@blamejs/pki 0.1.22 → 0.1.24

package/lib/schema-all.js

@@ -11,13 +11,13 @@
  *
  * @intro
  *   The schema family: a declarative ASN.1 structure-schema engine and the
- *   per-format parsers built on it. Every format — from X.509 certificates
+ *   per-format parsers built on it. Every format -- from X.509 certificates
  *   and CRLs through CMS, OCSP, timestamps, and PKCS#12 stores; `all()`
- *   enumerates the registered set — is a member that COMPOSES the
+ *   enumerates the registered set -- is a member that COMPOSES the
  *   shared engine and the shared PKIX sub-schemas (AlgorithmIdentifier, Name,
- *   Extension), so a structural rule — bounds-checked positional reads,
+ *   Extension), so a structural rule -- bounds-checked positional reads,
  *   optional / tagged field ordering, SET-OF uniqueness, fail-closed typed
- *   errors — is defined once in the engine and no format can reintroduce the
+ *   errors -- is defined once in the engine and no format can reintroduce the
  *   class of bug it prevents.
  *
  *   `parse` is the orchestrator: hand it DER (or PEM) and it detects which
@@ -26,7 +26,7 @@
  *   and `all()` enumerates the registered formats.
  *
  * @card
- *   One declarative schema engine; every PKI format (X.509, CRL, …) is a
+ *   One declarative schema engine; every PKI format (X.509, CRL, ...) is a
  *   member composed on it. Detect-and-parse DER, or call a format directly.
  */
 
@@ -42,9 +42,10 @@ var ocsp = require("./schema-ocsp");
 var tsp = require("./schema-tsp");
 var crmf = require("./schema-crmf");
 var cmp = require("./schema-cmp");
+var csrattrs = require("./schema-csrattrs");
 var attrcert = require("./schema-attrcert");
 // smime is a COMPANION decoder for CMS signed-attribute values, NOT a top-level
-// format — it has no self-describing DER root (an ESS attribute value is a bare
+// format -- it has no self-describing DER root (an ESS attribute value is a bare
 // SEQUENCE) so it is deliberately absent from FORMATS / the detect-and-route
 // `parse`; it is reached only by explicit OID dispatch on a CMS attribute.
 var smime = require("./schema-smime");
@@ -61,14 +62,14 @@ var PemError = frameworkError.PemError;
 // fails typed inside that format's own parse.
 var ENTRY = { pemLabel: null, PemError: PemError, ErrorClass: SchemaError, prefix: "schema", what: "input", ber: true };
 
