@blamejs/pki 0.1.13 → 0.1.14

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.14 — 2026-07-06
+
+An RFC 5755 attribute-certificate parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.attrcert — an RFC 5755 attribute-certificate parser. pki.schema.attrcert.parse turns a DER Buffer or PEM into a structured v2 attribute certificate ({ version, holder, issuer, signatureAlgorithm, serialNumber, serialNumberHex, validity, attributes, issuerUniqueID, extensions, tbsBytes, signatureValue }). The holder (baseCertificateID / entityName / objectDigestInfo) and issuer (v1Form / v2Form) identities come back as validated GeneralNames; the validity window is real Dates; the privilege attributes (id-at-role, id-aca-group, id-at-clearance, and any others) resolve by name where the registry knows them. The outer-equals-inner signatureAlgorithm agreement (RFC 5755 4.2.4), the positive-and-at-most-20-octet serialNumber (4.2.5), the GeneralizedTime-only validity (4.2.6), the non-empty unique-typed attribute list (4.2.7), and the digestedObjectType enumeration are all enforced fail-closed. pki.schema.parse detect-and-routes an attribute certificate; the obsolete v1 form is recognized and deferred with a precise attrcert/legacy-v1-not-supported.
+- pki.schema.pkix gains a shared GeneralNames validator that the attribute-certificate parser composes for its four GeneralNames-bearing fields — validating every element as a well-formed GeneralName (rejecting a bad tag, a wrong primitive/constructed form, a non-IA5 string, or a mis-sized iPAddress) rather than surfacing the sequence as opaque bytes. It handles both a bare universal SEQUENCE OF GeneralName and a context-tagged IMPLICIT GeneralNames.
+- The OID registry gains the RFC 5755 attribute-certificate object identifiers: the id-aca attribute-type family (authenticationInfo / accessIdentity / chargingIdentity / group), id-at-role and id-at-clearance, the id-ce-targetInformation and id-ce-noRevAvail extensions, and the id-pe-ac-auditIdentity / id-pe-aaControls / id-pe-ac-proxying private extensions — so a parsed attribute certificate's attributes and extensions resolve by name.
+
 ## v0.1.13 — 2026-07-05
 
 An RFC 3161 timestamp parser joins the pki.schema family.

package/README.md

@@ -198,6 +198,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.cms` | Parse DER / PEM CMS SignedData per RFC 5652 — encapsulated content, signer infos, raw signed-attribute bytes for external verification, certificates / CRLs kept raw, fail-closed; non-SignedData content types recognized (not decoded) — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode` |
 | `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp responses and tokens — the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseTstInfo`, `parseToken`, `pemDecode` |
+| `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` plus the schema combinators |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError`, each carrying a stable `code` in `domain/reason` form |
@@ -238,9 +239,12 @@ plus a documentation comment block, not new parse logic.
 │  pki.schema.parse — inspect the DER root, route to the matching sibling │
 └─────────────────────────────────────────────────────────────────────────┘
                                      │
- ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐   Format
- │ x509 │ │ crl  │ │ csr  │ │pkcs8 │ │ cms  │ │ ocsp │ │ tsp  │   parsers
- └──────┘ └──────┘ └──────┘ └──────┘ └──────┘ └──────┘ └──────┘   (siblings)
+ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐   Format
+ │  x509  │ │  crl   │ │  csr   │ │ pkcs8  │   parsers
+ └────────┘ └────────┘ └────────┘ └────────┘   (siblings)
+ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐
+ │  cms   │ │  ocsp  │ │  tsp   │ │attrcert│
+ └────────┘ └────────┘ └────────┘ └────────┘
                                      │  every sibling composes ↓
 ┌─ Shared structure ──────────────────────────────────────────────────────┐
 │  pki.schema.engine — walk + combinators (positional reads, tag order,   │
@@ -272,7 +276,7 @@ bounded version reader, and the single coerce → decode → walk parse-entry th
 every format's `parse` is bound to. Because input coercion, the PEM size cap, and
 the DER-decode wrapping live here once, a format cannot diverge on a guard.
 
