@blamejs/pki 0.1.22 → 0.1.23

package/lib/path-validate.js

@@ -9,9 +9,9 @@
  * @intro
  * RFC 5280 6 certification-path validation as a pure, re-entrant algorithm
  * over already-parsed certificates. `pki.path.validate(path, opts)` runs the
- * 6.1 state machine — signature chaining, validity windows, name chaining,
+ * 6.1 state machine -- signature chaining, validity windows, name chaining,
  * basic constraints and path length, key usage, name constraints, and the
- * certificate-policy tree — and returns a structured verdict with a per-check
+ * certificate-policy tree -- and returns a structured verdict with a per-check
  * reason code for every step. Validity-window enforcement is always on, with
  * the check date an explicit input; the trust anchor is an input, never one of
  * the validated certificates, and no input object is mutated.
@@ -19,12 +19,12 @@
  * Revocation is a pluggable hook: `pki.path.crlChecker(crls)` ships a CRL
  * consultation built on `pki.schema.crl.parse`; an OCSP checker satisfies the
  * same interface. Signature verification derives its algorithm from the
- * certificate and the issuer key — never from a value the message controls —
+ * certificate and the issuer key -- never from a value the message controls --
  * and fails closed on an unknown critical extension, an undetermined
  * revocation status, or any structural fault.
  *
  * @card
- *   RFC 5280 6 certification-path validation — run the 6.1 state machine over
+ *   RFC 5280 6 certification-path validation -- run the 6.1 state machine over
  *   an ordered path and a trust anchor for a structured, fail-closed verdict
  *   with per-check reason codes. Pure and re-entrant.
  */
@@ -34,6 +34,7 @@ var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var errors = require("./framework-error");
 var asn1 = require("./asn1-der");
+var schema = require("./schema-engine");
 var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
 var constants = require("./constants");
@@ -65,32 +66,40 @@ var OID = {
   subjectAltName: oid.byName("subjectAltName"),
   anyPolicy: oid.byName("anyPolicy"),
   emailAddress: oid.byName("emailAddress"),
+  extKeyUsage: oid.byName("extKeyUsage"),
+  anyExtendedKeyUsage: oid.byName("anyExtendedKeyUsage"),
 };
 
-// The set of extension OIDs the validator PROCESSES — an unrecognized critical
+// The set of extension OIDs the validator PROCESSES -- an unrecognized critical
 // extension outside this set fails the path (6.1.4(o), 6.1.5(e)).
+// extendedKeyUsage is recognized: the critical form is legal (4.2.1.12) and
+// appears in the wild (RFC 6960 4.2.2.2 delegated OCSP responders); its
+// structure is validated wherever it is critical, and key-purpose enforcement
+// is the caller's opt-in via opts.requiredEku (RFC 5280 6.1 defines no EKU
+// processing step -- the required purpose is application context).
 var PROCESSED_EXTENSIONS = {};
 [OID.basicConstraints, OID.keyUsage, OID.nameConstraints, OID.certificatePolicies,
- OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName].
+ OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
+ OID.extKeyUsage].
   forEach(function (o) { PROCESSED_EXTENSIONS[o] = true; });
 
 // ---- signature verify bridge (NEW 6) ---------------------------------------
 
 // Signature-algorithm OID -> the WebCrypto verify descriptor + how to import
 // the issuer SPKI. Keyed via oid.byName so no dotted-decimal OID literal
-// appears in source (the registry owns arc↔name). The algorithm is a property
+// appears in source (the registry owns arc<->name). The algorithm is a property
 // of the CERTIFICATE and the issuer key, never of a message-selected field
 // (CVE-2015-9235).
 var SIG_ALGS = {};
 // `params` is the REQUIRED AlgorithmIdentifier parameters shape: "null" (a DER
-// NULL must be present — RSASSA-PKCS1-v1_5, RFC 4055 §5) or "absent" (parameters
-// must be omitted — ECDSA/EdDSA/ML-DSA, RFC 5758/8410). A cert deviating from
+// NULL must be present -- RSASSA-PKCS1-v1_5, RFC 4055 sec. 5) or "absent" (parameters
+// must be omitted -- ECDSA/EdDSA/ML-DSA, RFC 5758/8410). A cert deviating from
 // its algorithm's required shape is malformed and rejected before verify.
 // `sameKeyOid` marks the one-shot families whose PUBLIC-KEY algorithm OID is the
-// SAME as the signature algorithm OID — EdDSA, ML-DSA, SLH-DSA. For these, Node's
+// SAME as the signature algorithm OID -- EdDSA, ML-DSA, SLH-DSA. For these, Node's
 // WebCrypto imports an SPKI of ANOTHER type under the requested name and verifies
 // with the real key (it does NOT reject a mismatched SPKI the way it does for
-// RSA/ECDSA), so the issuer-key <-> signature-algorithm consistency (RFC 9814 §4)
+// RSA/ECDSA), so the issuer-key <-> signature-algorithm consistency (RFC 9814 sec. 4)
 // must be checked structurally: the SPKI OID must equal the signature OID.
 function _sig(name, verify, imp, params, ecdsa, sameKeyOid) {
   var entry = { verify: verify, imp: imp, params: params };
@@ -98,23 +107,23 @@ function _sig(name, verify, imp, params, ecdsa, sameKeyOid) {
   if (sameKeyOid) entry.sameKeyOid = true;
   SIG_ALGS[oid.byName(name)] = entry;
 }
-// RSASSA-PKCS1-v1_5 — parameters MUST be NULL.
+// RSASSA-PKCS1-v1_5 -- parameters MUST be NULL.
 _sig("sha256WithRSAEncryption", { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, "null");
 _sig("sha384WithRSAEncryption", { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" }, "null");
 _sig("sha512WithRSAEncryption", { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" }, "null");
-// ECDSA (hash in the OID; the curve comes from the imported key) — params absent.
+// ECDSA (hash in the OID; the curve comes from the imported key) -- params absent.
 _sig("ecdsaWithSHA256", { name: "ECDSA", hash: "SHA-256" }, { name: "ECDSA" }, "absent", true);
 _sig("ecdsaWithSHA384", { name: "ECDSA", hash: "SHA-384" }, { name: "ECDSA" }, "absent", true);
 _sig("ecdsaWithSHA512", { name: "ECDSA", hash: "SHA-512" }, { name: "ECDSA" }, "absent", true);
-// EdDSA (one-shot, no hash parameter) — params absent; key OID == sig OID.
+// EdDSA (one-shot, no hash parameter) -- params absent; key OID == sig OID.
 _sig("Ed25519", { name: "Ed25519" }, { name: "Ed25519" }, "absent", false, true);
 _sig("Ed448", { name: "Ed448" }, { name: "Ed448" }, "absent", false, true);
-// ML-DSA (FIPS 204) — params absent; key OID == sig OID.
+// ML-DSA (FIPS 204) -- params absent; key OID == sig OID.
 _sig("id-ml-dsa-44", { name: "ML-DSA-44" }, { name: "ML-DSA-44" }, "absent", false, true);
 _sig("id-ml-dsa-65", { name: "ML-DSA-65" }, { name: "ML-DSA-65" }, "absent", false, true);
 _sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", false, true);
-// SLH-DSA (FIPS 205) — params absent; key OID == sig OID. The twelve pure sets;
-// the RFC 9909 §3 OID name maps to the WebCrypto set name by id-slh-dsa-<set> ->
+// SLH-DSA (FIPS 205) -- params absent; key OID == sig OID. The twelve pure sets;
+// the RFC 9909 sec. 3 OID name maps to the WebCrypto set name by id-slh-dsa-<set> ->
 // SLH-DSA-<SET> (the webcrypto SLH_DSA_NODE keys). One-shot verify like ML-DSA.
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
@@ -126,7 +135,7 @@ _sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", fal
 // RSASSA-PSS resolves its hash + salt from the AlgorithmIdentifier parameters.
 var OID_RSA_PSS = oid.byName("rsassaPss");
 var OID_MGF1 = oid.byName("mgf1");
-// SHA-1 is deliberately ABSENT — a SHA-1 signature (PKCS#1 or PSS) is rejected,
+// SHA-1 is deliberately ABSENT -- a SHA-1 signature (PKCS#1 or PSS) is rejected,
 // matching the no-sha1WithRSAEncryption posture (SHAttered chosen-prefix).
 var HASH_BY_OID = {};
 HASH_BY_OID[oid.byName("sha256")] = "SHA-256";
@@ -134,7 +143,7 @@ HASH_BY_OID[oid.byName("sha384")] = "SHA-384";
 HASH_BY_OID[oid.byName("sha512")] = "SHA-512";
 
 var CURVE_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
-// Curve group orders n — a valid ECDSA signature has r,s in [1, n-1].
+// Curve group orders n -- a valid ECDSA signature has r,s in [1, n-1].
 var CURVE_ORDER = {
   "P-256": BigInt("0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"),
   "P-384": BigInt("0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973"),
@@ -143,7 +152,7 @@ var CURVE_ORDER = {
 