-// REGISTRY — each format is declarative data: a name, a `detect(root)` that
+// REGISTRY -- each format is declarative data: a name, a `detect(root)` that
 // recognizes the decoded DER root as this format's outer structure, and the
 // member's own `parse`. Adding a format is a table entry, not new dispatch
 // logic. Order matters: the most specific detector wins, so a new member is
 // inserted ahead of any more-permissive one.
 var FORMATS = [
   {
-    // CMS ContentInfo (RFC 5652 §3) — the only registered root that leads with an
+    // CMS ContentInfo (RFC 5652 sec. 3) -- the only registered root that leads with an
     // OBJECT IDENTIFIER child (a SEQUENCE of exactly 2: contentType OID + a
     // context [0] EXPLICIT content wrapper). Disjoint from the INTEGER-first pkcs8
     // and the tbs-SEQUENCE-first signed-envelope trio, so it detects unambiguously.
@@ -80,13 +81,13 @@ var FORMATS = [
     parse: function (input) { return cms.parse(input); },
   },
   {
-    // TimeStampResp ::= SEQUENCE { status PKIStatusInfo, timeStampToken OPTIONAL } —
+    // TimeStampResp ::= SEQUENCE { status PKIStatusInfo, timeStampToken OPTIONAL } --
     // a SEQUENCE of 1-2 whose first child is a PKIStatusInfo SEQUENCE whose own first
     // child is an INTEGER status. This detector is a strict REFINEMENT of the
     // ocsp-request one (both are SEQUENCE-of-1-2 with a SEQUENCE first child), so it
     // MUST be checked first: a tokenless TimeStampResp (a bare PKIStatusInfo) would
     // otherwise be shadowed by ocsp-request, whereas an OCSPRequest's tbsRequest never
-    // leads with a universal INTEGER and so never matches here (RFC 3161 §2.4.2). A
+    // leads with a universal INTEGER and so never matches here (RFC 3161 sec. 2.4.2). A
     // bare timestamp token is a CMS ContentInfo and routes to cms; a bare TSTInfo is
     // an internal payload (reached via pki.schema.tsp.parseTstInfo).
     name: "tsp",
@@ -95,7 +96,7 @@ var FORMATS = [
     parse: function (input) { return tsp.parse(input); },
   },
   {
-    // CertReqMessages ::= SEQUENCE SIZE(1..MAX) OF CertReqMsg (RFC 4211 §3) — a
+    // CertReqMessages ::= SEQUENCE SIZE(1..MAX) OF CertReqMsg (RFC 4211 sec. 3) -- a
     // SEQUENCE whose first CertReqMsg's CertRequest leads with a universal INTEGER
     // (certReqId) then a universal SEQUENCE (certTemplate). Leads with a SEQUENCE
     // like the signed-envelope trio and the ocsp-request, but the INTEGER-then-
@@ -109,25 +110,39 @@ var FORMATS = [
   },
   {
     // PKIMessage ::= SEQUENCE { header PKIHeader, body PKIBody [0..26],
-    // protection [0]?, extraCerts [1]? } (RFC 9810 §5.1) — a SEQUENCE of 2-4
+    // protection [0]?, extraCerts [1]? } (RFC 9810 sec. 5.1) -- a SEQUENCE of 2-4
     // whose first child is a >=3-child SEQUENCE leading with a bare INTEGER
     // (pvno) and whose second child is context-constructed [0..26]. ORDER IS
     // LOAD-BEARING here: a 2-child PKIMessage whose body is ir [0] also
     // satisfies the shallow ocsp-request probe below (k[0] SEQUENCE +
     // k[1] context-[0]), while no OCSPRequest satisfies this detector (its
-    // tbsRequest never leads with a bare INTEGER) — so cmp MUST sit ahead of
+    // tbsRequest never leads with a bare INTEGER) -- so cmp MUST sit ahead of
     // ocsp-request for the pair to dispatch deterministically.
     name: "cmp",
     module: cmp,
     detect: cmp.matches,
     parse: function (input) { return cmp.parse(input); },
   },
+  {
+    // CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID (RFC 8951 sec. 3.5) -- a
+    // SEQUENCE whose every child is a bare universal OID or an Attribute (a
+    // universal SEQUENCE of exactly 2: OID + SET). A 1-2-element all-Attribute
+    // CsrAttrs satisfies the permissive ocsp-request probe below (SEQUENCE +
+    // constructed first child), and the empty 30 00 is a CsrAttrs no other root
+    // accepts -- so csrattrs is the strict refinement and MUST sit ahead of
+    // ocsp-request, the same resolution tsp / cmp use. Disjoint from cmp (whose
+    // body child is context-[0..26], never a universal OID/Attribute).
+    name: "csrattrs",
+    module: csrattrs,
+    detect: csrattrs.matches,
+    parse: function (input) { return csrattrs.parse(input); },
+  },
   {
     // OCSPRequest ::= SEQUENCE { tbsRequest SEQUENCE, optionalSignature [0] EXPLICIT
-    // OPTIONAL } — a SEQUENCE of 1-2 whose first child is the tbsRequest SEQUENCE.
+    // OPTIONAL } -- a SEQUENCE of 1-2 whose first child is the tbsRequest SEQUENCE.
     // Leads with a SEQUENCE like the signed-envelope trio, but is excluded by arity
     // (the trio is EXACTLY 3 children; an OCSPRequest is 1-2). Checked AFTER tsp,
-    // whose detector is a strict refinement (RFC 6960 §4.1.1), and AFTER cmp,
+    // whose detector is a strict refinement (RFC 6960 sec. 4.1.1), and AFTER cmp,
     // whose 2-child ir-body shape this probe would otherwise shadow.
     name: "ocsp-request",
     module: ocsp,
@@ -136,8 +151,8 @@ var FORMATS = [
   },
   {
     // OCSPResponse ::= SEQUENCE { responseStatus ENUMERATED, responseBytes [0]
-    // EXPLICIT OPTIONAL } — the only registered root that leads with an ENUMERATED
-    // child, so it is disjoint from every other format (RFC 6960 §4.2.1).
+    // EXPLICIT OPTIONAL } -- the only registered root that leads with an ENUMERATED
+    // child, so it is disjoint from every other format (RFC 6960 sec. 4.2.1).
     name: "ocsp-response",
     module: ocsp,
     detect: ocsp.matchesResponse,
@@ -145,12 +160,12 @@ var FORMATS = [
   },
   {
     // PKCS#12 PFX ::= SEQUENCE { version INTEGER, authSafe ContentInfo, macData
-    // OPTIONAL } — INTEGER-first like pkcs8, so the discriminators are deeper:
-    // children[1] is a ContentInfo (SEQUENCE of exactly 2: OID + [0] constructed —
+    // OPTIONAL } -- INTEGER-first like pkcs8, so the discriminators are deeper:
+    // children[1] is a ContentInfo (SEQUENCE of exactly 2: OID + [0] constructed --
     // a shape a PrivateKeyInfo's AlgorithmIdentifier never presents) and
     // children[2] is a MacData SEQUENCE or absent (pkcs8 requires an OCTET STRING
     // there). Shape-disjoint from pkcs8, and registered ahead of it as the more
-    // specific probe (RFC 7292 §4). A BER-encoded PFX detects through the
+    // specific probe (RFC 7292 sec. 4). A BER-encoded PFX detects through the
     // orchestrator's BER decode fallback and routes here.
     name: "pkcs12",
     module: pkcs12,
@@ -158,11 +173,11 @@ var FORMATS = [
     parse: function (input) { return pkcs12.parse(input); },
   },
   {
-    // PKCS#8 PrivateKeyInfo / OneAsymmetricKey — SEQUENCE whose first child is an
