@blamejs/pki 0.1.22 → 0.1.23

package/lib/schema-smime.js

@@ -11,23 +11,23 @@
  * @intro
  *   S/MIME Enhanced Security Services signed-attribute values per RFC 5035 (ESS)
  *   and RFC 8551 (S/MIME 4.0). These are the DER-decoded VALUES of CMS signed
- *   attributes — they ride inside a `SignerInfo.signedAttrs`, so this is a
+ *   attributes -- they ride inside a `SignerInfo.signedAttrs`, so this is a
  *   companion decoder a CMS consumer invokes by attribute OID, NOT a top-level
  *   format the schema orchestrator auto-routes.
  *
  *   `parseSigningCertificate` / `parseSigningCertificateV2` decode the ESS
  *   signing-certificate attributes that bind a signature to the exact certificate
- *   that made it: each surfaces its list of `ESSCertID`(v2) — the certificate hash
+ *   that made it: each surfaces its list of `ESSCertID`(v2) -- the certificate hash
  *   (raw), the hash algorithm (decoded for v2, or the implied SHA-1 for v1), and
  *   the optional `issuerSerial` (issuer `GeneralNames` validated + surfaced raw,
- *   serial as a BigInt + hex) — plus the optional certificate policies.
+ *   serial as a BigInt + hex) -- plus the optional certificate policies.
  *   `parseSmimeCapabilities` decodes the ordered `SMIMECapabilities` list (each a
  *   capability OID + raw parameters). `decodeAttribute` takes a CMS-shaped
  *   `{ type, values }` attribute, enforces the single-`AttributeValue` rule
- *   (RFC 8551 §2.5.2), routes on the attribute OID, and recognize-and-defers an
+ *   (RFC 8551 sec. 2.5.2), routes on the attribute OID, and recognize-and-defers an
  *   unknown attribute type with its raw values intact.
  *
- *   Structure is decoded; verification is the consumer's — the parser surfaces
+ *   Structure is decoded; verification is the consumer's -- the parser surfaces
  *   `certHash` + `hashAlgorithm` + `issuerSerial` so a verifier recomputes the
  *   certificate hash (compose `webcrypto`) and matches the issuer/serial against
  *   the actual signing certificate; it never recomputes a hash or trusts a cert.
@@ -36,7 +36,7 @@
  *
  * @card
  *   Decode RFC 5035 ESS SigningCertificate / SigningCertificateV2 and RFC 8551
- *   SMIMECapabilities signed-attribute values — cert-hash binding, validated
+ *   SMIMECapabilities signed-attribute values -- cert-hash binding, validated
  *   issuer GeneralNames, ordered capability list, OID-dispatched, fail-closed.
  */
 
@@ -54,7 +54,7 @@ var TAGS = asn1.TAGS;
 
 var ALGID = pkix.algorithmIdentifier(NS);
 
-// Registry constants — never a dotted literal in a format module.
+// Registry constants -- never a dotted literal in a format module.
 var OID_SHA1 = oid.byName("sha1");
 var OID_SHA256 = oid.byName("sha256");
 var OID_SIGNING_CERTIFICATE = oid.byName("signingCertificate");
@@ -62,15 +62,15 @@ var OID_SIGNING_CERTIFICATE_V2 = oid.byName("signingCertificateV2");
 var OID_SMIME_CAPABILITIES = oid.byName("smimeCapabilities");
 
 // IssuerSerial ::= SEQUENCE { issuer GeneralNames, serialNumber CertificateSerialNumber }
-// (RFC 5035 App A). A bare universal SEQUENCE of exactly two fields — distinct
+// (RFC 5035 App A). A bare universal SEQUENCE of exactly two fields -- distinct
 // from the RFC 5755 attribute-certificate IssuerSerial (three fields, reached
 // IMPLICIT-tagged), so declared per-format. `issuer` composes the shared
 // GeneralNames factory (every CHOICE arm validated + surfaced raw, SIZE 1..MAX)
-// and is surfaced unchanged here: the RFC 5035 §5 directoryName narrowing applies
+// and is surfaced unchanged here: the RFC 5035 sec. 5 directoryName narrowing applies
 // only to a non-attribute (public-key) certificate reference, and an ESSCertID
 // entry may reference an attribute certificate whose issuer is a full GeneralNames.
-// The FIRST cert is known to be the signing public-key cert (RFC 5035 §3), so the
-// directoryName rule is enforced there — in the SigningCertificate build — not here.
+// The FIRST cert is known to be the signing public-key cert (RFC 5035 sec. 3), so the
+// directoryName rule is enforced there -- in the SigningCertificate build -- not here.
 var GENERAL_NAME_DIRECTORY = 4;
 var ISSUER_SERIAL = schema.seq([
   schema.field("issuer", pkix.generalNames(NS, { code: "smime/bad-general-names" })),
@@ -86,21 +86,21 @@ var ISSUER_SERIAL = schema.seq([
   },
 });
 
-// RFC 5035 §5: the signing certificate (certs[0], the public-key cert that made
-// the signature per §3) MUST identify its issuer as exactly one directoryName [4].
+// RFC 5035 sec. 5: the signing certificate (certs[0], the public-key cert that made
+// the signature per sec. 3) MUST identify its issuer as exactly one directoryName [4].
 // Additional certs[1..] may reference attribute certificates, whose issuer is a
-// GeneralNames — left unconstrained (a verifier-tier profile concern). `fail`
+// GeneralNames -- left unconstrained (a verifier-tier profile concern). `fail`
 // throws the caller's code.
 function assertSignerIssuerIsDirectoryName(certs, fail) {
   if (!certs.length || !certs[0].issuerSerial) return;
   var names = certs[0].issuerSerial.issuer.names;
   if (names.length !== 1 || names[0].tagClass !== "context" || names[0].tagNumber !== GENERAL_NAME_DIRECTORY) {
-    fail("the signing certificate's IssuerSerial issuer MUST be exactly one directoryName [4] GeneralName (RFC 5035 §5)");
+    fail("the signing certificate's IssuerSerial issuer MUST be exactly one directoryName [4] GeneralName (RFC 5035 sec. 5)");
   }
 }
 