 // The algorithm OID of an AlgorithmIdentifier SEQUENCE { algorithm OID,
 // parameters OPTIONAL }. STRICT: a universal SEQUENCE with the OID and AT MOST
-// one optional parameters element — a bare [n]-wrapped OID (no SEQUENCE) or a
+// one optional parameters element -- a bare [n]-wrapped OID (no SEQUENCE) or a
 // SEQUENCE carrying a spurious third element is malformed and must not be read
 // leniently as its named algorithm.
 function seqAlgOid(seq) {
@@ -153,14 +162,14 @@ function seqAlgOid(seq) {
   return asn1.read.oid(seq.children[0]);
 }
 // A hash AlgorithmIdentifier { OID, parameters? } whose parameters, when present,
-// MUST be DER NULL (RFC 4055 §2.1 / RFC 5754) — never a SEQUENCE or arbitrary
+// MUST be DER NULL (RFC 4055 sec. 2.1 / RFC 5754) -- never a SEQUENCE or arbitrary
 // value. Used for the PSS hashAlgorithm and the MGF1 inner hash.
 function hashAlgOid(seq) {
   var o = seqAlgOid(seq);
   if (seq.children.length === 2) {
     var p = seq.children[1];
     if (p.tagClass !== "universal" || p.tagNumber !== asn1.TAGS.NULL) throw E("path/unsupported-algorithm", "hash AlgorithmIdentifier parameters must be NULL or absent (RFC 4055)");
-    // A NULL is well-formed only with empty content (X.690 §8.8.2); the tag check
+    // A NULL is well-formed only with empty content (X.690 sec. 8.8.2); the tag check
     // alone would accept a non-empty NULL as valid parameters.
     try { asn1.read.nullValue(p); }
     catch (e) { throw E("path/unsupported-algorithm", "hash AlgorithmIdentifier NULL parameters must have empty content (RFC 4055)", e); }
@@ -182,7 +191,7 @@ function resolveRsaPss(paramsBytes) {
   //   under WebCrypto's defaults (a signatureAlgorithm bypass otherwise).
   // RFC 4055 DEFAULTs are SHA-1 (hashAlgorithm and mgf1SHA1). Because SHA-1 is
   // rejected, an absent hashAlgorithm or maskGenAlgorithm would resolve to SHA-1
-  // and must be REJECTED — a supported PSS AlgorithmIdentifier must state both
+  // and must be REJECTED -- a supported PSS AlgorithmIdentifier must state both
   // explicitly, with the MGF1 hash matching the signature hash.
   var hash = null, saltLength = 20, mgfNode = null, trailer = 1;
   if (!paramsBytes) throw E("path/unsupported-algorithm", "RSASSA-PSS requires explicit parameters (the SHA-1 defaults are rejected)");
@@ -199,7 +208,7 @@ function resolveRsaPss(paramsBytes) {
     pssLastTag = f.tagNumber;
     // Every RSASSA-PSS-params field is an EXPLICIT [n] wrapper (constructed)
     // around EXACTLY ONE value (an AlgorithmIdentifier or an INTEGER); a
-    // primitive/childless or multi-child context field is malformed — reading
+    // primitive/childless or multi-child context field is malformed -- reading
     // f.children[0] and ignoring the rest would accept non-DER parameters.
     if (!f.children || f.children.length !== 1) throw E("path/unsupported-algorithm", "malformed RSASSA-PSS parameter field [" + f.tagNumber + "] (an EXPLICIT wrapper carries exactly one value)");
     if (f.tagNumber === 0) {
@@ -212,7 +221,7 @@ function resolveRsaPss(paramsBytes) {
       var sl = asn1.read.integer(f.children[0]);
       // A negative saltLength must be rejected: the OpenSSL-backed verify shim
       // reads -1/-2/-3 as RSA_PSS_SALTLEN_DIGEST/AUTO/MAX, and AUTO (-2) accepts
-      // a signature of ANY salt length — defeating the salt-length binding.
+      // a signature of ANY salt length -- defeating the salt-length binding.
       // The upper bound keeps the value exact through Number conversion: the
       // verifier binds to the salt length the certificate states, so a value
       // that would round is not verifiable material (no real salt exceeds the
@@ -220,7 +229,7 @@ function resolveRsaPss(paramsBytes) {
       if (sl < 0n || sl > 2147483647n) throw E("path/unsupported-algorithm", "RSASSA-PSS saltLength must be a non-negative integer within the salt-length range");
       saltLength = Number(sl);
     } else if (f.tagNumber === 3) {
-      // Compared for equality with 1 below — bound before conversion so an
+      // Compared for equality with 1 below -- bound before conversion so an
       // oversized value cannot round on its way to the comparison.
       var tf = asn1.read.integer(f.children[0]);
       if (tf < 0n || tf > 2147483647n) throw E("path/unsupported-algorithm", "unsupported RSASSA-PSS trailerField " + tf.toString());
@@ -254,13 +263,13 @@ function resolveDescriptor(sigAlg) {
   return d;
 }
 
-// RFC 9814 §4 issuer-key <-> signature-algorithm consistency (algorithm-confusion
+// RFC 9814 sec. 4 issuer-key <-> signature-algorithm consistency (algorithm-confusion
 // defense). For the one-shot families whose public key shares the signature OID
 // (EdDSA, ML-DSA, SLH-DSA), Node's WebCrypto imports an SPKI of a DIFFERENT type
-// under the requested name and verifies with the real key — so an Ed25519-signed
+// under the requested name and verifies with the real key -- so an Ed25519-signed
 // certificate labelled SLH-DSA would otherwise validate. Enforce structurally:
 // the issuer SPKI's algorithm OID MUST equal the signature algorithm OID. (For
-// RSA/ECDSA — different key vs signature OIDs — WebCrypto's import already rejects
+// RSA/ECDSA -- different key vs signature OIDs -- WebCrypto's import already rejects
 // a mismatched key type, so `sameKeyOid` is not set and this is a no-op.)
 function assertKeyMatchesSigAlg(spkiBytes, sigOid, d) {
   if (!d || !d.sameKeyOid) return;
@@ -268,7 +277,7 @@ function assertKeyMatchesSigAlg(spkiBytes, sigOid, d) {
   try { keyOid = asn1.read.oid(asn1.decode(spkiBytes).children[0].children[0]); }
   catch (e) { throw E("path/algorithm-mismatch", "cannot read the issuer public-key algorithm identifier", e); }
   if (keyOid !== sigOid) {
-    throw E("path/algorithm-mismatch", "issuer public-key algorithm " + keyOid + " does not match the signature algorithm " + sigOid + " (RFC 9814 §4 - algorithm confusion)");
+    throw E("path/algorithm-mismatch", "issuer public-key algorithm " + keyOid + " does not match the signature algorithm " + sigOid + " (RFC 9814 sec. 4 - algorithm confusion)");
   }
 }
 