+    // PKCS#8 PrivateKeyInfo / OneAsymmetricKey -- SEQUENCE whose first child is an
     // INTEGER (version) and third an OCTET STRING (privateKey); disjoint from the
     // signed-envelope trio. (EncryptedPrivateKeyInfo is deliberately NOT
-    // auto-routed: its SEQUENCE{SEQUENCE, OCTET STRING} shape is ambiguous — a
-    // PKCS#1 DigestInfo is identical — so structural detection cannot classify it
+    // auto-routed: its SEQUENCE{SEQUENCE, OCTET STRING} shape is ambiguous -- a
+    // PKCS#1 DigestInfo is identical -- so structural detection cannot classify it
     // without a validated encryption-algorithm discriminator, which arrives with
     // the PBES layer. It is reached explicitly via pki.schema.pkcs8.parseEncrypted.)
     name: "pkcs8",
@@ -172,7 +187,7 @@ var FORMATS = [
   },
   {
     // CertificationRequest ::= SEQUENCE { certificationRequestInfo,
-    // signatureAlgorithm, signature } — the same outer 3-element shape,
+    // signatureAlgorithm, signature } -- the same outer 3-element shape,
     // distinguished by a CertificationRequestInfo of EXACTLY four children
     // ending in the IMPLICIT [0] attributes element. Checked first because that
     // detector is the most specific and mutually exclusive with the others.
@@ -183,20 +198,28 @@ var FORMATS = [
   },
   {
     // AttributeCertificate ::= SEQUENCE { acinfo, signatureAlgorithm, signatureValue }
-    // — the signed-envelope trio, distinguished from a certificate / CRL by an acinfo
-    // that LEADS WITH a bare INTEGER version and carries a 2-GeneralizedTime validity
-    // at children[5]. Registered ahead of crl / x509 (most-specific-first): a legacy v1
-    // AC would otherwise satisfy x509.matches's Validity probe (RFC 5755 §4.1).
+    // -- the signed-envelope trio, recognized by an acinfo that LEADS WITH a bare
+    // INTEGER version and carries a 2-GeneralizedTime attrCertValidityPeriod at
+    // children[5] (RFC 5755, section 4.1). Order-independent versus crl / x509 / csr:
+    // a v2 acinfo puts the AlgorithmIdentifier at the position where their probes
+    // require a bare Time / a 2-Time Validity / a 4-child CRI, and none of their tbs
+    // shapes carry the 2-GeneralizedTime marker at children[5].
     name: "attrcert",
     module: attrcert,
     detect: attrcert.matches,
     parse: function (input) { return attrcert.parse(input); },
   },
   {
-    // AttributeCertificateV1 (X.509-1997, RFC 5652 §10.2) — the obsolete predecessor
-    // whose acInfo LEADS WITH the subject CHOICE (context [0]/[1]). Recognized and
-    // deferred with a precise attrcert/legacy-v1-not-supported rather than routed to a
-    // wrong format. children[1] == SEQUENCE keeps it disjoint from a v3 certificate.
+    // AttributeCertificateV1 (X.509-1997, RFC 5652, section 10.2) -- the obsolete
+    // predecessor whose acInfo LEADS WITH the subject CHOICE (context [0]/[1]).
+    // Recognized and deferred with a precise attrcert/legacy-v1-not-supported rather
+    // than routed to a wrong format. ORDER IS LOAD-BEARING against x509: a [0]-subject
+    // v1 AC ALSO satisfies x509.matches (the [0] child reads as the certificate's
+    // EXPLICIT version marker, putting the 2-GeneralizedTime attrCertValidityPeriod at
+    // the Validity probe offset), so this entry MUST sit ahead of x509 for first-match
+    // dispatch to defer it here. children[1] == SEQUENCE keeps a v3 certificate (whose
+    // [0] version is followed by an INTEGER serialNumber) from matching in the other
+    // direction.
     name: "attrcert-v1",
     module: attrcert,
     detect: attrcert.matchesV1,
@@ -204,7 +227,7 @@ var FORMATS = [
   },
   {
     // CertificateList ::= SEQUENCE { tbsCertList, signatureAlgorithm,
-    // signatureValue } — the same outer shape as a certificate, distinguished
+    // signatureValue } -- the same outer shape as a certificate, distinguished
     // by its tbsCertList (a bare Time at the certificate's Validity position).
     name: "crl",
     module: crl,
@@ -214,7 +237,7 @@ var FORMATS = [
   {
     name: "x509",
     module: x509,
-    // Certificate — identified by a Validity (SEQUENCE of two Times) inside the
+    // Certificate -- identified by a Validity (SEQUENCE of two Times) inside the
     // tbs, so a CSR / other 3-element signed envelope is NOT misclassified as a
     // certificate (it falls through to schema/unknown-format).
     detect: x509.matches,
@@ -233,7 +256,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // → ["cms", "tsp", "crmf", "cmp", "ocsp-request", "ocsp-response", "pkcs12", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
+ *   pki.schema.all();  // -> ["cms", "tsp", "crmf", "cmp", "ocsp-request", "ocsp-response", "pkcs12", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -252,7 +275,7 @@ function all() { return FORMATS.map(function (f) { return f.name; }); }
  * errors of the matched format propagate unchanged.
  *
  * @example
- *   var parsed = pki.schema.parse(der);  // cert → the pki.schema.x509 shape
+ *   var parsed = pki.schema.parse(der);  // cert -> the pki.schema.x509 shape
  */
 function parse(input) {
   // Coerce + decode via the shared parse-entry, then route the COERCED DER (a
@@ -272,16 +295,17 @@ function parse(input) {
 module.exports = {
   engine: engine,
   x509: { parse: x509.parse, pemDecode: x509.pemDecode, pemEncode: x509.pemEncode },
-  crl:  { parse: crl.parse,  pemDecode: crl.pemDecode },
+  crl:  { parse: crl.parse,  pemDecode: crl.pemDecode, pemEncode: crl.pemEncode },
   csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },
   pkcs12: { parse: pkcs12.parse, pemDecode: pkcs12.pemDecode, pemEncode: pkcs12.pemEncode },
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
-  ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode },
-  tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode },
-  crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode },
+  ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode, pemEncode: ocsp.pemEncode },
+  tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode, pemEncode: tsp.pemEncode },
+  crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode, pemEncode: crmf.pemEncode },
   cmp: { parse: cmp.parse, pemDecode: cmp.pemDecode, pemEncode: cmp.pemEncode },
-  attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode },
+  csrattrs: { parse: csrattrs.parse },
+  attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode, pemEncode: attrcert.pemEncode },
   smime: { parseSigningCertificate: smime.parseSigningCertificate, parseSigningCertificateV2: smime.parseSigningCertificateV2, parseSmimeCapabilities: smime.parseSmimeCapabilities, decodeAttribute: smime.decodeAttribute },
   all: all,
   parse: parse,

