@blamejs/pki 0.2.31 → 0.2.33

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.33 — 2026-07-16
+
+Attribute certificates now decode their RFC 5755 attribute values and attribute-certificate extensions, not just the certificate structure.
+
+### Added
+
+- pki.schema.attrcert.parse decodes the RFC 5755 section 4.4 attribute values -- role (RoleSyntax), clearance (Clearance, including the classification bit list and security categories), authenticationInfo and accessIdentity (SvceAuthInfo), and group and chargingIdentity (IetfAttrSyntax) -- and the section 4.3 attribute-certificate extensions -- auditIdentity, targetInformation and proxyInfo (Targets, with targetCert reusing the IssuerSerial decoder), noRevAvail, and aaControls. Each is surfaced additively (a decoded field alongside the raw value) through the parse consumer path; an unrecognized attribute type or extension id is preserved opaque, and a malformed recognized value fails closed with a typed error. Every GeneralName inside these structures is validated through the shared name decoder.
+
+## v0.2.32 — 2026-07-16
+
+X.509 certificates now decode the Microsoft Active Directory Certificate Services enrollment extensions, and pki.lint's critical-extension check is aligned with certification-path validation.
+
+### Added
+
+- pki.schema.x509.parse decodes the Microsoft Active Directory Certificate Services enrollment extensions ([MS-WCCE] / [MS-CRTD]): the v2 certificate template (szOID-CERTIFICATE_TEMPLATE -- template OID plus major/minor version), the legacy v1 template name (szOID-ENROLL_CERTTYPE_EXTENSION), the CA version (szOID-CERTSRV_CA_VERSION, surfaced as the raw value and as the CA key index / certificate index split), the previous-CA-certificate hash (szOID-CERTSRV_PREVIOUS_CERT_HASH), and the application policies (szOID-APPLICATION_CERT_POLICIES, decoded as RFC 5280 certificate policies). Each is rendered by pki.inspect and fails closed with a typed error on a malformed shape. The version fields accept the full 32-bit range Active Directory uses, not a signed subset.
+
+### Changed
+
+- pki.lint's unrecognized-critical-extension check now mirrors certification-path validation: it reports a critical extension whose semantics the path validator does not process -- an authority/subject key identifier, a freshest-CRL pointer, an SCT list, a qualified-certificate statement, or a Microsoft enterprise-CA extension -- rather than treating any extension it can merely decode as processed. precertificatePoison, which RFC 6962 requires to be critical, is not reported. A conforming relying party must reject a critical extension it cannot process, so a certificate whose critical enterprise or qualified-certificate constraints this toolkit does not enforce is now surfaced by the linter.
+
 ## v0.2.31 — 2026-07-16
 
 X.509 certificates now decode the RFC 3739 / ETSI EN 319 412-5 qualified-certificate qcStatements extension, and the sigstore verifier gains a low-order EdDSA public-key gate.

package/README.md

@@ -203,7 +203,7 @@ is callable today; nothing below is a stub.
 | `pki.oid` | Two-way OID ↔ name registry — `name`, `byName`, `register`, `toArcs`/`fromArcs`, `toDER`/`fromDER`; seeded with RFC 5280 + NIST PQC arcs |
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
-| `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque), fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.c509` | Parse C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed) |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
@@ -211,7 +211,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.cms` | Parse DER / PEM CMS per RFC 5652 / 5083 / 9629 — SignedData (§5, signer infos + raw signed-attribute bytes for external verification), EnvelopedData (§6, all five RecipientInfo kinds incl. RFC 5753 key-agreement and RFC 9629 KEM recipients with ML-KEM validation), EncryptedData (§8), AuthenticatedData (§9, MAC surface + raw `authAttrsBytes`), and AuthEnvelopedData (RFC 5083, with RFC 5084 AES-GCM/CCM parameter validation); §11 attribute placement enforced, countersignatures validated recursively, certificates / CRLs validated against the closed CHOICE sets and kept raw, every result tagged `contentTypeName`, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode`, `pemEncode` |
 | `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp requests, responses, and tokens — the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseRequest`, `parseResponse`, `parseTstInfo`, `parseToken`, `pemDecode`, `pemEncode` |
-| `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes and extensions **decoded to structured values** (role, clearance, service/access identity, group, charging identity; audit identity, target/proxy information, no-rev-avail, AA controls — unknown types preserved opaque), with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.crmf` | Parse DER / PEM RFC 4211 certificate request messages (CertReqMessages — the CMP / EST enrollment body) — the requested-certificate template (subject, public key, validity, extensions), proof-of-possession, and registration controls, with the raw `CertRequest` region a POP verifier hashes; names dual-accepted (IMPLICIT and EXPLICIT), fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs12` | Parse DER / BER / PEM RFC 7292 PKCS#12 (PFX) stores — key bags via the PKCS#8 parser, shrouded keys (algorithm surfaced, ciphertext opaque), cert / CRL / secret bags raw and byte-exact, encrypted and enveloped safes structurally via CMS, `friendlyName` / `localKeyId` decoded, and the exact MAC byte range (`macedBytes`) plus RFC 9579 PBMAC1 recognition for external verification; BER accepted exactly where §4.1 requires it, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.cmp` | Parse DER / PEM RFC 9810 Certificate Management Protocol messages (PKIMessage) — the header (version, sender / recipient incl. the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` / `bodyBytes` slices an external verifier reconstructs the protected part from; the CMP-before-OCSP dispatch order is enforced, fail-closed — `parse`, `pemDecode`, `pemEncode` |