 // PolicyInformation ::= SEQUENCE { policyIdentifier CertPolicyId,
-//   policyQualifiers SEQUENCE OF PolicyQualifierInfo OPTIONAL } (RFC 5280 §4.2.1.4).
+//   policyQualifiers SEQUENCE OF PolicyQualifierInfo OPTIONAL } (RFC 5280 sec. 4.2.1.4).
 // Decode the policy OID (+ registry name); surface policyQualifiers raw.
 var POLICY_INFORMATION = schema.seq([
   schema.field("policyIdentifier", schema.oidLeaf()),
@@ -111,7 +111,7 @@ var POLICY_INFORMATION = schema.seq([
     var qualifiers = null;
     if (m.fields.policyQualifiers.present) {
       // The qualifier body stays raw (per the ESS scope), but the RFC 5280
-      // §4.2.1.4 structure is validated fail-closed by the shared assertion — the
+      // sec. 4.2.1.4 structure is validated fail-closed by the shared assertion -- the
       // same PolicyInformation shape the certificatePolicies decoder enforces.
       var q = m.fields.policyQualifiers.node;
       pkix.assertPolicyQualifiers(q, function (msg, cause) { throw ctx.E("smime/bad-policy-information", msg, cause); });
@@ -124,7 +124,7 @@ var POLICY_INFORMATION = schema.seq([
     };
   },
 });
-// policies SEQUENCE OF PolicyInformation OPTIONAL — order-preserving; the ASN.1
+// policies SEQUENCE OF PolicyInformation OPTIONAL -- order-preserving; the ASN.1
 // module carries no SIZE bound, so an explicitly present but empty list is legal.
 var POLICIES = schema.seqOf(POLICY_INFORMATION, {
   assert: "sequence", min: 0, code: "smime/bad-policies", what: "policies",
@@ -132,7 +132,7 @@ var POLICIES = schema.seqOf(POLICY_INFORMATION, {
 });
 
 // ESSCertID ::= SEQUENCE { certHash Hash, issuerSerial IssuerSerial OPTIONAL }
-// (RFC 5035 §5.4.2). Hash ::= OCTET STRING — for v1 it is the SHA-1 hash of the
+// (RFC 5035 sec. 5.4.2). Hash ::= OCTET STRING -- for v1 it is the SHA-1 hash of the
 // whole certificate with NO algorithm field, so the hash algorithm is SYNTHESIZED
 // as the implied SHA-1 to make v1 shape-compatible with v2 for a verifier.
 var ESS_CERT_ID = schema.seq([
@@ -151,7 +151,7 @@ var ESS_CERT_ID = schema.seq([
 
 // ESSCertIDv2 ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier DEFAULT
 //   {algorithm id-sha256}, certHash Hash, issuerSerial IssuerSerial OPTIONAL }
-// (RFC 5035 §5.4.1 / §4). The mandatory certHash OCTET STRING pivots between the
+// (RFC 5035 sec. 5.4.1 / sec. 4). The mandatory certHash OCTET STRING pivots between the
 // two optional SEQUENCEs, so a leading SEQUENCE is hashAlgorithm and a leading
 // OCTET STRING means hashAlgorithm defaulted.
 var ESS_CERT_ID_V2 = schema.seq([
@@ -164,7 +164,7 @@ var ESS_CERT_ID_V2 = schema.seq([
     var hashAlgorithm;
     if (m.fields.hashAlgorithm.present) {
       var alg = m.fields.hashAlgorithm.value.result;
-      // X.690 §11.5: a DEFAULT value MUST be omitted in DER. The default is
+      // X.690 sec. 11.5: a DEFAULT value MUST be omitted in DER. The default is
       // {algorithm id-sha256, parameters ABSENT}; an explicit encoding byte-equal
       // to it is a non-canonical DEFAULT and is rejected fail-closed (the
       // structured-value analogue of the primitive-DEFAULT rejection the toolkit
@@ -172,7 +172,7 @@ var ESS_CERT_ID_V2 = schema.seq([
       // parameters is NOT byte-equal to the params-absent default and decodes.
       if (alg.oid === OID_SHA256 && alg.parameters === null) {
         throw ctx.E("smime/non-canonical-default",
-          "ESSCertIDv2 hashAlgorithm equal to the DEFAULT {algorithm id-sha256} MUST be omitted (X.690 §11.5)");
+          "ESSCertIDv2 hashAlgorithm equal to the DEFAULT {algorithm id-sha256} MUST be omitted (X.690 sec. 11.5)");
       }
       hashAlgorithm = { oid: alg.oid, name: alg.name, parameters: alg.parameters, defaulted: false };
     } else {
@@ -187,9 +187,9 @@ var ESS_CERT_ID_V2 = schema.seq([
 });
 