@@ -321,7 +330,7 @@ function builtinVerify(state, cert) {
     return { ok: ok === true };
   }, function (e) {
     // A raw OpenSSL / WebCrypto fault (wrong key type for the declared
-    // algorithm — the algorithm-confusion case) is a signature failure, not a
+    // algorithm -- the algorithm-confusion case) is a signature failure, not a
     // path/* verdict of its own; only a PathError code is preserved.
     return { ok: false, code: pathCode(e, "path/bad-signature"), error: e };
   });
@@ -333,7 +342,7 @@ function normalizeAttrValue(v) {
   // RFC 5280 7.1 canonical DN comparison: case-fold + collapse internal
   // whitespace. Every standard X.520 DN attribute (CN/O/OU/L/ST/C/serialNumber/
   // dnQualifier) uses caseIgnoreMatch, and this canonical form matches OpenSSL's
-  // X509_NAME_cmp — applying it uniformly is the interoperable behavior, not a
+  // X509_NAME_cmp -- applying it uniformly is the interoperable behavior, not a
   // per-attribute caseExact rule that would reject a chain OpenSSL accepts.
   // Reject embedded NUL / control bytes so a truncation attack (CVE-2009-2408)
   // cannot make two different names compare equal.
@@ -390,7 +399,7 @@ function decodeExt(cert, extOid) {
 // RFC 5280 requires several CA-scoped extensions to be marked critical:
 // basicConstraints (4.2.1.9), nameConstraints (4.2.1.10),
 // policyConstraints (4.2.1.11), inhibitAnyPolicy (4.2.1.14). A conforming
-// validator rejects the non-critical form — an extension a non-supporting
+// validator rejects the non-critical form -- an extension a non-supporting
 // relying party would ignore must not silently pass here either. Returns a
 // typed PathError when a PRESENT extension is not critical, else null.
 function requireCriticalExt(ext, name, checks) {
@@ -406,7 +415,7 @@ function requireCriticalExt(ext, name, checks) {
 // Split an addr-spec into [localPart, host] at its single "@". Returns null when
 // there is no "@" (a bare host/domain constraint), or "ambiguous" when there are
 // multiple "@": a conformant certificate rfc822Name is a simple addr-spec with
-// EXACTLY ONE "@" (RFC 5280 §4.2.1.6 deprecates the quoted local part, and an
+// EXACTLY ONE "@" (RFC 5280 sec. 4.2.1.6 deprecates the quoted local part, and an
 // addr-spec domain never contains "@"), so a multi-"@" mailbox like
 // "a@b"@example.com cannot be split reliably and must fail closed.
 function splitMailbox(addr) {
@@ -417,7 +426,7 @@ function splitMailbox(addr) {
 }
 
 function emailMatch(constraint, mailbox) {
-  // RFC 5280 §4.2.1.10 rfc822Name: a constraint with an "@" is a full mailbox;
+  // RFC 5280 sec. 4.2.1.10 rfc822Name: a constraint with an "@" is a full mailbox;
   // a leading "." is a domain matching mailboxes at a SUBDOMAIN; otherwise it is
   // a host matching mailboxes AT that host only. RFC 5321: the local part is
   // CASE-SENSITIVE (exact); only the host is compared case-insensitively.
@@ -443,11 +452,11 @@ function emailMatch(constraint, mailbox) {
 }
 
 // Strip a single trailing dot (the absolute-FQDN root label) so "evil.com."
-// and "evil.com" compare equal — otherwise a trailing-dot SAN would escape a
+// and "evil.com" compare equal -- otherwise a trailing-dot SAN would escape a
 // dNSName constraint.
 function stripTrailingDot(s) { return s.charAt(s.length - 1) === "." ? s.slice(0, -1) : s; }
 
-// Host-suffix match with the RFC 5280 §4.2.1.10 leading-period rule shared by
+// Host-suffix match with the RFC 5280 sec. 4.2.1.10 leading-period rule shared by
 // dNSName and uniformResourceIdentifier constraints on a host.
 function hostConstraintMatch(constraint, host) {
   var c = stripTrailingDot(constraint.toLowerCase()), h = stripTrailingDot(host.toLowerCase());
@@ -457,7 +466,7 @@ function hostConstraintMatch(constraint, host) {
 }
 
 // Is `host` a fully qualified domain name (as a URI host constraint requires,
-// RFC 5280 §4.2.1.10)? A dotless single label (localhost), an IPv4/IPv6 literal,
+// RFC 5280 sec. 4.2.1.10)? A dotless single label (localhost), an IPv4/IPv6 literal,
 // or a value carrying non-hostname characters (a scheme "://", a path "/", a
 // port ":") is NOT a FQDN and cannot be matched against a domain-suffix
 // constraint. Only [A-Za-z0-9.-] with at least one dot qualifies.
@@ -470,7 +479,7 @@ function isFqdnHost(host) {
 }
 
 // A URI constraint applies to the host part: a leading "." matches subdomains
-// only; a bare host matches that host EXACTLY (not subdomains, per §4.2.1.10).
+// only; a bare host matches that host EXACTLY (not subdomains, per sec. 4.2.1.10).
 // BOTH sides must be a fully qualified domain name: a URI SAN with no host / an
 // IP literal, OR a malformed constraint that is not an FQDN (e.g. a full URI
 // "http://blocked.example" rather than "blocked.example"), cannot be evaluated
@@ -493,7 +502,7 @@ function uriHost(uri) {
   var authority = m[1];
   // authority = [ userinfo "@" ] host [ ":" port ]. RFC 3986 userinfo does not
   // contain a raw "@", so a conformant authority has AT MOST ONE "@". Multiple
-  // "@" is ambiguous — the host cannot be determined reliably — so fail CLOSED
+  // "@" is ambiguous -- the host cannot be determined reliably -- so fail CLOSED
   // (null -> uriMatch returns "unsupported" -> the caller rejects the path)
   // rather than guess a host that could slip a URI name constraint.
   var firstAt = authority.indexOf("@");
@@ -516,7 +525,7 @@ function ipMatch(constraint, addr) {
 // Does GeneralName-like {tagNumber, value} match a constraint base of the same
 // form? Returns true/false for a supported form, null when the forms differ
 // (not comparable), or the string "unsupported" when the forms are the SAME
-// but this validator does not implement that form's comparison — the caller
+// but this validator does not implement that form's comparison -- the caller
 // must then fail closed rather than treat it as "no match".
 function nameMatchesConstraint(gnTag, gnValue, base) {
   if (base.tagNumber !== gnTag) return null;         // different form -> not comparable
@@ -549,7 +558,7 @@ function certNameForms(cert) {
   var hasRfc822San = false;
   if (san) {
     // Preserve EVERY SAN entry, including a form whose value the validator does
-    // not decode (x400Address [3] / ediPartyName [5]) — dropping it would let a
+    // not decode (x400Address [3] / ediPartyName [5]) -- dropping it would let a
     // critical constraint of that same unsupported form pass unenforced. The
     // constraint check fails such a form closed (name-constraint-unsupported).
     san.value.names.forEach(function (nm) {
@@ -557,10 +566,10 @@ function certNameForms(cert) {
       forms.push({ tag: nm.tagNumber, value: nm.value === undefined ? null : nm.value });
     });
   }
-  // RFC 5280 §4.2.1.10: the legacy emailAddress in the subject DN is checked as
+  // RFC 5280 sec. 4.2.1.10: the legacy emailAddress in the subject DN is checked as
   // an rfc822Name UNLESS the SAN already carries the email identity as an
   // rfc822Name entry. A SAN of a DIFFERENT form (e.g. dNSName only) does NOT
-  // cover the email, so the subject-DN email must still be constrained — else an
+  // cover the email, so the subject-DN email must still be constrained -- else an
   // excluded/non-permitted mailbox would slip an rfc822Name constraint.
   if (!hasRfc822San) {
     cert.subject.rdns.forEach(function (rdn) {
@@ -578,7 +587,7 @@ function certNameForms(cert) {
 // absorbing cert's permittedSubtrees (6.1.4(g)): the permitted set is tracked
 // as one GENERATION per absorbing cert, and a name of form F must match a
 // subtree of form F in EVERY generation that constrains form F. A flat pool
-// would compute the UNION — letting a subordinate CA BROADEN what its parent
+// would compute the UNION -- letting a subordinate CA BROADEN what its parent
 // permitted (a name-constraint bypass).
 function checkNameConstraints(state, cert) {
   var forms = certNameForms(cert);
@@ -670,16 +679,44 @@ function treeIsEmpty(tree) { return tree.children.length === 0; }
 
