@blamejs/pki 0.2.32 → 0.2.33

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.33 — 2026-07-16
+
+Attribute certificates now decode their RFC 5755 attribute values and attribute-certificate extensions, not just the certificate structure.
+
+### Added
+
+- pki.schema.attrcert.parse decodes the RFC 5755 section 4.4 attribute values -- role (RoleSyntax), clearance (Clearance, including the classification bit list and security categories), authenticationInfo and accessIdentity (SvceAuthInfo), and group and chargingIdentity (IetfAttrSyntax) -- and the section 4.3 attribute-certificate extensions -- auditIdentity, targetInformation and proxyInfo (Targets, with targetCert reusing the IssuerSerial decoder), noRevAvail, and aaControls. Each is surfaced additively (a decoded field alongside the raw value) through the parse consumer path; an unrecognized attribute type or extension id is preserved opaque, and a malformed recognized value fails closed with a typed error. Every GeneralName inside these structures is validated through the shared name decoder.
+
 ## v0.2.32 — 2026-07-16
 
 X.509 certificates now decode the Microsoft Active Directory Certificate Services enrollment extensions, and pki.lint's critical-extension check is aligned with certification-path validation.

package/README.md

@@ -211,7 +211,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.cms` | Parse DER / PEM CMS per RFC 5652 / 5083 / 9629 — SignedData (§5, signer infos + raw signed-attribute bytes for external verification), EnvelopedData (§6, all five RecipientInfo kinds incl. RFC 5753 key-agreement and RFC 9629 KEM recipients with ML-KEM validation), EncryptedData (§8), AuthenticatedData (§9, MAC surface + raw `authAttrsBytes`), and AuthEnvelopedData (RFC 5083, with RFC 5084 AES-GCM/CCM parameter validation); §11 attribute placement enforced, countersignatures validated recursively, certificates / CRLs validated against the closed CHOICE sets and kept raw, every result tagged `contentTypeName`, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode`, `pemEncode` |
 | `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp requests, responses, and tokens — the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseRequest`, `parseResponse`, `parseTstInfo`, `parseToken`, `pemDecode`, `pemEncode` |
-| `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes and extensions **decoded to structured values** (role, clearance, service/access identity, group, charging identity; audit identity, target/proxy information, no-rev-avail, AA controls — unknown types preserved opaque), with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.crmf` | Parse DER / PEM RFC 4211 certificate request messages (CertReqMessages — the CMP / EST enrollment body) — the requested-certificate template (subject, public key, validity, extensions), proof-of-possession, and registration controls, with the raw `CertRequest` region a POP verifier hashes; names dual-accepted (IMPLICIT and EXPLICIT), fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs12` | Parse DER / BER / PEM RFC 7292 PKCS#12 (PFX) stores — key bags via the PKCS#8 parser, shrouded keys (algorithm surfaced, ciphertext opaque), cert / CRL / secret bags raw and byte-exact, encrypted and enveloped safes structurally via CMS, `friendlyName` / `localKeyId` decoded, and the exact MAC byte range (`macedBytes`) plus RFC 9579 PBMAC1 recognition for external verification; BER accepted exactly where §4.1 requires it, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.cmp` | Parse DER / PEM RFC 9810 Certificate Management Protocol messages (PKIMessage) — the header (version, sender / recipient incl. the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` / `bodyBytes` slices an external verifier reconstructs the protected part from; the CMP-before-OCSP dispatch order is enforced, fail-closed — `parse`, `pemDecode`, `pemEncode` |

package/lib/schema-attrcert.js

@@ -281,7 +281,24 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
     // kept stable for consumers keying off `form`.
     var issuer = { form: "v2Form", v2Form: acinfo.fields.issuer.value.result, v1Form: null };
 