package/lib/schema-attrcert.js

@@ -11,23 +11,25 @@
  * @intro
  *   X.509 Attribute Certificate handling per RFC 5755. An attribute certificate
  *   binds a holder to a set of privilege attributes (role, group, clearance)
- *   without carrying a public key — the authorization counterpart to an identity
+ *   without carrying a public key -- the authorization counterpart to an identity
  *   certificate. `parse` decodes a v2 `AttributeCertificate` into its holder,
  *   issuer, validity window (real `Date`s), attributes, and extensions, reusing
  *   the shared signed-envelope so the raw `tbsBytes` (the exact signed region) and
  *   the `signatureValue` are surfaced for a downstream verifier.
  *
  *   The holder and issuer identities are `GeneralName`s, validated on the way in
- *   (each alternative's form and content per RFC 5280 §4.2.1.6) and surfaced with
- *   their raw bytes; the profile MUSTs above structural scope (a single
- *   non-empty `directoryName` issuer, the holder-to-PKC binding, targeting and
- *   revocation) are verification-layer concerns. The obsolete X.509-1997
+ *   (each alternative's form and content per RFC 5280 sec. 4.2.1.6) and surfaced with
+ *   their raw bytes. The RFC 5755 sec. 4.2.3 issuer profile is enforced at parse: the
+ *   issuer is `v2Form` (never `v1Form`) carrying exactly one non-empty
+ *   `directoryName` in `issuerName`, with `baseCertificateID` / `objectDigestInfo`
+ *   absent. The MUSTs above parse altitude (the holder-to-PKC binding, targeting
+ *   and revocation) remain verification-layer concerns. The obsolete X.509-1997
  *   `AttributeCertificateV1` is recognized and deferred, not parsed. DER-only,
  *   fail-closed.
  *
  * @card
  *   Parse DER / PEM RFC 5755 attribute certificates into holder, issuer,
- *   validity, attributes, and extensions — validated GeneralNames, raw verifier
+ *   validity, attributes, and extensions -- validated GeneralNames, raw verifier
  *   inputs, legacy v1 recognize-and-defer, fail-closed.
  */
 
@@ -47,36 +49,31 @@ var TAGS = asn1.TAGS;
 var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
 var EXTENSIONS = pkix.extensions(NS);
 
-// AttCertVersion ::= INTEGER { v2(1) } — a bare, mandatory INTEGER (not the x509
+// AttCertVersion ::= INTEGER { v2(1) } -- a bare, mandatory INTEGER (not the x509
 // [0] EXPLICIT DEFAULT shape). The only legal value is v2, surfaced as 2.
 var VERSION = pkix.versionReader(NS, { "1": 2 });
 
 // ---- shared leaves ---------------------------------------------------
 
-// AttCertValidityPeriod times are GeneralizedTime (RFC 5755 §4.2.6) — a UTCTime is
+// AttCertValidityPeriod times are GeneralizedTime (RFC 5755 sec. 4.2.6) -- a UTCTime is
 // rejected. Non-fractional YYYYMMDDHHMMSSZ is enforced by the codec.
-var GENERALIZED_TIME = schema.decode(function (n, ctx) {
-  if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
-    throw ctx.E("attrcert/bad-time", "AttCertValidityPeriod times must be GeneralizedTime (RFC 5755 §4.2.6)");
-  }
-  return asn1.read.time(n);
-});
+var GENERALIZED_TIME = pkix.generalizedTime(NS, { code: "attrcert/bad-time", message: "AttCertValidityPeriod times must be GeneralizedTime (RFC 5755 sec. 4.2.6)" });
 
