@blamejs/pki 0.1.12 → 0.1.14

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.14 — 2026-07-06
+
+An RFC 5755 attribute-certificate parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.attrcert — an RFC 5755 attribute-certificate parser. pki.schema.attrcert.parse turns a DER Buffer or PEM into a structured v2 attribute certificate ({ version, holder, issuer, signatureAlgorithm, serialNumber, serialNumberHex, validity, attributes, issuerUniqueID, extensions, tbsBytes, signatureValue }). The holder (baseCertificateID / entityName / objectDigestInfo) and issuer (v1Form / v2Form) identities come back as validated GeneralNames; the validity window is real Dates; the privilege attributes (id-at-role, id-aca-group, id-at-clearance, and any others) resolve by name where the registry knows them. The outer-equals-inner signatureAlgorithm agreement (RFC 5755 4.2.4), the positive-and-at-most-20-octet serialNumber (4.2.5), the GeneralizedTime-only validity (4.2.6), the non-empty unique-typed attribute list (4.2.7), and the digestedObjectType enumeration are all enforced fail-closed. pki.schema.parse detect-and-routes an attribute certificate; the obsolete v1 form is recognized and deferred with a precise attrcert/legacy-v1-not-supported.
+- pki.schema.pkix gains a shared GeneralNames validator that the attribute-certificate parser composes for its four GeneralNames-bearing fields — validating every element as a well-formed GeneralName (rejecting a bad tag, a wrong primitive/constructed form, a non-IA5 string, or a mis-sized iPAddress) rather than surfacing the sequence as opaque bytes. It handles both a bare universal SEQUENCE OF GeneralName and a context-tagged IMPLICIT GeneralNames.
+- The OID registry gains the RFC 5755 attribute-certificate object identifiers: the id-aca attribute-type family (authenticationInfo / accessIdentity / chargingIdentity / group), id-at-role and id-at-clearance, the id-ce-targetInformation and id-ce-noRevAvail extensions, and the id-pe-ac-auditIdentity / id-pe-aaControls / id-pe-ac-proxying private extensions — so a parsed attribute certificate's attributes and extensions resolve by name.
+
+## v0.1.13 — 2026-07-05
+
+An RFC 3161 timestamp parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.tsp — an RFC 3161 timestamp parser. pki.schema.tsp.parse turns a DER Buffer or PEM into a TimeStampResp ({ status, statusString, failInfo, timeStampToken }) with the granted-carries-token / rejected-carries-none coupling enforced (tsp/missing-token, tsp/unexpected-token) and the PKIFailureInfo named bits decoded. pki.schema.tsp.parseToken parses a TimeStampToken by composing pki.schema.cms.parse and asserting the id-ct-TSTInfo content type (tsp/wrong-econtent-type), attached content (tsp/detached-token), and the single (TSA) signer (tsp/multi-signer), returning the decoded TSTInfo plus the signer material. pki.schema.tsp.parseTstInfo decodes a bare TSTInfo. The TSTInfo mandatory version-1, the GeneralizedTime-only genTime, the accuracy 1..999 range, the ordering DEFAULT FALSE omission, and the PKIStatus 0..5 range are all enforced fail-closed. pki.schema.parse detect-and-routes a TimeStampResp.
+- The codec and schema engine gain three composable primitives that TSP required: pki.asn1.read.integerImplicit / pki.schema.engine.implicitInteger(tag) (a context-tagged IMPLICIT INTEGER, for the Accuracy millis / micros fields); pki.schema.engine.implicitSeqOf(tag, item) (an order-preserving IMPLICIT SEQUENCE OF, the sibling of implicitSetOf without the SET ordering rule, for the extensions field); and RFC 3161 / X.690 §11.7 fractional-seconds GeneralizedTime support in pki.asn1.read.time (a '.'-separated, trailing-zero-free, Z-terminated fraction, surfaced at millisecond precision).
+- The OID registry gains the id-kp extended-key-purpose family (including id-kp-timeStamping) and the id-aa S/MIME authenticated-attribute family (signingCertificate / signingCertificateV2 / timeStampToken), so a parsed TSA certificate's key purpose and a signer's ESS binding attribute resolve by name.
+
 ## v0.1.12 — 2026-07-05
 