+    // RFC 5755 sec. 4.4 -- decode each attribute's value(s) additively: a recognized attribute type
+    // gains `decoded` (parallel to `values`); an unrecognized type falls back to { opaque, bytes } so
+    // the parse never fails on an unknown attribute, and a recognized-but-malformed value fails closed.
+    var attributes = acinfo.fields.attributes.value.result;
+    attributes.forEach(function (a) {
+      var dec = _ATTR_VALUE_DECODERS[a.type];
+      a.decoded = a.values.map(function (v) { return dec ? dec(v) : { opaque: true, bytes: v }; });
+    });
+
+    // RFC 5755 sec. 4.3 -- decode each AC extension additively (extensions[i].decoded), same opaque
+    // fallback + fail-closed-on-malformed contract as the attributes above.
     var extField = acinfo.fields.extensions;
+    var extensions = (extField && extField.present) ? extField.value.result : [];
+    extensions.forEach(function (x) {
+      var dec = _AC_EXT_DECODERS[x.oid];
+      x.decoded = dec ? dec(x.value) : { opaque: true, bytes: x.value };
+    });
+
     return {
       version:               acinfo.fields.version.value,     // 2
       holder:                acinfo.fields.holder.value.result,
@@ -291,9 +308,9 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
       serialNumber:          acinfo.fields.serialNumber.value,
       serialNumberHex:       sc.toString("hex"),
       validity:              acinfo.fields.attrCertValidityPeriod.value.result,
-      attributes:            acinfo.fields.attributes.value.result,
+      attributes:            attributes,
       issuerUniqueID:        acinfo.fields.issuerUniqueID.present ? acinfo.fields.issuerUniqueID.value : null,
-      extensions:            (extField && extField.present) ? extField.value.result : [],
+      extensions:            extensions,
       tbsBytes:              e.tbsBytes,
       signatureValue:        e.signatureValue,
     };
@@ -417,6 +434,238 @@ function matchesV1(root) {
   return schema.isUniversal(k[1], TAGS.SEQUENCE);
 }
 
