@blamejs/pki 0.6.13 → 0.6.15

package/lib/schema-cmp.js

@@ -54,20 +54,15 @@ var OID_CONFIRM_WAIT_TIME = oid.byName("confirmWaitTime");
 var OID_CERT_PROFILE = oid.byName("certProfile");
 var OID_PKI_ARCHIVE_OPTIONS = oid.byName("pkiArchiveOptions");
 
-// ---- leaves -----------------------------------------------------------
 
-// CMP times are GeneralizedTime only; PKIFreeText elements are UTF8String
-// (RFC 9810 sec. 5.1.1). Both ride the shared pkix leaf factories.
 var GENERALIZED_TIME = pkix.generalizedTime(NS, { code: "cmp/bad-time", message: "CMP times must be GeneralizedTime (RFC 9810 sec. 5.1.1)" });
 var UTF8_TEXT = pkix.utf8Text(NS, { code: "cmp/bad-freetext", message: "PKIFreeText elements must be UTF8String (RFC 9810 sec. 5.1.1)" });
 
-// PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String.
 var PKI_FREE_TEXT = schema.seqOf(UTF8_TEXT, {
   min: 1, code: "cmp/bad-freetext", what: "PKIFreeText",
   build: function (m) { return m.items.map(function (it) { return it.value; }); },
 });
 
-// PKIStatus ::= INTEGER {0..6} (sec. 5.2.3): a value whitelist, surfaced named.
 var PKI_STATUS_NAMES = ["accepted", "grantedWithMods", "rejection", "waiting",
   "revocationWarning", "revocationNotification", "keyUpdateWarning"];
 var PKI_STATUS = schema.decode(function (n, ctx) {
@@ -77,9 +72,6 @@ var PKI_STATUS = schema.decode(function (n, ctx) {
   return { code: code, name: PKI_STATUS_NAMES[code] };
 });
 
-// PKIFailureInfo ::= BIT STRING named bits 0..26 (sec. 5.2.3). X.690 sec. 11.2.2:
-// a named-bit BIT STRING drops trailing zero bits, so the final carried bit
-// must be 1. Bits past 26 are extensible and surface as numeric indexes.
 var FAIL_INFO_NAMES = ["badAlg", "badMessageCheck", "badRequest", "badTime", "badCertId",
   "badDataFormat", "wrongAuthority", "incorrectData", "missingTimeStamp", "badPOP",
   "certRevoked", "certConfirmed", "wrongIntegrity", "badRecipientNonce", "timeNotAvailable",
@@ -97,18 +89,10 @@ var PKI_FAILURE_INFO = schema.decode(function (n, ctx) {
   return { bits: bits, raw: bs };
 });
 
-// PollRep checkAfter is a delay in seconds; a negative one poisons scheduling, and
-// the value surfaces as an exact number or not at all.
 var CHECK_AFTER = schema.decode(function (n, ctx) {
   return guard.range.uint31(asn1.read.integer(n), ctx.E, "cmp/bad-poll-rep", "checkAfter delay in seconds (RFC 9810 sec. 5.3.22)");
 });
 
-// A raw certificate / CRL / publication-info element, surfaced byte-exact for
-// downstream parsing, but structurally a universal SEQUENCE: a CMPCertificate
-// is a Certificate, and CertificateList / PKIPublicationInfo are SEQUENCEs, so
-// a primitive (an INTEGER) or wrong-tag element is not a valid structure and
-// rejects, never handing arbitrary bytes to certificate processing. The
-// `code` names the containing structure (a shared leaf cannot know its context).
 function rawSequence(code) {
   return pkix.rawNonEmptySequence(NS, { code: code, message: "expected a non-empty universal SEQUENCE (Certificate / CertificateList / PKIPublicationInfo)" });
 }
@@ -117,12 +101,7 @@ var GENERAL_NAME = pkix.generalName(NS, { decodeValue: true });
 var ALG_ID = pkix.algorithmIdentifier(NS);
 var EXTENSIONS = pkix.extensions(NS);
 