 SLH-DSA object identifiers corrected and completed to all twelve FIPS 205 parameter sets.

package/README.md

@@ -197,9 +197,11 @@ is callable today; nothing below is a stub.
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
 | `pki.schema.cms` | Parse DER / PEM CMS SignedData per RFC 5652 — encapsulated content, signer infos, raw signed-attribute bytes for external verification, certificates / CRLs kept raw, fail-closed; non-SignedData content types recognized (not decoded) — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode` |
+| `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp responses and tokens — the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseTstInfo`, `parseToken`, `pemDecode` |
+| `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` plus the schema combinators |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
-| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError`, each carrying a stable `code` in `domain/reason` form |
+| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
 
 ### CLI
@@ -233,26 +235,34 @@ reintroduce the bug class it prevents. Adding a format is a schema declaration
 plus a documentation comment block, not new parse logic.
 
 ```
-  Detect + route     pki.schema.parse ── detects the format, routes to a sibling
-                              │
-  Format parsers     x509   crl   csr   pkcs8   cms   ocsp      (siblings)
-  (one schema each)    └──────┴─────┴──────┴──────┴─────┘
-                              │  every sibling COMPOSES ↓
-  Shared structure   pki.schema.engine        PKIX sub-schemas
-                     walk + combinators   ·   AlgorithmIdentifier · Name ·
-                     (positional reads,       Extension · version reader ·
-                      tag ordering, SET-OF     the one coerce → decode → walk
-                      uniqueness, arity,       parse-entry (PEM cap + DER
-                      fail-closed errors)      wrapping shared, never copied)
-                              │  built on ↓
-  Foundation         pki.asn1       pki.oid          pki.errors       pki.C
-                     DER codec  ·   OID registry  ·  PkiError     ·   constants
-                     (strict,       (two-way,        taxonomy         (LIMITS,
-                      bounded)       PQC-seeded)      (domain/reason)   scale)
-
-  Crypto             pki.webcrypto ──▶ node:crypto
-                     W3C SubtleCrypto over the platform: the classical set +
-                     post-quantum ML-DSA / SLH-DSA signatures + ML-KEM keygen
+┌─ Detect + route ────────────────────────────────────────────────────────┐
+│  pki.schema.parse — inspect the DER root, route to the matching sibling │
+└─────────────────────────────────────────────────────────────────────────┘
+                                     │
+ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐   Format
+ │  x509  │ │  crl   │ │  csr   │ │ pkcs8  │   parsers
+ └────────┘ └────────┘ └────────┘ └────────┘   (siblings)
+ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐
+ │  cms   │ │  ocsp  │ │  tsp   │ │attrcert│
+ └────────┘ └────────┘ └────────┘ └────────┘
+                                     │  every sibling composes ↓
+┌─ Shared structure ──────────────────────────────────────────────────────┐
+│  pki.schema.engine — walk + combinators (positional reads, tag order,   │
+│  SET-OF uniqueness, arity, typed errors) · the PKIX sub-schemas —       │
+│  AlgorithmIdentifier · Name · Extension · a bounded version reader —    │
+│  and the one coerce → decode → walk parse-entry (PEM cap + DER wrap).   │
+└─────────────────────────────────────────────────────────────────────────┘
+                                     │  built on ↓
+┌─ Foundation ────────────────────────────────────────────────────────────┐
+│  pki.asn1 — strict, bounded DER codec · pki.oid — two-way, PQC-seeded   │
+│  OID registry · pki.errors — the PkiError domain/reason taxonomy ·      │
+│  pki.C — version-stable LIMITS + scale constants.                       │
+└─────────────────────────────────────────────────────────────────────────┘
+
+┌─ Crypto ────────────────────────────────────────────────────────────────┐
+│  pki.webcrypto ──▶ node:crypto — a W3C SubtleCrypto engine: the         │
+│  classical set + post-quantum ML-DSA / SLH-DSA + ML-KEM key generation. │
+└─────────────────────────────────────────────────────────────────────────┘
 ```
 
 **Foundation.** The strict, bounded DER codec (`pki.asn1`), the two-way OID
@@ -266,7 +276,7 @@ bounded version reader, and the single coerce → decode → walk parse-entry th
 every format's `parse` is bound to. Because input coercion, the PEM size cap, and
 the DER-decode wrapping live here once, a format cannot diverge on a guard.
 