+// ---- RFC 5755 sec. 4.4 attribute-value decoders ----------------------
+// A per-attribute-type decoder table (mirroring pkix.certExtensionDecoders): each takes the raw
+// AttributeValue TLV Buffer and returns a structured value, throwing a typed attrcert/bad-* error on
+// any non-conformant shape. Composes pkix's shared imperative helpers + generalName/generalNames.
+// A single GeneralName decodes as the walk OBJECT itself (gn.tagNumber / gn.value); generalNames
+// (plural) returns { names:[...] } on .result.
+var _AV = pkix._decodeHelpers(NS);
+var _decodeTop = _AV.decodeTop, _seqChildren = _AV.seqChildren, _readInt = _AV.readInt, _Oav = _AV.O;
+var _GN = pkix.generalName(NS, { decodeValue: true, code: "attrcert/bad-general-name" });
+var _GNS_0 = pkix.generalNames(NS, { implicitTag: 0, decodeValue: true, code: "attrcert/bad-general-names" });
+function _isCtx(node, n) { return node && node.tagClass === "context" && node.tagNumber === n; }
+function _isU(node, tag) { return node && node.tagClass === "universal" && node.tagNumber === tag; }
+function _oneGN(node, code) {
+  if (!_isCtx(node, 0) && !_isCtx(node, 1) && !_isCtx(node, 2) && !_isCtx(node, 3) &&
+      !_isCtx(node, 4) && !_isCtx(node, 5) && !_isCtx(node, 6) && !_isCtx(node, 7) && !_isCtx(node, 8)) {
+    throw NS.E(code, "a GeneralName must be a context-tagged [0]..[8] CHOICE alternative");
+  }
+  var gn = schema.walk(_GN, node, NS);
+  return { tagNumber: gn.tagNumber, value: gn.value };
+}
+
+// SvceAuthInfo ::= SEQUENCE { service GeneralName, ident GeneralName, authInfo OCTET STRING OPTIONAL }
+// -- authenticationInfo (sec. 4.4.1) allows authInfo; accessIdentity (sec. 4.4.2) MUST omit it.
+function _svceAuthInfo(authInfoAllowed, code) {
+  return function (buf) {
+    var kids = _seqChildren(buf, code, "SvceAuthInfo");
+    if (kids.length < 2 || kids.length > 3) throw NS.E(code, "SvceAuthInfo must be a SEQUENCE { service, ident, authInfo? }");
+    var service = _oneGN(kids[0], code);
+    var ident = _oneGN(kids[1], code);
+    var authInfo = null;
+    if (kids.length === 3) {
+      if (!authInfoAllowed) throw NS.E(code, "this attribute must not carry authInfo (RFC 5755 sec. 4.4.2)");
+      if (!_isU(kids[2], TAGS.OCTET_STRING)) throw NS.E(code, "SvceAuthInfo authInfo must be an OCTET STRING");
+      authInfo = Buffer.concat([asn1.read.octetString(kids[2])]);
+    }
+    return { service: service, ident: ident, authInfo: authInfo };
+  };
+}
+
+// IetfAttrSyntax ::= SEQUENCE { policyAuthority [0] IMPLICIT GeneralNames OPTIONAL,
+//   values SEQUENCE OF CHOICE { octets OCTET STRING, oid OBJECT IDENTIFIER, string UTF8String } }
+function _ietfAttrSyntax(buf) {
+  var C = "attrcert/bad-ietf-attr";
+  var kids = _seqChildren(buf, C, "IetfAttrSyntax");
+  if (!kids.length || kids.length > 2) throw NS.E(C, "IetfAttrSyntax must be a SEQUENCE { policyAuthority [0]?, values }");
+  var policyAuthority = null, i = 0;
+  if (_isCtx(kids[0], 0)) { policyAuthority = schema.walk(_GNS_0, kids[0], NS).result; i = 1; }
+  var valuesNode = kids[i];
+  if (!valuesNode || !_isU(valuesNode, TAGS.SEQUENCE) || !valuesNode.children || !valuesNode.children.length) {
+    throw NS.E(C, "IetfAttrSyntax values must be a non-empty SEQUENCE OF value");
+  }
+  if (i + 1 !== kids.length) throw NS.E(C, "IetfAttrSyntax has unexpected trailing fields (a [0] must precede values)");
+  var kinds = {};
+  var values = valuesNode.children.map(function (v) {
+    if (_isU(v, TAGS.OCTET_STRING)) { kinds.octets = true; return { kind: "octets", value: Buffer.concat([asn1.read.octetString(v)]) }; }
+    if (_isU(v, TAGS.OBJECT_IDENTIFIER)) { kinds.oid = true; return { kind: "oid", value: asn1.read.oid(v) }; }
+    if (_isU(v, TAGS.UTF8_STRING)) { kinds.string = true; return { kind: "string", value: asn1.read.string(v) }; }