 // SigningCertificate ::= SEQUENCE { certs SEQUENCE OF ESSCertID,
-//   policies SEQUENCE OF PolicyInformation OPTIONAL } (RFC 5035 §5.4.2). certs is
-// order-preserving — RFC 5035 §3 makes the FIRST element the signing certificate
-// — and non-empty (an empty certs cannot name a signing cert).
+//   policies SEQUENCE OF PolicyInformation OPTIONAL } (RFC 5035 sec. 5.4.2). certs is
+// order-preserving -- RFC 5035 sec. 3 makes the FIRST element the signing certificate
+// -- and non-empty (an empty certs cannot name a signing cert).
 function signingCertificateSchema(essCertId, code, what) {
   return schema.seq([
     schema.field("certs", schema.seqOf(essCertId, { assert: "sequence", min: 1, code: "smime/bad-certs", what: "certs" })),
@@ -210,8 +210,8 @@ var SIGNING_CERTIFICATE = signingCertificateSchema(ESS_CERT_ID, "smime/bad-signi
 var SIGNING_CERTIFICATE_V2 = signingCertificateSchema(ESS_CERT_ID_V2, "smime/bad-signing-certificate-v2", "SigningCertificateV2");
 
 // SMIMECapability ::= SEQUENCE { capabilityID OBJECT IDENTIFIER,
-//   parameters ANY DEFINED BY capabilityID OPTIONAL } (RFC 8551 §2.5.2). Distinct
-// domain from AlgorithmIdentifier though isomorphic — surfaced as capabilityID +
+//   parameters ANY DEFINED BY capabilityID OPTIONAL } (RFC 8551 sec. 2.5.2). Distinct
+// domain from AlgorithmIdentifier though isomorphic -- surfaced as capabilityID +
 // raw parameters (the ANY-DEFINED-BY interpretation is a negotiation concern).
 var SMIME_CAPABILITY = schema.seq([
   schema.field("capabilityID", schema.oidLeaf()),
@@ -226,8 +226,8 @@ var SMIME_CAPABILITY = schema.seq([
     };
   },
 });
-// SMIMECapabilities ::= SEQUENCE OF SMIMECapability — ordered by preference
-// (RFC 8551 §2.5.2), never sorted; an empty list is legal.
+// SMIMECapabilities ::= SEQUENCE OF SMIMECapability -- ordered by preference
+// (RFC 8551 sec. 2.5.2), never sorted; an empty list is legal.
 var SMIME_CAPABILITIES = schema.seqOf(SMIME_CAPABILITY, {
   assert: "sequence", min: 0, code: "smime/bad-capabilities", what: "SMIMECapabilities",
   build: function (m) { return { capabilities: m.items.map(function (it) { return it.value.result; }) }; },
@@ -241,7 +241,7 @@ var SMIME_CAPABILITIES = schema.seqOf(SMIME_CAPABILITY, {
  * @spec       RFC 5035, RFC 2634
  * @related    pki.schema.smime.parseSigningCertificateV2, pki.schema.smime.decodeAttribute
  *
- * Decode an ESS v1 `SigningCertificate` attribute value (RFC 5035 §5.4.2) — the
+ * Decode an ESS v1 `SigningCertificate` attribute value (RFC 5035 sec. 5.4.2) -- the
  * raw `AttributeValue` a CMS consumer plucks off `SignerInfo.signedAttrs`. Returns
  * `{ certs, policies }`: each `certs` entry is `{ certHash, hashAlgorithm,
  * issuerSerial }` in wire order (the first is the signing certificate), where
@@ -266,12 +266,12 @@ var parseSigningCertificate = pkix.makeParser({ pemLabel: null, PemError: PemErr
  * @spec       RFC 5035, RFC 5816
  * @related    pki.schema.smime.parseSigningCertificate, pki.schema.smime.decodeAttribute
  *
- * Decode an ESS v2 `SigningCertificateV2` attribute value (RFC 5035 §5.4.1).
+ * Decode an ESS v2 `SigningCertificateV2` attribute value (RFC 5035 sec. 5.4.1).
  * Identical shape to v1 but each `certs` entry carries a real `hashAlgorithm`:
- * decoded when present, or the RFC 5035 §4 default `id-sha256` (with
+ * decoded when present, or the RFC 5035 sec. 4 default `id-sha256` (with
  * `defaulted: true`) when omitted. An explicit `hashAlgorithm` byte-equal to that
  * default is a non-canonical DER encoding and is rejected `smime/non-canonical-default`
- * (X.690 §11.5). Throws a typed `smime/*` error on malformed input.
+ * (X.690 sec. 11.5). Throws a typed `smime/*` error on malformed input.
  *
  * @example
  *   var b = pki.asn1.build;
@@ -290,8 +290,8 @@ var parseSigningCertificateV2 = pkix.makeParser({ pemLabel: null, PemError: PemE
  * @spec       RFC 8551
  * @related    pki.schema.smime.decodeAttribute
  *
- * Decode an `SMIMECapabilities` attribute value (RFC 8551 §2.5.2) into
- * `{ capabilities }` — an ORDERED list (preference order, never sorted), each
+ * Decode an `SMIMECapabilities` attribute value (RFC 8551 sec. 2.5.2) into
+ * `{ capabilities }` -- an ORDERED list (preference order, never sorted), each
  * `{ capabilityID, name, parameters }` with `parameters` the raw
  * `ANY DEFINED BY capabilityID` bytes (or `null`). Throws a typed `smime/*` error
  * on malformed input.
@@ -315,8 +315,8 @@ var parseSmimeCapabilities = pkix.makeParser({ pemLabel: null, PemError: PemErro
  * OID-dispatch convenience over the three value decoders for a CMS-shaped
  * `{ type, values }` attribute (the shape `cms.parse` surfaces on
  * `signerInfos[i].signedAttrs`). Enforces the single-`AttributeValue` rule
- * (RFC 8551 §2.5.2 / §2.5) — a `values` length other than 1 is rejected
- * `smime/multi-valued-attribute` — then routes on `attr.type`:
+ * (RFC 8551 sec. 2.5.2 / sec. 2.5) -- a `values` length other than 1 is rejected
+ * `smime/multi-valued-attribute` -- then routes on `attr.type`:
  * `signingCertificate` / `signingCertificateV2` / `smimeCapabilities` decode to
  * `{ kind, ...result }`; any other type is recognize-and-deferred
  * `smime/unsupported-attribute` (its `type`, registry `name`, and raw `values`
@@ -334,14 +334,14 @@ function decodeAttribute(attr) {
     throw new SmimeError("smime/bad-input", "decodeAttribute expects a CMS attribute { type, values }");
   }
   // Route on the attribute OID FIRST. The single-AttributeValue MUST (RFC 8551
-  // §2.5.2) is specific to the ESS / SMIMECapabilities attributes, so it is
+  // sec. 2.5.2) is specific to the ESS / SMIMECapabilities attributes, so it is
   // enforced only inside the known-type branch; an unknown / custom attribute
   // recognize-and-defers with its raw values intact regardless of value count
   // (its own cardinality rules are not this decoder's to enforce).
   if (attr.type === OID_SIGNING_CERTIFICATE || attr.type === OID_SIGNING_CERTIFICATE_V2 || attr.type === OID_SMIME_CAPABILITIES) {
     if (attr.values.length !== 1) {
       throw new SmimeError("smime/multi-valued-attribute",
-        "an ESS / SMIMECapabilities attribute MUST carry exactly one AttributeValue, got " + attr.values.length + " (RFC 8551 §2.5.2)");
+        "an ESS / SMIMECapabilities attribute MUST carry exactly one AttributeValue, got " + attr.values.length + " (RFC 8551 sec. 2.5.2)");
     }
     var value = attr.values[0];
     if (attr.type === OID_SIGNING_CERTIFICATE) { var v1 = parseSigningCertificate(value); return { kind: "signingCertificate", certs: v1.certs, policies: v1.policies }; }