-**Format parsers.** `x509`, `crl`, `csr`, `pkcs8`, `cms`, and `ocsp` are siblings:
+**Format parsers.** `x509`, `crl`, `csr`, `pkcs8`, `cms`, `ocsp`, `tsp`, and `attrcert` are siblings:
 each is a schema declaration composed from the shared pieces, emitting its own
 typed `domain/reason` error codes. `pki.schema.parse` inspects a decoded root and
 detect-and-routes to the matching sibling; the detectors are mutually exclusive by

package/lib/asn1-der.js

@@ -318,6 +318,18 @@ function readEnumerated(node) {
   return _readIntegerLikeContent(node, "ENUMERATED", "readEnumerated");
 }
 
+// Read a [tag] IMPLICIT INTEGER — a context-class PRIMITIVE node whose content is an
+// integer body (the IMPLICIT tag replaces the universal INTEGER tag). Same minimal
+// two's-complement content rules as a universal INTEGER. The integer counterpart of
+// readBitStringImplicit, for the RFC 3161 Accuracy millis [0] / micros [1] fields.
+function readIntegerImplicit(node, tag) {
+  if (node.tagClass !== "context" || node.tagNumber !== tag) {
+    throw new Asn1Error("asn1/unexpected-tag", "readIntegerImplicit: expected context tag [" + tag +
+      "], got " + node.tagClass + "/" + node.tagNumber);
+  }
+  return _readIntegerLikeContent(node, "INTEGER", "readIntegerImplicit");
+}
+
 // The BIT STRING content decoder (the leading unused-bit octet + body, with the
 // DER zero-pad rule). Shared by the universal reader and the IMPLICIT
 // context-tagged reader — the caller asserts the tag first.
@@ -533,8 +545,17 @@ function _decodeUtf32be(buf) {
 
 var UTC_RE = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/;
 var GEN_RE = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/;
-
-function readTime(node) {
+// The X.690 §11.7 DER fractional-seconds GeneralizedTime profile: seconds present,
+// a `.` decimal separator (never `,`), a non-empty fraction, Z-terminated. The
+// trailing-zeros rule (§11.7.3) is enforced separately. Used by RFC 3161 genTime.
+var GEN_FRAC_RE = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})\.(\d+)Z$/;
+
+// readTime(node, opts?) — opts.allowFractional enables the RFC 3161 / X.690 §11.7
+// fractional-seconds GeneralizedTime profile. Fractional is OFF by default because
+// most profiles (RFC 5280 certificate/CRL Validity, §4.1.2.5.2) require the integer-
+// second YYYYMMDDHHMMSSZ form and MUST NOT include a fraction; only callers that
+// permit sub-second precision (TSP genTime) pass allowFractional.
+function readTime(node, opts) {
   if (node.tagClass !== "universal") throw new Asn1Error("asn1/expected-time", "readTime: not a universal time type");
   _expectPrimitive(node, "readTime");
   var s = node.content.toString("latin1");
@@ -547,7 +568,19 @@ function readTime(node) {
     year += (year < 50) ? 2000 : 1900;
   } else if (node.tagNumber === TAGS.GENERALIZED_TIME) {
     m = GEN_RE.exec(s);
-    if (!m) throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime must be YYYYMMDDHHMMSSZ, got " + JSON.stringify(s));
+    if (!m) {
+      if (!(opts && opts.allowFractional)) throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime must be YYYYMMDDHHMMSSZ, got " + JSON.stringify(s));
+      m = GEN_FRAC_RE.exec(s);
+      if (!m) throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime must be YYYYMMDDHHMMSS[.fraction]Z, got " + JSON.stringify(s));
+      // X.690 §11.7.3 — the fractional part MUST NOT end in a zero (and is non-empty
+      // by the regex). ".5Z" is valid; ".50Z" and ".500Z" are non-canonical. X.690
+      // §11.7 places NO cap on the fraction length (RFC 3161 §2.4.2 gives the 5-digit
+      // example 19990609001326.34352Z), so a fraction of any length is accepted; the
+      // returned Date is millisecond-precision, and a caller needing the exact fraction
+      // reads it from node.content (the raw bytes, surfaced losslessly like the OID /
+      // serial paths).
+      if (m[7].charAt(m[7].length - 1) === "0") throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime fraction must not have trailing zeros, got " + JSON.stringify(s));
+    }
     year = parseInt(m[1], 10);
   } else {
     throw new Asn1Error("asn1/expected-time", "readTime: tag " + node.tagNumber + " is not a time type");
@@ -562,9 +595,12 @@ function readTime(node) {
   // GeneralizedTime year below 100 (0099 -> 1999). setUTCFullYear(year, ...)
   // takes the year literally and uses that year's own calendar, so years
   // below 100 and proleptic leap years are handled correctly.
+  // A fractional GeneralizedTime carries sub-second precision; surface it on the
+  // Date at millisecond resolution (the first three fraction digits, zero-padded).
+  var ms = (node.tagNumber === TAGS.GENERALIZED_TIME && m[7]) ? parseInt((m[7] + "000").slice(0, 3), 10) : 0;
   var d = new Date(0);
   d.setUTCFullYear(year, month - 1, day);
-  d.setUTCHours(hour, min, sec, 0);
+  d.setUTCHours(hour, min, sec, ms);
   if (isNaN(d.getTime())) throw new Asn1Error("asn1/bad-time", "unparseable time " + JSON.stringify(s));
   // Date/setUTC* silently roll over out-of-range fields (Feb 30 -> Mar 2,
   // month 13 -> next Jan, hour 25 -> +1 day). Reject unless every component
@@ -818,6 +854,7 @@ module.exports = {
   read: {
     boolean:      readBoolean,
     integer:      readInteger,
+    integerImplicit: readIntegerImplicit,
     enumerated:   readEnumerated,
     bitString:    readBitString,
     bitStringImplicit: readBitStringImplicit,