package/lib/inspect.js

@@ -335,6 +335,19 @@ var EXT_RENDERERS = {
       return label;
     }).join("\n");
   },
+  msCertificateTemplate: function (decoded, inner) {
+    var v = decoded.templateMajorVersion === null ? "" : " v" + decoded.templateMajorVersion + "." + (decoded.templateMinorVersion === null ? 0 : decoded.templateMinorVersion);
+    return inner + "Template: " + (decoded.name || decoded.templateID) + v;
+  },
+  msEnrollCertType: function (decoded, inner) {
+    return inner + "Cert Type: " + _clean(String(decoded));
+  },
+  msCaVersion: function (decoded, inner) {
+    return inner + "CA Version: V" + decoded.caKeyIndex + "." + decoded.certIndex;
+  },
+  msPreviousCertHash: function (decoded, inner) {
+    return inner + _hexColon(Buffer.isBuffer(decoded) ? decoded : Buffer.alloc(0), { upper: true });
+  },
   subjectAltName: _renderAltName,
   issuerAltName: _renderAltName,
   certificatePolicies: function (decoded, inner) {
@@ -422,6 +435,8 @@ var EXT_RENDERERS = {
     return akiLines.length ? akiLines.join("\n") : inner + "keyid:(none)";
   },
 };
+// [MS-WCCE] szOID-APPLICATION_CERT_POLICIES decodes as certificatePolicies, so it renders identically.
+EXT_RENDERERS.msApplicationPolicies = EXT_RENDERERS.certificatePolicies;
 
 // Coverage residual -- the EXT_RENDERERS entry fallbacks are unreachable because each shared
 // decoder (and asn1.read.oid) already narrows the shape before the renderer runs:

package/lib/lint.js

@@ -29,6 +29,7 @@ var guard = require("./guard-all");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var pkix = require("./schema-pkix");
+var path = require("./path-validate");
 var C = require("./constants");
 var ipUtils = require("./ip-utils");
 
@@ -237,24 +238,32 @@ function _subjectCNs(cert) {
   return out;
 }
 
-// An extension is "recognized" (RFC 5280 4.2: a consumer MUST reject a critical extension
-// it does NOT recognize / cannot process) when the toolkit has a DECODER for it -- the
-// shared certExtensionDecoders table IS the set of extensions this toolkit processes. This
-// is registry-driven (no curated list to omit a legitimately-critical extension such as
-// policyMappings, which the table decodes) and correctly scoped to EXTENSION OIDs: an
-// algorithm / EKU-purpose OID the name registry happens to resolve is NOT in the decoder
-// table, so a critical extension carrying such an OID is still flagged.
-//
-// The one exception: an extension the table DECODES for display but whose CRITICAL semantics
-// the toolkit does not enforce. qcStatements decodes (for pki.inspect / this linter) yet a
-// critical instance asserts qualified-certificate constraints (a reliance limit, a certificate
-// purpose) no consumer here processes -- path-validate rejects a critical qcStatements as
-// unrecognized-critical for exactly that reason. Structural decodability is not validation
-// processing, so a critical qcStatements is still flagged here, keeping lint consistent with
-// certification-path validation.
-var _DECODE_ONLY_UNPROCESSED_CRITICAL = {};
-_DECODE_ONLY_UNPROCESSED_CRITICAL[oid.byName("qcStatements")] = true;
-function _isUnknownExtension(extOid) { return !EXT_DECODERS[extOid] || _DECODE_ONLY_UNPROCESSED_CRITICAL[extOid] === true; }
+// An extension's CRITICALITY is honoured (RFC 5280 4.2: a consumer MUST reject a critical extension
+// it cannot PROCESS) only when this toolkit actually processes its semantics. That authority is
+// path-validate's PROCESSED_EXTENSIONS (the RFC 5280 sec. 6.1 path-processing set), NOT the decoder
+// table: certExtensionDecoders also DECODES many extensions purely for display (qcStatements, the MS
+// enterprise-CA extensions, the SCT list, the *KeyIdentifiers, freshestCRL, issuerAltName) whose
+// critical semantics are not enforced -- path-validate rejects a critical instance of any of those
+// as unrecognized-critical, so the linter flags them too (structural decodability is not validation
+// processing). The one decode-only extension that is LEGITIMATELY critical is precertificatePoison
+// (RFC 6962 sec. 3.1 REQUIRES it critical), so it is allow-listed. Everything else -- a processed
+// extension, or an unregistered OID (algorithm / EKU-purpose OID the name registry resolves but that
+// is no extension) -- falls out correctly: processed -> recognized, unregistered -> unknown. Driving
+// this off the validator's set (not the decoder table) means a newly-decoded extension is
+// flagged-when-critical automatically until its semantics are actually processed.
+var _CRITICAL_LEGIT = {};
+_CRITICAL_LEGIT[oid.byName("precertificatePoison")] = true;
+// Mirrors path-validate's unrecognizedCriticalExtension. An extension not in PROCESSED_EXTENSIONS is
+// unknown everywhere (precertificatePoison is the one legitimately-critical exception). An extension
+// that IS processed for an intermediate but is unprocessed on the TARGET (policyMappings) is also
+// flagged: path-validate decides target status purely by path position (i === n), so ANY certificate
+// -- a CA included -- can be validated as the final/target certificate, where a critical instance is
+// rejected. A linter has no path context and cannot rule that out, so it flags these regardless of
+// cA-ness (policyMappings is SHOULD-be-non-critical everywhere, so this never mis-flags conformant input).
+function _isUnknownExtension(extOid) {
+  if (path.PROCESSED_EXTENSIONS[extOid] !== true) return _CRITICAL_LEGIT[extOid] !== true;
+  return path.TARGET_UNPROCESSED_IF_CRITICAL[extOid] === true;
+}
 
 // RSA-modulus / EC-curve helpers for the weak-key lint. Each returns null when the key
 // material cannot be read as expected (a malformed RSA modulus, or EC parameters that are

package/lib/oid.js

@@ -95,6 +95,13 @@ var FAMILIES = {
   // ETSI EN 319 412-5 QcType member OIDs (the certificate-purpose types) on the id-etsi-qct arc.
   etsiQcType: { base: [0, 4, 0, 1862, 1, 6], of: { qctEsign: 1, qctEseal: 2, qctWeb: 3 } },
 