-**Format parsers.** `x509`, `crl`, `csr`, `pkcs8`, `cms`, `ocsp`, and `tsp` are siblings:
+**Format parsers.** `x509`, `crl`, `csr`, `pkcs8`, `cms`, `ocsp`, `tsp`, and `attrcert` are siblings:
 each is a schema declaration composed from the shared pieces, emitting its own
 typed `domain/reason` error codes. `pki.schema.parse` inspects a decoded root and
 detect-and-routes to the matching sibling; the detectors are mutually exclusive by

package/lib/framework-error.js

@@ -149,6 +149,12 @@ var OcspError = defineClass("OcspError", { withCause: true });
 // TSTInfo, or TimeStampResp. Carries the underlying leaf fault as `.cause`.
 var TspError = defineClass("TspError", { withCause: true });
 
+// AttrCertError — a byte sequence that is not a well-formed X.509 Attribute
+// Certificate (AttributeCertificate / AttributeCertificateInfo — RFC 5755 §4),
+// or a recognized-and-deferred legacy AttributeCertificateV1. Carries the
+// underlying leaf fault as `.cause`.
+var AttrCertError = defineClass("AttrCertError", { withCause: true });
+
 module.exports = {
   PkiError:         PkiError,
   defineClass:      defineClass,
@@ -164,4 +170,5 @@ module.exports = {
   CmsError:         CmsError,
   OcspError:        OcspError,
   TspError:         TspError,
+  AttrCertError:    AttrCertError,
 };

package/lib/oid.js

@@ -49,7 +49,9 @@ var FAMILIES = {
   attributeType: { base: [2, 5, 4], of: {
     commonName: 3, surname: 4, serialNumber: 5, countryName: 6,
     localityName: 7, stateOrProvinceName: 8, streetAddress: 9,
-    organizationName: 10, organizationalUnitName: 11, title: 12, givenName: 42 } },
+    organizationName: 10, organizationalUnitName: 11, title: 12, givenName: 42,
+    // RFC 5755 §4.4 attribute-certificate attribute types.
+    clearance: 55, role: 72 } },
 
   // RFC 5280 certificate extensions.
   certExtension: { base: [2, 5, 29], of: {
@@ -60,10 +62,28 @@ var FAMILIES = {
     issuingDistributionPoint: 28, certificateIssuer: 29,
     nameConstraints: 30, cRLDistributionPoints: 31,
     certificatePolicies: 32, authorityKeyIdentifier: 35, extKeyUsage: 37,
-    freshestCRL: 46 } },
-
-  // PKIX private extensions (authorityInfoAccess et al).
-  pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: { authorityInfoAccess: 1 } },
+    freshestCRL: 46,
+    // RFC 5755 attribute-certificate extensions (§4.3.2, §4.3.6).
+    targetInformation: 55, noRevAvail: 56 } },
+
+  // PKIX private extensions on the id-pe arc (authorityInfoAccess et al, plus the
+  // RFC 5755 attribute-certificate id-pe extensions: ac-auditIdentity §4.3.1,
+  // aaControls §7.4, ac-proxying §7.2).
+  pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
+    authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10 } },
+
+  // id-aca — RFC 5755 attribute-certificate attribute types on the id-pkix 10 arc:
+  // authenticationInfo §4.4.1 .. group §4.4.4, plus encAttrs §7.1 (the encrypted-
+  // attribute wrapper, syntax ContentInfo). { id-aca 5 } is reserved.
+  idAca: { base: [1, 3, 6, 1, 5, 5, 7, 10], of: {
+    authenticationInfo: 1, accessIdentity: 2, chargingIdentity: 3, group: 4, encAttrs: 6 } },
+
+  // The legacy RFC 3281 id-at-clearance on the X.501 selected-attribute-types arc.
+  // RFC 5755 §4.4.6 says implementations MUST NOT OUTPUT this form but SHOULD ACCEPT
+  // it for decoding, so it is registered as an alias of "clearance". The canonical
+  // name -> OID reverse stays the RFC 5755 attributeType-arc 2.5.4.55 (registered
+  // first under attributeType, so it wins the reverse mapping).
+  selectedAttrType: { base: [2, 5, 1, 5], of: { clearance: 55 } },
 
   // PKIX Access Descriptor methods (id-ad, RFC 5280 §4.2.2.1/§4.2.2.2). id-ad-ocsp
   // is the arc the OCSP responder OIDs hang under; id-ad-caIssuers names the AIA

package/lib/schema-all.js

@@ -39,6 +39,7 @@ var pkcs8 = require("./schema-pkcs8");
 var cms = require("./schema-cms");
 var ocsp = require("./schema-ocsp");
 var tsp = require("./schema-tsp");
+var attrcert = require("./schema-attrcert");
 var frameworkError = require("./framework-error");
 