+    throw NS.E(C, "IetfAttrSyntax value must be an OCTET STRING, OBJECT IDENTIFIER, or UTF8String");
+  });
+  return { policyAuthority: policyAuthority, values: values, homogeneous: Object.keys(kinds).length === 1 };
+}
+
+// RoleSyntax ::= SEQUENCE { roleAuthority [0] IMPLICIT GeneralNames OPTIONAL, roleName [1] EXPLICIT GeneralName }
+function _role(buf) {
+  var C = "attrcert/bad-role";
+  var kids = _seqChildren(buf, C, "RoleSyntax");
+  if (!kids.length || kids.length > 2) throw NS.E(C, "RoleSyntax must be a SEQUENCE { roleAuthority [0]?, roleName [1] }");
+  var roleAuthority = null, i = 0;
+  if (_isCtx(kids[0], 0)) { roleAuthority = schema.walk(_GNS_0, kids[0], NS).result; i = 1; }
+  var rn = kids[i];
+  if (!_isCtx(rn, 1) || !rn.children || rn.children.length !== 1) throw NS.E(C, "RoleSyntax roleName must be an EXPLICIT [1] wrapping exactly one GeneralName");
+  if (i + 1 !== kids.length) throw NS.E(C, "RoleSyntax has unexpected trailing fields");
+  return { roleAuthority: roleAuthority, roleName: _oneGN(rn.children[0], C) };
+}
+
+// Clearance ::= SEQUENCE { policyId OBJECT IDENTIFIER, classList ClassList DEFAULT {unclassified},
+//   securityCategories SET OF SecurityCategory OPTIONAL }.
+// ClassList ::= BIT STRING { unmarked(0), unclassified(1), restricted(2), confidential(3), secret(4), topSecret(5) }.
+var _CLASSLIST_NAMES = ["unmarked", "unclassified", "restricted", "confidential", "secret", "topSecret"];
+function _decodeClassList(node, C) {
+  var bs;
+  try { bs = asn1.read.bitString(node); } catch (e) { throw NS.E(C, "Clearance classList must be a BIT STRING", e); }
+  schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw NS.E(C, m); });
+  var names = [], flags = {}, reserved = [];
+  var total = bs.bytes.length * 8 - bs.unusedBits;
+  for (var bit = 0; bit < total; bit++) {
+    if ((bs.bytes[bit >> 3] & (0x80 >> (bit & 7))) === 0) continue;
+    if (bit < _CLASSLIST_NAMES.length) { names.push(_CLASSLIST_NAMES[bit]); flags[_CLASSLIST_NAMES[bit]] = true; }
+    else reserved.push(bit);
+  }
+  return { names: names, flags: flags, reservedBits: reserved };
+}
+// SecurityCategory ::= SEQUENCE { type [0] IMPLICIT OBJECT IDENTIFIER, value [1] EXPLICIT ANY }.
+function _securityCategory(node, C) {
+  if (!_isU(node, TAGS.SEQUENCE) || !node.children || node.children.length !== 2) throw NS.E(C, "a SecurityCategory must be a SEQUENCE of a type and a value");
+  var typeNode = node.children[0], valueNode = node.children[1];
+  if (!_isCtx(typeNode, 0) || typeNode.children) throw NS.E(C, "SecurityCategory type must be a primitive [0] IMPLICIT OBJECT IDENTIFIER");
+  var type; try { type = asn1.decodeOidContent(typeNode.content); } catch (e) { throw NS.E(C, "SecurityCategory type is not a valid OBJECT IDENTIFIER", e); }
+  if (!_isCtx(valueNode, 1) || !valueNode.children || valueNode.children.length !== 1) throw NS.E(C, "SecurityCategory value must be an EXPLICIT [1] wrapping one element");
+  return { type: type, valueBytes: Buffer.concat([valueNode.children[0].bytes]) };
+}
+function _clearance(buf) {
+  var C = "attrcert/bad-clearance";
+  var kids = _seqChildren(buf, C, "Clearance");
+  if (!kids.length || kids.length > 3) throw NS.E(C, "Clearance must be a SEQUENCE { policyId, classList?, securityCategories? }");
+  if (!_isU(kids[0], TAGS.OBJECT_IDENTIFIER)) throw NS.E(C, "Clearance policyId must be an OBJECT IDENTIFIER");
+  var policyId; try { policyId = asn1.read.oid(kids[0]); } catch (e) { throw NS.E(C, "Clearance policyId must be an OBJECT IDENTIFIER", e); }
+  var classList = { names: ["unclassified"], flags: { unclassified: true }, reservedBits: [] }, i = 1;   // DEFAULT {unclassified}
+  if (kids[i] && _isU(kids[i], TAGS.BIT_STRING)) {
+    classList = _decodeClassList(kids[i], C);
+    if (classList.names.length === 1 && classList.flags.unclassified && !classList.reservedBits.length) {