+  // [MS-WCCE] AD CS enrollment extensions on the id-microsoft-21 arc (szOID-CERTSRV / szOID-CERTIFICATE_TEMPLATE / szOID-APPLICATION_CERT_POLICIES).
+  msEnrollment: { base: [1, 3, 6, 1, 4, 1, 311, 21], of: {
+    msCaVersion: 1, msPreviousCertHash: 2, msCertificateTemplate: 7, msApplicationPolicies: 10 } },
+
+  // [MS-CRTD] legacy v1 enroll cert-type name on the id-microsoft-20 arc (szOID-ENROLL_CERTTYPE_EXTENSION).
+  msEnrollmentLegacy: { base: [1, 3, 6, 1, 4, 1, 311, 20], of: { msEnrollCertType: 2 } },
+
   // id-aca -- RFC 5755 attribute-certificate attribute types on the id-pkix 10 arc:
   // authenticationInfo sec. 4.4.1 .. group sec. 4.4.4, plus encAttrs sec. 7.1 (the encrypted-
   // attribute wrapper, syntax ContentInfo). { id-aca 5 } is reserved.

package/lib/path-validate.js

@@ -101,6 +101,11 @@ var PROCESSED_EXTENSIONS = {};
  OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
  OID.extKeyUsage, OID.cRLDistributionPoints].
   forEach(function (o) { PROCESSED_EXTENSIONS[o] = true; });
+// Frozen after seeding: this exact object is both consulted by the critical-extension check here and
+// exported (for pki.lint to stay consistent). A caller must not be able to add an OID -- doing so
+// would make an attacker's critical, decoder-less extension pass as "processed" and skip both the
+// unrecognized-critical check and structural validation. Freezing makes any such write a no-op.
+Object.freeze(PROCESSED_EXTENSIONS);
 
 // ---- signature verify bridge (NEW 6) ---------------------------------------
 
@@ -1061,6 +1066,7 @@ function applyPolicyMappings(state, mappings, i) {
 // a terminal CA cert is conforming and is NOT treated as unprocessed here.)
 var TARGET_UNPROCESSED_IF_CRITICAL = {};
 TARGET_UNPROCESSED_IF_CRITICAL[OID.policyMappings] = true;
+Object.freeze(TARGET_UNPROCESSED_IF_CRITICAL);
 
 function unrecognizedCriticalExtension(cert, isTarget) {
   for (var i = 0; i < cert.extensions.length; i++) {
@@ -2023,4 +2029,13 @@ module.exports = {
   crlChecker: crlChecker,
   ocspChecker: ocspChecker,
   verifyOcspResponse: verifyOcspResponse,
+  // The set of extension OIDs whose CRITICAL semantics this validator processes (RFC 5280 sec. 6.1).
+  // Exposed so a linter can distinguish "processed" from "merely decoded" and stay consistent with
+  // the path-validation verdict on a critical extension -- a decoder in certExtensionDecoders is NOT
+  // by itself proof the criticality is honoured. Both sets are frozen so a caller cannot mutate them.
+  PROCESSED_EXTENSIONS: PROCESSED_EXTENSIONS,
+  // Extensions that ARE processed for an intermediate CA but are unprocessed on the target/leaf, so a
+  // critical instance on the target fails closed (RFC 5280 sec. 6.1.5(f)) -- policyMappings is
+  // prepare-next-only and SHOULD-be-non-critical. A linter mirrors this for a leaf certificate.
+  TARGET_UNPROCESSED_IF_CRITICAL: TARGET_UNPROCESSED_IF_CRITICAL,
 };

package/lib/schema-attrcert.js

@@ -281,7 +281,24 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
     // kept stable for consumers keying off `form`.
     var issuer = { form: "v2Form", v2Form: acinfo.fields.issuer.value.result, v1Form: null };
 
+    // RFC 5755 sec. 4.4 -- decode each attribute's value(s) additively: a recognized attribute type
+    // gains `decoded` (parallel to `values`); an unrecognized type falls back to { opaque, bytes } so
+    // the parse never fails on an unknown attribute, and a recognized-but-malformed value fails closed.
+    var attributes = acinfo.fields.attributes.value.result;
+    attributes.forEach(function (a) {
+      var dec = _ATTR_VALUE_DECODERS[a.type];
+      a.decoded = a.values.map(function (v) { return dec ? dec(v) : { opaque: true, bytes: v }; });
+    });
+
+    // RFC 5755 sec. 4.3 -- decode each AC extension additively (extensions[i].decoded), same opaque
+    // fallback + fail-closed-on-malformed contract as the attributes above.
     var extField = acinfo.fields.extensions;
+    var extensions = (extField && extField.present) ? extField.value.result : [];
+    extensions.forEach(function (x) {
+      var dec = _AC_EXT_DECODERS[x.oid];
+      x.decoded = dec ? dec(x.value) : { opaque: true, bytes: x.value };
+    });
+
     return {
       version:               acinfo.fields.version.value,     // 2
       holder:                acinfo.fields.holder.value.result,
@@ -291,9 +308,9 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
       serialNumber:          acinfo.fields.serialNumber.value,
       serialNumberHex:       sc.toString("hex"),
       validity:              acinfo.fields.attrCertValidityPeriod.value.result,
-      attributes:            acinfo.fields.attributes.value.result,
+      attributes:            attributes,
       issuerUniqueID:        acinfo.fields.issuerUniqueID.present ? acinfo.fields.issuerUniqueID.value : null,
-      extensions:            (extField && extField.present) ? extField.value.result : [],
+      extensions:            extensions,
       tbsBytes:              e.tbsBytes,
       signatureValue:        e.signatureValue,
     };
@@ -417,6 +434,238 @@ function matchesV1(root) {
   return schema.isUniversal(k[1], TAGS.SEQUENCE);
 }
 