 var SchemaError = frameworkError.SchemaError;
@@ -126,6 +127,27 @@ var FORMATS = [
     detect: csr.matches,
     parse: function (input) { return csr.parse(input); },
   },
+  {
+    // AttributeCertificate ::= SEQUENCE { acinfo, signatureAlgorithm, signatureValue }
+    // — the signed-envelope trio, distinguished from a certificate / CRL by an acinfo
+    // that LEADS WITH a bare INTEGER version and carries a 2-GeneralizedTime validity
+    // at children[5]. Registered ahead of crl / x509 (most-specific-first): a legacy v1
+    // AC would otherwise satisfy x509.matches's Validity probe (RFC 5755 §4.1).
+    name: "attrcert",
+    module: attrcert,
+    detect: attrcert.matches,
+    parse: function (input) { return attrcert.parse(input); },
+  },
+  {
+    // AttributeCertificateV1 (X.509-1997, RFC 5652 §10.2) — the obsolete predecessor
+    // whose acInfo LEADS WITH the subject CHOICE (context [0]/[1]). Recognized and
+    // deferred with a precise attrcert/legacy-v1-not-supported rather than routed to a
+    // wrong format. children[1] == SEQUENCE keeps it disjoint from a v3 certificate.
+    name: "attrcert-v1",
+    module: attrcert,
+    detect: attrcert.matchesV1,
+    parse: function (input) { return attrcert.parseV1(input); },
+  },
   {
     // CertificateList ::= SEQUENCE { tbsCertList, signatureAlgorithm,
     // signatureValue } — the same outer shape as a certificate, distinguished
@@ -157,7 +179,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // → ["cms", "tsp", "ocsp-request", "ocsp-response", "pkcs8", "csr", "crl", "x509"]
+ *   pki.schema.all();  // → ["cms", "tsp", "ocsp-request", "ocsp-response", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -202,6 +224,7 @@ module.exports = {
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode },
   tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode },
+  attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode },
   all: all,
   parse: parse,
 };