package/lib/schema-tsp.js

@@ -10,7 +10,7 @@
  *
  * @intro
  *   RFC 3161 Time-Stamp Protocol handling. A `TimeStampResp` is what a client
- *   receives from a TSA — a `PKIStatusInfo` plus, on success, a `TimeStampToken`;
+ *   receives from a TSA -- a `PKIStatusInfo` plus, on success, a `TimeStampToken`;
  *   `parse` decodes it and enforces the status-to-token coupling (a granted
  *   response carries a token, a rejection does not). A `TimeStampToken` is itself a
  *   CMS SignedData whose encapsulated content is a `TSTInfo`, so `parseToken`
@@ -21,13 +21,14 @@
  *   The parser surfaces everything a verifier needs and interprets nothing it
  *   cannot: `messageImprint.hashAlgorithm` and the raw `hashedMessage`, the
  *   `genTime` (with sub-second precision), the `serialNumber` and `nonce` (lossless,
- *   as BigInt + hex), and the `policy`. The imprint-to-request and nonce-to-request
- *   round-trips, the ESS signing-certificate binding, the timestamping EKU, and the
- *   signature are verification-layer concerns above parse altitude. DER-only,
- *   fail-closed.
+ *   as BigInt + hex), and the `policy`. The PRESENCE of the ESS
+ *   SigningCertificate(V2) attribute is asserted at parse (a structural token
+ *   property); the imprint-to-request and nonce-to-request round-trips, the ESS
+ *   hash-vs-certificate binding, the timestamping EKU, and the signature are
+ *   verification-layer concerns above parse altitude. DER-only, fail-closed.
  *
  * @card
- *   Parse DER / PEM RFC 3161 timestamp responses and tokens — per-response status,
+ *   Parse DER / PEM RFC 3161 timestamp responses and tokens -- per-response status,
  *   the TSTInfo payload (imprint, genTime, serial, nonce, accuracy), raw verifier
  *   inputs, single-signer token composition over CMS, fail-closed.
  */
@@ -47,16 +48,22 @@ var NS = pkix.makeNS("tsp", TspError, oid);
 var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
 var EXTENSION = pkix.extension(NS);
 
-// TSTInfo.version is INTEGER { v1(1) } — the only legal value is 1.
+// TSTInfo.version is INTEGER { v1(1) } -- the only legal value is 1.
 var VERSION = pkix.versionReader(NS, { "1": 1 });
 
 // id-ct-TSTInfo is the eContentType that identifies a timestamp token (RFC 3161
-// §2.4.2); resolved from the registry, never a dotted literal.
+// sec. 2.4.2); resolved from the registry, never a dotted literal.
 var OID_TST_INFO = oid.byName("tSTInfo");
 
+// The ESS certificate-identifier attributes: RFC 3161 sec. 2.4.2 requires the TSA
+// certificate identifier as a SigningCertificate signed attribute; RFC 5816
+// additionally permits SigningCertificateV2.
+var OID_SIGNING_CERT = oid.byName("signingCertificate");
+var OID_SIGNING_CERT_V2 = oid.byName("signingCertificateV2");
+
 var TAGS = asn1.TAGS;
 
-// PKIFailureInfo ::= BIT STRING NamedBitList (RFC 3161 §2.4.2). bit 0 is the MSB of
+// PKIFailureInfo ::= BIT STRING NamedBitList (RFC 3161 sec. 2.4.2). bit 0 is the MSB of
 // the first content octet; a set bit outside the named set is surfaced by index.
 var FAILURE_BITS = {
   0: "badAlg", 2: "badRequest", 5: "badDataFormat", 14: "timeNotAvailable",
@@ -65,33 +72,23 @@ var FAILURE_BITS = {
 
