@blamejs/pki 0.1.13 → 0.1.15

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.15 — 2026-07-06
+
+CMS EnvelopedData and EncryptedData join the parser, and every documentation example is now executed as a test.
+
+### Added
+
+- pki.schema.cms.parse now decodes CMS EnvelopedData (RFC 5652 §6) and EncryptedData (§8). An EnvelopedData returns { version, originatorInfo, recipientInfos, encryptedContentInfo, unprotectedAttrs } with all five RecipientInfo kinds decoded — KeyTransRecipientInfo (§6.2.1, with the issuerAndSerialNumber/subjectKeyIdentifier version coupling enforced), KeyAgreeRecipientInfo (§6.2.2 + RFC 5753 §3.1), KEKRecipientInfo (§6.2.3), PasswordRecipientInfo (§6.2.4), and OtherRecipientInfo (§6.2.5). An EncryptedData returns { version, encryptedContentInfo, unprotectedAttrs }. The wrapped keys, the ciphertext, and all AlgorithmIdentifier parameters are surfaced raw — every recipient carries the keyEncryptionAlgorithm its encryptedKey must be unwrapped with, and a kekid / rKeyId OtherKeyAttribute is surfaced as raw DER — decryption and key-unwrap are a separate layer. The CMSVersion is recomputed and enforced per structure and per recipient, recipientInfos is required non-empty, and the encryptedContent [0] IMPLICIT OCTET STRING is read as the ciphertext directly.
+- The schema engine gains an implicitTag option on pki.schema.engine.seq() and on pki.schema.pkix.algorithmIdentifier(ns, { implicitTag }) — a [tag] IMPLICIT SEQUENCE / AlgorithmIdentifier reader (used by the PasswordRecipientInfo keyDerivationAlgorithm [0]). A call with no option is byte-identical to before.
+- Every @example in the documentation comment blocks is now executed end-to-end as a test (test/layer-0-primitives/doc-examples.test.js, in the smoke gate), not merely parse-checked: an example must run to completion or throw a typed PkiError, and every documented @primitive path must resolve to a real export — so a documented example can no longer drift from the shipped API. A new @originated comment tag records a callable's original availability version when its documented path is later corrected, enforced alongside the @since version gate.
+
+### Changed
+
+- The W3C WebCrypto constructor classes (CryptoKey, Crypto, SubtleCrypto, WebCryptoError) are now reachable under pki.webcrypto (e.g. pki.webcrypto.CryptoKey) alongside the ready Crypto instance, matching their documented path; the previously-separate pki.WebCrypto holder is removed.
+- Repository tooling now installs npm packages exclusively through integrity-verified lockfiles: the fuzz build installs the jazzer.js engine via npm ci against the committed fuzz/package-lock.json, and the vendoring script resolves a package to an integrity-pinned lockfile in an isolated staging workspace — no install script runs and the repo's own node_modules is never touched — before bundling. Tooling child processes that need a shell (the Windows npm shim) now receive one explicitly-quoted command string instead of an unescaped argument array.
+
+### Fixed
+
+- Two documented API paths that did not resolve at runtime are corrected: pki.webcrypto.CryptoKey (previously reachable only via pki.WebCrypto.CryptoKey) and pki.asn1.read.oid (its comment block labeled the path pki.asn1.readOid, which never existed). Both are now reachable at the documented path.
+- A documentation example for pki.webcrypto.subtle.exportKey referenced an undefined variable; it now generates the key pair it exports.
+
+## v0.1.14 — 2026-07-05
+
+An RFC 5755 attribute-certificate parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.attrcert — an RFC 5755 attribute-certificate parser. pki.schema.attrcert.parse turns a DER Buffer or PEM into a structured v2 attribute certificate ({ version, holder, issuer, signatureAlgorithm, serialNumber, serialNumberHex, validity, attributes, issuerUniqueID, extensions, tbsBytes, signatureValue }). The holder (baseCertificateID / entityName / objectDigestInfo) and issuer (v1Form / v2Form) identities come back as validated GeneralNames; the validity window is real Dates; the privilege attributes (id-at-role, id-aca-group, id-at-clearance, and any others) resolve by name where the registry knows them. The outer-equals-inner signatureAlgorithm agreement (RFC 5755 4.2.4), the positive-and-at-most-20-octet serialNumber (4.2.5), the GeneralizedTime-only validity (4.2.6), the non-empty unique-typed attribute list (4.2.7), and the digestedObjectType enumeration are all enforced fail-closed. pki.schema.parse detect-and-routes an attribute certificate; the obsolete v1 form is recognized and deferred with a precise attrcert/legacy-v1-not-supported.
+- pki.schema.pkix gains a shared GeneralNames validator that the attribute-certificate parser composes for its four GeneralNames-bearing fields — validating every element as a well-formed GeneralName (rejecting a bad tag, a wrong primitive/constructed form, a non-IA5 string, or a mis-sized iPAddress) rather than surfacing the sequence as opaque bytes. It handles both a bare universal SEQUENCE OF GeneralName and a context-tagged IMPLICIT GeneralNames.
+- The OID registry gains the RFC 5755 attribute-certificate object identifiers: the id-aca attribute-type family (authenticationInfo / accessIdentity / chargingIdentity / group), id-at-role and id-at-clearance, the id-ce-targetInformation and id-ce-noRevAvail extensions, and the id-pe-ac-auditIdentity / id-pe-aaControls / id-pe-ac-proxying private extensions — so a parsed attribute certificate's attributes and extensions resolve by name.
+
 ## v0.1.13 — 2026-07-05
 
 An RFC 3161 timestamp parser joins the pki.schema family.

package/README.md

@@ -195,9 +195,10 @@ is callable today; nothing below is a stub.
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
-| `pki.schema.cms` | Parse DER / PEM CMS SignedData per RFC 5652 — encapsulated content, signer infos, raw signed-attribute bytes for external verification, certificates / CRLs kept raw, fail-closed; non-SignedData content types recognized (not decoded) — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.cms` | Parse DER / PEM CMS per RFC 5652 — SignedData (§5, signer infos + raw signed-attribute bytes for external verification), EnvelopedData (§6, all five RecipientInfo kinds incl. RFC 5753 key-agreement, with the wrapped keys / ciphertext surfaced raw), and EncryptedData (§8); certificates / CRLs kept raw, fail-closed; remaining content types recognized (not decoded) — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode` |
 | `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp responses and tokens — the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseTstInfo`, `parseToken`, `pemDecode` |
+| `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` plus the schema combinators |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError`, each carrying a stable `code` in `domain/reason` form |
@@ -238,9 +239,12 @@ plus a documentation comment block, not new parse logic.
 │  pki.schema.parse — inspect the DER root, route to the matching sibling │
 └─────────────────────────────────────────────────────────────────────────┘
                                      │
- ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐   Format
- │ x509 │ │ crl  │ │ csr  │ │pkcs8 │ │ cms  │ │ ocsp │ │ tsp  │   parsers
- └──────┘ └──────┘ └──────┘ └──────┘ └──────┘ └──────┘ └──────┘   (siblings)
+ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐   Format
+ │  x509  │ │  crl   │ │  csr   │ │ pkcs8  │   parsers
+ └────────┘ └────────┘ └────────┘ └────────┘   (siblings)
+ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐
+ │  cms   │ │  ocsp  │ │  tsp   │ │attrcert│
+ └────────┘ └────────┘ └────────┘ └────────┘
                                      │  every sibling composes ↓
 ┌─ Shared structure ──────────────────────────────────────────────────────┐
 │  pki.schema.engine — walk + combinators (positional reads, tag order,   │
@@ -272,7 +276,7 @@ bounded version reader, and the single coerce → decode → walk parse-entry th
 every format's `parse` is bound to. Because input coercion, the PEM size cap, and
 the DER-decode wrapping live here once, a format cannot diverge on a guard.
 