package/lib/framework-error.js

@@ -145,6 +145,16 @@ var CmsError = defineClass("CmsError", { withCause: true });
 // (OCSPRequest / OCSPResponse — RFC 6960 §4). Carries the leaf fault as `.cause`.
 var OcspError = defineClass("OcspError", { withCause: true });
 
+// TspError — a byte sequence that is not a well-formed RFC 3161 timestamp token,
+// TSTInfo, or TimeStampResp. Carries the underlying leaf fault as `.cause`.
+var TspError = defineClass("TspError", { withCause: true });
+
+// AttrCertError — a byte sequence that is not a well-formed X.509 Attribute
+// Certificate (AttributeCertificate / AttributeCertificateInfo — RFC 5755 §4),
+// or a recognized-and-deferred legacy AttributeCertificateV1. Carries the
+// underlying leaf fault as `.cause`.
+var AttrCertError = defineClass("AttrCertError", { withCause: true });
+
 module.exports = {
   PkiError:         PkiError,
   defineClass:      defineClass,
@@ -159,4 +169,6 @@ module.exports = {
   Pkcs8Error:       Pkcs8Error,
   CmsError:         CmsError,
   OcspError:        OcspError,
+  TspError:         TspError,
+  AttrCertError:    AttrCertError,
 };

package/lib/oid.js

@@ -49,7 +49,9 @@ var FAMILIES = {
   attributeType: { base: [2, 5, 4], of: {
     commonName: 3, surname: 4, serialNumber: 5, countryName: 6,
     localityName: 7, stateOrProvinceName: 8, streetAddress: 9,
-    organizationName: 10, organizationalUnitName: 11, title: 12, givenName: 42 } },
+    organizationName: 10, organizationalUnitName: 11, title: 12, givenName: 42,
+    // RFC 5755 §4.4 attribute-certificate attribute types.
+    clearance: 55, role: 72 } },
 
