var OID_KEY_USAGE = oid.byName("keyUsage");
 
-function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return _bufferFrom(h); }); }
+function ocspDigest(alg, buf) { return intrinsic.chain(subtle.digest(alg, buf), function (h) { return _bufferFrom(h); }); }
 
 function ocspKeyValue(spkiDer) {
   return asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;

package/lib/pki-build.js

@@ -522,6 +522,20 @@ function makeBuilder(ctx) {
   }
   function encodeName(spec) {
     if (guard.bytes.isByteSource(spec)) { var _nd = guard.bytes.snapshotSource(spec, ErrorClass, ctx.prefix + "/bad-name", "raw Name DER"); assertValidNameDer(_nd); return _nd; }
+    /** @internal A bare string is the common-name shorthand, and a caller who writes a distinguished
+     *  name here gets one commonName holding the whole text: measured, `"CN=Example CA, O=Example"`
+     *  certified the single RDN `CN=CN=Example CA\, O=Example`, the doubled `CN=` being the caller's
+     *  own attribute type read as part of the value. Only one of the two readings can be what was
+     *  meant, so the distinguished-name one is refused rather than certified as a name nobody asked
+     *  for, and the caller says which by passing `pki.x509.parseDn(s).bytes` or the RDN array. A
+     *  common name that contains an `=` further along does not open as a distinguished name
+     *  and is untouched. OpenSSL refuses the same string for the same reason, naming the form it
+     *  wants; Go has no string form and .NET reads a string as the distinguished name. */
+    if (typeof spec === "string" && guard.name.opensAsDnString(spec)) {
+      throw E("bad-name", "a bare name string is a common name, and " + guard.text.showValue(spec) +
+        " opens as a distinguished name. Pass pki.x509.parseDn(s).bytes for the distinguished name, " +
+        "or [{ commonName: s }] to certify it as one common name");
+    }
     if (typeof spec === "string") spec = [{ commonName: spec }];
     if (!_isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
     /** @internal Held to the same density every other authoring list is held to. Mapping over a

package/lib/possession.js

@@ -160,12 +160,12 @@ function _namesCertificate(signer, certParsed) {
  *   var kemSpki = await pki.key.export(kem.publicKey, { format: "der" });
  *   var sigSpki = await pki.key.export(sig.publicKey, { format: "der" });
  *   var sigCert = await pki.x509.sign({
- *     subject: "CN=kem.example", subjectPublicKey: sigSpki, serialNumber: 34n,
+ *     subject: "kem.example", subjectPublicKey: sigSpki, serialNumber: 34n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z"),
  *   }, { key: sig.privateKey });
  *   var parsedCert = pki.schema.x509.parse(sigCert);
  *   var csr = await pki.csr.sign({
- *     subject: "CN=kem.example", subjectPublicKey: kemSpki,
+ *     subject: "kem.example", subjectPublicKey: kemSpki,
  *     privateKeyPossessionStatement: {
  *       signer: { issuer: parsedCert.issuer.bytes, serialNumber: parsedCert.serialNumber },
  *       certificate: sigCert,
@@ -354,18 +354,18 @@ var _isSignatureOnlyKey = pkix.signatureOnlyKeyOid(NS);
  *   var ca = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var caSpki = await pki.key.export(ca.publicKey, { format: "der" });
  *   var caCert = await pki.x509.sign({
- *     subject: "CN=Possession CA", subjectPublicKey: caSpki, serialNumber: 1n,
+ *     subject: "Possession CA", subjectPublicKey: caSpki, serialNumber: 1n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z"),
  *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign"] },
  *   }, { key: ca.privateKey });
  *   var sigCert = await pki.x509.sign({
- *     subject: "CN=kem.example", subjectPublicKey: sigSpki, serialNumber: 34n,
+ *     subject: "kem.example", subjectPublicKey: sigSpki, serialNumber: 34n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z"),
  *     extensions: { keyUsage: ["digitalSignature"] },
  *   }, { cert: caCert, key: ca.privateKey });
  *   var p = pki.schema.x509.parse(sigCert);
  *   var csr = await pki.csr.sign({
- *     subject: "CN=kem.example", subjectPublicKey: kemSpki,
+ *     subject: "kem.example", subjectPublicKey: kemSpki,
  *     privateKeyPossessionStatement: {
  *       signer: { issuer: p.issuer.bytes, serialNumber: p.serialNumber }, certificate: sigCert,
  *     },
@@ -522,13 +522,15 @@ function _verifyRequest(request, opts) {
       "authorize a certification request (RFC 5280 sec. 4.2.1.3)");
   }
 