-**Format parsers.** `x509`, `crl`, `csr`, `pkcs8`, `cms`, `ocsp`, and `tsp` are siblings:
+**Format parsers.** `x509`, `crl`, `csr`, `pkcs8`, `cms`, `ocsp`, `tsp`, and `attrcert` are siblings:
 each is a schema declaration composed from the shared pieces, emitting its own
 typed `domain/reason` error codes. `pki.schema.parse` inspects a decoded root and
 detect-and-routes to the matching sibling; the detectors are mutually exclusive by

package/index.js

@@ -42,13 +42,17 @@ module.exports = {
   // `schema` is the family: the L2 structure-schema engine (schema.engine) and
   // the per-format parsers (schema.x509, …) with detect-and-route schema.parse.
   schema:    schema,
-  // A ready W3C Crypto instance (globalThis.crypto shape) + the classes
-  // for constructing more. PQC-first, classical-capable, zero-dep.
-  webcrypto: webcrypto.webcrypto,
-  WebCrypto: {
-    Crypto:         webcrypto.Crypto,
-    SubtleCrypto:   webcrypto.SubtleCrypto,
-    CryptoKey:      webcrypto.CryptoKey,
-    WebCryptoError: webcrypto.WebCryptoError,
-  },
+  // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
+  // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
+  // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.
+  webcrypto: _webcryptoNamespace(),
 };
+
+function _webcryptoNamespace() {
+  var wc = webcrypto.webcrypto;                 // the ready Crypto instance
+  wc.Crypto = webcrypto.Crypto;
+  wc.SubtleCrypto = webcrypto.SubtleCrypto;
+  wc.CryptoKey = webcrypto.CryptoKey;
+  wc.WebCryptoError = webcrypto.WebCryptoError;
+  return wc;
+}

package/lib/asn1-der.js

@@ -408,9 +408,10 @@ function readNullImplicit(node, tag) {
 }
 
 /**
- * @primitive  pki.asn1.readOid
+ * @primitive  pki.asn1.read.oid
  * @signature  pki.asn1.read.oid(node) -> "1.2.840.113549.1.1.11"
- * @since      0.1.0
+ * @since      0.1.15
+ * @originated 0.1.0
  * @status     stable
  * @spec       X.690 §8.19
  * @related    pki.oid.name

package/lib/framework-error.js

@@ -149,6 +149,12 @@ var OcspError = defineClass("OcspError", { withCause: true });
 // TSTInfo, or TimeStampResp. Carries the underlying leaf fault as `.cause`.
 var TspError = defineClass("TspError", { withCause: true });
 
+// AttrCertError — a byte sequence that is not a well-formed X.509 Attribute
+// Certificate (AttributeCertificate / AttributeCertificateInfo — RFC 5755 §4),
+// or a recognized-and-deferred legacy AttributeCertificateV1. Carries the
+// underlying leaf fault as `.cause`.
+var AttrCertError = defineClass("AttrCertError", { withCause: true });
+
 module.exports = {
   PkiError:         PkiError,
   defineClass:      defineClass,
@@ -164,4 +170,5 @@ module.exports = {
   CmsError:         CmsError,
   OcspError:        OcspError,
   TspError:         TspError,
+  AttrCertError:    AttrCertError,
 };

package/lib/oid.js

@@ -49,7 +49,9 @@ var FAMILIES = {
   attributeType: { base: [2, 5, 4], of: {
     commonName: 3, surname: 4, serialNumber: 5, countryName: 6,
     localityName: 7, stateOrProvinceName: 8, streetAddress: 9,
-    organizationName: 10, organizationalUnitName: 11, title: 12, givenName: 42 } },
+    organizationName: 10, organizationalUnitName: 11, title: 12, givenName: 42,
+    // RFC 5755 §4.4 attribute-certificate attribute types.
+    clearance: 55, role: 72 } },
 
   // RFC 5280 certificate extensions.
   certExtension: { base: [2, 5, 29], of: {
@@ -60,10 +62,28 @@ var FAMILIES = {
     issuingDistributionPoint: 28, certificateIssuer: 29,
     nameConstraints: 30, cRLDistributionPoints: 31,
     certificatePolicies: 32, authorityKeyIdentifier: 35, extKeyUsage: 37,
-    freshestCRL: 46 } },
-
-  // PKIX private extensions (authorityInfoAccess et al).
-  pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: { authorityInfoAccess: 1 } },
+    freshestCRL: 46,
+    // RFC 5755 attribute-certificate extensions (§4.3.2, §4.3.6).
+    targetInformation: 55, noRevAvail: 56 } },
+
+  // PKIX private extensions on the id-pe arc (authorityInfoAccess et al, plus the
+  // RFC 5755 attribute-certificate id-pe extensions: ac-auditIdentity §4.3.1,
+  // aaControls §7.4, ac-proxying §7.2).
+  pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
+    authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10 } },
+
+  // id-aca — RFC 5755 attribute-certificate attribute types on the id-pkix 10 arc:
+  // authenticationInfo §4.4.1 .. group §4.4.4, plus encAttrs §7.1 (the encrypted-
+  // attribute wrapper, syntax ContentInfo). { id-aca 5 } is reserved.
+  idAca: { base: [1, 3, 6, 1, 5, 5, 7, 10], of: {
+    authenticationInfo: 1, accessIdentity: 2, chargingIdentity: 3, group: 4, encAttrs: 6 } },
+
+  // The legacy RFC 3281 id-at-clearance on the X.501 selected-attribute-types arc.
+  // RFC 5755 §4.4.6 says implementations MUST NOT OUTPUT this form but SHOULD ACCEPT
+  // it for decoding, so it is registered as an alias of "clearance". The canonical
+  // name -> OID reverse stays the RFC 5755 attributeType-arc 2.5.4.55 (registered
+  // first under attributeType, so it wins the reverse mapping).
+  selectedAttrType: { base: [2, 5, 1, 5], of: { clearance: 55 } },
 
   // PKIX Access Descriptor methods (id-ad, RFC 5280 §4.2.2.1/§4.2.2.2). id-ad-ocsp
   // is the arc the OCSP responder OIDs hang under; id-ad-caIssuers names the AIA

package/lib/schema-all.js

@@ -39,6 +39,7 @@ var pkcs8 = require("./schema-pkcs8");
 var cms = require("./schema-cms");
 var ocsp = require("./schema-ocsp");
 var tsp = require("./schema-tsp");
+var attrcert = require("./schema-attrcert");
 var frameworkError = require("./framework-error");
 
 var SchemaError = frameworkError.SchemaError;
@@ -126,6 +127,27 @@ var FORMATS = [
     detect: csr.matches,
     parse: function (input) { return csr.parse(input); },
   },
+  {
+    // AttributeCertificate ::= SEQUENCE { acinfo, signatureAlgorithm, signatureValue }
+    // — the signed-envelope trio, distinguished from a certificate / CRL by an acinfo
+    // that LEADS WITH a bare INTEGER version and carries a 2-GeneralizedTime validity
+    // at children[5]. Registered ahead of crl / x509 (most-specific-first): a legacy v1
+    // AC would otherwise satisfy x509.matches's Validity probe (RFC 5755 §4.1).
+    name: "attrcert",
+    module: attrcert,
+    detect: attrcert.matches,
+    parse: function (input) { return attrcert.parse(input); },
+  },
+  {
+    // AttributeCertificateV1 (X.509-1997, RFC 5652 §10.2) — the obsolete predecessor
+    // whose acInfo LEADS WITH the subject CHOICE (context [0]/[1]). Recognized and
+    // deferred with a precise attrcert/legacy-v1-not-supported rather than routed to a
+    // wrong format. children[1] == SEQUENCE keeps it disjoint from a v3 certificate.
+    name: "attrcert-v1",
+    module: attrcert,
+    detect: attrcert.matchesV1,
+    parse: function (input) { return attrcert.parseV1(input); },
+  },
   {
     // CertificateList ::= SEQUENCE { tbsCertList, signatureAlgorithm,
     // signatureValue } — the same outer shape as a certificate, distinguished
@@ -157,7 +179,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // → ["cms", "tsp", "ocsp-request", "ocsp-response", "pkcs8", "csr", "crl", "x509"]
+ *   pki.schema.all();  // → ["cms", "tsp", "ocsp-request", "ocsp-response", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -202,6 +224,7 @@ module.exports = {
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode },
   tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode },
+  attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode },
   all: all,
   parse: parse,
 };