   // RFC 5280 certificate extensions.
   certExtension: { base: [2, 5, 29], of: {
@@ -60,10 +62,28 @@ var FAMILIES = {
     issuingDistributionPoint: 28, certificateIssuer: 29,
     nameConstraints: 30, cRLDistributionPoints: 31,
     certificatePolicies: 32, authorityKeyIdentifier: 35, extKeyUsage: 37,
-    freshestCRL: 46 } },
-
-  // PKIX private extensions (authorityInfoAccess et al).
-  pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: { authorityInfoAccess: 1 } },
+    freshestCRL: 46,
+    // RFC 5755 attribute-certificate extensions (§4.3.2, §4.3.6).
+    targetInformation: 55, noRevAvail: 56 } },
+
+  // PKIX private extensions on the id-pe arc (authorityInfoAccess et al, plus the
+  // RFC 5755 attribute-certificate id-pe extensions: ac-auditIdentity §4.3.1,
+  // aaControls §7.4, ac-proxying §7.2).
+  pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
+    authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10 } },
+
+  // id-aca — RFC 5755 attribute-certificate attribute types on the id-pkix 10 arc:
+  // authenticationInfo §4.4.1 .. group §4.4.4, plus encAttrs §7.1 (the encrypted-
+  // attribute wrapper, syntax ContentInfo). { id-aca 5 } is reserved.
+  idAca: { base: [1, 3, 6, 1, 5, 5, 7, 10], of: {
+    authenticationInfo: 1, accessIdentity: 2, chargingIdentity: 3, group: 4, encAttrs: 6 } },
+
+  // The legacy RFC 3281 id-at-clearance on the X.501 selected-attribute-types arc.
+  // RFC 5755 §4.4.6 says implementations MUST NOT OUTPUT this form but SHOULD ACCEPT
+  // it for decoding, so it is registered as an alias of "clearance". The canonical
+  // name -> OID reverse stays the RFC 5755 attributeType-arc 2.5.4.55 (registered
+  // first under attributeType, so it wins the reverse mapping).
+  selectedAttrType: { base: [2, 5, 1, 5], of: { clearance: 55 } },
 
   // PKIX Access Descriptor methods (id-ad, RFC 5280 §4.2.2.1/§4.2.2.2). id-ad-ocsp
   // is the arc the OCSP responder OIDs hang under; id-ad-caIssuers names the AIA
@@ -79,6 +99,11 @@ var FAMILIES = {
     ocspBasic: 1, ocspNonce: 2, ocspCrl: 3, ocspResponse: 4, ocspNoCheck: 5,
     ocspArchiveCutoff: 6, ocspServiceLocator: 7, ocspPrefSigAlgs: 8, ocspExtendedRevoke: 9 } },
 
+  // PKIX extended key purposes (id-kp, RFC 5280 §4.2.1.12). timeStamping is required
+  // — critical and sole — on an RFC 3161 TSA signing certificate (§2.3).
+  pkixKp: { base: [1, 3, 6, 1, 5, 5, 7, 3], of: {
+    serverAuth: 1, clientAuth: 2, codeSigning: 3, emailProtection: 4, timeStamping: 8, ocspSigning: 9 } },
+
   // PKCS#1 RSA public-key + RSASSA signature algorithms.
   rsa: { base: [1, 2, 840, 113549, 1, 1], of: {
     rsaEncryption: 1, rsassaPss: 10, sha256WithRSAEncryption: 11,
@@ -98,6 +123,12 @@ var FAMILIES = {
   // S/MIME content types on the PKCS#9 smime arc (RFC 5652, RFC 3161): id-ct.
   smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4 } },
 
+  // S/MIME authenticated attributes (id-aa, RFC 2634 / RFC 5035 / RFC 5816). The ESS
+  // signing-certificate attributes bind a CMS / TSP SignerInfo to its signing cert;
+  // signingCertificateV2 (ESSCertIDv2) carries a non-SHA-1 cert hash (RFC 5816 §2.2.1).
+  smimeAa: { base: [1, 2, 840, 113549, 1, 9, 16, 2], of: {
+    signingCertificate: 12, timeStampToken: 14, signingCertificateV2: 47 } },
+
   // ANSI X9.62 EC public key, named curve, and ECDSA signatures.
   ansiX962: { base: [1, 2, 840, 10045], of: {
     ecPublicKey: [2, 1], prime256v1: [3, 1, 7],