 // ---- the state machine -----------------------------------------------------
 
-function initialize(certs, params) {
+// Is `base` the value shape the constraint matcher compares for a GeneralName
+// form? Forms 0/3/5/8 (otherName / x400Address / ediPartyName / registeredID)
+// carry any present value -- the matcher fails them closed as unsupported.
+function isSubtreeBaseValid(tag, base) {
+  switch (tag) {
+    case 1: case 2: case 6: return typeof base === "string";                       // rfc822Name / dNSName / URI
+    case 7: return (Buffer.isBuffer(base) || base instanceof Uint8Array) &&
+                   (base.length === 8 || base.length === 32);                      // iPAddress: address + mask
+    case 4: return base !== null && typeof base === "object" && !!base.rdns && Array.isArray(base.rdns);   // directoryName
+    default: return base !== undefined;
+  }
+}
+
+// Entry-point validation of a 6.1.1(b,c) user-initial subtree seed. A
+// mis-shaped entry (e.g. the { base: { tagNumber, value } } shape the
+// nameConstraints decoder emits) would never match any name, silently
+// disabling the constraint the caller configured -- so it throws instead.
+function checkedSubtreeSeeds(list, optName) {
+  if (list === undefined || list === null) return [];
+  if (!Array.isArray(list)) throw E("path/bad-input", "validate: opts." + optName + " must be an array of { tag, base } subtree entries");
+  return list.map(function (st) {
+    if (!st || typeof st !== "object" || !Number.isInteger(st.tag) || st.tag < 0 || st.tag > 8 || !isSubtreeBaseValid(st.tag, st.base)) {
+      throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
+    }
+    return { tag: st.tag, base: st.base };
+  });
+}
+
+function initialize(certs, params, seeds) {
   var n = certs.length;
   return {
     validPolicyTree: rootNode(),
     policyNodeCount: 1,
-    maxPolicyNodes: params.maxPolicyNodes || 4096,
+    maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
     // Each absorbing cert's permittedSubtrees is one generation; a name must be
     // admitted by EVERY generation (intersection). An initial seed is generation 0.
-    permittedGenerations: (params.initialPermittedSubtrees && params.initialPermittedSubtrees.length) ? [params.initialPermittedSubtrees.slice()] : [],
-    excludedSubtrees: (params.initialExcludedSubtrees || []).slice(),
+    permittedGenerations: seeds.permitted.length ? [seeds.permitted] : [],
+    excludedSubtrees: seeds.excluded,
     explicitPolicy: params.initialExplicitPolicy ? 0 : n + 1,
     inhibitAnyPolicy: params.initialAnyPolicyInhibit ? 0 : n + 1,
     policyMapping: params.initialPolicyMappingInhibit ? 0 : n + 1,
@@ -711,12 +748,15 @@ function processPolicies(state, cert, i, checks) {
     var policies = cp.value;
     var depth = i - 1;
     // anyPolicy processing is active only while inhibit_anyPolicy > 0, or for a
-    // self-issued non-final cert (6.1.3(d)) — this gates BOTH the (d)(1)(ii)
-    // child-from-anyPolicy fallback and the (d)(2) expansion.
+    // self-issued non-final cert -- this gates ONLY the (d)(2) expansion of a
+    // cert-asserted anyPolicy. 4.2.1.14 inhibition is implemented entirely by
+    // that gate: a depth-(i-1) anyPolicy node created while processing was
+    // active remains matchable in (d)(1)(ii).
     var anyPolicyActive = state.inhibitAnyPolicy > 0 || (i < state._n && selfIssued(cert));
     var anyPolicyPresent = false;
+    var anyPolicyQualifiers = null;
     policies.forEach(function (p) {
-      if (p.policyIdentifier === OID.anyPolicy) { anyPolicyPresent = true; return; }
+      if (p.policyIdentifier === OID.anyPolicy) { anyPolicyPresent = true; anyPolicyQualifiers = p.qualifiersBytes; return; }
       var matched = false;
       leavesAt(state.validPolicyTree, depth).forEach(function (node) {
         if (node.expectedPolicySet.indexOf(p.policyIdentifier) !== -1) {
@@ -724,10 +764,11 @@ function processPolicies(state, cert, i, checks) {
           matched = true;
         }
       });
-      if (!matched && anyPolicyActive) {
-        // 6.1.3(d)(1)(ii): create the node from a depth-(i-1) anyPolicy node —
-        // ONLY while anyPolicy processing is active (else a leaf policy would
-        // wrongly survive after inhibit_anyPolicy reached 0).
+      if (!matched) {
+        // 6.1.3(d)(1)(ii): no expected-policy match -- create the node from a
+        // depth-(i-1) anyPolicy node. The RFC runs this step UNCONDITIONALLY
+        // (no inhibit clause); gating it would false-reject a path whose
+        // specific policy chains through a legitimately created anyPolicy node.
         leavesAt(state.validPolicyTree, depth).forEach(function (node) {
           if (node.validPolicy === OID.anyPolicy) addChild(state, node, p.policyIdentifier, p.qualifiersBytes, [p.policyIdentifier], checks);
         });
@@ -735,10 +776,12 @@ function processPolicies(state, cert, i, checks) {
     });
     if (anyPolicyPresent && anyPolicyActive) {
       // 6.1.3(d)(2): expand anyPolicy into unmatched expected-policy values.
+      // Each generated child carries AP-Q -- the qualifier set of the
+      // certificate's own anyPolicy entry ("set the qualifier_set to AP-Q").
       leavesAt(state.validPolicyTree, depth).forEach(function (node) {
         node.expectedPolicySet.forEach(function (ep) {
           var already = node.children.some(function (ch) { return ch.validPolicy === ep; });
-          if (!already) addChild(state, node, ep, null, [ep], checks);
+          if (!already) addChild(state, node, ep, anyPolicyQualifiers, [ep], checks);
         });
       });
     }
@@ -774,7 +817,7 @@ function isNullOrAbsentParams(p) {
 // Rebuild a SubjectPublicKeyInfo with the given AlgorithmIdentifier parameters
 // spliced in, so a key that inherited its domain parameters (an EC public key
 // whose SPKI omits the namedCurve, RFC 5280 6.1.4(f)/6.1.5(d)) becomes a
-// self-contained SPKI that importKey("spki", …) can consume.
+// self-contained SPKI that importKey("spki", ...) can consume.
 function spliceSpkiParameters(spki, algOid, paramsBytes) {
   return asn1.build.sequence([
     asn1.build.sequence([asn1.build.oid(algOid), asn1.build.raw(paramsBytes)]),
@@ -804,9 +847,35 @@ function updateWorkingKey(state, cert) {
   state.workingPublicKeyAlgorithm = keyAlg.oid;
 }
 
+// RFC 5280 4.2.1.12 -- when the caller states required key purposes, a cert
+// carrying an extendedKeyUsage must assert every one (or anyExtendedKeyUsage).
+// Applied to the TARGET cert (its own purposes) AND to every intermediate CA
+// (EKU chaining: an EKU on a CA constrains the purposes below it), so marking
+// extKeyUsage a PROCESSED critical extension is sound -- the semantic gate runs
+// wherever the extension appears, never only on the leaf. A cert with no EKU is
+// unconstrained. Returns true if the cert FAILS the required-purpose check.
+function ekuPurposeFails(cert, requiredEku, checks) {
+  var eku;
+  try { eku = decodeExt(cert, OID.extKeyUsage); }
+  catch (e) { checks.push({ name: "extendedKeyUsage", ok: false, code: pathCode(e, "path/bad-extension-value") }); return true; }
+  if (!eku) return false;   // absent EKU: unrestricted (4.2.1.12 restricts only when present)
+  var purposes = eku.value;
+  var ok = purposes.indexOf(OID.anyExtendedKeyUsage) !== -1 ||
+    requiredEku.every(function (p) { return purposes.indexOf(p) !== -1; });
+  checks.push({ name: "extendedKeyUsage", ok: ok, code: ok ? undefined : "path/eku-not-permitted" });
+  return !ok;
+}
+
 function prepareNext(state, cert, i, checks) {
   var isSelfIssued = selfIssued(cert);
 