-  return _promiseResolve(_Promise, _validatePath(chain, { trustAnchors: o.trustAnchors, time: at }))
-    .then(function (pathResult) {
+  return intrinsic.chain(
+    _promiseResolve(_Promise, _validatePath(chain, { trustAnchors: o.trustAnchors, time: at })),
+    function (pathResult) {
       var pathValidated = pathResult.valid === true;
       if (!pathValidated) _push(reasons, "the signature certificate's certification path is not valid, and RFC 9883 sec. 4 makes that a MUST");
-      return _seam.verify(parsed.signatureAlgorithm, parsed.signatureValue,
-        sigCert.subjectPublicKeyInfo.bytes, parsed.certificationRequestInfoBytes)
-        .then(function (verified) {
+      return intrinsic.chain(
+        _seam.verify(parsed.signatureAlgorithm, parsed.signatureValue,
+          sigCert.subjectPublicKeyInfo.bytes, parsed.certificationRequestInfoBytes),
+        function (verified) {
           if (verified !== true) _push(reasons, "the request signature does not verify under the signature certificate's public key, and RFC 9883 sec. 4 makes that a MUST");
           return guard.verdict.of({}, {
             valid: verified === true && pathValidated && signerMaySign && !requestsSignatureCertificate &&
@@ -543,15 +545,19 @@ function _verifyRequest(request, opts) {
             requestsSignatureCertificate: requestsSignatureCertificate,
             reason: reasons.length ? _join(reasons, "; ") : undefined,
           });
-        });
-    });
+        }
+      );
+    }
+  );
 }
 
 /** @internal Whether the signature certificate's key may make this signature at all. A certificate confined
  *  to `keyAgreement` does not authorize a signature over a certification request, and accepting one lets a
  *  key never issued for signing authorize issuance. The accepted set is `pki.cms`'s: a signature over
- *  content is authorized by digitalSignature, contentCommitment or nonRepudiation alike. */
-var _maySign = pkix.keyUsagePermits(NS, ["digitalSignature", "contentCommitment", "nonRepudiation"]);
+ *  content is authorized by digitalSignature or nonRepudiation alike. The decoder emits the
+ *  RFC 5280 sec. 4.2.1.3 bit name `nonRepudiation`, never the X.509 spelling `contentCommitment`,
+ *  so naming the latter here asked for a name nothing defines. */
+var _maySign = pkix.keyUsagePermits(NS, ["digitalSignature", "nonRepudiation"]);
 
 /** @internal The subjectAltName a request asks for, or null when it asks for none. */
 function _requestedSan(parsedCsr) {

package/lib/related-cert.js

@@ -99,6 +99,33 @@ function _certIdParts(der) {
 var DIGEST_LENGTHS = pkix.digestLengths();
 var SIG_OID_DIGEST = pkix.signatureDigestNames(oid);
 