package/lib/schema-attrcert.js

@@ -0,0 +1,383 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.schema.attrcert
+ * @nav        Schema
+ * @title      Attribute Cert
+ * @order      175
+ * @slug       attrcert
+ *
+ * @intro
+ *   X.509 Attribute Certificate handling per RFC 5755. An attribute certificate
+ *   binds a holder to a set of privilege attributes (role, group, clearance)
+ *   without carrying a public key — the authorization counterpart to an identity
+ *   certificate. `parse` decodes a v2 `AttributeCertificate` into its holder,
+ *   issuer, validity window (real `Date`s), attributes, and extensions, reusing
+ *   the shared signed-envelope so the raw `tbsBytes` (the exact signed region) and
+ *   the `signatureValue` are surfaced for a downstream verifier.
+ *
+ *   The holder and issuer identities are `GeneralName`s, validated on the way in
+ *   (each alternative's form and content per RFC 5280 §4.2.1.6) and surfaced with
+ *   their raw bytes; the profile MUSTs above structural scope (a single
+ *   non-empty `directoryName` issuer, the holder-to-PKC binding, targeting and
+ *   revocation) are verification-layer concerns. The obsolete X.509-1997
+ *   `AttributeCertificateV1` is recognized and deferred, not parsed. DER-only,
+ *   fail-closed.
+ *
+ * @card
+ *   Parse DER / PEM RFC 5755 attribute certificates into holder, issuer,
+ *   validity, attributes, and extensions — validated GeneralNames, raw verifier
+ *   inputs, legacy v1 recognize-and-defer, fail-closed.
+ */
+
+var asn1 = require("./asn1-der");
+var schema = require("./schema-engine");
+var pkix = require("./schema-pkix");
+var oid = require("./oid");
+var frameworkError = require("./framework-error");
+
+var AttrCertError = frameworkError.AttrCertError;
+var PemError = frameworkError.PemError;
+
+var NS = pkix.makeNS("attrcert", AttrCertError, oid);
+
+var TAGS = asn1.TAGS;
+
+var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
+var EXTENSIONS = pkix.extensions(NS);
+
+// AttCertVersion ::= INTEGER { v2(1) } — a bare, mandatory INTEGER (not the x509
+// [0] EXPLICIT DEFAULT shape). The only legal value is v2, surfaced as 2.
+var VERSION = pkix.versionReader(NS, { "1": 2 });
+
+// ---- shared leaves ---------------------------------------------------
+
+// AttCertValidityPeriod times are GeneralizedTime (RFC 5755 §4.2.6) — a UTCTime is
+// rejected. Non-fractional YYYYMMDDHHMMSSZ is enforced by the codec.
+var GENERALIZED_TIME = schema.decode(function (n, ctx) {
+  if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
+    throw ctx.E("attrcert/bad-time", "AttCertValidityPeriod times must be GeneralizedTime (RFC 5755 §4.2.6)");
+  }
+  return asn1.read.time(n);
+});
+
+// digestedObjectType ::= ENUMERATED { publicKey(0), publicKeyCert(1),
+// otherObjectTypes(2) } (RFC 5755 §4.1) — an undefined value is rejected; a
+// non-ENUMERATED tag fails at the codec (asn1/*).
+var ODT_NAMES = { "0": "publicKey", "1": "publicKeyCert", "2": "otherObjectTypes" };
+var DIGESTED_OBJECT_TYPE = schema.decode(function (n, ctx) {
+  var v = asn1.read.enumerated(n);
+  var k = v.toString();
+  if (!Object.prototype.hasOwnProperty.call(ODT_NAMES, k)) {
+    throw ctx.E("attrcert/bad-digested-object-type", "digestedObjectType " + k + " is not a defined value (RFC 5755 §4.1)");
+  }
+  // RFC 5755 §7.3 — a conformant AC MUST NOT use otherObjectTypes(2); the digested
+  // object is limited to a public key or a public-key certificate, so reject it
+  // fail-closed rather than parse a digest whose object type is unidentifiable.
+  if (k === "2") {
+    throw ctx.E("attrcert/bad-digested-object-type", "otherObjectTypes(2) MUST NOT be used (RFC 5755 §7.3)");
+  }
+  return { code: Number(v), name: ODT_NAMES[k] };
+});
+
+// ---- IssuerSerial / ObjectDigestInfo ---------------------------------
+
+// IssuerSerial ::= SEQUENCE { issuer GeneralNames, serial CertificateSerialNumber,
+// issuerUID UniqueIdentifier OPTIONAL } (RFC 5755 §4.1). Reached as an IMPLICIT
+// [n] node (Holder [0] / V2Form [0]) whose tag replaces the SEQUENCE tag, so the
+// shape assertion is "constructed" (the tag is pinned by the enclosing trailing);
+// a context [n] PRIMITIVE node has no children and fails closed here.
+var ISSUER_SERIAL = schema.seq([
+  schema.field("issuer", pkix.generalNames(NS, { code: "attrcert/bad-issuer-serial" })),
+  schema.field("serial", schema.integerLeaf()),
+  schema.optional("issuerUID", schema.bitString(), { whenUniversal: [TAGS.BIT_STRING] }),
+], {
+  assert: "constructed", code: "attrcert/bad-issuer-serial", what: "IssuerSerial",
+  build: function (m) {
+    return {
+      issuer: m.fields.issuer.value.result,
+      serial: m.fields.serial.value,
+      serialHex: m.fields.serial.node.content.toString("hex"),
+      issuerUID: m.fields.issuerUID.present ? m.fields.issuerUID.value : null,