+  // RFC 5280 4.2.1.12 EKU chaining -- an intermediate CA's EKU constrains the
+  // purposes of the certs beneath it. Enforced here so a critical EKU on an
+  // intermediate (now a PROCESSED extension) is not merely tolerated but honored.
+  if (state.requiredEku && ekuPurposeFails(cert, state.requiredEku, checks)) {
+    return { fatal: true, error: E("path/eku-not-permitted", "an intermediate CA extendedKeyUsage does not permit a required purpose (RFC 5280 4.2.1.12)") };
+  }
+
   // (a),(b) policy mappings.
   var pm;
   try { pm = decodeExt(cert, OID.policyMappings); }
@@ -853,7 +922,7 @@ function prepareNext(state, cert, i, checks) {
   if (iapCritErr) return { fatal: true, error: iapCritErr };
   if (iap && iap.value < state.inhibitAnyPolicy) state.inhibitAnyPolicy = iap.value;
 
-  // (k) basicConstraints cA gate — the single authoritative CA check.
+  // (k) basicConstraints cA gate -- the single authoritative CA check.
   var bc;
   try { bc = decodeExt(cert, OID.basicConstraints); }
   catch (e) { checks.push({ name: "basicConstraints", ok: false, code: "path/bad-basic-constraints" }); return { fatal: true, error: e }; }
@@ -862,7 +931,7 @@ function prepareNext(state, cert, i, checks) {
     return { fatal: true, error: E("path/not-a-ca", "intermediate certificate is not a CA (basicConstraints cA is not TRUE, RFC 5280 6.1.4(k))") };
   }
   // 4.2.1.9: a CA certificate used to validate certificate signatures MUST mark
-  // basicConstraints critical. A non-critical cA:TRUE is non-conforming — a
+  // basicConstraints critical. A non-critical cA:TRUE is non-conforming -- a
   // relying party that skips non-critical extensions would not see the CA bit.
   var bcCritErr = requireCriticalExt(bc, "basicConstraints", checks);
   if (bcCritErr) return { fatal: true, error: bcCritErr };
@@ -889,7 +958,7 @@ function applyPolicyMappings(state, mappings, i) {
   if (state.policyMapping > 0) {
     // 6.1.4(b)(1): for each depth-i node whose valid_policy is an ID-P that
     // the extension maps, REPLACE its expected_policy_set with the SET of
-    // subjectDomainPolicy values mapped from that ID-P (not append — retaining
+    // subjectDomainPolicy values mapped from that ID-P (not append -- retaining
     // the pre-mapping policy would let a later cert satisfy the chain by
     // asserting the mapped-away policy).
     var mappedFrom = {};   // issuerDomainPolicy -> [subjectDomainPolicy, ...]
@@ -901,7 +970,7 @@ function applyPolicyMappings(state, mappings, i) {
       if (idpNodes.length) {
         idpNodes.forEach(function (nd) { nd.expectedPolicySet = mappedFrom[idp].slice(); });
       } else {
-        // 6.1.4(b)(1): no depth-i ID-P node, but a depth-i anyPolicy node — GENERATE
+        // 6.1.4(b)(1): no depth-i ID-P node, but a depth-i anyPolicy node -- GENERATE
         // the missing ID-P node under the anyPolicy node's parent with the mapped
         // expected set (else an anyPolicy-only CA loses the mapping).
         anyNodes.forEach(function (anyNode) {
@@ -912,7 +981,7 @@ function applyPolicyMappings(state, mappings, i) {
   } else {
     // 6.1.4(b)(2), policy_mapping == 0: delete every depth-i node whose
     // valid_policy is a mapped ID-P, then prune. A prior mapping in the same
-    // extension may have already emptied the tree — stop if it is gone.
+    // extension may have already emptied the tree -- stop if it is gone.
     var mappedSet = {};
     mappings.forEach(function (m) { mappedSet[m.issuerDomainPolicy] = true; });
     if (!state.validPolicyTree) return;
@@ -931,10 +1000,10 @@ function applyPolicyMappings(state, mappings, i) {
 }
 
 // policyMappings is semantically processed ONLY in the prepare-for-next step
-// (§6.1.4(a),(b)), which does not run for the target certificate. It is also
-// SHOULD-be-non-critical (§4.2.1.5), so a CRITICAL policyMappings on the target
-// is both anomalous and unprocessed — it must fail closed (§6.1.5(f)) rather
-// than let, e.g., a mapping to/from anyPolicy slip past the §6.1.4(a) rejection
+// (sec. 6.1.4(a),(b)), which does not run for the target certificate. It is also
+// SHOULD-be-non-critical (sec. 4.2.1.5), so a CRITICAL policyMappings on the target
+// is both anomalous and unprocessed -- it must fail closed (sec. 6.1.5(f)) rather
+// than let, e.g., a mapping to/from anyPolicy slip past the sec. 6.1.4(a) rejection
 // the intermediate path applies. (nameConstraints / inhibitAnyPolicy are also
 // prepare-next-only but are MUST-be-critical CA extensions, so a critical one on
 // a terminal CA cert is conforming and is NOT treated as unprocessed here.)
@@ -952,7 +1021,7 @@ function unrecognizedCriticalExtension(cert, isTarget) {
 }
 