+      throw NS.E(C, "Clearance classList equal to the DEFAULT {unclassified} must be omitted (non-canonical DER)");
+    }
+    i++;
+  }
+  var securityCategories = null;
+  if (kids[i]) {
+    var setNode = kids[i];
+    if (!_isU(setNode, TAGS.SET) || !setNode.children || !setNode.children.length) throw NS.E(C, "Clearance securityCategories must be a non-empty SET OF SecurityCategory");
+    securityCategories = setNode.children.map(function (categoryNode) { return _securityCategory(categoryNode, C); });
+    i++;
+  }
+  if (i !== kids.length) throw NS.E(C, "Clearance has fields out of order or unexpected trailing fields");
+  return { policyId: policyId, classList: classList, securityCategories: securityCategories };
+}
+
+var _ATTR_VALUE_DECODERS = {};
+_ATTR_VALUE_DECODERS[_Oav("role")] = _role;
+_ATTR_VALUE_DECODERS[_Oav("clearance")] = _clearance;
+// RFC 5755 sec. 4.4.6 requires decoding the legacy RFC 3281 id-at-clearance too (the X.501
+// selected-attribute-types arc, an alias of "clearance" -- built from arcs, never a dotted literal).
+_ATTR_VALUE_DECODERS[oid.fromArcs([2, 5, 1, 5, 55])] = _clearance;
+_ATTR_VALUE_DECODERS[_Oav("authenticationInfo")] = _svceAuthInfo(true, "attrcert/bad-svce-auth-info");
+_ATTR_VALUE_DECODERS[_Oav("accessIdentity")] = _svceAuthInfo(false, "attrcert/bad-access-identity");
+_ATTR_VALUE_DECODERS[_Oav("chargingIdentity")] = _ietfAttrSyntax;
+_ATTR_VALUE_DECODERS[_Oav("group")] = _ietfAttrSyntax;
+
+// ---- RFC 5755 sec. 4.3 AC-extension decoders -------------------------
+// A per-extension-OID decoder table for the AC-specific extensions (kept in the AC domain, not the
+// shared cert-extension table, because Targets/TargetCert reuse the local IssuerSerial). Each takes
+// the raw extnValue content Buffer and returns a structured value, fail-closed with a typed error.
+
+// AuditIdentity ::= OCTET STRING (sec. 4.3.1) -- an opaque audit tag, unconstrained (no SIZE), so an
+// empty OCTET STRING (04 00) is valid; only the OCTET STRING type is enforced.
+function _acAuditIdentity(buf) {
+  var C = "attrcert/bad-audit-identity";
+  var n = _decodeTop(buf, C, "AuditIdentity");
+  if (!_isU(n, TAGS.OCTET_STRING)) throw NS.E(C, "AuditIdentity must be an OCTET STRING");
+  return Buffer.concat([asn1.read.octetString(n)]);
+}
+
+// NoRevAvail syntax is NULL (sec. 4.3.6: '0500'H is the DER encoding) -- the extnValue OCTET STRING
+// contains a DER NULL. An empty or any-other-shape value is malformed and fails closed.
+function _noRevAvail(buf) {
+  var C = "attrcert/bad-no-rev-avail";
+  var n = _decodeTop(buf, C, "NoRevAvail");
+  try { asn1.read.nullValue(n); } catch (e) { throw NS.E(C, "NoRevAvail must be a DER NULL (RFC 5755 sec. 4.3.6)", e); }
+  return { noRevAvail: true };
+}
+
+// Target ::= CHOICE { targetName [0] GeneralName, targetGroup [1] GeneralName, targetCert [2] TargetCert }.
+// [0]/[1] wrap a GeneralName CHOICE (EXPLICIT); [2] is an IMPLICIT TargetCert SEQUENCE.
+function _acTargetCert(node, C) {
+  if (!node.children || !node.children.length) throw NS.E(C, "a targetCert [2] must be a non-empty TargetCert SEQUENCE");
+  var out = { kind: "targetCert", targetCertificate: null, targetName: null, certDigestInfo: null }, i = 0;
+  out.targetCertificate = schema.walk(ISSUER_SERIAL, node.children[i++], NS).result;
+  if (node.children[i] && node.children[i].tagClass === "context") out.targetName = _oneGN(node.children[i++], C);
+  if (node.children[i] && _isU(node.children[i], TAGS.SEQUENCE)) out.certDigestInfo = schema.walk(OBJECT_DIGEST_INFO, node.children[i++], NS).result;
+  if (i !== node.children.length) throw NS.E(C, "a targetCert has unexpected trailing fields");
+  return out;
+}
+function _acTarget(node, C, allowTargetCert) {
+  if (_isCtx(node, 0) || _isCtx(node, 1)) {