package/lib/schema-attrcert.js

@@ -0,0 +1,383 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.schema.attrcert
+ * @nav        Schema
+ * @title      Attribute Cert
+ * @order      175
+ * @slug       attrcert
+ *
+ * @intro
+ *   X.509 Attribute Certificate handling per RFC 5755. An attribute certificate
+ *   binds a holder to a set of privilege attributes (role, group, clearance)
+ *   without carrying a public key — the authorization counterpart to an identity
+ *   certificate. `parse` decodes a v2 `AttributeCertificate` into its holder,
+ *   issuer, validity window (real `Date`s), attributes, and extensions, reusing
+ *   the shared signed-envelope so the raw `tbsBytes` (the exact signed region) and
+ *   the `signatureValue` are surfaced for a downstream verifier.
+ *
+ *   The holder and issuer identities are `GeneralName`s, validated on the way in
+ *   (each alternative's form and content per RFC 5280 §4.2.1.6) and surfaced with
+ *   their raw bytes; the profile MUSTs above structural scope (a single
+ *   non-empty `directoryName` issuer, the holder-to-PKC binding, targeting and
+ *   revocation) are verification-layer concerns. The obsolete X.509-1997
+ *   `AttributeCertificateV1` is recognized and deferred, not parsed. DER-only,
+ *   fail-closed.
+ *
+ * @card
+ *   Parse DER / PEM RFC 5755 attribute certificates into holder, issuer,
+ *   validity, attributes, and extensions — validated GeneralNames, raw verifier
+ *   inputs, legacy v1 recognize-and-defer, fail-closed.
+ */
+
+var asn1 = require("./asn1-der");
+var schema = require("./schema-engine");
+var pkix = require("./schema-pkix");
+var oid = require("./oid");
+var frameworkError = require("./framework-error");
+
+var AttrCertError = frameworkError.AttrCertError;
+var PemError = frameworkError.PemError;
+
+var NS = pkix.makeNS("attrcert", AttrCertError, oid);
+
+var TAGS = asn1.TAGS;
+
+var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
+var EXTENSIONS = pkix.extensions(NS);
+
+// AttCertVersion ::= INTEGER { v2(1) } — a bare, mandatory INTEGER (not the x509
+// [0] EXPLICIT DEFAULT shape). The only legal value is v2, surfaced as 2.
+var VERSION = pkix.versionReader(NS, { "1": 2 });
+
+// ---- shared leaves ---------------------------------------------------
+
+// AttCertValidityPeriod times are GeneralizedTime (RFC 5755 §4.2.6) — a UTCTime is
+// rejected. Non-fractional YYYYMMDDHHMMSSZ is enforced by the codec.
+var GENERALIZED_TIME = schema.decode(function (n, ctx) {
+  if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
+    throw ctx.E("attrcert/bad-time", "AttCertValidityPeriod times must be GeneralizedTime (RFC 5755 §4.2.6)");
+  }
+  return asn1.read.time(n);
+});
+
+// digestedObjectType ::= ENUMERATED { publicKey(0), publicKeyCert(1),
+// otherObjectTypes(2) } (RFC 5755 §4.1) — an undefined value is rejected; a
+// non-ENUMERATED tag fails at the codec (asn1/*).
+var ODT_NAMES = { "0": "publicKey", "1": "publicKeyCert", "2": "otherObjectTypes" };
+var DIGESTED_OBJECT_TYPE = schema.decode(function (n, ctx) {
+  var v = asn1.read.enumerated(n);
+  var k = v.toString();
+  if (!Object.prototype.hasOwnProperty.call(ODT_NAMES, k)) {
+    throw ctx.E("attrcert/bad-digested-object-type", "digestedObjectType " + k + " is not a defined value (RFC 5755 §4.1)");
+  }
+  // RFC 5755 §7.3 — a conformant AC MUST NOT use otherObjectTypes(2); the digested
+  // object is limited to a public key or a public-key certificate, so reject it
+  // fail-closed rather than parse a digest whose object type is unidentifiable.
+  if (k === "2") {
+    throw ctx.E("attrcert/bad-digested-object-type", "otherObjectTypes(2) MUST NOT be used (RFC 5755 §7.3)");
+  }
+  return { code: Number(v), name: ODT_NAMES[k] };
+});
+
+// ---- IssuerSerial / ObjectDigestInfo ---------------------------------
+
+// IssuerSerial ::= SEQUENCE { issuer GeneralNames, serial CertificateSerialNumber,
+// issuerUID UniqueIdentifier OPTIONAL } (RFC 5755 §4.1). Reached as an IMPLICIT
+// [n] node (Holder [0] / V2Form [0]) whose tag replaces the SEQUENCE tag, so the
+// shape assertion is "constructed" (the tag is pinned by the enclosing trailing);
+// a context [n] PRIMITIVE node has no children and fails closed here.
+var ISSUER_SERIAL = schema.seq([
+  schema.field("issuer", pkix.generalNames(NS, { code: "attrcert/bad-issuer-serial" })),
+  schema.field("serial", schema.integerLeaf()),
+  schema.optional("issuerUID", schema.bitString(), { whenUniversal: [TAGS.BIT_STRING] }),
+], {
+  assert: "constructed", code: "attrcert/bad-issuer-serial", what: "IssuerSerial",
+  build: function (m) {
+    return {
+      issuer: m.fields.issuer.value.result,
+      serial: m.fields.serial.value,
+      serialHex: m.fields.serial.node.content.toString("hex"),
+      issuerUID: m.fields.issuerUID.present ? m.fields.issuerUID.value : null,
+    };
+  },
+});
+
+// ObjectDigestInfo ::= SEQUENCE { digestedObjectType ENUMERATED, otherObjectTypeID
+// OBJECT IDENTIFIER OPTIONAL, digestAlgorithm AlgorithmIdentifier, objectDigest BIT
+// STRING } (RFC 5755 §4.1). otherObjectTypeID is present only for otherObjectTypes(2).
+var OBJECT_DIGEST_INFO = schema.seq([
+  schema.field("digestedObjectType", DIGESTED_OBJECT_TYPE),
+  schema.optional("otherObjectTypeID", schema.oidLeaf(), { whenUniversal: [TAGS.OBJECT_IDENTIFIER] }),
+  schema.field("digestAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("objectDigest", schema.bitString()),
+], {
+  assert: "constructed", code: "attrcert/bad-object-digest-info", what: "ObjectDigestInfo",
+  build: function (m, ctx) {
+    var t = m.fields.digestedObjectType.value;
+    // otherObjectTypeID identifies a non-certificate object type, meaningful only with
+    // otherObjectTypes(2) — which RFC 5755 §7.3 forbids (rejected at the leaf above) —
+    // so a present otherObjectTypeID is never valid here and is rejected fail-closed.
+    if (m.fields.otherObjectTypeID.present) {
+      throw ctx.E("attrcert/bad-object-digest-info", "otherObjectTypeID is only valid with otherObjectTypes(2), which RFC 5755 §7.3 forbids");
+    }
+    return {
+      digestedObjectType: t,
+      otherObjectTypeID: null,
+      digestAlgorithm: m.fields.digestAlgorithm.value.result,
+      objectDigest: m.fields.objectDigest.value,
+    };
+  },
+});
+
+// ---- Holder / AttCertIssuer / V2Form ---------------------------------
+
+// Holder ::= SEQUENCE { baseCertificateID [0] IMPLICIT IssuerSerial OPTIONAL,
+// entityName [1] IMPLICIT GeneralNames OPTIONAL, objectDigestInfo [2] IMPLICIT
+// ObjectDigestInfo OPTIONAL } (RFC 5755 §4.1). All three are IMPLICIT + OPTIONAL;
+// the profile RECOMMENDS exactly one, but the parser surfaces all three (null when
+// absent) and does not enforce the cardinality.
+var HOLDER = schema.seq([
+  schema.trailing([
+    { tag: 0, name: "baseCertificateID", schema: ISSUER_SERIAL },
+    { tag: 1, name: "entityName", schema: pkix.generalNames(NS, { implicitTag: 1, code: "attrcert/bad-entity-name" }) },
+    { tag: 2, name: "objectDigestInfo", schema: OBJECT_DIGEST_INFO },
+  ], { minTag: 0, maxTag: 2, unexpectedCode: "attrcert/bad-holder", orderCode: "attrcert/bad-holder" }),
+], {
+  assert: "sequence", code: "attrcert/bad-holder", what: "Holder",
+  build: function (m) {
+    return {
+      baseCertificateID: m.fields.baseCertificateID.present ? m.fields.baseCertificateID.value.result : null,
+      entityName: m.fields.entityName.present ? m.fields.entityName.value.result : null,
+      objectDigestInfo: m.fields.objectDigestInfo.present ? m.fields.objectDigestInfo.value.result : null,
+    };
+  },
+});
+
+// V2Form ::= SEQUENCE { issuerName GeneralNames OPTIONAL, baseCertificateID [0]
+// IMPLICIT IssuerSerial OPTIONAL, objectDigestInfo [1] IMPLICIT ObjectDigestInfo
+// OPTIONAL } (RFC 5755 §4.1). Reached via the AttCertIssuer CHOICE on a context [0]
+// node, so the shape is "constructed".
+var V2_FORM = schema.seq([
+  schema.optional("issuerName", pkix.generalNames(NS, { code: "attrcert/bad-issuer-name" }), { whenUniversal: [TAGS.SEQUENCE] }),
+  schema.trailing([
+    { tag: 0, name: "baseCertificateID", schema: ISSUER_SERIAL },
+    { tag: 1, name: "objectDigestInfo", schema: OBJECT_DIGEST_INFO },
+  ], { minTag: 0, maxTag: 1, unexpectedCode: "attrcert/bad-v2form", orderCode: "attrcert/bad-v2form" }),
+], {
+  assert: "constructed", code: "attrcert/bad-v2form", what: "V2Form",
+  build: function (m) {
+    return {
+      issuerName: m.fields.issuerName.present ? m.fields.issuerName.value.result : null,
+      baseCertificateID: m.fields.baseCertificateID.present ? m.fields.baseCertificateID.value.result : null,
+      objectDigestInfo: m.fields.objectDigestInfo.present ? m.fields.objectDigestInfo.value.result : null,
+    };
+  },
+});
+
+// AttCertIssuer ::= CHOICE { v1Form GeneralNames, v2Form [0] IMPLICIT V2Form } (RFC
+// 5755 §4.1). A universal SEQUENCE is the (obsolete but structurally legal) v1Form;
+// a context [0] is v2Form. A conforming AC uses v2Form; the parser surfaces which.
+var ATT_CERT_ISSUER = schema.choice([
+  { when: { tagClass: "universal", tagNumber: TAGS.SEQUENCE }, schema: pkix.generalNames(NS, { code: "attrcert/bad-issuer" }) },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: V2_FORM },
+], { code: "attrcert/bad-issuer" });
+
+// ---- validity + attributes -------------------------------------------
+
+// AttCertValidityPeriod ::= SEQUENCE { notBeforeTime GeneralizedTime, notAfterTime
+// GeneralizedTime } (RFC 5755 §4.2.6).
+var VALIDITY = schema.seq([
+  schema.field("notBeforeTime", GENERALIZED_TIME),
+  schema.field("notAfterTime", GENERALIZED_TIME),
+], {
+  assert: "sequence", arity: { exact: 2 }, code: "attrcert/bad-validity", what: "AttCertValidityPeriod",