+// ---- RFC 5755 sec. 4.4 attribute-value decoders ----------------------
+// A per-attribute-type decoder table (mirroring pkix.certExtensionDecoders): each takes the raw
+// AttributeValue TLV Buffer and returns a structured value, throwing a typed attrcert/bad-* error on
+// any non-conformant shape. Composes pkix's shared imperative helpers + generalName/generalNames.
+// A single GeneralName decodes as the walk OBJECT itself (gn.tagNumber / gn.value); generalNames
+// (plural) returns { names:[...] } on .result.
+var _AV = pkix._decodeHelpers(NS);
+var _decodeTop = _AV.decodeTop, _seqChildren = _AV.seqChildren, _readInt = _AV.readInt, _Oav = _AV.O;
+var _GN = pkix.generalName(NS, { decodeValue: true, code: "attrcert/bad-general-name" });
+var _GNS_0 = pkix.generalNames(NS, { implicitTag: 0, decodeValue: true, code: "attrcert/bad-general-names" });
+function _isCtx(node, n) { return node && node.tagClass === "context" && node.tagNumber === n; }
+function _isU(node, tag) { return node && node.tagClass === "universal" && node.tagNumber === tag; }
+function _oneGN(node, code) {
+  if (!_isCtx(node, 0) && !_isCtx(node, 1) && !_isCtx(node, 2) && !_isCtx(node, 3) &&
+      !_isCtx(node, 4) && !_isCtx(node, 5) && !_isCtx(node, 6) && !_isCtx(node, 7) && !_isCtx(node, 8)) {
+    throw NS.E(code, "a GeneralName must be a context-tagged [0]..[8] CHOICE alternative");
+  }
+  var gn = schema.walk(_GN, node, NS);
+  return { tagNumber: gn.tagNumber, value: gn.value };
+}
+
+// SvceAuthInfo ::= SEQUENCE { service GeneralName, ident GeneralName, authInfo OCTET STRING OPTIONAL }
+// -- authenticationInfo (sec. 4.4.1) allows authInfo; accessIdentity (sec. 4.4.2) MUST omit it.
+function _svceAuthInfo(authInfoAllowed, code) {
+  return function (buf) {
+    var kids = _seqChildren(buf, code, "SvceAuthInfo");
+    if (kids.length < 2 || kids.length > 3) throw NS.E(code, "SvceAuthInfo must be a SEQUENCE { service, ident, authInfo? }");
+    var service = _oneGN(kids[0], code);
+    var ident = _oneGN(kids[1], code);
+    var authInfo = null;
+    if (kids.length === 3) {
+      if (!authInfoAllowed) throw NS.E(code, "this attribute must not carry authInfo (RFC 5755 sec. 4.4.2)");
+      if (!_isU(kids[2], TAGS.OCTET_STRING)) throw NS.E(code, "SvceAuthInfo authInfo must be an OCTET STRING");
+      authInfo = Buffer.concat([asn1.read.octetString(kids[2])]);
+    }
+    return { service: service, ident: ident, authInfo: authInfo };
+  };
+}
+
+// IetfAttrSyntax ::= SEQUENCE { policyAuthority [0] IMPLICIT GeneralNames OPTIONAL,
+//   values SEQUENCE OF CHOICE { octets OCTET STRING, oid OBJECT IDENTIFIER, string UTF8String } }
+function _ietfAttrSyntax(buf) {
+  var C = "attrcert/bad-ietf-attr";
+  var kids = _seqChildren(buf, C, "IetfAttrSyntax");
+  if (!kids.length || kids.length > 2) throw NS.E(C, "IetfAttrSyntax must be a SEQUENCE { policyAuthority [0]?, values }");
+  var policyAuthority = null, i = 0;
+  if (_isCtx(kids[0], 0)) { policyAuthority = schema.walk(_GNS_0, kids[0], NS).result; i = 1; }
+  var valuesNode = kids[i];
+  if (!valuesNode || !_isU(valuesNode, TAGS.SEQUENCE) || !valuesNode.children || !valuesNode.children.length) {
+    throw NS.E(C, "IetfAttrSyntax values must be a non-empty SEQUENCE OF value");
+  }
+  if (i + 1 !== kids.length) throw NS.E(C, "IetfAttrSyntax has unexpected trailing fields (a [0] must precede values)");
+  var kinds = {};
+  var values = valuesNode.children.map(function (v) {
+    if (_isU(v, TAGS.OCTET_STRING)) { kinds.octets = true; return { kind: "octets", value: Buffer.concat([asn1.read.octetString(v)]) }; }
+    if (_isU(v, TAGS.OBJECT_IDENTIFIER)) { kinds.oid = true; return { kind: "oid", value: asn1.read.oid(v) }; }
+    if (_isU(v, TAGS.UTF8_STRING)) { kinds.string = true; return { kind: "string", value: asn1.read.string(v) }; }
+    throw NS.E(C, "IetfAttrSyntax value must be an OCTET STRING, OBJECT IDENTIFIER, or UTF8String");
+  });
+  return { policyAuthority: policyAuthority, values: values, homogeneous: Object.keys(kinds).length === 1 };
+}
+
+// RoleSyntax ::= SEQUENCE { roleAuthority [0] IMPLICIT GeneralNames OPTIONAL, roleName [1] EXPLICIT GeneralName }
+function _role(buf) {
+  var C = "attrcert/bad-role";
+  var kids = _seqChildren(buf, C, "RoleSyntax");
+  if (!kids.length || kids.length > 2) throw NS.E(C, "RoleSyntax must be a SEQUENCE { roleAuthority [0]?, roleName [1] }");
+  var roleAuthority = null, i = 0;
+  if (_isCtx(kids[0], 0)) { roleAuthority = schema.walk(_GNS_0, kids[0], NS).result; i = 1; }
+  var rn = kids[i];
+  if (!_isCtx(rn, 1) || !rn.children || rn.children.length !== 1) throw NS.E(C, "RoleSyntax roleName must be an EXPLICIT [1] wrapping exactly one GeneralName");
+  if (i + 1 !== kids.length) throw NS.E(C, "RoleSyntax has unexpected trailing fields");
+  return { roleAuthority: roleAuthority, roleName: _oneGN(rn.children[0], C) };
+}
+
+// Clearance ::= SEQUENCE { policyId OBJECT IDENTIFIER, classList ClassList DEFAULT {unclassified},
+//   securityCategories SET OF SecurityCategory OPTIONAL }.
+// ClassList ::= BIT STRING { unmarked(0), unclassified(1), restricted(2), confidential(3), secret(4), topSecret(5) }.