 // digestedObjectType ::= ENUMERATED { publicKey(0), publicKeyCert(1),
-// otherObjectTypes(2) } (RFC 5755 §4.1) — an undefined value is rejected; a
+// otherObjectTypes(2) } (RFC 5755 sec. 4.1) -- an undefined value is rejected; a
 // non-ENUMERATED tag fails at the codec (asn1/*).
 var ODT_NAMES = { "0": "publicKey", "1": "publicKeyCert", "2": "otherObjectTypes" };
 var DIGESTED_OBJECT_TYPE = schema.decode(function (n, ctx) {
   var v = asn1.read.enumerated(n);
   var k = v.toString();
   if (!Object.prototype.hasOwnProperty.call(ODT_NAMES, k)) {
-    throw ctx.E("attrcert/bad-digested-object-type", "digestedObjectType " + k + " is not a defined value (RFC 5755 §4.1)");
+    throw ctx.E("attrcert/bad-digested-object-type", "digestedObjectType " + k + " is not a defined value (RFC 5755 sec. 4.1)");
   }
-  // RFC 5755 §7.3 — a conformant AC MUST NOT use otherObjectTypes(2); the digested
+  // RFC 5755 sec. 7.3 -- a conformant AC MUST NOT use otherObjectTypes(2); the digested
   // object is limited to a public key or a public-key certificate, so reject it
   // fail-closed rather than parse a digest whose object type is unidentifiable.
   if (k === "2") {
-    throw ctx.E("attrcert/bad-digested-object-type", "otherObjectTypes(2) MUST NOT be used (RFC 5755 §7.3)");
+    throw ctx.E("attrcert/bad-digested-object-type", "otherObjectTypes(2) MUST NOT be used (RFC 5755 sec. 7.3)");
   }
   return { code: Number(v), name: ODT_NAMES[k] };
 });
@@ -84,7 +81,7 @@ var DIGESTED_OBJECT_TYPE = schema.decode(function (n, ctx) {
 // ---- IssuerSerial / ObjectDigestInfo ---------------------------------
 
 // IssuerSerial ::= SEQUENCE { issuer GeneralNames, serial CertificateSerialNumber,
-// issuerUID UniqueIdentifier OPTIONAL } (RFC 5755 §4.1). Reached as an IMPLICIT
+// issuerUID UniqueIdentifier OPTIONAL } (RFC 5755 sec. 4.1). Reached as an IMPLICIT
 // [n] node (Holder [0] / V2Form [0]) whose tag replaces the SEQUENCE tag, so the
 // shape assertion is "constructed" (the tag is pinned by the enclosing trailing);
 // a context [n] PRIMITIVE node has no children and fails closed here.
@@ -106,7 +103,7 @@ var ISSUER_SERIAL = schema.seq([
 
 // ObjectDigestInfo ::= SEQUENCE { digestedObjectType ENUMERATED, otherObjectTypeID
 // OBJECT IDENTIFIER OPTIONAL, digestAlgorithm AlgorithmIdentifier, objectDigest BIT
-// STRING } (RFC 5755 §4.1). otherObjectTypeID is present only for otherObjectTypes(2).
+// STRING } (RFC 5755 sec. 4.1). otherObjectTypeID is present only for otherObjectTypes(2).
 var OBJECT_DIGEST_INFO = schema.seq([
   schema.field("digestedObjectType", DIGESTED_OBJECT_TYPE),
   schema.optional("otherObjectTypeID", schema.oidLeaf(), { whenUniversal: [TAGS.OBJECT_IDENTIFIER] }),
@@ -117,10 +114,10 @@ var OBJECT_DIGEST_INFO = schema.seq([
   build: function (m, ctx) {
     var t = m.fields.digestedObjectType.value;
     // otherObjectTypeID identifies a non-certificate object type, meaningful only with
-    // otherObjectTypes(2) — which RFC 5755 §7.3 forbids (rejected at the leaf above) —
+    // otherObjectTypes(2) -- which RFC 5755 sec. 7.3 forbids (rejected at the leaf above) --
     // so a present otherObjectTypeID is never valid here and is rejected fail-closed.
     if (m.fields.otherObjectTypeID.present) {
-      throw ctx.E("attrcert/bad-object-digest-info", "otherObjectTypeID is only valid with otherObjectTypes(2), which RFC 5755 §7.3 forbids");
+      throw ctx.E("attrcert/bad-object-digest-info", "otherObjectTypeID is only valid with otherObjectTypes(2), which RFC 5755 sec. 7.3 forbids");
     }
     return {
       digestedObjectType: t,
@@ -135,7 +132,7 @@ var OBJECT_DIGEST_INFO = schema.seq([
 
 // Holder ::= SEQUENCE { baseCertificateID [0] IMPLICIT IssuerSerial OPTIONAL,
 // entityName [1] IMPLICIT GeneralNames OPTIONAL, objectDigestInfo [2] IMPLICIT
-// ObjectDigestInfo OPTIONAL } (RFC 5755 §4.1). All three are IMPLICIT + OPTIONAL;
+// ObjectDigestInfo OPTIONAL } (RFC 5755 sec. 4.1). All three are IMPLICIT + OPTIONAL;
 // the profile RECOMMENDS exactly one, but the parser surfaces all three (null when
 // absent) and does not enforce the cardinality.
 var HOLDER = schema.seq([
@@ -157,8 +154,11 @@ var HOLDER = schema.seq([
 