+  build: function (m) { return { notBeforeTime: m.fields.notBeforeTime.value, notAfterTime: m.fields.notAfterTime.value }; },
+});
+
+// attributes ::= SEQUENCE OF Attribute (RFC 5755 §4.2.7) — MUST be non-empty and
+// each AttributeType OID unique. Order-preserving (SEQUENCE OF, not SET OF).
+var ATTRIBUTES = schema.seqOf(pkix.attribute(NS), {
+  assert: "sequence", min: 1, code: "attrcert/bad-attributes", what: "attributes",
+  unique: function (it) { return it.value.result.type; }, dupCode: "attrcert/duplicate-attribute",
+  build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
+});
+
+// ---- AttributeCertificateInfo / AttributeCertificate -----------------
+
+// AttributeCertificateInfo ::= SEQUENCE { version, holder, issuer, signature
+// AlgorithmIdentifier, serialNumber, attrCertValidityPeriod, attributes,
+// issuerUniqueID OPTIONAL, extensions OPTIONAL } (RFC 5755 §4.1). The tbs body the
+// signed envelope wraps; the cross-field invariants live in the envelope build.
+var ACINFO = schema.seq([
+  schema.field("version", VERSION),
+  schema.field("holder", HOLDER),
+  schema.field("issuer", ATT_CERT_ISSUER),
+  schema.field("signature", ALGORITHM_IDENTIFIER),
+  schema.field("serialNumber", schema.integerLeaf()),
+  schema.field("attrCertValidityPeriod", VALIDITY),
+  schema.field("attributes", ATTRIBUTES),
+  schema.optional("issuerUniqueID", schema.bitString(), { whenUniversal: [TAGS.BIT_STRING] }),
+  schema.optional("extensions", EXTENSIONS, { whenUniversal: [TAGS.SEQUENCE] }),
+], { assert: "sequence", code: "attrcert/bad-acinfo", what: "AttributeCertificateInfo" });
+
+// AttributeCertificate ::= SEQUENCE { acinfo, signatureAlgorithm, signatureValue
+// BIT STRING } — the shared SIGNED envelope (RFC 5755 §4.1). The AC-specific
+// invariants (§4.2.4 sig-alg agreement, §4.2.5 positive-and-<=20-octet serialNumber)
+// run in the build; the envelope owns the SEQUENCE-of-3 shape + signature extraction.
+var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
+  code: "attrcert/not-an-attribute-certificate", what: "AttributeCertificate",
+  build: function (e, ctx) {
+    var acinfo = e.tbsMatch;
+
+    // RFC 5755 §4.2.4 — the outer signatureAlgorithm MUST equal acinfo.signature.
+    if (!e.outerSignatureAlgorithmBytes.equals(acinfo.fields.signature.node.bytes)) {
+      throw ctx.E("attrcert/bad-signature-algorithm", "signatureAlgorithm must match AttributeCertificateInfo.signature (RFC 5755 §4.2.4)");
+    }
+
+    // RFC 5755 §4.2.5 — serialNumber MUST be a positive INTEGER of at most 20 content
+    // octets. Positive excludes both a negative (DER sign bit set) and zero (a minimal
+    // INTEGER 0 is a single 0x00 octet — the codec already rejected any non-minimal
+    // zero). Surface it lossless (BigInt) + as hex.
+    var serialNode = acinfo.fields.serialNumber.node;
+    var sc = serialNode.content;
+    if (sc.length === 0 || (sc[0] & 0x80) !== 0 || (sc.length === 1 && sc[0] === 0)) {
+      throw ctx.E("attrcert/bad-serial-number", "serialNumber must be a positive INTEGER (RFC 5755 §4.2.5)");
+    }
+    if (sc.length > 20) {
+      throw ctx.E("attrcert/bad-serial-number", "serialNumber must not exceed 20 content octets (RFC 5755 §4.2.5)");
+    }
+
+    // AttCertIssuer is a CHOICE — the chosen arm is read off the issuer node's tag
+    // (a universal SEQUENCE is v1Form; a context [0] is v2Form).
+    var issuerNode = acinfo.fields.issuer.node;
+    var issuerVal = acinfo.fields.issuer.value;
+    var issuer = issuerNode.tagClass === "context"
+      ? { form: "v2Form", v2Form: issuerVal.result, v1Form: null }
+      : { form: "v1Form", v1Form: issuerVal.result, v2Form: null };
+
+    var extField = acinfo.fields.extensions;
+    return {
+      version:               acinfo.fields.version.value,     // 2
+      holder:                acinfo.fields.holder.value.result,
+      issuer:                issuer,
+      signatureAlgorithm:    e.signatureAlgorithm,
+      tbsSignatureAlgorithm: acinfo.fields.signature.value.result,
+      serialNumber:          acinfo.fields.serialNumber.value,
+      serialNumberHex:       sc.toString("hex"),
+      validity:              acinfo.fields.attrCertValidityPeriod.value.result,
+      attributes:            acinfo.fields.attributes.value.result,
+      issuerUniqueID:        acinfo.fields.issuerUniqueID.present ? acinfo.fields.issuerUniqueID.value : null,
+      extensions:            (extField && extField.present) ? extField.value.result : [],
+      tbsBytes:              e.tbsBytes,
+      signatureValue:        e.signatureValue,
+    };
+  },
+});
+
+// ---- parse -----------------------------------------------------------
+
+/**
+ * @primitive  pki.schema.attrcert.parse
+ * @signature  pki.schema.attrcert.parse(input) -> attributeCertificate
+ * @since      0.1.14
+ * @status     experimental
+ * @spec       RFC 5755, X.509
+ * @related    pki.schema.parse, pki.schema.x509.parse
+ *
+ * Parse a DER `Buffer` or a PEM string/Buffer into a structured v2 attribute
+ * certificate: `{ version, holder, issuer, signatureAlgorithm, serialNumber,
+ * serialNumberHex, validity, attributes, issuerUniqueID, extensions, tbsBytes,
+ * signatureValue }`. The holder / issuer identities come back as validated
+ * `GeneralName`s (each element `{ bytes, tagClass, tagNumber }`); the validity
+ * window is real `Date`s; `tbsBytes` is the exact signed byte range for a verifier.
+ *
+ * Throws `AttrCertError` when the bytes are not a well-formed attribute certificate
+ * (an obsolete `AttributeCertificateV1` throws `attrcert/legacy-v1-not-supported`)
+ * and `Asn1Error` when the underlying DER is malformed.
+ *
+ * @example
+ *   var ac = pki.schema.attrcert.parse(der);
+ *   ac.attributes[0].name;   // "role"
+ *   ac.validity.notAfterTime;// Date
+ */
+var PARSE_OPTS = { pemLabel: null, PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" };
+
+function _legacyV1Error() {
+  return new AttrCertError("attrcert/legacy-v1-not-supported", "AttributeCertificateV1 (X.509-1997) is obsolete and not parsed by this build (RFC 5755 §1)");
+}
+
+function parse(input) {
+  var root = pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
+  // A well-formed legacy AttributeCertificateV1 gets the advertised, stable
+  // attrcert/legacy-v1-not-supported on the DIRECT path too — not a low-level asn1/*
+  // tag error from attempting the v2 walk — so a direct caller of this entry sees the
+  // same error family for the recognized-but-deferred form as the orchestrator does.
+  if (matchesV1(root)) throw _legacyV1Error();
+  return schema.walk(ATTRIBUTE_CERTIFICATE, root, NS).result;
+}
+
+// The obsolete X.509-1997 AttributeCertificateV1 (RFC 5652 §10.2) is recognized and
+// deferred: decode the envelope (so a malformed input still fails as bad DER), then
+// throw the precise diagnostic rather than routing it to a wrong format.
+function parseV1(input) {
+  pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
+  throw _legacyV1Error();
+}
+
+/**
+ * @primitive  pki.schema.attrcert.pemDecode
+ * @signature  pki.schema.attrcert.pemDecode(text, label?) -> Buffer
+ * @since      0.1.14
+ * @status     experimental
+ * @spec       RFC 7468, RFC 5755
+ * @related    pki.schema.attrcert.parse
+ *
+ * Extract the DER bytes from a PEM block (OpenSSL emits
+ * `-----BEGIN ATTRIBUTE CERTIFICATE-----`; the first block is taken unless `label`
+ * is given). Throws `PemError` on a missing envelope or a non-base64 body.
+ *
+ * @example
+ *   var der = pki.schema.attrcert.pemDecode(pemText);
+ */
+function pemDecode(text, label) { return pkix.pemDecode(text, label || null, PemError); }
+
+// matches(root): a v2 AttributeCertificate is the signed-envelope trio whose acinfo
+// LEADS WITH a bare universal INTEGER version (== v2 = 1, NOT the x509 [0] EXPLICIT
+// wrapper) and whose attrCertValidityPeriod at children[5] is a SEQUENCE of exactly
+// two GeneralizedTime (RFC 5755 §4.2.6 forbids UTCTime) — a marker no cert / CRL /
+// CSR presents at that position. Disjoint from matchesV1 by the children[0] tag class.
+function matches(root) {
+  var acinfo = pkix.signedEnvelopeTbs(root);
+  if (!acinfo) return false;
+  var k = acinfo.children;
+  if (!k || k.length < 7) return false;
+  if (!(k[0].tagClass === "universal" && k[0].tagNumber === TAGS.INTEGER)) return false;
+  if (!(k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE && k[1].children)) return false;
+  var v = k[5];
+  if (!(v && v.tagClass === "universal" && v.tagNumber === TAGS.SEQUENCE && v.children && v.children.length === 2)) return false;
+  return v.children.every(function (t) { return t.tagClass === "universal" && t.tagNumber === TAGS.GENERALIZED_TIME; });
+}
+
+// matchesV1(root): the obsolete AttributeCertificateV1 — its acInfo (version DEFAULT
+// v1 OMITTED) LEADS WITH the subject CHOICE (a context [0]/[1]), and its children[1]
+// is the issuer GeneralNames (a universal SEQUENCE). The children[1] == SEQUENCE test
+// keeps it disjoint from a v3 certificate (whose [0] EXPLICIT version is followed by
+// an INTEGER serialNumber), so v1-vs-cert dispatch is order-independent.
+function matchesV1(root) {
+  var acinfo = pkix.signedEnvelopeTbs(root);
+  if (!acinfo) return false;
+  var k = acinfo.children;
+  if (!k || k.length < 6) return false;
+  if (!(k[0].tagClass === "context" && (k[0].tagNumber === 0 || k[0].tagNumber === 1) && k[0].children)) return false;
+  return !!k[1] && k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE;
+}
+
+module.exports = {
+  parse: parse,
+  parseV1: parseV1,
+  pemDecode: pemDecode,
+  matches: matches,
+  matchesV1: matchesV1,
+};