+var _CLASSLIST_NAMES = ["unmarked", "unclassified", "restricted", "confidential", "secret", "topSecret"];
+function _decodeClassList(node, C) {
+  var bs;
+  try { bs = asn1.read.bitString(node); } catch (e) { throw NS.E(C, "Clearance classList must be a BIT STRING", e); }
+  schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw NS.E(C, m); });
+  var names = [], flags = {}, reserved = [];
+  var total = bs.bytes.length * 8 - bs.unusedBits;
+  for (var bit = 0; bit < total; bit++) {
+    if ((bs.bytes[bit >> 3] & (0x80 >> (bit & 7))) === 0) continue;
+    if (bit < _CLASSLIST_NAMES.length) { names.push(_CLASSLIST_NAMES[bit]); flags[_CLASSLIST_NAMES[bit]] = true; }
+    else reserved.push(bit);
+  }
+  return { names: names, flags: flags, reservedBits: reserved };
+}
+// SecurityCategory ::= SEQUENCE { type [0] IMPLICIT OBJECT IDENTIFIER, value [1] EXPLICIT ANY }.
+function _securityCategory(node, C) {
+  if (!_isU(node, TAGS.SEQUENCE) || !node.children || node.children.length !== 2) throw NS.E(C, "a SecurityCategory must be a SEQUENCE of a type and a value");
+  var typeNode = node.children[0], valueNode = node.children[1];
+  if (!_isCtx(typeNode, 0) || typeNode.children) throw NS.E(C, "SecurityCategory type must be a primitive [0] IMPLICIT OBJECT IDENTIFIER");
+  var type; try { type = asn1.decodeOidContent(typeNode.content); } catch (e) { throw NS.E(C, "SecurityCategory type is not a valid OBJECT IDENTIFIER", e); }
+  if (!_isCtx(valueNode, 1) || !valueNode.children || valueNode.children.length !== 1) throw NS.E(C, "SecurityCategory value must be an EXPLICIT [1] wrapping one element");
+  return { type: type, valueBytes: Buffer.concat([valueNode.children[0].bytes]) };
+}
+function _clearance(buf) {
+  var C = "attrcert/bad-clearance";
+  var kids = _seqChildren(buf, C, "Clearance");
+  if (!kids.length || kids.length > 3) throw NS.E(C, "Clearance must be a SEQUENCE { policyId, classList?, securityCategories? }");
+  if (!_isU(kids[0], TAGS.OBJECT_IDENTIFIER)) throw NS.E(C, "Clearance policyId must be an OBJECT IDENTIFIER");
+  var policyId; try { policyId = asn1.read.oid(kids[0]); } catch (e) { throw NS.E(C, "Clearance policyId must be an OBJECT IDENTIFIER", e); }
+  var classList = { names: ["unclassified"], flags: { unclassified: true }, reservedBits: [] }, i = 1;   // DEFAULT {unclassified}
+  if (kids[i] && _isU(kids[i], TAGS.BIT_STRING)) {
+    classList = _decodeClassList(kids[i], C);
+    if (classList.names.length === 1 && classList.flags.unclassified && !classList.reservedBits.length) {
+      throw NS.E(C, "Clearance classList equal to the DEFAULT {unclassified} must be omitted (non-canonical DER)");
+    }
+    i++;
+  }
+  var securityCategories = null;
+  if (kids[i]) {
+    var setNode = kids[i];
+    if (!_isU(setNode, TAGS.SET) || !setNode.children || !setNode.children.length) throw NS.E(C, "Clearance securityCategories must be a non-empty SET OF SecurityCategory");
+    securityCategories = setNode.children.map(function (categoryNode) { return _securityCategory(categoryNode, C); });
+    i++;
+  }
+  if (i !== kids.length) throw NS.E(C, "Clearance has fields out of order or unexpected trailing fields");
+  return { policyId: policyId, classList: classList, securityCategories: securityCategories };
+}
+
+var _ATTR_VALUE_DECODERS = {};
+_ATTR_VALUE_DECODERS[_Oav("role")] = _role;
+_ATTR_VALUE_DECODERS[_Oav("clearance")] = _clearance;
+// RFC 5755 sec. 4.4.6 requires decoding the legacy RFC 3281 id-at-clearance too (the X.501
+// selected-attribute-types arc, an alias of "clearance" -- built from arcs, never a dotted literal).
+_ATTR_VALUE_DECODERS[oid.fromArcs([2, 5, 1, 5, 55])] = _clearance;
+_ATTR_VALUE_DECODERS[_Oav("authenticationInfo")] = _svceAuthInfo(true, "attrcert/bad-svce-auth-info");
+_ATTR_VALUE_DECODERS[_Oav("accessIdentity")] = _svceAuthInfo(false, "attrcert/bad-access-identity");
+_ATTR_VALUE_DECODERS[_Oav("chargingIdentity")] = _ietfAttrSyntax;
+_ATTR_VALUE_DECODERS[_Oav("group")] = _ietfAttrSyntax;
+
+// ---- RFC 5755 sec. 4.3 AC-extension decoders -------------------------
+// A per-extension-OID decoder table for the AC-specific extensions (kept in the AC domain, not the
+// shared cert-extension table, because Targets/TargetCert reuse the local IssuerSerial). Each takes
+// the raw extnValue content Buffer and returns a structured value, fail-closed with a typed error.
+
+// AuditIdentity ::= OCTET STRING (sec. 4.3.1) -- an opaque audit tag, unconstrained (no SIZE), so an
+// empty OCTET STRING (04 00) is valid; only the OCTET STRING type is enforced.
+function _acAuditIdentity(buf) {
+  var C = "attrcert/bad-audit-identity";
+  var n = _decodeTop(buf, C, "AuditIdentity");
+  if (!_isU(n, TAGS.OCTET_STRING)) throw NS.E(C, "AuditIdentity must be an OCTET STRING");
+  return Buffer.concat([asn1.read.octetString(n)]);
+}
+
+// NoRevAvail syntax is NULL (sec. 4.3.6: '0500'H is the DER encoding) -- the extnValue OCTET STRING
+// contains a DER NULL. An empty or any-other-shape value is malformed and fails closed.
+function _noRevAvail(buf) {
+  var C = "attrcert/bad-no-rev-avail";