-// ---- header ------------------------------------------------------------
 
-// InfoTypeAndValue ::= SEQUENCE { infoType OID, infoValue ANY OPTIONAL }
-// (sec. 5.1.1, sec. 5.3.19). Recognized id-it types with a fixed value syntax are
-// validated (the CMS signed-attr value-syntax posture); all others surface
-// raw with the registry name resolving.
 var INFO_TYPE_AND_VALUE = schema.seq([
   schema.field("infoType", schema.oidLeaf()),
   schema.optional("infoValue", schema.any(), { whenAny: true }),
@@ -131,19 +110,10 @@ var INFO_TYPE_AND_VALUE = schema.seq([
   build: function (m, ctx) {
     var t = m.fields.infoType.value;
     var valueNode = m.fields.infoValue.present ? m.fields.infoValue.value : null;
-    // A recognized id-it type with a FIXED value syntax (RFC 9810 sec. 5.1.1) MUST
-    // carry its infoValue -- implicitConfirm a NULL, confirmWaitTime a
-    // GeneralizedTime, certProfile a SEQUENCE OF UTF8String. A missing value is
-    // accepted only for the open / query id-it types (a bare OID in a genm body),
-    // never for a type whose value syntax the RFC defines.
     if ((t === OID_IMPLICIT_CONFIRM || t === OID_CONFIRM_WAIT_TIME || t === OID_CERT_PROFILE) && valueNode === null) {
       throw ctx.E("cmp/bad-info-value", "a recognized fixed-syntax id-it (implicitConfirm / confirmWaitTime / certProfile) must carry its infoValue (RFC 9810 sec. 5.1.1)");
     }
     if (valueNode !== null) {
-      // A recognized id-it value is validated by content, not just tag: run the
-      // strict typed reader so a well-tagged but malformed payload (a non-empty
-      // NULL, a GeneralizedTime carrying garbage, an invalid-UTF-8 string)
-      // rejects and is never surfaced as valid CMP.
       if (t === OID_IMPLICIT_CONFIRM) {
         if (!(valueNode.tagClass === "universal" && valueNode.tagNumber === TAGS.NULL)) {
           throw ctx.E("cmp/bad-info-value", "an implicitConfirm value must be NULL (RFC 9810 sec. 5.1.1.1)");
@@ -182,8 +152,6 @@ var GENERAL_INFO = schema.seqOf(INFO_TYPE_AND_VALUE, {
   build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
 });
 
-// PKIHeader ::= SEQUENCE { pvno, sender, recipient, then EXPLICIT [0]..[8]
-// optionals, ascending, at-most-once } (sec. 5.1.1).
 var PKI_HEADER = schema.seq([
   schema.field("pvno", pkix.versionReader(NS, { "1": 1, "2": 2, "3": 3 })),
   schema.field("sender", GENERAL_NAME),
@@ -220,9 +188,7 @@ var PKI_HEADER = schema.seq([
   },
 });
 
-// ---- decoded body arms ---------------------------------------------------
 
-// PKIStatusInfo ::= SEQUENCE { status, statusString OPTIONAL, failInfo OPTIONAL } (sec. 5.2.3).
 var PKI_STATUS_INFO = schema.seq([
   schema.field("status", PKI_STATUS),
   schema.optional("statusString", PKI_FREE_TEXT, { whenUniversal: [TAGS.SEQUENCE] }),
@@ -238,8 +204,6 @@ var PKI_STATUS_INFO = schema.seq([
   },
 });
 
-// ErrorMsgContent ::= SEQUENCE { pKIStatusInfo, errorCode INTEGER OPTIONAL,
-// errorDetails PKIFreeText OPTIONAL } (sec. 5.3.21).
 var ERROR_MSG_CONTENT = schema.seq([
   schema.field("pKIStatusInfo", PKI_STATUS_INFO),
   schema.optional("errorCode", schema.integerLeaf(), { whenUniversal: [TAGS.INTEGER] }),
@@ -255,8 +219,6 @@ var ERROR_MSG_CONTENT = schema.seq([
   },
 });
 
-// CertStatus ::= SEQUENCE { certHash, certReqId, statusInfo OPTIONAL,
-// hashAlg [0] OPTIONAL } (sec. 5.3.18). certReqId accepts the -1 sentinel.
 var CERT_STATUS = schema.seq([
   schema.field("certHash", schema.octetString()),
   schema.field("certReqId", schema.integerLeaf()),
@@ -276,23 +238,16 @@ var CERT_STATUS = schema.seq([
   },
 });
 
-// CertConfirmContent ::= SEQUENCE OF CertStatus, where an empty sequence is legal
-// (reject-all, sec. 5.3.18), so no SIZE floor.
 var CERT_CONFIRM_CONTENT = schema.seqOf(CERT_STATUS, {
   code: "cmp/bad-cert-status", what: "CertConfirmContent",
   build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
 });
 
-// GenMsgContent / GenRepContent ::= SEQUENCE OF InfoTypeAndValue, with no SIZE
-// bound, empty legal (sec. 5.3.19/.20).
 var GEN_MSG_CONTENT = schema.seqOf(INFO_TYPE_AND_VALUE, {
   code: "cmp/bad-info-type-and-value", what: "GenMsgContent",
   build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
 });
 
-// RevDetails ::= SEQUENCE { certDetails CertTemplate, crlEntryDetails
-// Extensions OPTIONAL } (sec. 5.3.9). The CertTemplate interior (an IMPLICIT
-// TAGS module) is owned by the CRMF parser and walked NS-bound there.
 var CERT_TEMPLATE_LEAF = schema.decode(function (n) { return crmf.walkCertTemplate(n); });
 var REV_DETAILS = schema.seq([
   schema.field("certDetails", CERT_TEMPLATE_LEAF),
@@ -311,7 +266,6 @@ var REV_REQ_CONTENT = schema.seqOf(REV_DETAILS, {
   build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
 });
 