+/** @internal Whether the related certificate's key may make this one signature. RFC 5280 sec. 4.2.1.3
+ *  confines a key to the purposes a present keyUsage asserts, so a certificate issued only to sign
+ *  certificates or CRLs does not authorize a proof of possession over a certification request.
+ *
+ *  The set is NOT `pki.possession`'s. RFC 9763 sec. 3.1 states that "if the related certificate is a
+ *  key establishment certificate (e.g., using RSA key transport or Elliptic Curve Cryptography (ECC)
+ *  key agreement), the private key is used to sign one time for proof of possession (POP)", so
+ *  keyEncipherment and keyAgreement authorize this signature where they authorize no other, and
+ *  holding the proof to possession's signing-only set would refuse a request the document admits.
+ *  What is left to refuse is a certificate confined to keyCertSign, cRLSign, or the two modifier bits
+ *  that carry no meaning without keyAgreement. An absent keyUsage constrains nothing.
+ *
+ *  Which establishment bit counts comes from the SUBJECT KEY, because the sentence admits a key
+ *  establishment CERTIFICATE and a bit the key's own family cannot perform does not make one. The
+ *  union of both bits admitted a certificate that is not an establishment certificate under any
+ *  reading: measured, an EC certificate asserting only keyEncipherment, which RFC 8813 sec. 3 makes a
+ *  MUST NOT for id-ecPublicKey, and an RSA certificate asserting only keyAgreement, which RFC 3279
+ *  sec. 2.3.1 does not list, both reported signerMaySign and a valid proof. A family the shared table
+ *  places in neither column admits neither bit, so a signature usage is what authorizes it. */
+var SIGNATURE_USAGE_BITS = ["digitalSignature", "nonRepudiation"];
+var _estabBit = pkix.keyEstablishmentBit(NS);
+var _maySign = pkix.keyUsagePermits(NS, function (parsedCert) {
+  var spki = parsedCert && parsedCert.subjectPublicKeyInfo;
+  var bit = _estabBit(spki && spki.algorithm ? spki.algorithm.oid : null);
+  return bit === null ? SIGNATURE_USAGE_BITS : [bit, "digitalSignature", "nonRepudiation"];
+});
+
 /** @internal The digests this module will bind a certificate identity to. sha1 is registered and
  *  decodable, and is absent here: a chosen-prefix collision on a certificate is a demonstrated
  *  attack, so a value naming it is refused before anything is computed. A caller reading a hashValue a
@@ -392,7 +419,7 @@ function _parseCert(certDer, what) {
  * @example
  *   var kp = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var spki = await pki.key.export(kp.publicKey, { format: "der" });
- *   var related = await pki.x509.sign({ subject: "CN=Held", subjectPublicKey: spki, serialNumber: 42n,
+ *   var related = await pki.x509.sign({ subject: "Held", subjectPublicKey: spki, serialNumber: 42n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z") }, { key: kp.privateKey });
  *   pki.relatedCert.certificateHash(related).hashAlgorithm;          // -> "sha256", from this certificate's signature OID
  *   pki.relatedCert.certificateHash(related, "sha512").hashValue.length;   // -> 64
@@ -455,9 +482,9 @@ function digestValue(hashAlgorithm, hashValue) {
  * @example
  *   var kp = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var spki = await pki.key.export(kp.publicKey, { format: "der" });
- *   var related = await pki.x509.sign({ subject: "CN=Held", subjectPublicKey: spki, serialNumber: 42n,
+ *   var related = await pki.x509.sign({ subject: "Held", subjectPublicKey: spki, serialNumber: 42n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z") }, { key: kp.privateKey });
- *   var leaf = await pki.x509.sign({ subject: "CN=New Key", subjectPublicKey: spki, serialNumber: 43n,
+ *   var leaf = await pki.x509.sign({ subject: "New Key", subjectPublicKey: spki, serialNumber: 43n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z"),
  *     extensions: { relatedCertificate: { relatedCertificate: related } } }, { key: kp.privateKey });
  *   var ext = pki.schema.x509.parse(leaf).extensions
@@ -563,7 +590,7 @@ function _namedAlgorithm(value) {
 