+  var n = _decodeTop(buf, C, "NoRevAvail");
+  try { asn1.read.nullValue(n); } catch (e) { throw NS.E(C, "NoRevAvail must be a DER NULL (RFC 5755 sec. 4.3.6)", e); }
+  return { noRevAvail: true };
+}
+
+// Target ::= CHOICE { targetName [0] GeneralName, targetGroup [1] GeneralName, targetCert [2] TargetCert }.
+// [0]/[1] wrap a GeneralName CHOICE (EXPLICIT); [2] is an IMPLICIT TargetCert SEQUENCE.
+function _acTargetCert(node, C) {
+  if (!node.children || !node.children.length) throw NS.E(C, "a targetCert [2] must be a non-empty TargetCert SEQUENCE");
+  var out = { kind: "targetCert", targetCertificate: null, targetName: null, certDigestInfo: null }, i = 0;
+  out.targetCertificate = schema.walk(ISSUER_SERIAL, node.children[i++], NS).result;
+  if (node.children[i] && node.children[i].tagClass === "context") out.targetName = _oneGN(node.children[i++], C);
+  if (node.children[i] && _isU(node.children[i], TAGS.SEQUENCE)) out.certDigestInfo = schema.walk(OBJECT_DIGEST_INFO, node.children[i++], NS).result;
+  if (i !== node.children.length) throw NS.E(C, "a targetCert has unexpected trailing fields");
+  return out;
+}
+function _acTarget(node, C, allowTargetCert) {
+  if (_isCtx(node, 0) || _isCtx(node, 1)) {
+    if (!node.children || node.children.length !== 1) throw NS.E(C, "a Target name must be an EXPLICIT [0]/[1] wrapping one GeneralName");
+    return { kind: node.tagNumber === 0 ? "targetName" : "targetGroup", name: _oneGN(node.children[0], C) };
+  }
+  if (_isCtx(node, 2)) {
+    if (!allowTargetCert) throw NS.E(C, "the targetCert [2] CHOICE MUST NOT be used in proxying information (RFC 5755 sec. 7.4)");
+    return _acTargetCert(node, C);
+  }
+  throw NS.E(C, "a Target must be [0] targetName, [1] targetGroup, or [2] targetCert");
+}
+// Targets ::= SEQUENCE OF Target -- decode a Targets SEQUENCE node into an array of Target.
+function _acDecodeTargets(node, C, allowTargetCert) {
+  if (!_isU(node, TAGS.SEQUENCE) || !node.children || !node.children.length) throw NS.E(C, "Targets must be a non-empty SEQUENCE OF Target");
+  return node.children.map(function (t) { return _acTarget(t, C, allowTargetCert); });
+}
+// Both targetInformation (sec. 4.3.2) and ProxyInfo (sec. 7.4) are SEQUENCE OF Targets -- an outer
+// SEQUENCE whose every element is itself a Targets (SEQUENCE OF Target). A conforming issuer emits one
+// Targets, but users MUST accept several. proxying additionally forbids the targetCert [2] alternative.
+function _seqOfTargets(buf, C, allowTargetCert) {
+  var kids = _seqChildren(buf, C, "SEQUENCE OF Targets");
+  if (!kids.length) throw NS.E(C, "a SEQUENCE OF Targets must be non-empty");
+  return kids.map(function (targetsNode) { return _acDecodeTargets(targetsNode, C, allowTargetCert); });
+}
+function _targetInformation(buf) { return _seqOfTargets(buf, "attrcert/bad-targets", true); }
+function _acProxying(buf) { return _seqOfTargets(buf, "attrcert/bad-proxy-info", false); }
+
+// AAControls ::= SEQUENCE { pathLenConstraint INTEGER (0..MAX) OPTIONAL, permittedAttrs [0] AttrSpec
+//   OPTIONAL, excludedAttrs [1] AttrSpec OPTIONAL, permitUnSpecified BOOLEAN DEFAULT TRUE }.
+// AttrSpec ::= SEQUENCE OF OBJECT IDENTIFIER (the [0]/[1] IMPLICIT tag replaces the SEQUENCE tag).
+function _acAttrSpec(node, C) {
+  if (!node.children) throw NS.E(C, "an AttrSpec must be a SEQUENCE OF OBJECT IDENTIFIER");
+  return node.children.map(function (o) {
+    if (!_isU(o, TAGS.OBJECT_IDENTIFIER)) throw NS.E(C, "an AttrSpec element must be an OBJECT IDENTIFIER");
+    try { return asn1.read.oid(o); } catch (e) { throw NS.E(C, "an AttrSpec element must be an OBJECT IDENTIFIER", e); }
+  });
+}
+function _aaControls(buf) {
+  var C = "attrcert/bad-aa-controls";
+  var kids = _seqChildren(buf, C, "AAControls");
+  if (kids.length > 4) throw NS.E(C, "AAControls has too many fields");
+  var out = { pathLenConstraint: null, permittedAttrs: null, excludedAttrs: null, permitUnSpecified: true }, i = 0;
+  if (kids[i] && _isU(kids[i], TAGS.INTEGER)) { out.pathLenConstraint = guard.range.uint31(_readInt(kids[i], C, "pathLenConstraint"), NS.E, C, "AAControls pathLenConstraint"); i++; }
+  if (kids[i] && _isCtx(kids[i], 0)) { out.permittedAttrs = _acAttrSpec(kids[i], C); i++; }
+  if (kids[i] && _isCtx(kids[i], 1)) { out.excludedAttrs = _acAttrSpec(kids[i], C); i++; }
+  if (kids[i] && _isU(kids[i], TAGS.BOOLEAN)) {
+    var v = asn1.read.boolean(kids[i]);
+    if (v === true) throw NS.E(C, "AAControls permitUnSpecified TRUE equals the DEFAULT and must be omitted (non-canonical DER)");
+    out.permitUnSpecified = v; i++;
+  }
+  if (i !== kids.length) throw NS.E(C, "AAControls has fields out of order or unexpected trailing fields");
+  return out;
+}
+
+var _AC_EXT_DECODERS = {};
+_AC_EXT_DECODERS[_Oav("acAuditIdentity")] = _acAuditIdentity;
+_AC_EXT_DECODERS[_Oav("targetInformation")] = _targetInformation;
+_AC_EXT_DECODERS[_Oav("noRevAvail")] = _noRevAvail;
+_AC_EXT_DECODERS[_Oav("aaControls")] = _aaControls;
+_AC_EXT_DECODERS[_Oav("acProxying")] = _acProxying;
+
 module.exports = {
   parse: parse,
   parseV1: parseV1,