+    if (!node.children || node.children.length !== 1) throw NS.E(C, "a Target name must be an EXPLICIT [0]/[1] wrapping one GeneralName");
+    return { kind: node.tagNumber === 0 ? "targetName" : "targetGroup", name: _oneGN(node.children[0], C) };
+  }
+  if (_isCtx(node, 2)) {
+    if (!allowTargetCert) throw NS.E(C, "the targetCert [2] CHOICE MUST NOT be used in proxying information (RFC 5755 sec. 7.4)");
+    return _acTargetCert(node, C);
+  }
+  throw NS.E(C, "a Target must be [0] targetName, [1] targetGroup, or [2] targetCert");
+}
+// Targets ::= SEQUENCE OF Target -- decode a Targets SEQUENCE node into an array of Target.
+function _acDecodeTargets(node, C, allowTargetCert) {
+  if (!_isU(node, TAGS.SEQUENCE) || !node.children || !node.children.length) throw NS.E(C, "Targets must be a non-empty SEQUENCE OF Target");
+  return node.children.map(function (t) { return _acTarget(t, C, allowTargetCert); });
+}
+// Both targetInformation (sec. 4.3.2) and ProxyInfo (sec. 7.4) are SEQUENCE OF Targets -- an outer
+// SEQUENCE whose every element is itself a Targets (SEQUENCE OF Target). A conforming issuer emits one
+// Targets, but users MUST accept several. proxying additionally forbids the targetCert [2] alternative.
+function _seqOfTargets(buf, C, allowTargetCert) {
+  var kids = _seqChildren(buf, C, "SEQUENCE OF Targets");
+  if (!kids.length) throw NS.E(C, "a SEQUENCE OF Targets must be non-empty");
+  return kids.map(function (targetsNode) { return _acDecodeTargets(targetsNode, C, allowTargetCert); });
+}
+function _targetInformation(buf) { return _seqOfTargets(buf, "attrcert/bad-targets", true); }
+function _acProxying(buf) { return _seqOfTargets(buf, "attrcert/bad-proxy-info", false); }
+
+// AAControls ::= SEQUENCE { pathLenConstraint INTEGER (0..MAX) OPTIONAL, permittedAttrs [0] AttrSpec
+//   OPTIONAL, excludedAttrs [1] AttrSpec OPTIONAL, permitUnSpecified BOOLEAN DEFAULT TRUE }.
+// AttrSpec ::= SEQUENCE OF OBJECT IDENTIFIER (the [0]/[1] IMPLICIT tag replaces the SEQUENCE tag).
+function _acAttrSpec(node, C) {
+  if (!node.children) throw NS.E(C, "an AttrSpec must be a SEQUENCE OF OBJECT IDENTIFIER");
+  return node.children.map(function (o) {
+    if (!_isU(o, TAGS.OBJECT_IDENTIFIER)) throw NS.E(C, "an AttrSpec element must be an OBJECT IDENTIFIER");
+    try { return asn1.read.oid(o); } catch (e) { throw NS.E(C, "an AttrSpec element must be an OBJECT IDENTIFIER", e); }
+  });
+}
+function _aaControls(buf) {
+  var C = "attrcert/bad-aa-controls";
+  var kids = _seqChildren(buf, C, "AAControls");
+  if (kids.length > 4) throw NS.E(C, "AAControls has too many fields");
+  var out = { pathLenConstraint: null, permittedAttrs: null, excludedAttrs: null, permitUnSpecified: true }, i = 0;
+  if (kids[i] && _isU(kids[i], TAGS.INTEGER)) { out.pathLenConstraint = guard.range.uint31(_readInt(kids[i], C, "pathLenConstraint"), NS.E, C, "AAControls pathLenConstraint"); i++; }
+  if (kids[i] && _isCtx(kids[i], 0)) { out.permittedAttrs = _acAttrSpec(kids[i], C); i++; }
+  if (kids[i] && _isCtx(kids[i], 1)) { out.excludedAttrs = _acAttrSpec(kids[i], C); i++; }
+  if (kids[i] && _isU(kids[i], TAGS.BOOLEAN)) {
+    var v = asn1.read.boolean(kids[i]);
+    if (v === true) throw NS.E(C, "AAControls permitUnSpecified TRUE equals the DEFAULT and must be omitted (non-canonical DER)");
+    out.permitUnSpecified = v; i++;
+  }
+  if (i !== kids.length) throw NS.E(C, "AAControls has fields out of order or unexpected trailing fields");
+  return out;
+}
+
+var _AC_EXT_DECODERS = {};
+_AC_EXT_DECODERS[_Oav("acAuditIdentity")] = _acAuditIdentity;
+_AC_EXT_DECODERS[_Oav("targetInformation")] = _targetInformation;
+_AC_EXT_DECODERS[_Oav("noRevAvail")] = _noRevAvail;
+_AC_EXT_DECODERS[_Oav("aaControls")] = _aaControls;
+_AC_EXT_DECODERS[_Oav("acProxying")] = _acProxying;
+
 module.exports = {
   parse: parse,
   parseV1: parseV1,