 /**
  * @primitive pki.relatedCert.verifyRequest
- * @signature pki.relatedCert.verifyRequest(requesterCertificate, certificate, opts?) -> Promise<boolean>
+ * @signature pki.relatedCert.verifyRequest(requesterCertificate, certificate, opts?) -> Promise<verdict>
  * @since 0.8.42
  * @status stable
  * @spec RFC 9763 sec. 3.1
@@ -572,9 +599,18 @@ function _namedAlgorithm(value) {
  *
  * Verify the proof of possession in a `relatedCertRequest` CSR attribute. `requesterCertificate` is
  * the value `pki.schema.csr.parse` carries on that attribute, and `certificate` is the DER of the
- * certificate its `certID` names. Returns `true` when the signature over the bytes
- * `pki.relatedCert.requestSignedData` describes verifies under that certificate's subject key, and
- * `false` when a signature was checked and did not verify.
+ * certificate its `certID` names.
+ *
+ * Returns `{ valid, verified, signerMaySign, signatureAlgorithm }`, plus `code` and `reason` when it
+ * did not pass. `verified` is the signature over the bytes
+ * `pki.relatedCert.requestSignedData` describes, checked under that certificate's subject key.
+ * `signerMaySign` is whether the certificate's keyUsage authorizes that signature at all, and
+ * `valid` is both together. They are separate because a key the certificate never authorized for
+ * signing and a signature that does not verify are different facts, and a caller acting on one as
+ * if it were the other acts on the wrong one. RFC 5280 sec. 4.2.1.3 confines a key to the purposes a
+ * present keyUsage asserts; a certificate carrying none is unconstrained. A key-establishment
+ * certificate still passes, because RFC 9763 sec. 3.1 has such a key "sign one time for proof of
+ * possession", so keyEncipherment and keyAgreement authorize this signature and no other.
  *
  * The certificate handed in must be the one `certID` names: an issuer and serial that do not match
  * throw `relatedcert/cert-mismatch`, since verifying a proof against a certificate the request did
@@ -614,7 +650,7 @@ function _namedAlgorithm(value) {
  * @example
  *   var kp = await pki.key.generate({ name: "ECDSA", namedCurve: "P-256" });
  *   var spki = await pki.key.export(kp.publicKey, { format: "der" });
- *   var held = await pki.x509.sign({ subject: "CN=Held", subjectPublicKey: spki, serialNumber: 42n,
+ *   var held = await pki.x509.sign({ subject: "Held", subjectPublicKey: spki, serialNumber: 42n,
  *     notBefore: new Date("2027-01-01T00:00:00Z"), notAfter: new Date("2028-01-01T00:00:00Z") }, { key: kp.privateKey });
  *   var parsed = pki.schema.x509.parse(held);
  *   var certID = { issuer: parsed.issuer.bytes, serialNumber: parsed.serialNumber };
@@ -627,7 +663,7 @@ function _namedAlgorithm(value) {
  *     pki.asn1.build.integer(BigInt("0x" + raw.subarray(0, half).toString("hex"))),
  *     pki.asn1.build.integer(BigInt("0x" + raw.subarray(half).toString("hex"))),
  *   ]);
- *   var csr = await pki.csr.sign({ subject: "CN=New Key", subjectPublicKey: spki,
+ *   var csr = await pki.csr.sign({ subject: "New Key", subjectPublicKey: spki,
  *     relatedCertRequest: { certID: certID, requestTime: 1800000000,
  *       locationInfo: ["https://certs.example/held.cer"], signature: proof } }, { key: kp.privateKey });
  *   var attr = pki.schema.csr.parse(csr).attributes
@@ -635,7 +671,7 @@ function _namedAlgorithm(value) {
  *   // The window is the certification authority's policy, so it is named: five minutes here, judged
  *   // against the instant the request was made, which is what a CA reading a recorded request does.
  *   await pki.relatedCert.verifyRequest(attr.relatedCertRequest, held,
- *     { maxAge: 300, at: new Date(1800000060 * 1000) });   // -> true
+ *     { maxAge: 300, at: new Date(1800000060 * 1000) });   // -> { valid: true, verified: true, ... }
  */
 function verifyRequest(requesterCertificate, certificate, opts) {
   /** @internal Every refusal reaches the caller as a rejection, so a verb that returns a promise never
@@ -680,6 +716,8 @@ function _verifyRequest(requesterCertificate, certificate, opts) {
       "the certificate given is not the one certID names (RFC 9763 sec. 3.2)");
   }
 
+  var signerMaySign = _maySign(c.parsed);
+
   var sigAlg = o.signatureAlgorithm !== undefined && o.signatureAlgorithm !== null
     ? _namedAlgorithm(o.signatureAlgorithm)
     : _proofAlgorithm(c.parsed, o.digestAlgorithm);
@@ -694,7 +732,30 @@ function _verifyRequest(requesterCertificate, certificate, opts) {
   }
   if (sig.bytes.length === 0) throw _err("relatedcert/bad-input", "the proof signature must not be empty");
 
-  return _seam.verify(sigAlg, sig, c.parsed.subjectPublicKeyInfo.bytes, preimage);
+  /** @internal The two facts are reported apart. A bare boolean could not say which check failed, so
+   *  a key the certificate never authorized for signing and a signature that simply does not verify
+   *  read the same, and a caller acting on one as if it were the other acts on the wrong fact. */
+  return intrinsic.chain(_seam.verify(sigAlg, sig, c.parsed.subjectPublicKeyInfo.bytes, preimage), function (verified) {
+    var ok = verified === true && signerMaySign;
+    /** @internal The verdict carries what this verb DETERMINED, not an echo of what it was handed.
+     *  The caller already holds `certID` and `requestTime` on the request it passed in, and copying
+     *  the decoded issuer onto the result would invite a byte comparison against a name this verb
+     *  judged equal under the RFC 5280 sec. 7.1 folding: two names that compare equal here are
+     *  routinely different bytes, and there is no public comparison a caller could use instead.
+     *  `signatureAlgorithm` is kept because it is derived rather than supplied, so without it a
+     *  caller cannot tell which digest the proof was actually checked under. */
+    return guard.verdict.of({
+      valid: ok,
+      verified: verified === true,
+      signerMaySign: signerMaySign,
+      signatureAlgorithm: sigAlg,
+    }, ok ? null : {
+      code: !signerMaySign ? "relatedcert/signer-may-not-sign" : "relatedcert/bad-signature",
+      reason: !signerMaySign
+        ? "the related certificate's keyUsage does not authorize a proof-of-possession signature (RFC 5280 sec. 4.2.1.3)"
+        : "the proof signature does not verify under the key of the certificate certID names",
+    });
+  });
 }
 
 module.exports = {