 // V2Form ::= SEQUENCE { issuerName GeneralNames OPTIONAL, baseCertificateID [0]
 // IMPLICIT IssuerSerial OPTIONAL, objectDigestInfo [1] IMPLICIT ObjectDigestInfo
-// OPTIONAL } (RFC 5755 §4.1). Reached via the AttCertIssuer CHOICE on a context [0]
-// node, so the shape is "constructed".
+// OPTIONAL } (RFC 5755 sec. 4.1). Reached via the AttCertIssuer CHOICE on a context [0]
+// node, so the shape is "constructed". The build enforces the sec. 4.2.3 issuer
+// profile MUSTs: every field is syntactically OPTIONAL, but a conformant AC's
+// issuerName is present with one and only one GeneralName -- a non-empty
+// directoryName -- and baseCertificateID / objectDigestInfo are absent.
 var V2_FORM = schema.seq([
   schema.optional("issuerName", pkix.generalNames(NS, { code: "attrcert/bad-issuer-name" }), { whenUniversal: [TAGS.SEQUENCE] }),
   schema.trailing([
@@ -167,27 +167,47 @@ var V2_FORM = schema.seq([
   ], { minTag: 0, maxTag: 1, unexpectedCode: "attrcert/bad-v2form", orderCode: "attrcert/bad-v2form" }),
 ], {
   assert: "constructed", code: "attrcert/bad-v2form", what: "V2Form",
-  build: function (m) {
-    return {
-      issuerName: m.fields.issuerName.present ? m.fields.issuerName.value.result : null,
-      baseCertificateID: m.fields.baseCertificateID.present ? m.fields.baseCertificateID.value.result : null,
-      objectDigestInfo: m.fields.objectDigestInfo.present ? m.fields.objectDigestInfo.value.result : null,
-    };
+  build: function (m, ctx) {
+    if (!m.fields.issuerName.present) {
+      throw ctx.E("attrcert/bad-issuer-name", "v2Form must contain issuerName (RFC 5755 sec. 4.2.3)");
+    }
+    var issuerName = m.fields.issuerName.value.result;
+    if (issuerName.names.length !== 1) {
+      throw ctx.E("attrcert/bad-issuer-name", "issuerName must contain one and only one GeneralName (RFC 5755 sec. 4.2.3)");
+    }
+    if (issuerName.names[0].tagNumber !== 4) {
+      throw ctx.E("attrcert/bad-issuer-name", "the issuerName GeneralName must be a directoryName [4] (RFC 5755 sec. 4.2.3)");
+    }
+    // directoryName [4] EXPLICIT wraps exactly one Name (the shared GeneralName
+    // grammar validated that); a zero-RDN Name is an empty DN identifying no
+    // issuer, which sec. 4.2.3 forbids.
+    var dirName = asn1.decode(issuerName.names[0].bytes).children[0];
+    if (!dirName.children || dirName.children.length < 1) {
+      throw ctx.E("attrcert/bad-issuer-name", "the issuerName directoryName must be a non-empty distinguished name (RFC 5755 sec. 4.2.3)");
+    }
+    if (m.fields.baseCertificateID.present || m.fields.objectDigestInfo.present) {
+      throw ctx.E("attrcert/bad-v2form", "baseCertificateID and objectDigestInfo must not be present in v2Form (RFC 5755 sec. 4.2.3)");
+    }
+    return { issuerName: issuerName, baseCertificateID: null, objectDigestInfo: null };
   },
 });
 
 // AttCertIssuer ::= CHOICE { v1Form GeneralNames, v2Form [0] IMPLICIT V2Form } (RFC
-// 5755 §4.1). A universal SEQUENCE is the (obsolete but structurally legal) v1Form;
-// a context [0] is v2Form. A conforming AC uses v2Form; the parser surfaces which.
+// 5755 sec. 4.1). A universal SEQUENCE is the (obsolete but structurally recognizable)
+// v1Form, which a conformant AC MUST NOT use (sec. 4.2.3) -- the arm is recognized and
+// rejected with a precise verdict rather than mis-dispatched; a context [0] is v2Form.
 var ATT_CERT_ISSUER = schema.choice([
-  { when: { tagClass: "universal", tagNumber: TAGS.SEQUENCE }, schema: pkix.generalNames(NS, { code: "attrcert/bad-issuer" }) },
+  { when: { tagClass: "universal", tagNumber: TAGS.SEQUENCE },
+    schema: schema.decode(function (n, ctx) {
+      throw ctx.E("attrcert/bad-issuer", "AttCertIssuer must use v2Form -- v1Form MUST NOT be used (RFC 5755 sec. 4.2.3)");
+    }) },
   { when: { tagClass: "context", tagNumber: 0 }, schema: V2_FORM },
 ], { code: "attrcert/bad-issuer" });
 
 // ---- validity + attributes -------------------------------------------
 
 // AttCertValidityPeriod ::= SEQUENCE { notBeforeTime GeneralizedTime, notAfterTime
-// GeneralizedTime } (RFC 5755 §4.2.6).
+// GeneralizedTime } (RFC 5755 sec. 4.2.6).
 var VALIDITY = schema.seq([
   schema.field("notBeforeTime", GENERALIZED_TIME),
   schema.field("notAfterTime", GENERALIZED_TIME),
@@ -196,7 +216,7 @@ var VALIDITY = schema.seq([
   build: function (m) { return { notBeforeTime: m.fields.notBeforeTime.value, notAfterTime: m.fields.notAfterTime.value }; },
 });
 
-// attributes ::= SEQUENCE OF Attribute (RFC 5755 §4.2.7) — MUST be non-empty and
+// attributes ::= SEQUENCE OF Attribute (RFC 5755 sec. 4.2.7) -- MUST be non-empty and
 // each AttributeType OID unique. Order-preserving (SEQUENCE OF, not SET OF).
 var ATTRIBUTES = schema.seqOf(pkix.attribute(NS), {
   assert: "sequence", min: 1, code: "attrcert/bad-attributes", what: "attributes",
@@ -208,7 +228,7 @@ var ATTRIBUTES = schema.seqOf(pkix.attribute(NS), {
 