package/lib/schema-pkix.js

@@ -598,13 +598,14 @@ function assertPolicyQualifiers(qNode, fail) {
   });
 }
 
-function certExtensionDecoders(ns) {
-  var GN_SUBTREE = generalName(ns, { decodeValue: true, subtreeBase: true, code: ns.prefix + "/bad-name-constraints" });
-
+// Shared imperative decode helpers for the certExtensionDecoders + attrValueDecoders factories. Both
+// take the caller's ns, so the helpers close over ns.E / ns.oid; extracted once so the two factories
+// share one copy (a per-OID value-decoder body is the identical idiom to a per-OID extension body).
+function _decodeHelpers(ns) {
   function decodeTop(buf, code, what) {
     var n;
     try { n = asn1.decode(buf); }
-    catch (e) { throw ns.E(code, "malformed " + what + " extension value: " + ((e && e.message) || String(e)), e); }
+    catch (e) { throw ns.E(code, "malformed " + what + " value: " + ((e && e.message) || String(e)), e); }
     return n;
   }
   function seqChildren(buf, code, what) {
@@ -618,6 +619,19 @@ function certExtensionDecoders(ns) {
     try { return asn1.read.integer(node); }
     catch (e) { throw ns.E(code, what + " must be an INTEGER", e); }
   }
+  // Resolve a registered OID name -> dotted string, throwing at module load on a typo (a decoder keyed
+  // by an unresolved name would silently never match, treating a real extension/attribute as opaque).
+  function O(nm) {
+    var d = ns.oid.byName(nm);
+    if (typeof d !== "string") throw new TypeError("pki.schema.pkix: " + JSON.stringify(nm) + " is not a registered OID name");
+    return d;
+  }
+  return { decodeTop: decodeTop, seqChildren: seqChildren, readInt: readInt, O: O };
+}
+
+function certExtensionDecoders(ns) {
+  var GN_SUBTREE = generalName(ns, { decodeValue: true, subtreeBase: true, code: ns.prefix + "/bad-name-constraints" });
+  var _h = _decodeHelpers(ns), decodeTop = _h.decodeTop, seqChildren = _h.seqChildren, readInt = _h.readInt, O = _h.O;
 
   // basicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLen INTEGER (0..MAX) OPTIONAL }
   function basicConstraints(buf) {
@@ -910,15 +924,6 @@ function certExtensionDecoders(ns) {
     });
   }
 
-  // byName returns undefined for an unregistered name; keying a decoder row
-  // under "undefined" would silently drop that extension from dispatch (the
-  // consumer would treat the extension as structurally unvalidated / absent),
-  // so a typo'd key-list entry must fail here, at module load.
-  function O(nm) {
-    var d = ns.oid.byName(nm);
-    if (typeof d !== "string") throw new TypeError("certExtensionDecoders: " + JSON.stringify(nm) + " is not a registered OID name");
-    return d;
-  }
   // qcStatements ::= SEQUENCE OF QCStatement (RFC 3739 sec. 3.2.6). QCStatement ::= SEQUENCE {
   // statementId OBJECT IDENTIFIER, statementInfo ANY DEFINED BY statementId OPTIONAL }. Known statementIds
   // (RFC 3739 id-qcs + the ETSI EN 319 412-5 esi4 catalog) decode their statementInfo; an unknown statementId
@@ -1031,6 +1036,57 @@ function certExtensionDecoders(ns) {
     return out;
   }
 