+    };
+  },
+});
+
+// ObjectDigestInfo ::= SEQUENCE { digestedObjectType ENUMERATED, otherObjectTypeID
+// OBJECT IDENTIFIER OPTIONAL, digestAlgorithm AlgorithmIdentifier, objectDigest BIT
+// STRING } (RFC 5755 §4.1). otherObjectTypeID is present only for otherObjectTypes(2).
+var OBJECT_DIGEST_INFO = schema.seq([
+  schema.field("digestedObjectType", DIGESTED_OBJECT_TYPE),
+  schema.optional("otherObjectTypeID", schema.oidLeaf(), { whenUniversal: [TAGS.OBJECT_IDENTIFIER] }),
+  schema.field("digestAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("objectDigest", schema.bitString()),
+], {
+  assert: "constructed", code: "attrcert/bad-object-digest-info", what: "ObjectDigestInfo",
+  build: function (m, ctx) {
+    var t = m.fields.digestedObjectType.value;
+    // otherObjectTypeID identifies a non-certificate object type, meaningful only with
+    // otherObjectTypes(2) — which RFC 5755 §7.3 forbids (rejected at the leaf above) —
+    // so a present otherObjectTypeID is never valid here and is rejected fail-closed.
+    if (m.fields.otherObjectTypeID.present) {
+      throw ctx.E("attrcert/bad-object-digest-info", "otherObjectTypeID is only valid with otherObjectTypes(2), which RFC 5755 §7.3 forbids");
+    }
+    return {
+      digestedObjectType: t,
+      otherObjectTypeID: null,
+      digestAlgorithm: m.fields.digestAlgorithm.value.result,
+      objectDigest: m.fields.objectDigest.value,
+    };
+  },
+});
+
+// ---- Holder / AttCertIssuer / V2Form ---------------------------------
+
+// Holder ::= SEQUENCE { baseCertificateID [0] IMPLICIT IssuerSerial OPTIONAL,
+// entityName [1] IMPLICIT GeneralNames OPTIONAL, objectDigestInfo [2] IMPLICIT
+// ObjectDigestInfo OPTIONAL } (RFC 5755 §4.1). All three are IMPLICIT + OPTIONAL;
+// the profile RECOMMENDS exactly one, but the parser surfaces all three (null when
+// absent) and does not enforce the cardinality.
+var HOLDER = schema.seq([
+  schema.trailing([
+    { tag: 0, name: "baseCertificateID", schema: ISSUER_SERIAL },
+    { tag: 1, name: "entityName", schema: pkix.generalNames(NS, { implicitTag: 1, code: "attrcert/bad-entity-name" }) },
+    { tag: 2, name: "objectDigestInfo", schema: OBJECT_DIGEST_INFO },
+  ], { minTag: 0, maxTag: 2, unexpectedCode: "attrcert/bad-holder", orderCode: "attrcert/bad-holder" }),
+], {
+  assert: "sequence", code: "attrcert/bad-holder", what: "Holder",
+  build: function (m) {
+    return {
+      baseCertificateID: m.fields.baseCertificateID.present ? m.fields.baseCertificateID.value.result : null,
+      entityName: m.fields.entityName.present ? m.fields.entityName.value.result : null,
+      objectDigestInfo: m.fields.objectDigestInfo.present ? m.fields.objectDigestInfo.value.result : null,
+    };
+  },
+});
+
+// V2Form ::= SEQUENCE { issuerName GeneralNames OPTIONAL, baseCertificateID [0]
+// IMPLICIT IssuerSerial OPTIONAL, objectDigestInfo [1] IMPLICIT ObjectDigestInfo
+// OPTIONAL } (RFC 5755 §4.1). Reached via the AttCertIssuer CHOICE on a context [0]
+// node, so the shape is "constructed".
+var V2_FORM = schema.seq([
+  schema.optional("issuerName", pkix.generalNames(NS, { code: "attrcert/bad-issuer-name" }), { whenUniversal: [TAGS.SEQUENCE] }),
+  schema.trailing([
+    { tag: 0, name: "baseCertificateID", schema: ISSUER_SERIAL },
+    { tag: 1, name: "objectDigestInfo", schema: OBJECT_DIGEST_INFO },
+  ], { minTag: 0, maxTag: 1, unexpectedCode: "attrcert/bad-v2form", orderCode: "attrcert/bad-v2form" }),
+], {
+  assert: "constructed", code: "attrcert/bad-v2form", what: "V2Form",
+  build: function (m) {
+    return {
+      issuerName: m.fields.issuerName.present ? m.fields.issuerName.value.result : null,
+      baseCertificateID: m.fields.baseCertificateID.present ? m.fields.baseCertificateID.value.result : null,
+      objectDigestInfo: m.fields.objectDigestInfo.present ? m.fields.objectDigestInfo.value.result : null,
+    };
+  },
+});
+
+// AttCertIssuer ::= CHOICE { v1Form GeneralNames, v2Form [0] IMPLICIT V2Form } (RFC
+// 5755 §4.1). A universal SEQUENCE is the (obsolete but structurally legal) v1Form;
+// a context [0] is v2Form. A conforming AC uses v2Form; the parser surfaces which.
+var ATT_CERT_ISSUER = schema.choice([
+  { when: { tagClass: "universal", tagNumber: TAGS.SEQUENCE }, schema: pkix.generalNames(NS, { code: "attrcert/bad-issuer" }) },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: V2_FORM },
+], { code: "attrcert/bad-issuer" });
+
+// ---- validity + attributes -------------------------------------------
+
+// AttCertValidityPeriod ::= SEQUENCE { notBeforeTime GeneralizedTime, notAfterTime
+// GeneralizedTime } (RFC 5755 §4.2.6).
+var VALIDITY = schema.seq([
+  schema.field("notBeforeTime", GENERALIZED_TIME),
+  schema.field("notAfterTime", GENERALIZED_TIME),
+], {
+  assert: "sequence", arity: { exact: 2 }, code: "attrcert/bad-validity", what: "AttCertValidityPeriod",