-// CertId ::= SEQUENCE { issuer GeneralName, serialNumber INTEGER } (RFC 4211).
 var CERT_ID = schema.seq([
   schema.field("issuer", GENERAL_NAME),
   schema.field("serialNumber", schema.integerLeaf()),
@@ -322,8 +276,6 @@ var CERT_ID = schema.seq([
   },
 });
 
-// RevRepContent ::= SEQUENCE { status SIZE(1..MAX), revCerts [0] OPTIONAL,
-// crls [1] OPTIONAL } (sec. 5.3.10).
 var REV_REP_CONTENT = schema.seq([
   schema.field("status", schema.seqOf(PKI_STATUS_INFO, {
     min: 1, code: "cmp/bad-rev-rep", what: "RevRep status",
@@ -350,24 +302,9 @@ var REV_REP_CONTENT = schema.seq([
   },
 });
 
-// EncryptedKey ::= CHOICE { encryptedValue EncryptedValue (deprecated),
-// envelopedData [0] EnvelopedData } (sec. 5.2.2). EncryptedKey is imported from
-// the RFC 4211 CRMF module, which is IMPLICIT TAGS, so `envelopedData [0]` is
-// an IMPLICIT context tag replacing the EnvelopedData SEQUENCE tag: the [0]
-// node's children are the EnvelopedData fields, with no inner wrapper. Retag it to
-// the universal SEQUENCE the CMS walker expects, exactly as the sibling CRMF
-// `encryptedKey [4] EnvelopedData` POP arm does (schema-crmf.js). The
-// deprecated encryptedValue arm surfaces raw and is never field-walked, so nothing
-// dereferences its optional interior (absent algorithm parameters crash
-// consumers that walk it blindly).
 var ENCRYPTED_KEY = schema.choice([
   { when: { tagClass: "universal", tagNumber: TAGS.SEQUENCE },
     schema: schema.decode(function (n, ctx) {
-      // An RFC 4211 sec. 2 EncryptedValue REQUIRES encValue (its final BIT STRING
-      // field), so an empty SEQUENCE has the right tag but is not any valid
-      // EncryptedValue. Require at least one child, so no degenerate structure
-      // surfaces as encrypted certificate/key bytes (the same
-      // non-empty rule every raw-SEQUENCE surface in this module applies).
       if (!(n.children && n.children.length >= 1)) {
         throw ctx.E("cmp/bad-cert-response", "an EncryptedValue must be a non-empty SEQUENCE (RFC 4211 sec. 2)");
       }
@@ -376,25 +313,13 @@ var ENCRYPTED_KEY = schema.choice([
   { when: { tagClass: "context", tagNumber: 0 },
     schema: schema.decode(function (n, ctx) {
       var env;
-      // Wrap every EnvelopedData failure -- a non-decodable retarget OR a CmsError
-      // from the composed walker -- as the CMP domain error (with the original as
-      // the cause), so cmp.parse never escapes with a cms/* error for a malformed
-      // PKIMessage (the same wrapping the sibling CRMF encryptedKey POP arm does).
       try { env = cms.walkEnvelopedData(asn1.decode(asn1.sequenceTlv(n))); }
       catch (e) {
         throw ctx.E("cmp/bad-cert-response", "envelopedData [0] must be a well-formed IMPLICIT EnvelopedData (RFC 9810 sec. 5.2.2)", e);
       }
-      // RFC 9810 sec. 5.2.2 -- a CMP EncryptedKey EnvelopedData is addressed to
-      // exactly one recipient (the end entity for a delivered cert / key). CMS
-      // permits RecipientInfos SET SIZE 1..MAX, so the single-recipient bound is
-      // CMP's: more than one recipient is a malformed EncryptedKey.
       if (env.recipientInfos.length !== 1) {
         throw ctx.E("cmp/bad-cert-response", "an EncryptedKey EnvelopedData must contain exactly one RecipientInfo (RFC 9810 sec. 5.2.2)");
       }
-      // The ciphertext is the encrypted certificate / private key here, so an
-      // EnvelopedData with no ciphertext to decrypt, whether absent (detached, CMS
-      // permits it) or present-but-empty, must reject (RFC 9810 sec. 5.2.2/sec. 5.3.4;
-      // the same rule the CRMF encryptedKey POP arm enforces).
       var ct = env.encryptedContentInfo.encryptedContent;
       if (ct === null || ct.length === 0) {
         throw ctx.E("cmp/bad-cert-response", "an EncryptedKey envelopedData must carry non-empty attached ciphertext -- its encryptedContent is the certificate/key payload (RFC 9810 sec. 5.2.2)");
@@ -403,7 +328,6 @@ var ENCRYPTED_KEY = schema.choice([
     }) },
 ], { code: "cmp/bad-cert-response", what: "EncryptedKey" });
 