 // Decode every RECOGNIZED critical extension to enforce that its extnValue is
-// structurally valid — even where the semantic gate is skipped (the leaf).
+// structurally valid -- even where the semantic gate is skipped (the leaf).
 // Returns the failing typed code, or null.
 function validateCriticalExtensionStructure(cert) {
   for (var i = 0; i < cert.extensions.length; i++) {
@@ -974,16 +1043,27 @@ function validateCriticalExtensionStructure(cert) {
  * @spec       RFC 5280
  * @related    pki.schema.x509.parse, pki.path.crlChecker
  *
- * Validate an ordered certification `path` (anchor→target) against a trust
+ * Validate an ordered certification `path` (anchor->target) against a trust
  * anchor per RFC 5280 6.1. `path` is an array of `pki.schema.x509.parse`
  * objects (or DER/PEM the function parses); `opts` carries `time` (the
  * always-on window check), `trustAnchor` ({ name, publicKey, algorithm,
- * parameters? }), the optional policy inputs, and an optional
- * `revocationChecker`. Returns `{ valid, path, results, workingPublicKey,
- * workingPublicKeyAlgorithm, workingPublicKeyParameters, validPolicyTree }`
- * where `results[i].checks` carries a per-check reason code (`path/*`) for
- * every step. Pure and re-entrant — no input object is mutated. An empty path
- * or a missing anchor throws a typed `PathError`.
+ * parameters? }), the 6.1.1 user-initial inputs (`initialExplicitPolicy`,
+ * `initialAnyPolicyInhibit`, `initialPolicyMappingInhibit`,
+ * `userInitialPolicySet`, and `initialPermittedSubtrees` /
+ * `initialExcludedSubtrees` -- arrays of `{ tag, base }` where `tag` is the
+ * GeneralName tag number and `base` that form's constraint value), an
+ * optional `requiredEku` (key purposes -- registered OID names or dotted OID
+ * strings -- the target's extendedKeyUsage must assert; an absent extension
+ * is unrestricted, RFC 5280 4.2.1.12), and an optional `revocationChecker`.
+ * The value-carrying options (`time`, `maxPathCerts`, `maxPolicyNodes`, the
+ * subtree seeds, `userInitialPolicySet`, `requiredEku`) are validated at the
+ * entry point -- a mis-shaped value throws `path/bad-input` rather than
+ * silently not applying. Returns `{ valid, path,
+ * results, workingPublicKey, workingPublicKeyAlgorithm,
+ * workingPublicKeyParameters, validPolicyTree }` where `results[i].checks`
+ * carries a per-check reason code (`path/*`) for every step. Pure and
+ * re-entrant -- no input object is mutated. An empty path or a missing anchor
+ * throws a typed `PathError`.
  *
  * @example
  *   var cert = pki.schema.x509.parse(der);
@@ -1011,15 +1091,49 @@ async function validate(path, opts) {
   if (!(opts.time instanceof Date) || isNaN(opts.time.getTime())) {
     throw E("path/bad-input", "validate: opts.time must be a Date (the always-on validity-window check date)");
   }
+  // Entry-point tier for the remaining 6.1.1 user-initial inputs: a bad value
+  // throws here rather than silently disabling the behavior it configures.
+  if (opts.maxPolicyNodes !== undefined && (typeof opts.maxPolicyNodes !== "number" || !isFinite(opts.maxPolicyNodes) || opts.maxPolicyNodes < 1)) {
+    throw E("path/bad-input", "validate: opts.maxPolicyNodes must be a positive number");
+  }
+  // user-initial-policy-set is a non-empty SET of policy OID strings (6.1.1(c)).
+  // Membership is tested with indexOf, so a raw string here would be consulted
+  // as a SUBSTRING match -- validated to an array of strings instead.
+  if (opts.userInitialPolicySet !== undefined) {
+    var uipsOk = Array.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
+      opts.userInitialPolicySet.every(function (p) { return typeof p === "string" && p.length > 0; });
+    if (!uipsOk) throw E("path/bad-input", "validate: opts.userInitialPolicySet must be a non-empty array of policy OID strings");
+  }
+  var seeds = {
+    permitted: checkedSubtreeSeeds(opts.initialPermittedSubtrees, "initialPermittedSubtrees"),
+    excluded: checkedSubtreeSeeds(opts.initialExcludedSubtrees, "initialExcludedSubtrees"),
+  };
+  // opts.requiredEku -- the key purposes the TARGET certificate must be good
+  // for, each a registered OID name or a dotted OID string. Resolved (and
+  // typo-checked) here at the entry point.
+  var requiredEku = null;
+  if (opts.requiredEku !== undefined) {
+    if (!Array.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
+      throw E("path/bad-input", "validate: opts.requiredEku must be a non-empty array of key-purpose OID names or dotted OID strings");
+    }
+    requiredEku = opts.requiredEku.map(function (p) {
+      if (typeof p !== "string" || p.length === 0) throw E("path/bad-input", "validate: opts.requiredEku entries must be non-empty strings");
+      if (/^\d+(\.\d+)+$/.test(p)) return p;
+      var dotted = oid.byName(p);
+      if (typeof dotted !== "string") throw E("path/bad-input", "validate: opts.requiredEku entry " + JSON.stringify(p) + " is not a registered OID name");
+      return dotted;
+    });
+  }
 
-  var state = initialize(certs, opts);
+  var state = initialize(certs, opts, seeds);
   state._n = n;
+  state.requiredEku = requiredEku;
   var verifier = opts.verifier || null;
   var revocationChecker = opts.revocationChecker || null;
   var softFail = opts.softFail === true;
   // Revocation is a pluggable, opt-in step: by default a path with no checker is
   // not revocation-checked. opts.requireRevocation makes the 6.1.3(a)(3)
-  // determination mandatory — an absent checker (or an undetermined result)
+  // determination mandatory -- an absent checker (or an undetermined result)
   // then fails the path closed instead of silently skipping the step.
   var requireRevocation = opts.requireRevocation === true;
   var failed = false;
@@ -1115,7 +1229,7 @@ async function validate(path, opts) {
       var lpc;
       try { lpc = decodeExt(cert, OID.policyConstraints); }
       catch (_e) { lpc = null; checks.push({ name: "policyConstraints", ok: false, code: "path/bad-policy" }); failed = true; }
-      // 4.2.1.11: policyConstraints MUST be critical — apply the same check the
+      // 4.2.1.11: policyConstraints MUST be critical -- apply the same check the
       // intermediate path (prepareNext) uses, so a non-critical policyConstraints
       // on the TARGET cert fails closed consistently.
       if (requireCriticalExt(lpc, "policyConstraints", checks)) failed = true;
@@ -1130,7 +1244,25 @@ async function validate(path, opts) {
       if (lpm && lpm.value.some(function (m) { return m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy; })) {
         checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true;
       }
-      updateWorkingKey(state, cert);   // 6.1.5(c),(d) — key AND algorithm AND parameters
+      // 4.2.1.10 / 4.2.1.14: nameConstraints and inhibitAnyPolicy MUST be
+      // critical wherever they appear -- apply to the TARGET cert the same
+      // check prepareNext applies to every intermediate (their semantic gates
+      // do not run for the target, but the criticality rule still binds).
+      var lnc;
+      try { lnc = decodeExt(cert, OID.nameConstraints); }
+      catch (e) { lnc = null; checks.push({ name: "nameConstraints", ok: false, code: pathCode(e, "path/bad-name-constraints") }); failed = true; }
+      if (requireCriticalExt(lnc, "nameConstraints", checks)) failed = true;
+      var liap;
+      try { liap = decodeExt(cert, OID.inhibitAnyPolicy); }
+      catch (e) { liap = null; checks.push({ name: "inhibitAnyPolicy", ok: false, code: pathCode(e, "path/bad-policy") }); failed = true; }
+      if (requireCriticalExt(liap, "inhibitAnyPolicy", checks)) failed = true;
+      // 4.2.1.12: when the caller states required key purposes, the target's
+      // extendedKeyUsage must assert every one (or anyExtendedKeyUsage -- the
+      // 4.2.1.12 wildcard; rejecting it is an application MAY, not the
+      // default). An ABSENT extension leaves the key unrestricted, so it
+      // satisfies any required purpose.
+      if (requiredEku && ekuPurposeFails(cert, requiredEku, checks)) failed = true;
+      updateWorkingKey(state, cert);   // 6.1.5(c),(d) -- key AND algorithm AND parameters
     }
 
     // 6.1.4(o) / 6.1.5(e) unrecognized critical extension.
@@ -1140,7 +1272,7 @@ async function validate(path, opts) {
     // A RECOGNIZED critical extension must still be structurally valid even
     // when its semantic gate does not run on this cert (the leaf is not subject
     // to 6.1.4, so its basicConstraints/keyUsage/policy* are never read in
-    // prepareNext) — a malformed critical extnValue must fail closed, not slip
+    // prepareNext) -- a malformed critical extnValue must fail closed, not slip
     // through as "recognized". Decode every recognized critical extension to
     // validate it (a no-op for one already decoded above; the decoders are pure).
     var crit = validateCriticalExtensionStructure(cert);
@@ -1205,39 +1337,51 @@ function userConstrainedPolicies(state, n) {
 var OID_IDP = oid.byName("issuingDistributionPoint");
 var OID_DELTA_CRL = oid.byName("deltaCRLIndicator");
 