package/lib/schema-cms.js

@@ -9,14 +9,16 @@
  * @slug       cms
  *
  * @intro
- *   CMS SignedData handling per RFC 5652 (§3 ContentInfo envelope, §5 SignedData).
- *   `parse` turns a DER or PEM (`CMS`) message into a structured object: the
- *   SignedData version, the digest algorithms, the encapsulated content, the
- *   certificate / CRL sets, and the signer infos. It is an OID-dispatch envelope —
- *   ContentInfo reads its `contentType` and structurally decodes only
- *   `id-signedData`; the other PKCS#7 content types (EnvelopedData, EncryptedData,
- *   …) are recognized and rejected with a precise `cms/unsupported-content-type`
- *   rather than a generic unknown-format error.
+ *   CMS handling per RFC 5652 (§3 ContentInfo envelope). `parse` turns a DER or PEM
+ *   (`CMS`) message into a structured object and is an OID-dispatch envelope —
+ *   ContentInfo reads its `contentType` and structurally decodes SignedData (§5),
+ *   EnvelopedData (§6, with all five RecipientInfo kinds — key-transport,
+ *   key-agreement per RFC 5753, KEK, password, and other), and EncryptedData (§8);
+ *   the remaining PKCS#7 content types are recognized and rejected with a precise
+ *   `cms/unsupported-content-type` rather than a generic unknown-format error. A
+ *   SignedData surfaces its version, digest algorithms, encapsulated content,
+ *   certificate / CRL sets, and signer infos; an EnvelopedData its recipient infos
+ *   and encrypted content info; an EncryptedData its encrypted content info.
  *
  *   CMS is a signed container: the bytes an external verifier must hash are
  *   surfaced RAW and never re-serialized. `encapContentInfo.eContent` is the raw
@@ -53,15 +55,26 @@ var NAME = pkix.name(NS);
 // version is {1,3} (RFC 5652 §5.1, §5.3). Wider accept maps than any other format.
 var SIGNED_DATA_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3, "4": 4, "5": 5 });
 var SIGNER_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3 });
+// EnvelopedData §6.1 (0/2/3/4), EncryptedData §8 (0/2), and the per-RecipientInfo
+// versions (RFC 5652 §6.2.1-§6.2.4): ktri {0,2}, kari {3}, kekri {4}, pwri {0}.
+var ENVELOPED_DATA_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2, "3": 3, "4": 4 });
+var ENCRYPTED_DATA_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2 });
+var KTRI_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2 });
+var KARI_VERSION = pkix.versionReader(NS, { "3": 3 });
+var KEKRI_VERSION = pkix.versionReader(NS, { "4": 4 });
+var PWRI_VERSION = pkix.versionReader(NS, { "0": 0 });
 
-// id-signedData is the one content type this build structurally decodes; the rest
-// are recognized-and-deferred (a precise diagnostic, not a silent unknown-format).
-// OIDs resolve from the registry (pkcs7 / smimeCt families), never dotted literals.
+// id-signedData / id-envelopedData / id-encryptedData are the content types this
+// build structurally decodes; the rest are recognized-and-deferred (a precise
+// diagnostic, not a silent unknown-format). OIDs resolve from the registry (pkcs7 /
+// smimeCt families), never dotted literals.
 var OID_SIGNED_DATA = oid.byName("signedData");
+var OID_ENVELOPED_DATA = oid.byName("envelopedData");
+var OID_ENCRYPTED_DATA = oid.byName("encryptedData");
 var OID_DATA = oid.byName("data");
 var DEFERRED = new Set([
-  oid.byName("data"), oid.byName("envelopedData"), oid.byName("signedAndEnvelopedData"),
-  oid.byName("digestedData"), oid.byName("encryptedData"), oid.byName("authData"),
+  oid.byName("data"), oid.byName("signedAndEnvelopedData"),
+  oid.byName("digestedData"), oid.byName("authData"),
 ]);
 // The two mandatory signed-attribute types (RFC 5652 §5.3, §11.1/§11.2).
 var OID_CONTENT_TYPE = oid.byName("contentType");
@@ -277,11 +290,313 @@ var SIGNED_DATA = schema.seq([
   },
 });
 