-// CertOrEncCert ::= CHOICE { certificate [0], encryptedCert [1] } (sec. 5.3.4).
 var CERT_OR_ENC_CERT = schema.choice([
   { when: { tagClass: "context", tagNumber: 0 },
     schema: schema.explicit(0, schema.decode(function (n, ctx) {
@@ -416,8 +340,6 @@ var CERT_OR_ENC_CERT = schema.choice([
     schema: schema.explicit(1, ENCRYPTED_KEY, { code: "cmp/bad-cert-response" }) },
 ], { code: "cmp/bad-cert-response", what: "CertOrEncCert" });
 
-// CertifiedKeyPair ::= SEQUENCE { certOrEncCert, privateKey [0] OPTIONAL,
-// publicationInfo [1] OPTIONAL } (sec. 5.3.4).
 var CERTIFIED_KEY_PAIR = schema.seq([
   schema.field("certOrEncCert", CERT_OR_ENC_CERT),
   schema.trailing([
@@ -436,8 +358,6 @@ var CERTIFIED_KEY_PAIR = schema.seq([
   },
 });
 
-// CertResponse ::= SEQUENCE { certReqId INTEGER (the -1 sentinel is legal),
-// status PKIStatusInfo, certifiedKeyPair OPTIONAL, rspInfo OPTIONAL } (sec. 5.3.4).
 var CERT_RESPONSE = schema.seq([
   schema.field("certReqId", schema.integerLeaf()),
   schema.field("status", PKI_STATUS_INFO),
@@ -448,21 +368,10 @@ var CERT_RESPONSE = schema.seq([
   build: function (m, ctx) {
     var status = m.fields.status.value.result;
     var certifiedKeyPair = m.fields.certifiedKeyPair.present ? m.fields.certifiedKeyPair.value.result : null;
-    // RFC 9810 sec. 5.3.4 -- only one of the failInfo (in PKIStatusInfo) and
-    // certifiedKeyPair fields can be present in a CertResponse: a rejection
-    // carries no certificate. Accepting both lets a caller keying off
-    // certifiedKeyPair process a certificate from a failed response.
     if (status.failInfo !== null && certifiedKeyPair !== null) {
       throw ctx.E("cmp/bad-cert-response",
         "a CertResponse must not carry both failInfo and certifiedKeyPair (RFC 9810 sec. 5.3.4)");
     }
-    // A certifiedKeyPair is present only when the status grants the certificate:
-    // accepted (0) or grantedWithMods (1). Any other status (rejection, waiting,
-    // the revocation / keyUpdate warnings) denies or defers the request, so a
-    // certificate under it is a malformed response even when no explicit failInfo
-    // bit is set (a rejection is commonly signaled by status alone). Keying the
-    // rule off failInfo presence alone would let a bare-rejection status ship a
-    // certificate (RFC 9810 sec. 5.3.4).
     if (certifiedKeyPair !== null && status.status.code !== 0 && status.status.code !== 1) {
       throw ctx.E("cmp/bad-cert-response",
         "a CertResponse certifiedKeyPair is allowed only under a granting status (accepted or grantedWithMods) (RFC 9810 sec. 5.3.4)");
@@ -476,9 +385,6 @@ var CERT_RESPONSE = schema.seq([
   },
 });
 
-// CertRepMessage ::= SEQUENCE { caPubs [1] OPTIONAL, response SEQUENCE OF
-// CertResponse } (sec. 5.3.4), where the optional precedes the required field (the
-// x509-version shape). caPubs surface raw: the parser confers no trust.
 var CERT_REP_MESSAGE = schema.seq([
   schema.optional("caPubs", schema.seqOf(rawSequence("cmp/bad-cert-rep"), {
     min: 1, code: "cmp/bad-cert-rep", what: "caPubs",
@@ -498,12 +404,6 @@ var CERT_REP_MESSAGE = schema.seq([
   },
 });
 
-// KeyRecRepContent ::= SEQUENCE { status PKIStatusInfo, newSigCert [0]
-// Certificate OPTIONAL, caCerts [1] SEQUENCE OF Certificate OPTIONAL,
-// keyPairHist [2] SEQUENCE OF CertifiedKeyPair OPTIONAL } (sec. 5.3.8). The
-// keyPairHist CertifiedKeyPairs can carry the same EnvelopedData form as the
-// enrollment responses, so krp is decoded (not surfaced raw) and the operator sees
-// the status / key history and the cross-field EnvelopedData version check runs.
 var KEY_REC_REP_CONTENT = schema.seq([
   schema.field("status", PKI_STATUS_INFO),
   schema.trailing([
@@ -529,7 +429,6 @@ var KEY_REC_REP_CONTENT = schema.seq([
   },
 });
 
-// PollReqContent / PollRepContent (sec. 5.3.22) -- certReqId may be -1.
 var POLL_REQ_ENTRY = schema.seq([
   schema.field("certReqId", schema.integerLeaf()),
 ], {
@@ -559,16 +458,11 @@ var POLL_REP_CONTENT = schema.seqOf(POLL_REP_ENTRY, {
   build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
 });
 