+  // [MS-WCCE] szOID-CERTIFICATE_TEMPLATE -- CertificateTemplateOID ::= SEQUENCE {
+  //   templateID OID, templateMajorVersion INTEGER OPTIONAL, templateMinorVersion INTEGER OPTIONAL }.
+  // The two versions are DWORDs (0..2^32-1), NOT uint31 -- a CA key/template revision with bit 31
+  // set is a legal DWORD, so bound to the whole safe-integer range, never guard.range.uint31.
+  function msCertificateTemplate(buf) {
+    var C = ns.prefix + "/bad-ms-certificate-template";
+    var kids = seqChildren(buf, C, "CertificateTemplate");
+    if (!kids.length || kids.length > 3) throw ns.E(C, "CertificateTemplateOID must be a SEQUENCE of a templateID and up to two version INTEGERs");
+    if (kids[0].tagClass !== "universal" || kids[0].tagNumber !== _T.OBJECT_IDENTIFIER) throw ns.E(C, "CertificateTemplateOID templateID must be an OBJECT IDENTIFIER");
+    var id;
+    try { id = asn1.read.oid(kids[0]); } catch (e) { throw ns.E(C, "CertificateTemplateOID templateID must be an OBJECT IDENTIFIER", e); }
+    function ver(i, what) {
+      if (!kids[i]) return null;
+      if (kids[i].tagClass !== "universal" || kids[i].tagNumber !== _T.INTEGER) throw ns.E(C, what + " must be an INTEGER");
+      return guard.range.int(readInt(kids[i], C, what), 0n, 4294967295n, ns.E, C, what);
+    }
+    return { templateID: id, name: ns.oid.name(id) || null, templateMajorVersion: ver(1, "templateMajorVersion"), templateMinorVersion: ver(2, "templateMinorVersion") };
+  }
+
+  // [MS-CRTD] szOID-ENROLL_CERTTYPE_EXTENSION -- the legacy v1 template name as a BARE BMPString.
+  // asn1.read.string accepts any universal string tag, so the explicit BMP_STRING assert is the guard.
+  function msEnrollCertType(buf) {
+    var C = ns.prefix + "/bad-ms-enroll-cert-type";
+    var n = decodeTop(buf, C, "EnrollCertType");
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.BMP_STRING) throw ns.E(C, "the enroll cert-type name must be a BMPString");
+    try { return asn1.read.string(n); } catch (e) { throw ns.E(C, "the enroll cert-type name must be a well-formed BMPString", e); }
+  }
+
+  // [MS-WCCE] szOID-CERTSRV_CA_VERSION -- INTEGER (0..2^32-1) = (caKeyIndex << 16) | certIndex.
+  function msCaVersion(buf) {
+    var C = ns.prefix + "/bad-ms-ca-version";
+    var n = decodeTop(buf, C, "CACertVersion");
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.INTEGER) throw ns.E(C, "CACertVersion must be an INTEGER");
+    var v = guard.range.int(readInt(n, C, "CACertVersion"), 0n, 4294967295n, ns.E, C, "CACertVersion (DWORD)");
+    return { caVersion: v, caKeyIndex: v >>> 16, certIndex: v & 0xffff };
+  }
+
+  // [MS-WCCE] szOID-CERTSRV_PREVIOUS_CERT_HASH -- the SHA-1 thumbprint of the prior CA certificate.
+  // AD CS stamps the Windows certificate THUMBPRINT here, which Windows computes with SHA-1 regardless
+  // of the certificate's signature algorithm, so the OCTET STRING is exactly 20 octets. An empty or
+  // other-length value is malformed renewal metadata and fails closed.
+  function msPreviousCertHash(buf) {
+    var C = ns.prefix + "/bad-ms-previous-cert-hash";
+    var n = decodeTop(buf, C, "CAPrevCertHash");
+    var hash;
+    try { hash = Buffer.concat([asn1.read.octetString(n)]); }
+    catch (e) { throw ns.E(C, "CAPrevCertHash must be an OCTET STRING", e); }
+    if (hash.length !== 20) throw ns.E(C, "CAPrevCertHash must be a 20-octet SHA-1 certificate thumbprint");
+    return hash;
+  }
+
   var byOid = {};
   byOid[O("qcStatements")] = qcStatements;
   byOid[O("basicConstraints")] = basicConstraints;
@@ -1049,6 +1105,11 @@ function certExtensionDecoders(ns) {
   byOid[O("precertificatePoison")] = precertPoison;
   byOid[O("cRLDistributionPoints")] = crlDistributionPoints;
   byOid[O("freshestCRL")] = crlDistributionPoints;
+  byOid[O("msCertificateTemplate")] = msCertificateTemplate;
+  byOid[O("msEnrollCertType")] = msEnrollCertType;
+  byOid[O("msCaVersion")] = msCaVersion;
+  byOid[O("msPreviousCertHash")] = msPreviousCertHash;
+  byOid[O("msApplicationPolicies")] = certificatePolicies;   // [MS-WCCE] = RFC 5280 certificatePolicies, reused not re-implemented
   return { byOid: byOid };
 }
 
@@ -1263,6 +1324,7 @@ module.exports = {
   rawNonEmptySequence: rawNonEmptySequence,
   CRL_REASON_NAMES: CRL_REASON_NAMES,
   certExtensionDecoders: certExtensionDecoders,
+  _decodeHelpers: _decodeHelpers,
   attribute: attribute,
   extension: extension,
   extensions: extensions,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.31",
+  "version": "0.2.33",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c89087a8-9dba-4496-9704-cd639f3c4038",
+  "serialNumber": "urn:uuid:81b0b6a6-dee2-4e3f-b995-abbe40a0f560",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T21:10:43.618Z",
+    "timestamp": "2026-07-17T00:29:40.078Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.31",
+      "bom-ref": "@blamejs/pki@0.2.33",
       "type": "application",
       "name": "pki",
-      "version": "0.2.31",
+      "version": "0.2.33",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.31",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.33",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.31",
+      "ref": "@blamejs/pki@0.2.33",
       "dependsOn": []
     }
   ]