+// ==== EnvelopedData / EncryptedData (RFC 5652 §6/§8, RFC 5753) ========
+var T = asn1.TAGS;
+
+// EncryptedContentInfo ::= SEQUENCE { contentType OID, contentEncryptionAlgorithm
+//   AlgorithmIdentifier, encryptedContent [0] IMPLICIT OCTET STRING OPTIONAL } (RFC
+//   5652 §6.1). encryptedContent is [0] IMPLICIT (context PRIMITIVE) — its content
+//   octets ARE the ciphertext directly, so it reads through implicitOctetString(0),
+//   NOT the [0] EXPLICIT shape ENCAP_CONTENT_INFO uses (which would double-strip a
+//   length header). The ciphertext + algorithm parameters are surfaced RAW.
+var ENCRYPTED_CONTENT_INFO = schema.seq([
+  schema.field("contentType", schema.oidLeaf()),
+  schema.field("contentEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.optional("encryptedContent", schema.implicitOctetString(0), { tag: 0 }),
+], {
+  assert: "sequence", arity: { min: 2, max: 3 }, code: "cms/bad-encrypted-content-info", what: "EncryptedContentInfo",
+  build: function (m) {
+    return {
+      contentType: m.fields.contentType.value,
+      contentEncryptionAlgorithm: m.fields.contentEncryptionAlgorithm.value.result,
+      encryptedContent: m.fields.encryptedContent.present ? m.fields.encryptedContent.value : null,
+    };
+  },
+});
+
+// RecipientIdentifier ::= CHOICE { issuerAndSerialNumber, subjectKeyIdentifier [0]
+//   IMPLICIT OCTET STRING } (RFC 5652 §6.2.1) — structurally identical to
+//   SignerIdentifier; reuse ISSUER_AND_SERIAL + the implicitOctetString(0) leaf.
+var RECIPIENT_IDENTIFIER = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: ISSUER_AND_SERIAL },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: schema.implicitOctetString(0) },
+], { code: "cms/bad-recipient-identifier", what: "RecipientIdentifier" });
+
+// KeyTransRecipientInfo ::= SEQUENCE { version(0|2), rid RecipientIdentifier,
+//   keyEncryptionAlgorithm, encryptedKey OCTET STRING } (RFC 5652 §6.2.1).
+var KEY_TRANS_RECIPIENT_INFO = schema.seq([
+  schema.field("version", KTRI_VERSION),
+  schema.field("rid", RECIPIENT_IDENTIFIER),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "sequence", code: "cms/bad-ktri", what: "KeyTransRecipientInfo",
+  build: function (m) {
+    var version = m.fields.version.value;
+    var ridNode = m.fields.rid.node;
+    var isSkid = ridNode.tagClass === "context" && ridNode.tagNumber === 0;
+    // RFC 5652 §6.2.1 — rid ⇔ version: issuerAndSerialNumber ⇒ 0, subjectKeyIdentifier ⇒ 2.
+    if (isSkid && version !== 2) throw NS.E("cms/bad-recipient-version", "a subjectKeyIdentifier recipient identifier requires KeyTransRecipientInfo version 2 (RFC 5652 §6.2.1)");
+    if (!isSkid && version !== 0) throw NS.E("cms/bad-recipient-version", "an issuerAndSerialNumber recipient identifier requires KeyTransRecipientInfo version 0 (RFC 5652 §6.2.1)");
+    return {
+      type: "ktri", version: version,
+      rid: isSkid ? { subjectKeyIdentifier: m.fields.rid.value } : m.fields.rid.value.result,
+      ridType: isSkid ? "subjectKeyIdentifier" : "issuerAndSerialNumber",
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// OriginatorPublicKey ::= SEQUENCE { algorithm, publicKey BIT STRING } (RFC 5753
+//   §3.1.1), reached as originatorKey [1] IMPLICIT — SPKI-shaped but cannot reuse
+//   pkix.spki (which asserts a universal SEQUENCE), so assert:"constructed".
+var ORIGINATOR_PUBLIC_KEY = schema.seq([
+  schema.field("algorithm", ALGORITHM_IDENTIFIER),
+  schema.field("publicKey", schema.bitString()),
+], {
+  assert: "constructed", code: "cms/bad-originator-public-key", what: "OriginatorPublicKey",
+  build: function (m) { return { algorithm: m.fields.algorithm.value.result, publicKey: m.fields.publicKey.value }; },
+});
+
+// OriginatorIdentifierOrKey ::= CHOICE { issuerAndSerialNumber, subjectKeyIdentifier
+//   [0] IMPLICIT OCTET STRING, originatorKey [1] IMPLICIT OriginatorPublicKey }.
+var ORIGINATOR_IDENTIFIER_OR_KEY = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: ISSUER_AND_SERIAL },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: schema.implicitOctetString(0) },
+  { when: { tagClass: "context", tagNumber: 1 }, schema: ORIGINATOR_PUBLIC_KEY },
+], { code: "cms/bad-originator-identifier", what: "OriginatorIdentifierOrKey" });
+
+// RecipientKeyIdentifier (RFC 5652 §6.2.2) and KEKIdentifier (§6.2.3) are one
+//   shape — { <keyId> OCTET STRING, date GeneralizedTime OPTIONAL, other
+//   OtherKeyAttribute OPTIONAL } — differing only in the key-id field's name and
+//   the enclosing tag form. One factory defines both so the OPTIONAL handling
+//   (date and the raw-surfaced OtherKeyAttribute) cannot diverge between them.
+function keyIdentifierSchema(keyIdName, assert, code, what) {
+  return schema.seq([
+    schema.field(keyIdName, schema.octetString()),
+    schema.optional("date", schema.time(NS), { whenUniversal: [T.GENERALIZED_TIME] }),
+    schema.optional("other", schema.any(), { whenUniversal: [T.SEQUENCE] }),
+  ], {
+    assert: assert, code: code, what: what,
+    build: function (m) {
+      var out = {};
+      out[keyIdName] = m.fields[keyIdName].value;
+      out.date = m.fields.date.present ? m.fields.date.value : null;
+      out.other = m.fields.other.present ? m.fields.other.node.bytes : null;
+      return out;
+    },
+  });
+}
+
+// Reached as rKeyId [0] IMPLICIT (a SEQUENCE — constructed, unlike ktri's [0] leaf).
+var RECIPIENT_KEY_IDENTIFIER = keyIdentifierSchema("subjectKeyIdentifier",
+  "constructed", "cms/bad-recipient-key-identifier", "RecipientKeyIdentifier");
+
+// KeyAgreeRecipientIdentifier ::= CHOICE { issuerAndSerialNumber, rKeyId [0] IMPLICIT
+//   RecipientKeyIdentifier } (RFC 5652 §6.2.2).
+var KEY_AGREE_RECIPIENT_IDENTIFIER = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: ISSUER_AND_SERIAL },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: RECIPIENT_KEY_IDENTIFIER },
+], { code: "cms/bad-kari-identifier", what: "KeyAgreeRecipientIdentifier" });
+
+// RecipientEncryptedKey ::= SEQUENCE { rid KeyAgreeRecipientIdentifier, encryptedKey
+//   OCTET STRING } (RFC 5652 §6.2.2).
+var RECIPIENT_ENCRYPTED_KEY = schema.seq([
+  schema.field("rid", KEY_AGREE_RECIPIENT_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "sequence", code: "cms/bad-recipient-encrypted-key", what: "RecipientEncryptedKey",
+  build: function (m) {
+    var ridNode = m.fields.rid.node;
+    var isRkid = ridNode.tagClass === "context" && ridNode.tagNumber === 0;
+    return {
+      rid: isRkid ? m.fields.rid.value.result : m.fields.rid.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// KeyAgreeRecipientInfo ::= [1] IMPLICIT SEQUENCE { version(3), originator [0]
+//   EXPLICIT OriginatorIdentifierOrKey, ukm [1] EXPLICIT OPTIONAL,
+//   keyEncryptionAlgorithm, recipientEncryptedKeys SEQUENCE OF } (RFC 5652 §6.2.2 +
+//   RFC 5753 §3.1.1). originator [0] is EXPLICIT (wraps a CHOICE).
+var KEY_AGREE_RECIPIENT_INFO = schema.seq([
+  schema.field("version", KARI_VERSION),
+  schema.field("originator", schema.explicit(0, ORIGINATOR_IDENTIFIER_OR_KEY, { code: "cms/bad-kari" })),
+  schema.optional("ukm", schema.octetString(), { tag: 1, explicit: true, emptyCode: "cms/bad-kari" }),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("recipientEncryptedKeys", schema.seqOf(RECIPIENT_ENCRYPTED_KEY, { code: "cms/bad-recipient-encrypted-keys", what: "recipientEncryptedKeys" })),
+], {
+  assert: "constructed", code: "cms/bad-kari", what: "KeyAgreeRecipientInfo",
+  build: function (m) {
+    var origNode = m.fields.originator.node.children[0];
+    var origForm = origNode.tagClass === "context" ? (origNode.tagNumber === 0 ? "subjectKeyIdentifier" : "originatorKey") : "issuerAndSerialNumber";
+    var origVal = m.fields.originator.value;
+    return {
+      type: "kari", version: m.fields.version.value,
+      originator: { form: origForm, value: origForm === "subjectKeyIdentifier" ? origVal : origVal.result },
+      ukm: m.fields.ukm.present ? m.fields.ukm.value : null,
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      recipientEncryptedKeys: m.fields.recipientEncryptedKeys.value.items.map(function (it) { return it.value.result; }),
+    };
+  },
+});
+
+// KEKRecipientInfo ::= [2] IMPLICIT SEQUENCE { version(4), kekid KEKIdentifier,
+//   keyEncryptionAlgorithm, encryptedKey } (RFC 5652 §6.2.3).
+var KEK_IDENTIFIER = keyIdentifierSchema("keyIdentifier",
+  "sequence", "cms/bad-kek-identifier", "KEKIdentifier");
+var KEK_RECIPIENT_INFO = schema.seq([
+  schema.field("version", KEKRI_VERSION),
+  schema.field("kekid", KEK_IDENTIFIER),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "constructed", code: "cms/bad-kekri", what: "KEKRecipientInfo",
+  build: function (m) {
+    return {
+      type: "kekri", version: m.fields.version.value,