-// ---- the 27-arm body dispatch ----------------------------------------------
 
-// Tag -> arm name, verbatim from the PKIXCMP-2023 module (sec. 5.1.2). Every
-// defined arm is at minimum recognized; a subset decodes structurally.
 var BODY_ARMS = ["ir", "ip", "cr", "cp", "p10cr", "popdecc", "popdecr", "kur", "kup",
   "krr", "krp", "rr", "rp", "ccr", "ccp", "ckuann", "cann", "rann", "crlann",
   "pkiconf", "nested", "genm", "genp", "error", "certConf", "pollReq", "pollRep"];
-// Arms carrying RFC 4211 CertReqMessages -- walked by the CRMF parser.
 var CRMF_ARMS = { 0: true, 2: true, 7: true, 9: true, 13: true };
-// Arms with a structural schema here.
 var DECODED_ARMS = {
   1: CERT_REP_MESSAGE, 3: CERT_REP_MESSAGE, 8: CERT_REP_MESSAGE, 14: CERT_REP_MESSAGE,
   10: KEY_REC_REP_CONTENT,
@@ -578,12 +472,6 @@ var DECODED_ARMS = {
   25: POLL_REQ_CONTENT, 26: POLL_REP_CONTENT,
 };
 
-// The open-CHOICE dispatch: tag -> arm name; walk where a schema exists;
-// surface every other defined arm raw as { arm, tag, bytes }, where `decoded` is
-// absent (not null) on raw arms, so its presence discriminates decoded-empty
-// (pkiconf decodes to null) from recognized-undecoded. `nested` [20] is never
-// auto-recursed: a self-nesting tower amplifies per-level walk products, so
-// the operator re-feeds its bytes to parse explicitly.
 var BODY = schema.decode(function (n, ctx) {
   if (n.tagClass !== "context" || !n.children) {
     throw ctx.E("cmp/bad-body", "PKIBody must be a constructed context-tagged CHOICE arm (RFC 9810 sec. 5.1.2)");
@@ -597,26 +485,15 @@ var BODY = schema.decode(function (n, ctx) {
   var inner = n.children[0];
   var out = { arm: BODY_ARMS[n.tagNumber], tag: n.tagNumber, bytes: inner.bytes };
   if (CRMF_ARMS[n.tagNumber]) {
-    // ccr [13] cross-certification: RFC 9810 Appendix D.6 profiles its template
-    // with signingAlg present and version "v1 or v3" (both overriding RFC 4211
-    // sec. 5 for this one arm). Those relaxations are allowed. The D.6 profile
-    // also expects exactly one CertReqMsg, but sec. 5.3.11 defines a ccr as a
-    // CertReqMessages (SIZE (1..MAX)) and App. D is OPTIONAL, so the base parser
-    // does not enforce the single-request cardinality (an App. D.6 producer keeps
-    // to one by its own policy, sending multiple cross-certificates in separate
-    // messages); only the no-private-key restriction below is normative.
     var isCcr = n.tagNumber === 13;
     out.decoded = crmf.walkCertReqMessages(inner, { allowSigningAlg: isCcr, allowV1Version: isCcr });
   } else if (DECODED_ARMS[n.tagNumber]) {
     var match = schema.walk(DECODED_ARMS[n.tagNumber], inner, ctx);
     out.decoded = match.result;
   } else if (n.tagNumber === 19) {
-    // PKIConfirmContent ::= NULL (sec. 5.3.16).
     if (!(inner.tagClass === "universal" && inner.tagNumber === TAGS.NULL)) {
       throw ctx.E("cmp/bad-pkiconf", "PKIConfirmContent must be NULL (RFC 9810 sec. 5.3.16)");
     }
-    // A NULL is well-formed only with empty content (X.690 sec. 8.8.2); the tag check
-    // alone would surface a non-empty NULL as a valid confirmation.
     try { asn1.read.nullValue(inner); }
     catch (e) { throw ctx.E("cmp/bad-pkiconf", "PKIConfirmContent must be an empty NULL (RFC 9810 sec. 5.3.16)", e); }
     out.decoded = null;
@@ -624,12 +501,7 @@ var BODY = schema.decode(function (n, ctx) {
   return out;
 });
 
-// ---- the message envelope -----------------------------------------------------
 
-// PKIProtection ::= BIT STRING: raw bits for the external verifier. Every
-// RFC 9481 MSG_SIG_ALG / MSG_MAC_ALG output is an octet string, so the BIT
-// STRING must be octet-aligned; with no in-tree CMP verify layer this is
-// enforced at parse (the posture the OCSP signature shares), fail-closed.
 var PROTECTION = schema.decode(function (n, ctx) {
   var bs;
   try { bs = asn1.read.bitString(n); }
@@ -640,13 +512,6 @@ var PROTECTION = schema.decode(function (n, ctx) {
   return { unusedBits: bs.unusedBits, bytes: bs.bytes };
 });
 