+// IssuingDistributionPoint ::= SEQUENCE { distributionPoint [0] OPTIONAL,
+// onlyContainsUserCerts [1] DEFAULT FALSE, onlyContainsCACerts [2] DEFAULT FALSE,
+// onlySomeReasons [3] ReasonFlags OPTIONAL, indirectCRL [4] DEFAULT FALSE,
+// onlyContainsAttributeCerts [5] DEFAULT FALSE } (RFC 5280 sec. 5.2.5). Declared
+// through the engine so the trailing-field grammar (strictly-ascending tags, each
+// at most once) and the DER BOOLEAN value rules are the shared enforcement, not a
+// hand-walk; a present DEFAULT-FALSE flag encoding FALSE is the omitted default
+// (X.690 sec. 11.5) and rejects at the leaf-value level below.
+var IDP_SCHEMA = schema.seq([
+  schema.trailing([
+    { tag: 0, name: "distributionPoint", schema: schema.any() },
+    { tag: 1, name: "onlyContainsUserCerts", schema: schema.implicitBoolean(1) },
+    { tag: 2, name: "onlyContainsCACerts", schema: schema.implicitBoolean(2) },
+    { tag: 3, name: "onlySomeReasons", schema: schema.implicitBitString(3) },
+    { tag: 4, name: "indirectCRL", schema: schema.implicitBoolean(4) },
+    { tag: 5, name: "onlyContainsAttributeCerts", schema: schema.implicitBoolean(5) },
+  ], { minTag: 0, maxTag: 5, unexpectedCode: "path/bad-idp", orderCode: "path/bad-idp" }),
+], { assert: "sequence", code: "path/bad-idp", what: "IssuingDistributionPoint" });
+
 function decodeIdp(ext) {
-  // IssuingDistributionPoint ::= SEQUENCE { distributionPoint [0]?,
-  //   onlyContainsUserCerts [1]?, onlyContainsCACerts [2]?, onlySomeReasons [3]?,
-  //   indirectCRL [4]?, onlyContainsAttributeCerts [5]? }. Surface the scope
-  //   flags the checker gates on.
+  // Surface the scope flags the checker gates on. ANY structural or value fault
+  // -- non-SEQUENCE, unknown/duplicate/out-of-order field tag, a non-DER BOOLEAN,
+  // an encoded-FALSE default -- leaves the CRL's scope unknown: the CRL is
+  // unusable, never assumed unrestricted.
   var out = { hasDistributionPoint: false, onlyUser: false, onlyCa: false, onlySomeReasons: null, indirect: false, onlyAttr: false, malformed: false };
-  var n;
-  try { n = asn1.decode(ext.value); }
+  var m;
+  try { m = schema.walk(IDP_SCHEMA, asn1.decode(ext.value), NS); }
   catch (_e) { out.malformed = true; return out; }
-  // A present IDP whose value is not a SEQUENCE leaves the CRL's scope unknown
-  // — treat the CRL as unusable rather than assuming an unrestricted scope.
-  if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children) { out.malformed = true; return out; }
-  n.children.forEach(function (f) {
-    if (f.tagClass !== "context") { out.malformed = true; return; }
-    if (f.tagNumber === 0) out.hasDistributionPoint = true;   // scoped to a specific DP
-    else if (f.tagNumber === 1) { if (idpBoolTrue(f, out)) out.onlyUser = true; }
-    else if (f.tagNumber === 2) { if (idpBoolTrue(f, out)) out.onlyCa = true; }
-    else if (f.tagNumber === 3) out.onlySomeReasons = true;   // BIT STRING; presence gates out-of-scope
-    else if (f.tagNumber === 4) { if (idpBoolTrue(f, out)) out.indirect = true; }
-    else if (f.tagNumber === 5) { if (idpBoolTrue(f, out)) out.onlyAttr = true; }
-    else out.malformed = true;
-  });
+  function flag(f) {
+    if (!f.present) return false;
+    // A present flag must encode DER-TRUE; a FALSE is the omitted DEFAULT
+    // (X.690 sec. 11.5), so mark the scope unknown and report not-set.
+    var isSet = f.value === true;
+    if (!isSet) out.malformed = true;
+    return isSet;
+  }
+  out.hasDistributionPoint = m.fields.distributionPoint.present;
+  out.onlyUser = flag(m.fields.onlyContainsUserCerts);
+  out.onlyCa = flag(m.fields.onlyContainsCACerts);
+  out.onlySomeReasons = m.fields.onlySomeReasons.present ? true : null;
+  out.indirect = flag(m.fields.indirectCRL);
+  out.onlyAttr = flag(m.fields.onlyContainsAttributeCerts);
   return out;
 }
 
-// An IMPLICIT BOOLEAN scope flag is primitive with the single DER-TRUE octet
-// 0xFF (a present DEFAULT-FALSE field is TRUE); anything else — constructed,
-// wrong length, non-0xFF — is malformed, so mark the scope unknown.
-function idpBoolTrue(f, out) {
-  if (f.children || !f.content || f.content.length !== 1 || f.content[0] !== 0xff) { out.malformed = true; return false; }
-  return true;
-}
-
 /**
  * @primitive  pki.path.crlChecker
  * @signature  pki.path.crlChecker(crls) -> RevocationChecker
@@ -1265,20 +1409,40 @@ function crlChecker(crls) {
     check: async function (cert, issuer, ctx) {
       var time = ctx.time;
       var historical = ctx.historicalMode === true;
-      var certIsCa = (function () { try { var bc = decodeExt(cert, OID.basicConstraints); return bc && bc.value.cA === true; } catch (_e) { return false; } })();
-      // RFC 5280 §6.3.3(f): IF a keyUsage extension is present in the CRL issuer's
-      // certificate, the cRLSign bit must be set. An issuer that OMITS keyUsage is
-      // unconstrained (the same rule the §6.1.4(n) keyCertSign gate applies to
-      // certificate signing), so its CRL is authoritative. The anchor is likewise
-      // unconstrained (issuerCert is null for the cert it directly issued).
+      // The cert's CA-ness gates the IDP scope flags (onlyContainsUserCerts /
+      // onlyContainsCACerts, RFC 5280 sec. 6.3.3(b)(2)). An UNREADABLE
+      // basicConstraints leaves that scope undeterminable -- guessing "not a
+      // CA" would consult a user-only CRL for what may be a CA certificate
+      // (out of the CRL's scope, so its silence proves nothing) -- so certIsCa
+      // stays null, BOTH scoped forms are skipped below, and only a
+      // full-scope CRL can speak for this certificate. The decode fault is
+      // carried into the undetermined verdict's reason.
+      var certIsCa = null, certScopeFault = null;
+      try {
+        var bc = decodeExt(cert, OID.basicConstraints);
+        certIsCa = !!(bc && bc.value.cA === true);
+      } catch (e) {
+        certScopeFault = pathCode(e, "path/bad-extension-value");
+      }
+      // RFC 5280 sec. 6.3.3(f): IF a keyUsage extension is present in the CRL issuer's
+      // certificate, the cRLSign bit must be VERIFIED set. An issuer that OMITS
+      // keyUsage is unconstrained (the same rule the sec. 6.1.4(n) keyCertSign gate
+      // applies to certificate signing), so its CRL is authoritative. The anchor
+      // is likewise unconstrained (issuerCert is null for the cert it directly
+      // issued). A PRESENT-but-unreadable keyUsage cannot be verified -- treating
+      // it like an absent one would let garbage keyUsage bytes authorize CRL
+      // signing -- so no CRL from this issuer can be authoritative.
       var signerAuthorized = true;
       if (issuer && issuer.issuerCert) {
         var iku;
-        try { iku = decodeExt(issuer.issuerCert, OID.keyUsage); } catch (_e) { iku = null; }
+        try { iku = decodeExt(issuer.issuerCert, OID.keyUsage); }
+        catch (e) {
+          return { status: "unknown", reason: "the CRL issuer's keyUsage extension is unreadable (" + pathCode(e, "path/bad-key-usage") + "), so its authorization to sign CRLs cannot be verified" };
+        }
         if (iku && iku.value.cRLSign !== true) signerAuthorized = false;
       }
 
-      // Consult EVERY CRL issued by the cert's issuer — a clean CRL must not
+      // Consult EVERY CRL issued by the cert's issuer -- a clean CRL must not
       // shadow a revoking one (RFC 5280 6.3.3). A serial listed in ANY
       // authoritative, in-scope, current, verified CRL is revoked; the cert is
       // "good" only if at least one such CRL was consulted and none list it;
@@ -1291,7 +1455,7 @@ function crlChecker(crls) {
         var theCrl = parsed[k];
         // dnEqual throws on a DN carrying an embedded NUL/control byte (CVE-2009-2408).
         // A single malformed CRL in the bundle must NOT abort the whole check (which
-        // would mask a later authoritative CRL and pass under softFail) — treat it
+        // would mask a later authoritative CRL and pass under softFail) -- treat it
         // as unusable and skip it, consulting the remaining CRLs.
         var issuerMatches;
         try { issuerMatches = dnEqual(theCrl.issuer.rdns, cert.issuer.rdns); }
@@ -1300,7 +1464,7 @@ function crlChecker(crls) {
         if (!signerAuthorized) continue;
 