+  build: function (m) { return { notBeforeTime: m.fields.notBeforeTime.value, notAfterTime: m.fields.notAfterTime.value }; },
+});
+
+// attributes ::= SEQUENCE OF Attribute (RFC 5755 §4.2.7) — MUST be non-empty and
+// each AttributeType OID unique. Order-preserving (SEQUENCE OF, not SET OF).
+var ATTRIBUTES = schema.seqOf(pkix.attribute(NS), {
+  assert: "sequence", min: 1, code: "attrcert/bad-attributes", what: "attributes",
+  unique: function (it) { return it.value.result.type; }, dupCode: "attrcert/duplicate-attribute",
+  build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
+});
+
+// ---- AttributeCertificateInfo / AttributeCertificate -----------------
+
+// AttributeCertificateInfo ::= SEQUENCE { version, holder, issuer, signature
+// AlgorithmIdentifier, serialNumber, attrCertValidityPeriod, attributes,
+// issuerUniqueID OPTIONAL, extensions OPTIONAL } (RFC 5755 §4.1). The tbs body the
+// signed envelope wraps; the cross-field invariants live in the envelope build.
+var ACINFO = schema.seq([
+  schema.field("version", VERSION),
+  schema.field("holder", HOLDER),
+  schema.field("issuer", ATT_CERT_ISSUER),
+  schema.field("signature", ALGORITHM_IDENTIFIER),
+  schema.field("serialNumber", schema.integerLeaf()),
+  schema.field("attrCertValidityPeriod", VALIDITY),
+  schema.field("attributes", ATTRIBUTES),
+  schema.optional("issuerUniqueID", schema.bitString(), { whenUniversal: [TAGS.BIT_STRING] }),
+  schema.optional("extensions", EXTENSIONS, { whenUniversal: [TAGS.SEQUENCE] }),
+], { assert: "sequence", code: "attrcert/bad-acinfo", what: "AttributeCertificateInfo" });
+
+// AttributeCertificate ::= SEQUENCE { acinfo, signatureAlgorithm, signatureValue
+// BIT STRING } — the shared SIGNED envelope (RFC 5755 §4.1). The AC-specific
+// invariants (§4.2.4 sig-alg agreement, §4.2.5 positive-and-<=20-octet serialNumber)
+// run in the build; the envelope owns the SEQUENCE-of-3 shape + signature extraction.
+var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
+  code: "attrcert/not-an-attribute-certificate", what: "AttributeCertificate",
+  build: function (e, ctx) {
+    var acinfo = e.tbsMatch;
+
+    // RFC 5755 §4.2.4 — the outer signatureAlgorithm MUST equal acinfo.signature.
+    if (!e.outerSignatureAlgorithmBytes.equals(acinfo.fields.signature.node.bytes)) {
+      throw ctx.E("attrcert/bad-signature-algorithm", "signatureAlgorithm must match AttributeCertificateInfo.signature (RFC 5755 §4.2.4)");
+    }
+
+    // RFC 5755 §4.2.5 — serialNumber MUST be a positive INTEGER of at most 20 content
+    // octets. Positive excludes both a negative (DER sign bit set) and zero (a minimal
+    // INTEGER 0 is a single 0x00 octet — the codec already rejected any non-minimal
+    // zero). Surface it lossless (BigInt) + as hex.
+    var serialNode = acinfo.fields.serialNumber.node;
+    var sc = serialNode.content;
+    if (sc.length === 0 || (sc[0] & 0x80) !== 0 || (sc.length === 1 && sc[0] === 0)) {
+      throw ctx.E("attrcert/bad-serial-number", "serialNumber must be a positive INTEGER (RFC 5755 §4.2.5)");
+    }
+    if (sc.length > 20) {
+      throw ctx.E("attrcert/bad-serial-number", "serialNumber must not exceed 20 content octets (RFC 5755 §4.2.5)");
+    }
+
+    // AttCertIssuer is a CHOICE — the chosen arm is read off the issuer node's tag
+    // (a universal SEQUENCE is v1Form; a context [0] is v2Form).
+    var issuerNode = acinfo.fields.issuer.node;
+    var issuerVal = acinfo.fields.issuer.value;
+    var issuer = issuerNode.tagClass === "context"
+      ? { form: "v2Form", v2Form: issuerVal.result, v1Form: null }
+      : { form: "v1Form", v1Form: issuerVal.result, v2Form: null };
+
+    var extField = acinfo.fields.extensions;
+    return {
+      version:               acinfo.fields.version.value,     // 2
+      holder:                acinfo.fields.holder.value.result,
+      issuer:                issuer,
+      signatureAlgorithm:    e.signatureAlgorithm,
+      tbsSignatureAlgorithm: acinfo.fields.signature.value.result,
+      serialNumber:          acinfo.fields.serialNumber.value,
+      serialNumberHex:       sc.toString("hex"),
+      validity:              acinfo.fields.attrCertValidityPeriod.value.result,
+      attributes:            acinfo.fields.attributes.value.result,
+      issuerUniqueID:        acinfo.fields.issuerUniqueID.present ? acinfo.fields.issuerUniqueID.value : null,
+      extensions:            (extField && extField.present) ? extField.value.result : [],
+      tbsBytes:              e.tbsBytes,
+      signatureValue:        e.signatureValue,
+    };
+  },
+});
+
+// ---- parse -----------------------------------------------------------
+
+/**
+ * @primitive  pki.schema.attrcert.parse
+ * @signature  pki.schema.attrcert.parse(input) -> attributeCertificate