 // ---- shared leaves ---------------------------------------------------
 
-// GeneralizedTime-only leaf. RFC 3161 §2.4.2 requires genTime to be GeneralizedTime,
+// GeneralizedTime-only leaf. RFC 3161 sec. 2.4.2 requires genTime to be GeneralizedTime,
 // never UTCTime; assert the tag before the (fractional-capable) codec read.
-var GEN_TIME = schema.decode(function (n, ctx) {
-  if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
-    throw ctx.E("tsp/bad-gentime", "genTime must be a GeneralizedTime (RFC 3161 §2.4.2)");
-  }
-  // RFC 3161 genTime may carry sub-second precision (X.690 §11.7 fractional profile).
-  return asn1.read.time(n, { allowFractional: true });
-});
+// RFC 3161 genTime may carry sub-second precision (X.690 sec. 11.7 fractional profile).
+var GEN_TIME = pkix.generalizedTime(NS, { code: "tsp/bad-gentime", message: "genTime must be a GeneralizedTime (RFC 3161 sec. 2.4.2)", allowFractional: true });
 
-// tsa [0] EXPLICIT GeneralName (RFC 3161 §2.4.2) — validated + surfaced raw via the
-// shared pkix.generalName primitive (RFC 5280 §4.2.1.6), which checks the chosen
+// tsa [0] EXPLICIT GeneralName (RFC 3161 sec. 2.4.2) -- validated + surfaced raw via the
+// shared pkix.generalName primitive (RFC 5280 sec. 4.2.1.6), which checks the chosen
 // alternative's form and content so a malformed GeneralName fails closed.
 var GENERAL_NAME_RAW = pkix.generalName(NS, { code: "tsp/bad-tsa" });
 
-// A PKIFreeText element MUST be a UTF8String (RFC 3161 §2.4.2).
-var UTF8_TEXT = schema.decode(function (n, ctx) {
-  if (n.tagClass !== "universal" || n.tagNumber !== TAGS.UTF8_STRING) {
-    throw ctx.E("tsp/bad-status-info", "PKIFreeText elements must be UTF8String");
-  }
-  return asn1.read.string(n);
-});
+// A PKIFreeText element MUST be a UTF8String (RFC 3161 sec. 2.4.2).
+var UTF8_TEXT = pkix.utf8Text(NS, { code: "tsp/bad-status-info", message: "PKIFreeText elements must be UTF8String" });
 
 // ---- MessageImprint --------------------------------------------------
 
 // MessageImprint ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier, hashedMessage
-// OCTET STRING } (RFC 3161 §2.4.1). hashedMessage is a digest — surfaced RAW.
+// OCTET STRING } (RFC 3161 sec. 2.4.1). hashedMessage is a digest -- surfaced RAW.
 var MESSAGE_IMPRINT = schema.seq([
   schema.field("hashAlgorithm", ALGORITHM_IDENTIFIER),
   schema.field("hashedMessage", schema.octetString()),
@@ -106,7 +103,7 @@ var MESSAGE_IMPRINT = schema.seq([
 
 // Accuracy ::= SEQUENCE { seconds INTEGER OPTIONAL, millis [0] IMPLICIT INTEGER
 // (1..999) OPTIONAL, micros [1] IMPLICIT INTEGER (1..999) OPTIONAL } (RFC 3161
-// §2.4.2). Every sub-field is optional; a missing one defaults to 0.
+// sec. 2.4.2). Every sub-field is optional; a missing one defaults to 0.
 var ACCURACY = schema.seq([
   schema.optional("seconds", schema.integerLeaf(), { whenUniversal: [TAGS.INTEGER] }),
   schema.trailing([
@@ -119,13 +116,19 @@ var ACCURACY = schema.seq([
     function sub(f) {
       if (!f.present) return 0;
       var v = f.value;
-      // millis / micros are constrained to 1..999 (RFC 3161 §2.4.2); 0 is also
+      // millis / micros are constrained to 1..999 (RFC 3161 sec. 2.4.2); 0 is also
       // excluded (and non-canonical for a positive count).
       if (v < 1n || v > 999n) throw NS.E("tsp/bad-accuracy", "Accuracy millis/micros must be in 1..999");
       return Number(v);
     }
+    // Accuracy is the +/- deviation added to and subtracted from genTime (RFC
+    // 3161 sec. 2.4.2), so a negative seconds inverts the time window a verifier
+    // computes -- the same semantically-impossible class as a 0 millis/micros.
+    if (m.fields.seconds.present && m.fields.seconds.value < 0n) {
+      throw NS.E("tsp/bad-accuracy", "Accuracy seconds must not be negative (RFC 3161 sec. 2.4.2)");
+    }
     return {
-      // seconds is an unbounded INTEGER — keep it lossless as a BigInt (millis /
+      // seconds is an unbounded INTEGER -- keep it lossless as a BigInt (millis /
       // micros are constrained to 1..999, so Number is exact for those).
       seconds: m.fields.seconds.present ? m.fields.seconds.value : 0n,
       millis: sub(m.fields.millis),
@@ -139,7 +142,7 @@ var ACCURACY = schema.seq([
 // TSTInfo ::= SEQUENCE { version, policy, messageImprint, serialNumber, genTime,
 // accuracy OPTIONAL, ordering DEFAULT FALSE, nonce OPTIONAL, tsa [0] EXPLICIT
 // GeneralName OPTIONAL, extensions [1] IMPLICIT Extensions OPTIONAL } (RFC 3161
-// §2.4.2). The five mandatory fields come first; the optionals are consumed by tag.
+// sec. 2.4.2). The five mandatory fields come first; the optionals are consumed by tag.
 var TST_INFO = schema.seq([
   schema.field("version", VERSION),
   schema.field("policy", schema.oidLeaf()),
@@ -156,9 +159,9 @@ var TST_INFO = schema.seq([
 ], {
   assert: "sequence", code: "tsp/bad-tst-info", what: "TSTInfo",
   build: function (m, ctx) {
-    // ordering BOOLEAN DEFAULT FALSE — an explicit FALSE must be omitted (DER).
+    // ordering BOOLEAN DEFAULT FALSE -- an explicit FALSE must be omitted (DER).
     if (m.fields.ordering.present && m.fields.ordering.value === false) {
-      throw NS.E("tsp/bad-ordering", "ordering is BOOLEAN DEFAULT FALSE — an explicit FALSE must be omitted");
+      throw NS.E("tsp/bad-ordering", "ordering is BOOLEAN DEFAULT FALSE -- an explicit FALSE must be omitted");
     }
     var policy = m.fields.policy.value;
     var tsa = m.fields.tsa;
@@ -187,7 +190,7 @@ var TST_INFO = schema.seq([
 // ---- PKIStatusInfo / TimeStampResp -----------------------------------
 