+      kekid: m.fields.kekid.value.result,
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// PasswordRecipientInfo ::= [3] IMPLICIT SEQUENCE { version(0), keyDerivationAlgorithm
+//   [0] IMPLICIT AlgorithmIdentifier OPTIONAL, keyEncryptionAlgorithm, encryptedKey }
+//   (RFC 5652 §6.2.4). keyDerivationAlgorithm [0] IMPLICIT is the one field needing
+//   the implicitTag AlgorithmIdentifier; present iff the first post-version node is [0].
+var PASSWORD_RECIPIENT_INFO = schema.seq([
+  schema.field("version", PWRI_VERSION),
+  schema.optional("keyDerivationAlgorithm", pkix.algorithmIdentifier(NS, { implicitTag: 0 }), { tag: 0 }),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "constructed", code: "cms/bad-pwri", what: "PasswordRecipientInfo",
+  build: function (m) {
+    return {
+      type: "pwri", version: m.fields.version.value,
+      keyDerivationAlgorithm: m.fields.keyDerivationAlgorithm.present ? m.fields.keyDerivationAlgorithm.value.result : null,
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// OtherRecipientInfo ::= [4] IMPLICIT SEQUENCE { oriType OID, oriValue ANY } (RFC
+//   5652 §6.2.5) — oriValue opaque, surfaced RAW (the shipped encoder routes
+//   KEMRecipientInfo through here).
+var OTHER_RECIPIENT_INFO = schema.seq([
+  schema.field("oriType", schema.oidLeaf()),
+  schema.field("oriValue", schema.any()),
+], {
+  assert: "constructed", code: "cms/bad-ori", what: "OtherRecipientInfo",
+  build: function (m) { return { type: "ori", oriType: m.fields.oriType.value, oriValue: m.fields.oriValue.node.bytes }; },
+});
+
+// RecipientInfo ::= CHOICE { ktri KeyTransRecipientInfo, kari [1], kekri [2], pwri
+//   [3], ori [4] } (RFC 5652 §6.2). A bare universal SEQUENCE is ktri (the untagged
+//   alternative). An unknown context tag → no arm → cms/bad-recipient-info.
+var RECIPIENT_INFO = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: KEY_TRANS_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 1 }, schema: KEY_AGREE_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 2 }, schema: KEK_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 3 }, schema: PASSWORD_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 4 }, schema: OTHER_RECIPIENT_INFO },
+], { code: "cms/bad-recipient-info", what: "RecipientInfo" });
+
+// OriginatorInfo ::= [0] IMPLICIT SEQUENCE { certs [0] IMPLICIT OPTIONAL, crls [1]
+//   IMPLICIT OPTIONAL } (RFC 5652 §6.1). Members surfaced RAW (their outer tag feeds
+//   the version rule).
+var ORIGINATOR_INFO = schema.seq([
+  schema.optional("certs", schema.implicitSetOf(0, schema.any(), { min: 1, code: "cms/bad-originator-certs", what: "certs" }), { tag: 0 }),
+  schema.optional("crls", schema.implicitSetOf(1, schema.any(), { min: 1, code: "cms/bad-originator-crls", what: "crls" }), { tag: 1 }),
+], {
+  assert: "constructed", code: "cms/bad-originator-info", what: "OriginatorInfo",
+  build: function (m) {
+    return {
+      certs: m.fields.certs.present ? m.fields.certs.value.items.map(rawElement) : [],
+      crls: m.fields.crls.present ? m.fields.crls.value.items.map(rawElement) : [],
+    };
+  },
+});
+
+// RFC 5652 §6.1 — the exact EnvelopedData CMSVersion, from originatorInfo's raw
+// cert/crl outer tags and the recipient arms (a cert `other` is [3], a v2AttrCert
+// [2]; a crl `other` is [1]; a pwri or ori forces v3; all-ktri-IAS with no
+// originatorInfo/unprotectedAttrs is v0; everything else v2).
+function _expectedEnvelopedDataVersion(originatorInfo, recipientInfos, hasUnprotectedAttrs) {
+  function ctx(el, n) { return el.tagClass === "context" && el.tagNumber === n; }
+  var hasOrig = !!originatorInfo;
+  var certs = hasOrig ? originatorInfo.certs : [];
+  var crls = hasOrig ? originatorInfo.crls : [];
+  if (hasOrig && (certs.some(function (c) { return ctx(c, 3); }) || crls.some(function (c) { return ctx(c, 1); }))) return 4;
+  if ((hasOrig && certs.some(function (c) { return ctx(c, 2); })) ||
+      recipientInfos.some(function (r) { return r.type === "pwri" || r.type === "ori"; })) return 3;
+  if (!hasOrig && !hasUnprotectedAttrs &&
+      recipientInfos.every(function (r) { return r.type === "ktri" && r.ridType === "issuerAndSerialNumber"; })) return 0;
+  return 2;
+}
+
+// EnvelopedData ::= SEQUENCE { version, originatorInfo [0] IMPLICIT OPTIONAL,
+//   recipientInfos RecipientInfos (SET SIZE 1..MAX), encryptedContentInfo,
+//   unprotectedAttrs [1] IMPLICIT OPTIONAL } (RFC 5652 §6.1). recipientInfos is
+//   min:1 (an empty SET is non-conformant — the INVERSE of SignedData's degenerate
+//   signerInfos).
+var ENVELOPED_DATA = schema.seq([
+  schema.field("version", ENVELOPED_DATA_VERSION),
+  schema.optional("originatorInfo", ORIGINATOR_INFO, { tag: 0 }),
+  schema.field("recipientInfos", schema.setOf(RECIPIENT_INFO, { min: 1, code: "cms/bad-recipient-infos", what: "recipientInfos" })),
+  schema.field("encryptedContentInfo", ENCRYPTED_CONTENT_INFO),
+  schema.optional("unprotectedAttrs", schema.implicitSetOf(1, ATTRIBUTE, { min: 1, code: "cms/bad-unprotected-attrs", what: "unprotectedAttrs" }), { tag: 1 }),
+], {
+  assert: "sequence", code: "cms/bad-enveloped-data", what: "EnvelopedData",
+  build: function (m) {
+    var version = m.fields.version.value;
+    var originatorInfo = m.fields.originatorInfo.present ? m.fields.originatorInfo.value.result : null;
+    var recipientInfos = m.fields.recipientInfos.value.items.map(function (it) { return it.value.result; });
+    var hasUnprotectedAttrs = m.fields.unprotectedAttrs.present;
+    var expected = _expectedEnvelopedDataVersion(originatorInfo, recipientInfos, hasUnprotectedAttrs);
+    if (version !== expected) throw NS.E("cms/bad-version", "EnvelopedData version " + version + " does not match its contents (RFC 5652 §6.1 requires v" + expected + ")");
+    return {
+      version: version,
+      originatorInfo: originatorInfo,
+      recipientInfos: recipientInfos,
+      encryptedContentInfo: m.fields.encryptedContentInfo.value.result,
+      unprotectedAttrs: hasUnprotectedAttrs ? m.fields.unprotectedAttrs.value.items.map(function (it) { return it.value.result; }) : null,
+    };
+  },
+});
+
+// EncryptedData ::= SEQUENCE { version, encryptedContentInfo, unprotectedAttrs [1]
+//   IMPLICIT OPTIONAL } (RFC 5652 §8) — no recipients, no originatorInfo; the CEK is
+//   distributed out of band. version is 0, or 2 iff unprotectedAttrs are present.
+var ENCRYPTED_DATA = schema.seq([
+  schema.field("version", ENCRYPTED_DATA_VERSION),
+  schema.field("encryptedContentInfo", ENCRYPTED_CONTENT_INFO),
+  schema.optional("unprotectedAttrs", schema.implicitSetOf(1, ATTRIBUTE, { min: 1, code: "cms/bad-unprotected-attrs", what: "unprotectedAttrs" }), { tag: 1 }),
+], {
+  assert: "sequence", code: "cms/bad-encrypted-data", what: "EncryptedData",
+  build: function (m) {
+    var version = m.fields.version.value;
+    var hasUnprotectedAttrs = m.fields.unprotectedAttrs.present;
+    var expected = hasUnprotectedAttrs ? 2 : 0;
+    if (version !== expected) throw NS.E("cms/bad-version", "EncryptedData version " + version + " does not match its contents (RFC 5652 §8 requires v" + expected + ")");
+    return {
+      version: version,
+      encryptedContentInfo: m.fields.encryptedContentInfo.value.result,
+      unprotectedAttrs: hasUnprotectedAttrs ? m.fields.unprotectedAttrs.value.items.map(function (it) { return it.value.result; }) : null,
+    };
+  },
+});
+
 // ContentInfo ::= SEQUENCE { contentType OID, content [0] EXPLICIT ANY DEFINED BY
 //   contentType } (RFC 5652 §3). The content is captured raw (explicit(0, any()))
 //   and re-dispatched by contentType inside the build: id-signedData walks
-//   SIGNED_DATA, the other PKCS#7 types are recognized-and-deferred, unknown OIDs
-//   are rejected.
+//   SIGNED_DATA, id-envelopedData / id-encryptedData walk their schemas, the other
+//   PKCS#7 types are recognized-and-deferred, unknown OIDs are rejected.
 var CONTENT_INFO = schema.seq([
   schema.field("contentType", schema.oidLeaf()),
   schema.field("content", schema.explicit(0, schema.any(), { code: "cms/not-a-content-info" })),
@@ -290,6 +605,8 @@ var CONTENT_INFO = schema.seq([
   build: function (m, ctx) {
     var ct = m.fields.contentType.value;
     if (ct === OID_SIGNED_DATA) return schema.walk(SIGNED_DATA, m.fields.content.value, ctx).result;
+    if (ct === OID_ENVELOPED_DATA) return schema.walk(ENVELOPED_DATA, m.fields.content.value, ctx).result;
+    if (ct === OID_ENCRYPTED_DATA) return schema.walk(ENCRYPTED_DATA, m.fields.content.value, ctx).result;
     if (DEFERRED.has(ct)) {
       throw NS.E("cms/unsupported-content-type", (ctx.oid.name(ct) || ct) + " is recognized but not parsed by this build");
     }