 // AttributeCertificateInfo ::= SEQUENCE { version, holder, issuer, signature
 // AlgorithmIdentifier, serialNumber, attrCertValidityPeriod, attributes,
-// issuerUniqueID OPTIONAL, extensions OPTIONAL } (RFC 5755 §4.1). The tbs body the
+// issuerUniqueID OPTIONAL, extensions OPTIONAL } (RFC 5755 sec. 4.1). The tbs body the
 // signed envelope wraps; the cross-field invariants live in the envelope build.
 var ACINFO = schema.seq([
   schema.field("version", VERSION),
@@ -223,39 +243,36 @@ var ACINFO = schema.seq([
 ], { assert: "sequence", code: "attrcert/bad-acinfo", what: "AttributeCertificateInfo" });
 
 // AttributeCertificate ::= SEQUENCE { acinfo, signatureAlgorithm, signatureValue
-// BIT STRING } — the shared SIGNED envelope (RFC 5755 §4.1). The AC-specific
-// invariants (§4.2.4 sig-alg agreement, §4.2.5 positive-and-<=20-octet serialNumber)
+// BIT STRING } -- the shared SIGNED envelope (RFC 5755 sec. 4.1). The AC-specific
+// invariants (sec. 4.2.4 sig-alg agreement, sec. 4.2.5 positive-and-<=20-octet serialNumber)
 // run in the build; the envelope owns the SEQUENCE-of-3 shape + signature extraction.
 var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
   code: "attrcert/not-an-attribute-certificate", what: "AttributeCertificate",
   build: function (e, ctx) {
     var acinfo = e.tbsMatch;
 
-    // RFC 5755 §4.2.4 — the outer signatureAlgorithm MUST equal acinfo.signature.
+    // RFC 5755 sec. 4.2.4 -- the outer signatureAlgorithm MUST equal acinfo.signature.
     if (!e.outerSignatureAlgorithmBytes.equals(acinfo.fields.signature.node.bytes)) {
-      throw ctx.E("attrcert/bad-signature-algorithm", "signatureAlgorithm must match AttributeCertificateInfo.signature (RFC 5755 §4.2.4)");
+      throw ctx.E("attrcert/bad-signature-algorithm", "signatureAlgorithm must match AttributeCertificateInfo.signature (RFC 5755 sec. 4.2.4)");
     }
 
-    // RFC 5755 §4.2.5 — serialNumber MUST be a positive INTEGER of at most 20 content
+    // RFC 5755 sec. 4.2.5 -- serialNumber MUST be a positive INTEGER of at most 20 content
     // octets. Positive excludes both a negative (DER sign bit set) and zero (a minimal
-    // INTEGER 0 is a single 0x00 octet — the codec already rejected any non-minimal
+    // INTEGER 0 is a single 0x00 octet -- the codec already rejected any non-minimal
     // zero). Surface it lossless (BigInt) + as hex.
     var serialNode = acinfo.fields.serialNumber.node;
     var sc = serialNode.content;
     if (sc.length === 0 || (sc[0] & 0x80) !== 0 || (sc.length === 1 && sc[0] === 0)) {
-      throw ctx.E("attrcert/bad-serial-number", "serialNumber must be a positive INTEGER (RFC 5755 §4.2.5)");
+      throw ctx.E("attrcert/bad-serial-number", "serialNumber must be a positive INTEGER (RFC 5755 sec. 4.2.5)");
     }
     if (sc.length > 20) {
-      throw ctx.E("attrcert/bad-serial-number", "serialNumber must not exceed 20 content octets (RFC 5755 §4.2.5)");
+      throw ctx.E("attrcert/bad-serial-number", "serialNumber must not exceed 20 content octets (RFC 5755 sec. 4.2.5)");
     }
 
-    // AttCertIssuer is a CHOICE — the chosen arm is read off the issuer node's tag
-    // (a universal SEQUENCE is v1Form; a context [0] is v2Form).
-    var issuerNode = acinfo.fields.issuer.node;
-    var issuerVal = acinfo.fields.issuer.value;
-    var issuer = issuerNode.tagClass === "context"
-      ? { form: "v2Form", v2Form: issuerVal.result, v1Form: null }
-      : { form: "v1Form", v1Form: issuerVal.result, v2Form: null };
+    // AttCertIssuer is a CHOICE whose v1Form arm rejects at the leaf (sec. 4.2.3), so
+    // the surviving arm is always v2Form. The { form, v2Form, v1Form } shape is
+    // kept stable for consumers keying off `form`.
+    var issuer = { form: "v2Form", v2Form: acinfo.fields.issuer.value.result, v1Form: null };
 
     var extField = acinfo.fields.extensions;
     return {
@@ -286,7 +303,8 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
  * @spec       RFC 5755, X.509
  * @related    pki.schema.parse, pki.schema.x509.parse
  *
- * Parse a DER `Buffer` or a PEM string/Buffer into a structured v2 attribute
+ * Parse a DER `Buffer` or a PEM string/Buffer (label `ATTRIBUTE CERTIFICATE`,
+ * the OpenSSL armor) into a structured v2 attribute
  * certificate: `{ version, holder, issuer, signatureAlgorithm, serialNumber,
  * serialNumberHex, validity, attributes, issuerUniqueID, extensions, tbsBytes,
  * signatureValue }`. The holder / issuer identities come back as validated
@@ -302,23 +320,23 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
  *   ac.attributes[0].name;   // "role"
  *   ac.validity.notAfterTime;// Date
  */
-var PARSE_OPTS = { pemLabel: null, PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" };
+var PARSE_OPTS = { pemLabel: "ATTRIBUTE CERTIFICATE", PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" };
 