+ * @since      0.1.14
+ * @status     experimental
+ * @spec       RFC 5755, X.509
+ * @related    pki.schema.parse, pki.schema.x509.parse
+ *
+ * Parse a DER `Buffer` or a PEM string/Buffer into a structured v2 attribute
+ * certificate: `{ version, holder, issuer, signatureAlgorithm, serialNumber,
+ * serialNumberHex, validity, attributes, issuerUniqueID, extensions, tbsBytes,
+ * signatureValue }`. The holder / issuer identities come back as validated
+ * `GeneralName`s (each element `{ bytes, tagClass, tagNumber }`); the validity
+ * window is real `Date`s; `tbsBytes` is the exact signed byte range for a verifier.
+ *
+ * Throws `AttrCertError` when the bytes are not a well-formed attribute certificate
+ * (an obsolete `AttributeCertificateV1` throws `attrcert/legacy-v1-not-supported`)
+ * and `Asn1Error` when the underlying DER is malformed.
+ *
+ * @example
+ *   var ac = pki.schema.attrcert.parse(der);
+ *   ac.attributes[0].name;   // "role"
+ *   ac.validity.notAfterTime;// Date
+ */
+var PARSE_OPTS = { pemLabel: null, PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" };
+
+function _legacyV1Error() {
+  return new AttrCertError("attrcert/legacy-v1-not-supported", "AttributeCertificateV1 (X.509-1997) is obsolete and not parsed by this build (RFC 5755 §1)");
+}
+
+function parse(input) {
+  var root = pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
+  // A well-formed legacy AttributeCertificateV1 gets the advertised, stable
+  // attrcert/legacy-v1-not-supported on the DIRECT path too — not a low-level asn1/*
+  // tag error from attempting the v2 walk — so a direct caller of this entry sees the
+  // same error family for the recognized-but-deferred form as the orchestrator does.
+  if (matchesV1(root)) throw _legacyV1Error();
+  return schema.walk(ATTRIBUTE_CERTIFICATE, root, NS).result;
+}
+
+// The obsolete X.509-1997 AttributeCertificateV1 (RFC 5652 §10.2) is recognized and
+// deferred: decode the envelope (so a malformed input still fails as bad DER), then
+// throw the precise diagnostic rather than routing it to a wrong format.
+function parseV1(input) {
+  pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
+  throw _legacyV1Error();
+}
+
+/**
+ * @primitive  pki.schema.attrcert.pemDecode
+ * @signature  pki.schema.attrcert.pemDecode(text, label?) -> Buffer
+ * @since      0.1.14
+ * @status     experimental
+ * @spec       RFC 7468, RFC 5755
+ * @related    pki.schema.attrcert.parse
+ *
+ * Extract the DER bytes from a PEM block (OpenSSL emits
+ * `-----BEGIN ATTRIBUTE CERTIFICATE-----`; the first block is taken unless `label`
+ * is given). Throws `PemError` on a missing envelope or a non-base64 body.
+ *
+ * @example
+ *   var der = pki.schema.attrcert.pemDecode(pemText);
+ */
+function pemDecode(text, label) { return pkix.pemDecode(text, label || null, PemError); }
+
+// matches(root): a v2 AttributeCertificate is the signed-envelope trio whose acinfo
+// LEADS WITH a bare universal INTEGER version (== v2 = 1, NOT the x509 [0] EXPLICIT
+// wrapper) and whose attrCertValidityPeriod at children[5] is a SEQUENCE of exactly
+// two GeneralizedTime (RFC 5755 §4.2.6 forbids UTCTime) — a marker no cert / CRL /
+// CSR presents at that position. Disjoint from matchesV1 by the children[0] tag class.
+function matches(root) {
+  var acinfo = pkix.signedEnvelopeTbs(root);
+  if (!acinfo) return false;
+  var k = acinfo.children;
+  if (!k || k.length < 7) return false;
+  if (!(k[0].tagClass === "universal" && k[0].tagNumber === TAGS.INTEGER)) return false;
+  if (!(k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE && k[1].children)) return false;
+  var v = k[5];
+  if (!(v && v.tagClass === "universal" && v.tagNumber === TAGS.SEQUENCE && v.children && v.children.length === 2)) return false;
+  return v.children.every(function (t) { return t.tagClass === "universal" && t.tagNumber === TAGS.GENERALIZED_TIME; });
+}
+
+// matchesV1(root): the obsolete AttributeCertificateV1 — its acInfo (version DEFAULT
+// v1 OMITTED) LEADS WITH the subject CHOICE (a context [0]/[1]), and its children[1]
+// is the issuer GeneralNames (a universal SEQUENCE). The children[1] == SEQUENCE test
+// keeps it disjoint from a v3 certificate (whose [0] EXPLICIT version is followed by
+// an INTEGER serialNumber), so v1-vs-cert dispatch is order-independent.
+function matchesV1(root) {
+  var acinfo = pkix.signedEnvelopeTbs(root);
+  if (!acinfo) return false;
+  var k = acinfo.children;
+  if (!k || k.length < 6) return false;
+  if (!(k[0].tagClass === "context" && (k[0].tagNumber === 0 || k[0].tagNumber === 1) && k[0].children)) return false;
+  return !!k[1] && k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE;
+}
+
+module.exports = {
+  parse: parse,
+  parseV1: parseV1,
+  pemDecode: pemDecode,
+  matches: matches,
+  matchesV1: matchesV1,
+};