package/lib/schema-pkix.js

@@ -598,13 +598,14 @@ function assertPolicyQualifiers(qNode, fail) {
   });
 }
 
-function certExtensionDecoders(ns) {
-  var GN_SUBTREE = generalName(ns, { decodeValue: true, subtreeBase: true, code: ns.prefix + "/bad-name-constraints" });
-
+// Shared imperative decode helpers for the certExtensionDecoders + attrValueDecoders factories. Both
+// take the caller's ns, so the helpers close over ns.E / ns.oid; extracted once so the two factories
+// share one copy (a per-OID value-decoder body is the identical idiom to a per-OID extension body).
+function _decodeHelpers(ns) {
   function decodeTop(buf, code, what) {
     var n;
     try { n = asn1.decode(buf); }
-    catch (e) { throw ns.E(code, "malformed " + what + " extension value: " + ((e && e.message) || String(e)), e); }
+    catch (e) { throw ns.E(code, "malformed " + what + " value: " + ((e && e.message) || String(e)), e); }
     return n;
   }
   function seqChildren(buf, code, what) {
@@ -618,6 +619,19 @@ function certExtensionDecoders(ns) {
     try { return asn1.read.integer(node); }
     catch (e) { throw ns.E(code, what + " must be an INTEGER", e); }
   }
+  // Resolve a registered OID name -> dotted string, throwing at module load on a typo (a decoder keyed
+  // by an unresolved name would silently never match, treating a real extension/attribute as opaque).
+  function O(nm) {
+    var d = ns.oid.byName(nm);
+    if (typeof d !== "string") throw new TypeError("pki.schema.pkix: " + JSON.stringify(nm) + " is not a registered OID name");
+    return d;
+  }
+  return { decodeTop: decodeTop, seqChildren: seqChildren, readInt: readInt, O: O };
+}
+
+function certExtensionDecoders(ns) {
+  var GN_SUBTREE = generalName(ns, { decodeValue: true, subtreeBase: true, code: ns.prefix + "/bad-name-constraints" });
+  var _h = _decodeHelpers(ns), decodeTop = _h.decodeTop, seqChildren = _h.seqChildren, readInt = _h.readInt, O = _h.O;
 
   // basicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLen INTEGER (0..MAX) OPTIONAL }
   function basicConstraints(buf) {
@@ -910,15 +924,6 @@ function certExtensionDecoders(ns) {
     });
   }
 
-  // byName returns undefined for an unregistered name; keying a decoder row
-  // under "undefined" would silently drop that extension from dispatch (the
-  // consumer would treat the extension as structurally unvalidated / absent),
-  // so a typo'd key-list entry must fail here, at module load.
-  function O(nm) {
-    var d = ns.oid.byName(nm);
-    if (typeof d !== "string") throw new TypeError("certExtensionDecoders: " + JSON.stringify(nm) + " is not a registered OID name");
-    return d;
-  }
   // qcStatements ::= SEQUENCE OF QCStatement (RFC 3739 sec. 3.2.6). QCStatement ::= SEQUENCE {
   // statementId OBJECT IDENTIFIER, statementInfo ANY DEFINED BY statementId OPTIONAL }. Known statementIds
   // (RFC 3739 id-qcs + the ETSI EN 319 412-5 esi4 catalog) decode their statementInfo; an unknown statementId
@@ -1319,6 +1324,7 @@ module.exports = {
   rawNonEmptySequence: rawNonEmptySequence,
   CRL_REASON_NAMES: CRL_REASON_NAMES,
   certExtensionDecoders: certExtensionDecoders,
+  _decodeHelpers: _decodeHelpers,
   attribute: attribute,
   extension: extension,
   extensions: extensions,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.32",
+  "version": "0.2.33",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c1caa29b-a81a-443d-9296-76988e159993",
+  "serialNumber": "urn:uuid:81b0b6a6-dee2-4e3f-b995-abbe40a0f560",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T23:57:14.646Z",
+    "timestamp": "2026-07-17T00:29:40.078Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.32",
+      "bom-ref": "@blamejs/pki@0.2.33",
       "type": "application",
       "name": "pki",
-      "version": "0.2.32",
+      "version": "0.2.33",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.32",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.33",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.32",
+      "ref": "@blamejs/pki@0.2.33",
       "dependsOn": []
     }
   ]