package/lib/schema-all.js

@@ -38,6 +38,8 @@ var csr = require("./schema-csr");
 var pkcs8 = require("./schema-pkcs8");
 var cms = require("./schema-cms");
 var ocsp = require("./schema-ocsp");
+var tsp = require("./schema-tsp");
+var attrcert = require("./schema-attrcert");
 var frameworkError = require("./framework-error");
 
 var SchemaError = frameworkError.SchemaError;
@@ -66,12 +68,27 @@ var FORMATS = [
     detect: cms.matches,
     parse: function (input) { return cms.parse(input); },
   },
+  {
+    // TimeStampResp ::= SEQUENCE { status PKIStatusInfo, timeStampToken OPTIONAL } —
+    // a SEQUENCE of 1-2 whose first child is a PKIStatusInfo SEQUENCE whose own first
+    // child is an INTEGER status. This detector is a strict REFINEMENT of the
+    // ocsp-request one (both are SEQUENCE-of-1-2 with a SEQUENCE first child), so it
+    // MUST be checked first: a tokenless TimeStampResp (a bare PKIStatusInfo) would
+    // otherwise be shadowed by ocsp-request, whereas an OCSPRequest's tbsRequest never
+    // leads with a universal INTEGER and so never matches here (RFC 3161 §2.4.2). A
+    // bare timestamp token is a CMS ContentInfo and routes to cms; a bare TSTInfo is
+    // an internal payload (reached via pki.schema.tsp.parseTstInfo).
+    name: "tsp",
+    module: tsp,
+    detect: tsp.matches,
+    parse: function (input) { return tsp.parse(input); },
+  },
   {
     // OCSPRequest ::= SEQUENCE { tbsRequest SEQUENCE, optionalSignature [0] EXPLICIT
     // OPTIONAL } — a SEQUENCE of 1-2 whose first child is the tbsRequest SEQUENCE.
     // Leads with a SEQUENCE like the signed-envelope trio, but is excluded by arity
-    // (the trio is EXACTLY 3 children; an OCSPRequest is 1-2), so it detects
-    // unambiguously regardless of registry order (RFC 6960 §4.1.1).
+    // (the trio is EXACTLY 3 children; an OCSPRequest is 1-2). Checked AFTER tsp,
+    // whose detector is a strict refinement (RFC 6960 §4.1.1).
     name: "ocsp-request",
     module: ocsp,
     detect: ocsp.matchesRequest,
@@ -110,6 +127,27 @@ var FORMATS = [
     detect: csr.matches,
     parse: function (input) { return csr.parse(input); },
   },
+  {
+    // AttributeCertificate ::= SEQUENCE { acinfo, signatureAlgorithm, signatureValue }
+    // — the signed-envelope trio, distinguished from a certificate / CRL by an acinfo
+    // that LEADS WITH a bare INTEGER version and carries a 2-GeneralizedTime validity
+    // at children[5]. Registered ahead of crl / x509 (most-specific-first): a legacy v1
+    // AC would otherwise satisfy x509.matches's Validity probe (RFC 5755 §4.1).
+    name: "attrcert",
+    module: attrcert,
+    detect: attrcert.matches,
+    parse: function (input) { return attrcert.parse(input); },
+  },
+  {
+    // AttributeCertificateV1 (X.509-1997, RFC 5652 §10.2) — the obsolete predecessor
+    // whose acInfo LEADS WITH the subject CHOICE (context [0]/[1]). Recognized and
+    // deferred with a precise attrcert/legacy-v1-not-supported rather than routed to a
+    // wrong format. children[1] == SEQUENCE keeps it disjoint from a v3 certificate.
+    name: "attrcert-v1",
+    module: attrcert,
+    detect: attrcert.matchesV1,
+    parse: function (input) { return attrcert.parseV1(input); },
+  },
   {
     // CertificateList ::= SEQUENCE { tbsCertList, signatureAlgorithm,
     // signatureValue } — the same outer shape as a certificate, distinguished
@@ -141,7 +179,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // → ["cms", "ocsp-request", "ocsp-response", "pkcs8", "csr", "crl", "x509"]
+ *   pki.schema.all();  // → ["cms", "tsp", "ocsp-request", "ocsp-response", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -185,6 +223,8 @@ module.exports = {
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode },
+  tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode },
+  attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode },
   all: all,
   parse: parse,
 };