 function _legacyV1Error() {
-  return new AttrCertError("attrcert/legacy-v1-not-supported", "AttributeCertificateV1 (X.509-1997) is obsolete and not parsed by this build (RFC 5755 §1)");
+  return new AttrCertError("attrcert/legacy-v1-not-supported", "AttributeCertificateV1 (X.509-1997) is obsolete and not parsed by this build (RFC 5755 sec. 1)");
 }
 
 function parse(input) {
   var root = pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
   // A well-formed legacy AttributeCertificateV1 gets the advertised, stable
-  // attrcert/legacy-v1-not-supported on the DIRECT path too — not a low-level asn1/*
-  // tag error from attempting the v2 walk — so a direct caller of this entry sees the
+  // attrcert/legacy-v1-not-supported on the DIRECT path too -- not a low-level asn1/*
+  // tag error from attempting the v2 walk -- so a direct caller of this entry sees the
   // same error family for the recognized-but-deferred form as the orchestrator does.
   if (matchesV1(root)) throw _legacyV1Error();
   return schema.walk(ATTRIBUTE_CERTIFICATE, root, NS).result;
 }
 
-// The obsolete X.509-1997 AttributeCertificateV1 (RFC 5652 §10.2) is recognized and
+// The obsolete X.509-1997 AttributeCertificateV1 (RFC 5652 sec. 10.2) is recognized and
 // deferred: decode the envelope (so a malformed input still fails as bad DER), then
 // throw the precise diagnostic rather than routing it to a wrong format.
 function parseV1(input) {
@@ -334,19 +352,37 @@ function parseV1(input) {
  * @spec       RFC 7468, RFC 5755
  * @related    pki.schema.attrcert.parse
  *
- * Extract the DER bytes from a PEM block (OpenSSL emits
- * `-----BEGIN ATTRIBUTE CERTIFICATE-----`; the first block is taken unless `label`
- * is given). Throws `PemError` on a missing envelope or a non-base64 body.
+ * Extract the DER bytes from a PEM block (default label
+ * `ATTRIBUTE CERTIFICATE`, the OpenSSL armor -- the canonical-label default
+ * every sibling format applies). Pass a `label` to enforce a different block
+ * type, or an explicit `null` to take the first block of any type. Throws
+ * `PemError` on a missing / mismatched envelope or a non-base64 body.
  *
  * @example
  *   var der = pki.schema.attrcert.pemDecode(pemText);
  */
-function pemDecode(text, label) { return pkix.pemDecode(text, label || null, PemError); }
+function pemDecode(text, label) { return pkix.pemDecode(text, label === null ? null : (label || "ATTRIBUTE CERTIFICATE"), PemError); }
+
+/**
+ * @primitive  pki.schema.attrcert.pemEncode
+ * @signature  pki.schema.attrcert.pemEncode(der, label?) -> string
+ * @since      0.1.23
+ * @status     experimental
+ * @spec       RFC 7468, RFC 5755
+ * @related    pki.schema.attrcert.pemDecode
+ *
+ * Wrap DER bytes in a PEM envelope (default label `ATTRIBUTE CERTIFICATE`, the
+ * same default `pemDecode` reads). Throws `PemError` on a malformed label.
+ *
+ * @example
+ *   var pem = pki.schema.attrcert.pemEncode(der);
+ */
+function pemEncode(der, label) { return pkix.pemEncode(der, label || "ATTRIBUTE CERTIFICATE", PemError); }
 
 // matches(root): a v2 AttributeCertificate is the signed-envelope trio whose acinfo
 // LEADS WITH a bare universal INTEGER version (== v2 = 1, NOT the x509 [0] EXPLICIT
 // wrapper) and whose attrCertValidityPeriod at children[5] is a SEQUENCE of exactly
-// two GeneralizedTime (RFC 5755 §4.2.6 forbids UTCTime) — a marker no cert / CRL /
+// two GeneralizedTime (RFC 5755 sec. 4.2.6 forbids UTCTime) -- a marker no cert / CRL /
 // CSR presents at that position. Disjoint from matchesV1 by the children[0] tag class.
 function matches(root) {
   var acinfo = pkix.signedEnvelopeTbs(root);
@@ -360,7 +396,7 @@ function matches(root) {
   return v.children.every(function (t) { return schema.isUniversal(t, TAGS.GENERALIZED_TIME); });
 }
 
-// matchesV1(root): the obsolete AttributeCertificateV1 — its acInfo (version DEFAULT
+// matchesV1(root): the obsolete AttributeCertificateV1 -- its acInfo (version DEFAULT
 // v1 OMITTED) LEADS WITH the subject CHOICE (a context [0]/[1]), and its children[1]
 // is the issuer GeneralNames (a universal SEQUENCE). The children[1] == SEQUENCE test
 // keeps it disjoint from a v3 certificate (whose [0] EXPLICIT version is followed by
@@ -378,6 +414,7 @@ module.exports = {
   parse: parse,
   parseV1: parseV1,
   pemDecode: pemDecode,
+  pemEncode: pemEncode,
   matches: matches,
   matchesV1: matchesV1,
 };