 // PKIStatusInfo ::= SEQUENCE { status PKIStatus (INTEGER), statusString PKIFreeText
-// OPTIONAL, failInfo PKIFailureInfo OPTIONAL } (RFC 3161 §2.4.2, from RFC 4210).
+// OPTIONAL, failInfo PKIFailureInfo OPTIONAL } (RFC 3161 sec. 2.4.2, from RFC 4210).
 var PKI_STATUS_INFO = schema.seq([
   schema.field("status", schema.integerLeaf()),
   schema.optional("statusString", schema.seqOf(UTF8_TEXT, { assert: "sequence", min: 1, code: "tsp/bad-status-info", what: "statusString" }), { whenUniversal: [TAGS.SEQUENCE] }),
@@ -197,7 +200,7 @@ var PKI_STATUS_INFO = schema.seq([
   build: function (m) {
     var status = m.fields.status.value;
     // PKIStatus ::= INTEGER { granted(0) .. revocationNotification(5) }.
-    if (status < 0n || status > 5n) throw NS.E("tsp/bad-status", "PKIStatus " + status + " is outside 0..5 (RFC 3161 §2.4.2)");
+    if (status < 0n || status > 5n) throw NS.E("tsp/bad-status", "PKIStatus " + status + " is outside 0..5 (RFC 3161 sec. 2.4.2)");
     var failInfo = null;
     if (m.fields.failInfo.present) {
       var bs = m.fields.failInfo.value;
@@ -212,7 +215,7 @@ var PKI_STATUS_INFO = schema.seq([
   },
 });
 
-// X.690 §11.2.2 — a BIT STRING typed with a NamedBitList (PKIFailureInfo) MUST have
+// X.690 sec. 11.2.2 -- a BIT STRING typed with a NamedBitList (PKIFailureInfo) MUST have
 // all trailing 0 bits removed under DER: no trailing all-zero content octet, and the
 // declared unusedBits must sit exactly below the lowest set bit of the last octet (so
 // the encoding is minimal). The empty value encodes as 0 content octets, 0 unusedBits.
@@ -221,15 +224,15 @@ function _assertMinimalNamedBits(unusedBits, bytes) {
 }
 
 // Decode the set NamedBitList bits to their RFC 3161 names (bit 0 = MSB of byte 0).
-// A set bit outside the defined set is an unsupported PKIFailureInfo value — a client
-// MUST error on a failInfo it does not understand (RFC 3161 §2.4.2), so reject it
+// A set bit outside the defined set is an unsupported PKIFailureInfo value -- a client
+// MUST error on a failInfo it does not understand (RFC 3161 sec. 2.4.2), so reject it
 // rather than surfacing an opaque "bitN".
 function _namedBits(bytes) {
   var out = [];
   for (var i = 0; i < bytes.length * 8; i++) {
     if ((bytes[i >> 3] >> (7 - (i & 7))) & 1) {
       var nm = FAILURE_BITS[i];
-      if (!nm) throw NS.E("tsp/bad-failinfo", "unsupported PKIFailureInfo bit " + i + " (RFC 3161 §2.4.2)");
+      if (!nm) throw NS.E("tsp/bad-failinfo", "unsupported PKIFailureInfo bit " + i + " (RFC 3161 sec. 2.4.2)");
       out.push(nm);
     }
   }
@@ -237,8 +240,10 @@ function _namedBits(bytes) {
 }
 