-// PKIMessage ::= SEQUENCE { header, body, protection [0] OPTIONAL,
-// extraCerts [1] OPTIONAL } (sec. 5.1). The build runs the two cross-checks that
-// span structures: protection presence <=> protectionAlg presence (sec. 5.1.1,
-// both directions), and a certConf hashAlg requires pvno cmp2021(3)
-// (sec. 5.3.18). headerBytes / bodyBytes are the exact wire slices protection is
-// computed over (as DER-SEQUENCE(headerBytes || bodyBytes)), surfaced raw and
-// never re-encoded.
 var PKI_MESSAGE = schema.seq([
   schema.field("header", PKI_HEADER),
   schema.field("body", BODY),
@@ -675,12 +540,6 @@ var PKI_MESSAGE = schema.seq([
         }
       }
     }
-    // RFC 9810 sec. 5.2.2 / sec. 7: EnvelopedData is cmp2021(3) syntax, so a response
-    // carrying it (an encryptedCert or a privateKey in the envelopedData form)
-    // under pvno < 3 is a version mismatch, the same version gate the certConf
-    // hashAlg rule applies. The deprecated EncryptedValue form is the pre-2021
-    // encoding and stays legal at pvno 2. CertifiedKeyPairs arrive both in the
-    // CertRepMessage `response` array (ip/cp/kup/ccp) and in the krp keyPairHist.
     var ckps = [];
     if (body.decoded && body.decoded.response) {
       for (var r = 0; r < body.decoded.response.length; r++) {
@@ -698,17 +557,7 @@ var PKI_MESSAGE = schema.seq([
         throw ctx.E("cmp/bad-version", "a response carrying EnvelopedData (encryptedCert or privateKey) requires CMP version cmp2021(3) (RFC 9810 sec. 5.2.2, sec. 7)");
       }
     }
-    // RFC 9810 sec. 5.3.12 -- a cross-certification response (ccp) reuses the
-    // CertRepMessage syntax "with the restriction that no encrypted private key
-    // can be sent": cross-certification certifies an existing CA's public key,
-    // so there is no key generation and CertifiedKeyPair.privateKey has no
-    // meaning. Reject a ccp that carries one; never surface the key
-    // material. The field stays legal in the enrollment responses (ip/cp/kup).
     if (body.arm === "ccp" && body.decoded && body.decoded.response) {
-      // RFC 9810 Appendix D.6 profiles a one-way ccp as exactly one CertResponse (the mirror of the ccr
-      // one-CertReqMsg profile), but sec. 5.3.12 defines a ccp as a CertRepMessage (SIZE (1..MAX)) and App. D
-      // is OPTIONAL, so the base parser does not enforce the single-response cardinality; only the
-      // no-private-key restriction is normative.
       for (var c = 0; c < body.decoded.response.length; c++) {
         var ckpCcp = body.decoded.response[c].certifiedKeyPair;
         if (ckpCcp && ckpCcp.privateKey !== null) {
@@ -716,25 +565,13 @@ var PKI_MESSAGE = schema.seq([
         }
       }
     }
-    // RFC 9810 sec. 5.3.11: a cross-certification request (ccr) MUST NOT send the
-    // private key to the responding CA (the requesting CA generates and holds
-    // it). The private-key-carrying POP choices, encryptedKey (cmp2021) and the
-    // deprecated thisMessage (cmp2000), are therefore forbidden in a ccr; the
-    // MAC (dhMAC / agreeMAC) and indirect (subsequentMessage) methods carry no
-    // key. Checked before the version gate so a ccr always gets the ccr verdict.
     if (body.arm === "ccr" && body.decoded && body.decoded.messages) {
       for (var cc = 0; cc < body.decoded.messages.length; cc++) {
         var ccrMsg = body.decoded.messages[cc];
-        // Via the POP: the encryptedKey / thisMessage POPOPrivKey choices carry
-        // the private key.
         var ccrPopo = ccrMsg.popo;
         if (ccrPopo && (ccrPopo.method === "encryptedKey" || ccrPopo.method === "thisMessage")) {
           throw ctx.E("cmp/bad-body", "a cross-certification request (ccr) must not send the private key -- the " + ccrPopo.method + " POP choice is forbidden (RFC 9810 sec. 5.3.11)");
         }
-        // Via a control: a pkiArchiveOptions control with the encryptedPrivKey [0]