package/lib/schema-crl.js

@@ -121,6 +121,11 @@ var REVOKED_LIST = schema.seqOf(REVOKED_ENTRY, {
 // revokedCertificates=SEQUENCE) are disambiguated by their universal tag;
 // crlExtensions is modeled as a trailing [0]..[0] so a stray non-[0] trailing
 // context tag is REJECTED (crl/bad-tbs), not silently ignored.
+// `signature` is consumed by the CERTIFICATE_LIST build (the §5.1.1.2
+// outer==inner agreement check reads tbsMatch.fields.signature.node.bytes);
+// the operator reads the surfaced outer signatureAlgorithm, which that
+// check proves byte-identical.
+// allow:schema-build-drops-parsed-field
 var TBS_CERTLIST = schema.seq([
   schema.optional("version", CRL_VERSION, { whenUniversal: [TAGS.INTEGER] }),
   schema.field("signature", ALGORITHM_IDENTIFIER),

package/lib/schema-engine.js

@@ -63,11 +63,12 @@ function _assertShape(schema, node, ctx) {
       _fail(ctx, schema.code, (schema.what || "value") + " must be a constructed value");
     }
   } else if (mode === "implicit") {
-    // IMPLICIT [tag] SET/SEQUENCE OF: the context tag replaces the universal
-    // tag, so the node is a context-class constructed [tag] and its direct
-    // children are the items (no inner universal SET, no EXPLICIT unwrap).
+    // IMPLICIT [tag] SET/SEQUENCE OF or a fixed-field IMPLICIT [tag] SEQUENCE body:
+    // the context tag replaces the universal tag, so the node is a context-class
+    // constructed [tag] and its direct children are the items / positional fields
+    // (no inner universal tag, no EXPLICIT unwrap).
     if (node.tagClass !== "context" || node.tagNumber !== schema.implicitTag || !node.children) {
-      _fail(ctx, schema.code, (schema.what || "value") + " must be an IMPLICIT [" + schema.implicitTag + "] SET OF");
+      _fail(ctx, schema.code, (schema.what || "value") + " must be an IMPLICIT [" + schema.implicitTag + "] constructed value");
     }
   } else {
     _fail(ctx, schema.code, "unknown assert mode " + JSON.stringify(mode));
@@ -163,7 +164,7 @@ function trailing(members, opts) {
 
 function seq(fields, opts) {
   opts = opts || {};
-  return { kind: "seq", fields: fields, assert: opts.assert || "sequence", arity: opts.arity,
+  return { kind: "seq", fields: fields, assert: opts.assert || "sequence", implicitTag: opts.implicitTag, arity: opts.arity,
            code: opts.code, what: opts.what, build: opts.build, checks: opts.checks || [] };
 }
 

package/lib/schema-pkix.js

@@ -129,12 +129,18 @@ function versionReader(ns, accept) {
   });
 }
 
-function algorithmIdentifier(ns) {
+// opts.implicitTag (optional): read the AlgorithmIdentifier as a [tag] IMPLICIT
+// SEQUENCE (a context-class constructed node whose children are algorithm + parameters),
+// for the RFC 5652 §6.2.4 pwri.keyDerivationAlgorithm [0]. With no opts the shape is a
+// universal SEQUENCE, byte-identical to every existing caller.
+function algorithmIdentifier(ns, opts) {
+  opts = opts || {};
   return schema.seq([
     schema.field("algorithm", schema.oidLeaf()),
     schema.optional("parameters", schema.any(), { whenAny: true }),
   ], {
-    assert: "sequence", arity: { min: 1 }, code: ns.prefix + "/bad-algorithm-identifier", what: "AlgorithmIdentifier",
+    assert: opts.implicitTag != null ? "implicit" : "sequence", implicitTag: opts.implicitTag,
+    arity: { min: 1 }, code: ns.prefix + "/bad-algorithm-identifier", what: "AlgorithmIdentifier",
     build: function (m, ctx) {
       var dotted = m.fields.algorithm.value;
       return { oid: dotted, name: ctx.oid.name(dotted) || null, parameters: m.fields.parameters.present ? m.fields.parameters.node.bytes : null };
@@ -264,6 +270,26 @@ function generalName(ns, opts) {
   });
 }
 
+// GeneralNames ::= SEQUENCE OF GeneralName (RFC 5280 §4.2.1.6), SIZE (1..MAX). Every
+// element is validated by generalName (its CHOICE alternative's form + content) and
+// surfaced raw, so a caller carrying a GeneralNames field cannot accept a malformed
+// element by treating the whole sequence as opaque bytes. Returns { names: [{ bytes,
+// tagClass, tagNumber }], bytes } (the decoded element list + the raw outer DER).
+// `opts.implicitTag` handles a [tag] IMPLICIT GeneralNames — the context tag REPLACES
+// the universal SEQUENCE tag (RFC 5755 Holder.entityName [1]); otherwise it is a bare
+// universal SEQUENCE OF. `opts.code` is the caller's error code. Shared so the x509 /
+// attribute-certificate / (future) CRMF parsers validate a GeneralNames identically.
+function generalNames(ns, opts) {
+  opts = opts || {};
+  var code = opts.code || (ns.prefix + "/bad-general-names");
+  var gn = generalName(ns, { code: code });
+  function build(m) { return { names: m.items.map(function (it) { return it.value; }), bytes: m.node.bytes }; }
+  if (opts.implicitTag != null) {
+    return schema.implicitSeqOf(opts.implicitTag, gn, { min: 1, code: code, what: opts.what || "GeneralNames", build: build });
+  }
+  return schema.seqOf(gn, { assert: "sequence", min: 1, code: code, what: opts.what || "GeneralNames", build: build });
+}
+
 // Extension ::= SEQUENCE { extnID OID, critical BOOLEAN DEFAULT FALSE,
 // extnValue OCTET STRING }. `critical` is a universal BOOLEAN present-by-count
 // (not context-tagged), so the per-extension decode handles the 2-vs-3-child
@@ -419,6 +445,7 @@ module.exports = {
   relativeDistinguishedName: relativeDistinguishedName,
   name: name,
   generalName: generalName,
+  generalNames: generalNames,
   attribute: attribute,
   extension: extension,
   extensions: extensions,

package/lib/webcrypto.js

@@ -531,6 +531,7 @@ function _curveFromKey(ko) {
  * point). Throws unless the key was created `extractable`.
  *
  * @example
+ *   var keyPair = await pki.webcrypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
  *   var spki = await pki.webcrypto.subtle.exportKey("spki", keyPair.publicKey);
  */
 SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
@@ -566,7 +567,7 @@ function _rawPublic(key) {
  *
  * A ready `Crypto` instance (the shape of `globalThis.crypto`) exposing
  * `getRandomValues`, `randomUUID`, and `subtle`. Construct additional
- * instances with `new pki.WebCrypto.Crypto()`.
+ * instances with `new pki.webcrypto.Crypto()`.
  *
  * @example
  *   var iv = pki.webcrypto.getRandomValues(new Uint8Array(12));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f3d799b0-bde8-4f05-8577-e064f7a420f1",
+  "serialNumber": "urn:uuid:d18de1ff-7ebd-406f-91cb-801da4286f4f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-06T00:04:32.672Z",
+    "timestamp": "2026-07-06T08:32:53.685Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.13",
+      "bom-ref": "@blamejs/pki@0.1.15",
       "type": "application",
       "name": "pki",
-      "version": "0.1.13",
+      "version": "0.1.15",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.13",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.15",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.13",
+      "ref": "@blamejs/pki@0.1.15",
       "dependsOn": []
     }
   ]