package/lib/schema-pkix.js

@@ -264,6 +264,26 @@ function generalName(ns, opts) {
   });
 }
 
+// GeneralNames ::= SEQUENCE OF GeneralName (RFC 5280 §4.2.1.6), SIZE (1..MAX). Every
+// element is validated by generalName (its CHOICE alternative's form + content) and
+// surfaced raw, so a caller carrying a GeneralNames field cannot accept a malformed
+// element by treating the whole sequence as opaque bytes. Returns { names: [{ bytes,
+// tagClass, tagNumber }], bytes } (the decoded element list + the raw outer DER).
+// `opts.implicitTag` handles a [tag] IMPLICIT GeneralNames — the context tag REPLACES
+// the universal SEQUENCE tag (RFC 5755 Holder.entityName [1]); otherwise it is a bare
+// universal SEQUENCE OF. `opts.code` is the caller's error code. Shared so the x509 /
+// attribute-certificate / (future) CRMF parsers validate a GeneralNames identically.
+function generalNames(ns, opts) {
+  opts = opts || {};
+  var code = opts.code || (ns.prefix + "/bad-general-names");
+  var gn = generalName(ns, { code: code });
+  function build(m) { return { names: m.items.map(function (it) { return it.value; }), bytes: m.node.bytes }; }
+  if (opts.implicitTag != null) {
+    return schema.implicitSeqOf(opts.implicitTag, gn, { min: 1, code: code, what: opts.what || "GeneralNames", build: build });
+  }
+  return schema.seqOf(gn, { assert: "sequence", min: 1, code: code, what: opts.what || "GeneralNames", build: build });
+}
+
 // Extension ::= SEQUENCE { extnID OID, critical BOOLEAN DEFAULT FALSE,
 // extnValue OCTET STRING }. `critical` is a universal BOOLEAN present-by-count
 // (not context-tagged), so the per-extension decode handles the 2-vs-3-child
@@ -419,6 +439,7 @@ module.exports = {
   relativeDistinguishedName: relativeDistinguishedName,
   name: name,
   generalName: generalName,
+  generalNames: generalNames,
   attribute: attribute,
   extension: extension,
   extensions: extensions,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f3d799b0-bde8-4f05-8577-e064f7a420f1",
+  "serialNumber": "urn:uuid:7865e3f3-f43e-4cdb-818f-8a8fe2cf2d7a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-06T00:04:32.672Z",
+    "timestamp": "2026-07-06T02:35:05.577Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.13",
+      "bom-ref": "@blamejs/pki@0.1.14",
       "type": "application",
       "name": "pki",
-      "version": "0.1.13",
+      "version": "0.1.14",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.13",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.14",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.13",
+      "ref": "@blamejs/pki@0.1.14",
       "dependsOn": []
     }
   ]