-        // arm is the other private-key transport (sec. 5.2.8.3.1), likewise forbidden
-        // in a ccr. The control value is the raw PKIArchiveOptions CHOICE; the
-        // encryptedPrivKey arm is context tag [0].
         var controls = ccrMsg.certReq.controls;
         if (controls) {
           for (var cn = 0; cn < controls.length; cn++) {
@@ -749,21 +586,12 @@ var PKI_MESSAGE = schema.seq([
         }
       }
     }
-    // RFC 9810 sec. 5.2.8.3 -- the agreeMAC and encryptedKey POPOPrivKey choices are
-    // cmp2021(3) syntax; a request (ir/cr/kur/krr/ccr) whose proof-of-possession
-    // uses either under pvno < 3 is a version mismatch, the same gate the
-    // response EnvelopedData rule applies. The CRMF walker surfaces the chosen
-    // POPOPrivKey method on each message's popo.
     if (body.decoded && body.decoded.messages) {
       for (var q = 0; q < body.decoded.messages.length; q++) {
         var popo = body.decoded.messages[q].popo;
         if (popo && (popo.method === "agreeMAC" || popo.method === "encryptedKey") && header.pvno !== 3) {
           throw ctx.E("cmp/bad-version", "a request POP using the agreeMAC or encryptedKey choice requires CMP version cmp2021(3) (RFC 9810 sec. 5.2.8.3)");
         }
-        // sec. 5.2.8.3.1/sec. 7 -- the same key transport via a pkiArchiveOptions control
-        // whose encryptedPrivKey [0] EXPLICIT wraps the envelopedData-form
-        // EncryptedKey is cmp2021 syntax too (a ccr rejects the control outright
-        // above; the other request arms are version-gated here).
         var archCtrls = body.decoded.messages[q].certReq.controls;
         if (archCtrls && header.pvno !== 3) {
           for (var ac = 0; ac < archCtrls.length; ac++) {
@@ -777,11 +605,6 @@ var PKI_MESSAGE = schema.seq([
         }
       }
     }
-    // RFC 9810 sec. 5.1.1.4 -- the certProfile name count is bounded by the message
-    // body: a p10cr carries at most one; an ir/cr/kur no more names than its
-    // CertReqMsg count, a genm no more than its GenMsgContent InfoTypeAndValue
-    // count (the names map positionally to the body entries). An overlong list
-    // makes that mapping ambiguous, so reject it.
     if (header.generalInfo) {
       for (var gi = 0; gi < header.generalInfo.length; gi++) {
         if (header.generalInfo[gi].type !== OID_CERT_PROFILE) continue;
@@ -795,22 +618,12 @@ var PKI_MESSAGE = schema.seq([
         }
       }
     }
-    // RFC 9810 sec. 5.3.13/sec. 7 -- the cAKeyUpdAnnV3 [0] RootCaKeyUpdateContent CA key
-    // update form is cmp2021(3) syntax; a ckuann using it under pvno < 3 is a
-    // version mismatch. ckuann surfaces raw, so inspect its top-level tag: the
-    // deprecated cAKeyUpdAnnV2 is a universal SEQUENCE, the v3 form is [0].
     if (body.arm === "ckuann" && header.pvno !== 3) {
       var caKeyUpd = asn1.decode(body.bytes);
       if (caKeyUpd.tagClass === "context" && caKeyUpd.tagNumber === 0) {
         throw ctx.E("cmp/bad-version", "a ckuann using the cAKeyUpdAnnV3 [0] RootCaKeyUpdateContent form requires CMP version cmp2021(3) (RFC 9810 sec. 5.3.13, sec. 7)");
       }
     }
-    // RFC 9810 sec. 5.2.8.3.2/sec. 7 -- Challenge.encryptedRand [0] EnvelopedData is
-    // cmp2021(3) syntax (the replacement for the deprecated challenge field).
-    // popdecc surfaces raw, so inspect the already-decoded Challenges the same
-    // way the ckuann gate inspects its top-level tag: a Challenge carrying a
-    // context [0] (its only context-tagged field) under pvno < 3 is a version
-    // mismatch; a non-Challenges shape stays on the documented raw posture.
     if (body.arm === "popdecc" && header.pvno !== 3) {
       var challenges = asn1.decode(body.bytes);
       if (challenges.tagClass === "universal" && challenges.tagNumber === TAGS.SEQUENCE && challenges.children) {
@@ -835,26 +648,12 @@ var PKI_MESSAGE = schema.seq([
   },
 });
 