 // TimeStampResp ::= SEQUENCE { status PKIStatusInfo, timeStampToken TimeStampToken
-// OPTIONAL } (RFC 3161 §2.4.2). There is NO version field. The token is a CMS
+// OPTIONAL } (RFC 3161 sec. 2.4.2). There is NO version field. The token is a CMS
 // ContentInfo, decoded via cms.parse; the status-to-token coupling is load-bearing.
+// The top-level reject code predates the `<prefix>/not-a-<structure>` convention
+// and stays frozen on the public error-code surface.
 var TIME_STAMP_RESP = schema.seq([
   schema.field("status", PKI_STATUS_INFO),
   schema.optional("timeStampToken", schema.any(), { whenUniversal: [TAGS.SEQUENCE] }),
@@ -247,15 +252,15 @@ var TIME_STAMP_RESP = schema.seq([
   build: function (m) {
     var status = m.fields.status.value.result;
     var present = m.fields.timeStampToken.present;
-    // RFC 3161 §2.4.2 — granted / grantedWithMods carry a token; any other status
+    // RFC 3161 sec. 2.4.2 -- granted / grantedWithMods carry a token; any other status
     // (rejection / waiting / revocation*) MUST NOT.
     var granted = status.status === 0 || status.status === 1;
-    if (granted && !present) throw NS.E("tsp/missing-token", "a granted TimeStampResp must carry a timeStampToken (RFC 3161 §2.4.2)");
-    if (!granted && present) throw NS.E("tsp/unexpected-token", "a non-granted TimeStampResp must not carry a timeStampToken (RFC 3161 §2.4.2)");
+    if (granted && !present) throw NS.E("tsp/missing-token", "a granted TimeStampResp must carry a timeStampToken (RFC 3161 sec. 2.4.2)");
+    if (!granted && present) throw NS.E("tsp/unexpected-token", "a non-granted TimeStampResp must not carry a timeStampToken (RFC 3161 sec. 2.4.2)");
     // failInfo is the reason a request was rejected, so it is present ONLY when the
-    // status is rejection(2) — not on granted(0/1) nor on waiting / revocation* (3/4/5).
-    if (status.status !== 2 && status.failInfo) throw NS.E("tsp/unexpected-failinfo", "failInfo is present only when the status is rejection(2) (RFC 3161 §2.4.2)");
-    // A granted response's timeStampToken MUST be a well-formed TimeStampToken —
+    // status is rejection(2) -- not on granted(0/1) nor on waiting / revocation* (3/4/5).
+    if (status.status !== 2 && status.failInfo) throw NS.E("tsp/unexpected-failinfo", "failInfo is present only when the status is rejection(2) (RFC 3161 sec. 2.4.2)");
+    // A granted response's timeStampToken MUST be a well-formed TimeStampToken --
     // decode it (composing the CMS parser) rather than surfacing arbitrary SEQUENCE
     // bytes as a token; a malformed token fails the response parse.
     return {
@@ -275,8 +280,8 @@ var TIME_STAMP_RESP = schema.seq([
  * @spec       RFC 3161
  * @related    pki.schema.tsp.parseToken, pki.schema.tsp.parse
  *
- * Parse a bare `TSTInfo` payload (a DER `Buffer`) — the structure a timestamp token
- * encapsulates — into `{ version, policy, messageImprint, serialNumber, genTime,
+ * Parse a bare `TSTInfo` payload (a DER `Buffer`) -- the structure a timestamp token
+ * encapsulates -- into `{ version, policy, messageImprint, serialNumber, genTime,
  * accuracy, ordering, nonce, tsa, extensions }`. `messageImprint.hashedMessage` is
  * the raw digest; `serialNumber` / `nonce` are lossless (BigInt + hex); `genTime` is
  * a `Date` with sub-second precision. A malformed structure throws a typed
@@ -299,7 +304,7 @@ var parseTstInfo = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorCl
  *
  * Parse a DER `Buffer` or a PEM string into a `TimeStampResp`: `{ status,
  * statusString, failInfo, timeStampToken }`. The status-to-token coupling is
- * enforced — a granted response (status 0/1) carries `timeStampToken` (surfaced raw
+ * enforced -- a granted response (status 0/1) carries `timeStampToken` (surfaced raw
  * for `parseToken`), any other status does not. `failInfo` decodes the
  * `PKIFailureInfo` named bits. A malformed structure throws a typed `TspError`.
  *
@@ -318,13 +323,17 @@ var parse = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: Ts
  * @spec       RFC 3161, RFC 5652
  * @related    pki.schema.tsp.parse, pki.schema.cms.parse
  *
- * Parse a `TimeStampToken` (a DER `Buffer` or PEM) — a CMS SignedData whose
+ * Parse a `TimeStampToken` (a DER `Buffer` or PEM) -- a CMS SignedData whose
  * encapsulated content is a `TSTInfo`. Composes `pki.schema.cms.parse`, asserts the
  * `id-ct-TSTInfo` content type (`tsp/wrong-econtent-type`), that the content is
- * attached (`tsp/detached-token`), and the single-signer rule (`tsp/multi-signer`,
- * RFC 3161 §2.4.2), then decodes the inner `TSTInfo`. Returns `{ tstInfo, eContent,
- * signerInfo, certificates }` — the decoded payload, the raw eContent bytes a verifier
- * hashes for the CMS message-digest, and the CMS signer material.
+ * attached (`tsp/detached-token`), the single-signer rule (`tsp/multi-signer`,
+ * RFC 3161 sec. 2.4.2), and that the signerInfo carries a SigningCertificate or
+ * SigningCertificateV2 signed attribute (`tsp/missing-signing-certificate`,
+ * RFC 3161 sec. 2.4.2 / RFC 5816 -- the hash-vs-certificate binding stays a
+ * verification-layer concern), then decodes the inner `TSTInfo`. Returns
+ * `{ tstInfo, eContent, signerInfo, certificates }` -- the decoded payload, the raw
+ * eContent bytes a verifier hashes for the CMS message-digest, and the CMS signer
+ * material.
  *
  * @example
  *   var token = pki.schema.tsp.parseToken(tokenDer);
@@ -333,10 +342,10 @@ var parse = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: Ts
  */
 function parseToken(input) {
   // De-armor with TSP's label-agnostic PEM rules first (RFC 3161 has no standard
-  // label), THEN hand DER to the CMS parser — otherwise cms.parse would reject any
+  // label), THEN hand DER to the CMS parser -- otherwise cms.parse would reject any
   // PEM block not labeled "CMS" before the TSP checks run.
   var der = pkix.coerceToDer(input, { pemLabel: null, PemError: PemError, ErrorClass: TspError, prefix: "tsp" });
-  // Wrap the CMS decode so tsp.parse / parseToken keep their typed-TspError contract —
+  // Wrap the CMS decode so tsp.parse / parseToken keep their typed-TspError contract --
   // a malformed token surfaces tsp/bad-token, not a bare cms/* error.
   var signed;
   try { signed = cms.parse(der); }
@@ -344,13 +353,35 @@ function parseToken(input) {
     if (e instanceof TspError) throw e;
     throw new TspError("tsp/bad-token", "the timeStampToken did not decode as a CMS SignedData: " + ((e && e.message) || String(e)), e);
   }
+  // cms.parse decodes every CMS content type; a TimeStampToken MUST be a
+  // SignedData (RFC 3161 sec. 2.4.2). Gate on the dispatched content type before
+  // any SignedData-only field access -- an AuthenticatedData / EnvelopedData
+  // whose eContentType happens to be id-ct-TSTInfo would otherwise reach a raw
+  // TypeError on the absent signerInfos.
+  if (signed.contentTypeName !== "signedData") {
+    throw new TspError("tsp/not-signed-data", "a TimeStampToken must be a CMS SignedData, got " + (signed.contentTypeName || signed.contentType));
+  }
   var encap = signed.encapContentInfo;
   if (encap.eContentType !== OID_TST_INFO) {
     throw new TspError("tsp/wrong-econtent-type", "a TimeStampToken must encapsulate id-ct-TSTInfo, got " + encap.eContentType);
   }
-  if (encap.eContent === null) throw new TspError("tsp/detached-token", "a TimeStampToken must carry attached eContent (RFC 3161 §2.4.2)");
+  if (encap.eContent === null) throw new TspError("tsp/detached-token", "a TimeStampToken must carry attached eContent (RFC 3161 sec. 2.4.2)");
   if (signed.signerInfos.length !== 1) {
-    throw new TspError("tsp/multi-signer", "a TimeStampToken must contain exactly one (TSA) signerInfo (RFC 3161 §2.4.2)");
+    throw new TspError("tsp/multi-signer", "a TimeStampToken must contain exactly one (TSA) signerInfo (RFC 3161 sec. 2.4.2)");
+  }
+  // RFC 3161 sec. 2.4.2 / RFC 5816 -- the TSA certificate identifier MUST be present
+  // as a SigningCertificate (or SigningCertificateV2) signed attribute. Presence
+  // is a structural token property, same altitude as the single-signer rule; the
+  // hash-vs-certificate BINDING stays a verification-layer concern. signedAttrs
+  // is non-null here: the CMS parse already required it for a non-id-data
+  // eContentType (RFC 5652 sec. 5.3), and the eContentType is id-ct-TSTInfo.
+  var signedAttrs = signed.signerInfos[0].signedAttrs || [];
+  var hasSigningCert = false;
+  for (var a = 0; a < signedAttrs.length; a++) {
+    if (signedAttrs[a].type === OID_SIGNING_CERT || signedAttrs[a].type === OID_SIGNING_CERT_V2) { hasSigningCert = true; break; }
+  }
+  if (!hasSigningCert) {
+    throw new TspError("tsp/missing-signing-certificate", "a TimeStampToken signerInfo must carry a SigningCertificate or SigningCertificateV2 signed attribute (RFC 3161 sec. 2.4.2, RFC 5816)");
   }
   var tstInfo;
   try { tstInfo = schema.embeddedDer(TST_INFO, encap.eContent, NS, { code: "tsp/bad-der", what: "the encapsulated TSTInfo" }); }
@@ -359,7 +390,7 @@ function parseToken(input) {
     throw new TspError("tsp/bad-der", "the encapsulated TSTInfo did not decode: " + ((e && e.message) || String(e)), e);
   }
   // Surface the RAW eContent (the exact DER a verifier hashes for the CMS
-  // message-digest signed attribute) alongside the decoded TSTInfo — a re-serialized
+  // message-digest signed attribute) alongside the decoded TSTInfo -- a re-serialized
   // tstInfo may not byte-match, so the raw bytes are the verification feed.
   return { tstInfo: tstInfo.result, eContent: encap.eContent, signerInfo: signed.signerInfos[0], certificates: signed.certificates };
 }
@@ -381,6 +412,23 @@ function parseToken(input) {
  */
 function pemDecode(text, label) { return pkix.pemDecode(text, label || null, PemError); }
 