         // A CRL carrying deltaCRLIndicator is a DELTA CRL: it lists only the
-        // CHANGES since a base CRL (RFC 5280 §5.2.4). deltaCRLIndicator is a
+        // CHANGES since a base CRL (RFC 5280 sec. 5.2.4). deltaCRLIndicator is a
         // RECOGNIZED extension (so a critical one is not "unhandled"); the delta
         // is acted on only AFTER it passes the currency + signature checks below,
         // so a stale, malformed, or unverifiable delta cannot spuriously block a
@@ -1313,20 +1477,20 @@ function crlChecker(crls) {
 
         // A validly-signed CRL carrying a CRITICAL extension this checker does
         // not understand (anything but issuingDistributionPoint / deltaCRLIndicator)
-        // may change the CRL's scope or meaning — treat it as unusable (RFC 5280
+        // may change the CRL's scope or meaning -- treat it as unusable (RFC 5280
         // 5.2 critical-extension semantics), never authoritative.
         var unhandledCritical = false;
         for (var x = 0; x < theCrl.crlExtensions.length; x++) {
           var xe = theCrl.crlExtensions[x];
           if (xe.critical && xe.oid !== OID_IDP && xe.oid !== OID_DELTA_CRL) { unhandledCritical = true; break; }
         }
-        // RFC 5280 §5.3: a critical CRL-ENTRY extension the checker cannot
+        // RFC 5280 sec. 5.3: a critical CRL-ENTRY extension the checker cannot
         // process (anything but reasonCode) makes the CRL unusable for ANY
         // certificate, not just the entry that carries it.
         for (var ry = 0; ry < theCrl.revokedCertificates.length && !unhandledCritical; ry++) {
           var ees = theCrl.revokedCertificates[ry].crlEntryExtensions || [];
           for (var ex = 0; ex < ees.length; ex++) {
-            // Key on the stable OID only — a display name is registry-dependent
+            // Key on the stable OID only -- a display name is registry-dependent
             // (a custom OID could be registered as "reasonCode"), so matching by
             // name would let an unhandled critical entry extension fail open.
             if (ees[ex].critical && ees[ex].oid !== OID_REASON_CODE) { unhandledCritical = true; break; }
@@ -1339,7 +1503,7 @@ function crlChecker(crls) {
         // cannot by itself establish "good" (full coverage is unconfirmed). But a
         // serial it LISTS is a genuine revocation of this certificate (serials are
         // unique per issuer), so such a CRL must still be consulted for revocation
-        // — dropping it wholesale would let a revoked cert slip under softFail.
+        // -- dropping it wholesale would let a revoked cert slip under softFail.
         var scopeRevocationOnly = false;
         var idpExt = null;
         for (var e = 0; e < theCrl.crlExtensions.length; e++) if (theCrl.crlExtensions[e].oid === OID_IDP) idpExt = theCrl.crlExtensions[e];
@@ -1347,18 +1511,18 @@ function crlChecker(crls) {
           var idp = decodeIdp(idpExt);
           if (idp.malformed) continue;                       // scope unknown -> unusable
           // An indirect CRL carries entries for other issuers keyed by the
-          // per-entry certificateIssuer attribute (not tracked here) — matching
+          // per-entry certificateIssuer attribute (not tracked here) -- matching
           // by serial alone could revoke the wrong cert or falsely cover it, so
           // treat an indirect CRL as unusable until certificateIssuer is honored.
           if (idp.indirect) continue;
           if (idp.onlyAttr) continue;                        // scoped to attribute certs, not this public-key cert
-          if (idp.onlyCa && !certIsCa) continue;             // out of scope for this cert
-          if (idp.onlyUser && certIsCa) continue;
+          if (idp.onlyCa && certIsCa !== true) continue;     // out of scope (or CA-ness undeterminable)
+          if (idp.onlyUser && certIsCa !== false) continue;
           if (idp.hasDistributionPoint || idp.onlySomeReasons) scopeRevocationOnly = true;
         }
         if (theCrl.thisUpdate > time) continue;              // not yet valid
-        // A CRL with no nextUpdate has no bounded validity — its currency
-        // cannot be confirmed (RFC 5280 §5.1.2.5 requires nextUpdate), so a
+        // A CRL with no nextUpdate has no bounded validity -- its currency
+        // cannot be confirmed (RFC 5280 sec. 5.1.2.5 requires nextUpdate), so a
         // replayed old CRL must not read "good". Treat it as unusable.
         if (!theCrl.nextUpdate || theCrl.nextUpdate < time) continue;   // stale / no bound
 
@@ -1367,7 +1531,7 @@ function crlChecker(crls) {
 
         // The CRL is now authoritative + current + verified. An authoritative
         // delta blocks a "good" result (its base is not merged here) and can only
-        // reveal a revocation — never establish "good" on its own.
+        // reveal a revocation -- never establish "good" on its own.
         if (isDelta) { sawDelta = true; scopeRevocationOnly = true; }
 
         for (var r = 0; r < theCrl.revokedCertificates.length; r++) {
@@ -1375,15 +1539,15 @@ function crlChecker(crls) {
           if (entry.serialNumberHex !== cert.serialNumberHex) continue;
           // reasonCode removeFromCRL (8) means the entry was un-revoked. In a
           // DELTA this releases the serial from hold; because the base is not
-          // merged here, a definitive "revoked" is no longer possible for it — a
+          // merged here, a definitive "revoked" is no longer possible for it -- a
           // base CRL that still lists it must not override the delta removal.
           if (crlEntryReason(entry) === 8) { if (isDelta) sawDeltaRemoval = true; continue; }
-          // A revocation is effective as of its revocationDate (RFC 5280 §5.3).
+          // A revocation is effective as of its revocationDate (RFC 5280 sec. 5.3).
           // In the DEFAULT present-time validation a listed serial is revoked
-          // regardless of that date — a future revocationDate is post-dating or
+          // regardless of that date -- a future revocationDate is post-dating or
           // clock skew and must NOT read good. Only under an EXPLICIT historical
-          // validation (opts.historicalMode) — validating as of a past instant,
-          // e.g. a timestamped signature — does an entry dated AFTER the
+          // validation (opts.historicalMode) -- validating as of a past instant,
+          // e.g. a timestamped signature -- does an entry dated AFTER the
           // validation time not yet apply.
           if (historical && entry.revocationDate instanceof Date && entry.revocationDate.getTime() > time.getTime()) continue;
           // Record the revocation but keep scanning: a delta removeFromCRL for the
@@ -1392,19 +1556,22 @@ function crlChecker(crls) {
           break;
         }
         // A partition-scoped CRL that did not list this serial does NOT prove the
-        // cert is unrevoked (another shard/reason may revoke it) — only a
+        // cert is unrevoked (another shard/reason may revoke it) -- only a
         // full-scope CRL can establish "good".
         if (!scopeRevocationOnly) sawAuthoritative = true;   // covered this cert, not listed
       }
       // A delta released this serial from hold: without merging its base we cannot
-      // return a definitive revoked (else a released cert stays rejected) — the
+      // return a definitive revoked (else a released cert stays rejected) -- the
       // status is undetermined. This outranks a base CRL's revocation.
       if (sawDeltaRemoval) return { status: "unknown", reason: "a delta CRL released this serial from hold; without merging its base CRL the revocation status is undetermined" };
       if (revokedResult) return revokedResult;
       // A delta CRL for this issuer was seen but cannot be merged with its base,
-      // so the current revocation picture is incomplete — never report "good".
+      // so the current revocation picture is incomplete -- never report "good".
       if (sawDelta) return { status: "unknown", reason: "a delta CRL cannot be evaluated without combining it with its base CRL, so the revocation status is undetermined" };
       if (sawAuthoritative) return { status: "good" };
+      if (certScopeFault) {
+        return { status: "unknown", reason: "no authoritative in-scope CRL covers this certificate; its basicConstraints extension is unreadable (" + certScopeFault + "), so scope-limited CRLs were skipped" };
+      }
       return { status: "unknown", reason: "no authoritative in-scope CRL covers this certificate" };
     },
   };