-// ---- support-message infoValue structures (RFC 9480 sec. 2.14-2.17) -----
-//
-// A genm / genp carries its payload as an ANY, so the InfoTypeAndValue leaf above
-// surfaces it as raw bytes. These are the strict decoders for the four values RFC 9483
-// sec. 4.3 defines, each a standalone parser so a malformed payload is refused with the
-// same caps, minimal-encoding and trailing-byte rules the message itself is held to.
-// The CMP module is EXPLICIT TAGS, so every context tag here wraps its value.
 
-// CACertsValue ::= SEQUENCE SIZE (1..MAX) OF CMPCertificate. An absent infoValue is how
-// "no CA certificate is available" is said (sec. 4.3.1), so an EMPTY sequence is malformed
-// rather than a second spelling of the same answer.
 var CA_CERTS_VALUE = schema.seqOf(rawSequence("cmp/bad-info-value"), {
   min: 1, code: "cmp/bad-info-value", what: "CACertsValue",
   build: function (m) { return m.items.map(function (it) { return it.value; }); },
 });
 
-// RootCaKeyUpdateContent ::= SEQUENCE { newWithNew CMPCertificate,
-//   newWithOld [0] CMPCertificate OPTIONAL, oldWithNew [1] CMPCertificate OPTIONAL }
-// (RFC 9480 sec. 2.15). Both optionals are OPTIONAL in the syntax; RFC 9483 sec. 4.3.2
-// requires newWithOld of a response, which the caller of this decoder enforces.
 var ROOT_CA_KEY_UPDATE = schema.seq([
   schema.field("newWithNew", rawSequence("cmp/bad-info-value")),
   schema.trailing([
@@ -872,9 +671,6 @@ var ROOT_CA_KEY_UPDATE = schema.seq([
   },
 });
 
-// AttributeTypeAndValue ::= SEQUENCE { type OBJECT IDENTIFIER, value ANY }, the element of
-// the Controls that carries a CertReqTemplate keySpec (RFC 9480 sec. 2.16). The value stays
-// raw here: which syntax it must have depends on the type, which sec. 4.3.3 constrains.
 var ATTR_TYPE_AND_VALUE = schema.seq([
   schema.field("type", schema.oidLeaf()),
   schema.field("value", schema.any()),
@@ -886,9 +682,6 @@ var ATTR_TYPE_AND_VALUE = schema.seq([
   },
 });
 
-// CertReqTemplateContent ::= SEQUENCE { certTemplate CertTemplate, keySpec Controls OPTIONAL }
-// (RFC 9480 sec. 2.16). keySpec is untagged, so it is recognized by its universal SEQUENCE tag
-// following the CertTemplate, which is itself IMPLICIT [tagged] by the CRMF module.
 var CERT_REQ_TEMPLATE_VALUE = schema.seq([
   schema.field("certTemplate", CERT_TEMPLATE_LEAF),
   schema.optional("keySpec", schema.seqOf(ATTR_TYPE_AND_VALUE, {
@@ -905,7 +698,6 @@ var CERT_REQ_TEMPLATE_VALUE = schema.seq([
   },
 });
 
-// CRLsValue ::= SEQUENCE SIZE (1..MAX) OF CertificateList (RFC 9480 sec. 2.17).
 var CRLS_VALUE = schema.seqOf(rawSequence("cmp/bad-info-value"), {
   min: 1, code: "cmp/bad-info-value", what: "CRLsValue",
   build: function (m) { return m.items.map(function (it) { return it.value; }); },
@@ -914,18 +706,12 @@ var CRLS_VALUE = schema.seqOf(rawSequence("cmp/bad-info-value"), {
 function _valueParser(what, topSchema) {
   return pkix.makeParser({ pemLabel: "CMP", PemError: PemError, ErrorClass: CmpError, prefix: "cmp", what: what, topSchema: topSchema, ns: NS });
 }
-// @internal -- pki.cmp.session reads a support-message response through these.
+// @internal
 var readCaCerts = _valueParser("CACertsValue", CA_CERTS_VALUE);
 var readRootCaKeyUpdate = _valueParser("RootCaKeyUpdateContent", ROOT_CA_KEY_UPDATE);
 var readCertReqTemplate = _valueParser("CertReqTemplateValue", CERT_REQ_TEMPLATE_VALUE);
 var readCrls = _valueParser("CRLsValue", CRLS_VALUE);
-// A CertReqTemplate keySpec states a key requirement as an AlgorithmIdentifier (RFC 9480 sec. 2.16),
-// which is the shared sub-schema every format already reads one with: `SEQUENCE { algorithm OID,
-// parameters ANY OPTIONAL }` and nothing after it. Reading it through the same definition is what
-// keeps a third field from passing as a well-formed one.
 var readAlgorithmIdentifier = _valueParser("AlgorithmIdentifier", ALG_ID);
-// A bare Name, so a caller-encoded issuer can be read back into the RDN sequence that guard-name's
-// canonical comparison takes. pki.cmp.session binds a returned CRL to the issuer it asked for.
 var readName = _valueParser("Name", pkix.name(NS));
 
 /**
@@ -1039,13 +825,6 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "CMP", Pe
  */
 function pemEncode(der, label) { return pkix.pemEncode(der, label || "CMP", PemError); }
 
-// A PKIMessage root is a SEQUENCE of 2-4 whose first child (PKIHeader) is a
-// SEQUENCE of >= 3 leading with a bare INTEGER (pvno) and whose second child
-// (PKIBody) is context-class constructed [0..26]. The one overlap in the
-// registry is one-directional: a 2-child PKIMessage with body ir [0] also
-// satisfies the shallow ocsp-request probe, so this detector registers AHEAD
-// of ocsp-request -- while every real OCSPRequest fails here (its tbsRequest
-// never leads with a bare INTEGER).
 function matches(root) {
   var k = pkix.rootSequenceChildren(root, 2, 4);
   if (!k) return false;
@@ -1062,7 +841,7 @@ module.exports = {
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
-  // @internal -- the RFC 9483 sec. 4.3 support-message values, read strictly from a genp.
+  // @internal
   readCaCerts: readCaCerts,
   readRootCaKeyUpdate: readRootCaKeyUpdate,
   readCertReqTemplate: readCertReqTemplate,