+/**
+ * @primitive  pki.schema.tsp.pemEncode
+ * @signature  pki.schema.tsp.pemEncode(der, label) -> string
+ * @since      0.1.23
+ * @status     stable
+ * @spec       RFC 7468, RFC 3161
+ * @related    pki.schema.tsp.pemDecode
+ *
+ * Wrap DER bytes in a PEM envelope. RFC 3161 defines no standard PEM label, so
+ * `label` is REQUIRED -- the operator names the envelope explicitly (mirroring
+ * `pemDecode`, which accepts any label). Omitting it throws `pem/bad-label`.
+ *
+ * @example
+ *   var pem = pki.schema.tsp.pemEncode(der, "TSP RESPONSE");
+ */
+function pemEncode(der, label) { return pkix.pemEncode(der, label, PemError); }
+
 // A TimeStampResp root is a SEQUENCE of 1-2 whose first child is a PKIStatusInfo (a
 // SEQUENCE whose own first child is an INTEGER status). Disjoint from the OID-first
 // CMS ContentInfo, the INTEGER-first PKCS#8 key, and the exactly-3 signed-envelope
@@ -400,5 +448,6 @@ module.exports = {
   parseTstInfo: parseTstInfo,
   parseToken: parseToken,
   pemDecode: pemDecode,
+  pemEncode: pemEncode,
   matches: matches,
 };