@blamejs/pki 0.6.13 → 0.6.15

package/lib/schema-csr.js

@@ -38,36 +38,15 @@ var frameworkError = require("./framework-error");
 var CsrError = frameworkError.CsrError;
 var PemError = frameworkError.PemError;
 
-// The csr error namespace the schema engine walks under. Shared PKIX sub-schemas
-// are instantiated here under csr/* so a structural fault reports a csr code.
 var NS = pkix.makeNS("csr", CsrError, oid);
 
 var NAME = pkix.name(NS);
 var SPKI = pkix.spki(NS);
 
-// CertificationRequestInfo version ::= INTEGER { v1(0) } (RFC 2986 sec. 4.1). A bare
-// mandatory INTEGER whose one legal value is 0, the inverse of the cert/CRL
-// readers, which reject 0 as the DER-forbidden default. Surface v1 as 1. A
-// cert-shaped [0] EXPLICIT wrapper at this position makes asn1.read.integer throw
-// asn1/* (fail-closed).
 var CSR_VERSION = pkix.versionReader(NS, { "0": 1 });
 
-// Attribute ::= SEQUENCE { type OID, values SET OF ANY }, the shared pkix factory
-// under the csr NS (values raw DER, SET SIZE(1..MAX), no uniqueness). The same
-// factory serves the PKCS#8 private-key attributes.
 var ATTRIBUTE = pkix.attribute(NS);
 
-// The two RECOGNIZED PKCS#9 request attributes get their value syntax enforced
-// (RFC 2985 sec. 5.4.1 challengePassword / sec. 5.4.2 extensionRequest): both
-// are SINGLE VALUE TRUE, extensionRequest carries one Extensions value
-// (RFC 5280 sec. 4.1, SIZE(1..MAX)) and challengePassword one DirectoryString
-// of 1..255 characters. A recognized type with a malformed, multi-valued, or
-// wrong-syntax value fails closed (csr/bad-attribute-value) -- a CA pipeline
-// reading requested extensions off csr.attributes must never receive garbage
-// under the extensionRequest OID. An UNRECOGNIZED attribute type stays opaque
-// raw DER and never fails the parse, and duplicate attribute TYPES stay legal
-// (RFC 2986 puts no uniqueness on the attributes SET). Registry rows keyed by
-// the stable dotted OID, not a switch; values are still surfaced raw.
 var EXTENSIONS = pkix.extensions(NS);
 var DIRECTORY_STRING_TAGS = [
   asn1.TAGS.UTF8_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.TELETEX_STRING,
@@ -75,10 +54,6 @@ var DIRECTORY_STRING_TAGS = [
 ];
 var RECOGNIZED_ATTRIBUTE_VALUE = {};
 RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("extensionRequest")] = function (node, ctx) {
-  // Surface the requested extensions decoded (same {oid,name,critical,value}
-  // shape as a certificate's extensions) so a CA pipeline, and the EST
-  // re-enroll guard, read them off the attribute instead of re-walking the
-  // raw Extensions bytes. Returned as an enrichment merged onto the attribute.
   try { return { extensions: schema.walk(EXTENSIONS, node, ctx).result }; }
   catch (e) {
     throw ctx.E("csr/bad-attribute-value",
@@ -97,11 +72,6 @@ RECOGNIZED_ATTRIBUTE_VALUE[oid.byName("challengePassword")] = function (node, ct
   }
 };
 
-// CertificationRequestInfo ::= SEQUENCE { version, subject Name,
-//   subjectPKInfo SubjectPublicKeyInfo, attributes [0] IMPLICIT SET OF Attribute }.
-// attributes is a REQUIRED field (a CRI omitting [0] is a missing-required-field
-// fault, not silently accepted) modeled as an IMPLICIT [0] SET OF with min:0 (an
-// empty attributes SET is legal). subject MAY be empty, so there is no non-empty-DN guard.
 var CERTIFICATION_REQUEST_INFO = schema.seq([
   schema.field("version", CSR_VERSION),
   schema.field("subject", NAME),
@@ -115,7 +85,6 @@ var CERTIFICATION_REQUEST_INFO = schema.seq([
       var checkValue = RECOGNIZED_ATTRIBUTE_VALUE[a.type];
       if (checkValue) {
         var valueItems = it.value.fields.values.value.items;
-        // Both recognized PKCS#9 types are SINGLE VALUE TRUE (RFC 2985 sec. 5.4).
         if (valueItems.length !== 1) {
           throw ctx.E("csr/bad-attribute-value", (a.name || a.type) + " is a SINGLE VALUE attribute (RFC 2985 sec. 5.4)");
         }
@@ -126,19 +95,13 @@ var CERTIFICATION_REQUEST_INFO = schema.seq([
     });
     return {
       version: m.fields.version.value,
-      subject: m.fields.subject.value.result, // Name is a seqOf -> field.value is the match; .result is the {rdns, dn} build
+      subject: m.fields.subject.value.result,
       subjectPublicKeyInfo: m.fields.subjectPKInfo.value.result,
       attributes: attributes,
     };
   },
 });
 
-// CertificationRequest ::= SEQUENCE { certificationRequestInfo, signatureAlgorithm,
-//   signature BIT STRING }, the shared SIGNED envelope. It diverges from the
-// cert/CRL builders by omitting the outer-vs-inner signatureAlgorithm agreement
-// check (the CRI has no inner signature AlgorithmIdentifier) and the
-// non-empty-subject guard (a CSR subject MAY be empty). The omission is
-// structural: this build simply never references the agreement bytes.
 var CERTIFICATION_REQUEST = pkix.signedEnvelope(NS, CERTIFICATION_REQUEST_INFO, {
   code: "csr/not-a-certification-request", what: "CertificationRequest",
   build: function (e) {
@@ -185,9 +148,6 @@ var CERTIFICATION_REQUEST = pkix.signedEnvelope(NS, CERTIFICATION_REQUEST_INFO,
  *   csr.subject.dn;             // -> "CN=req.example"
  *   csr.attributes[0].type;     // -> "1.2.840.113549.1.9.14"
  */
-// Recording, because pki.csr.verify reaches a verdict from this result: the certificationRequestInfo
-// byte range, the key it proves possession of, and the subject and requested extensions that range
-// encodes are separate properties here, so the record is what binds them to one another.
 var parse = pkix.makeRecordingParser({ pemLabel: "CERTIFICATE REQUEST", PemError: PemError, ErrorClass: CsrError, prefix: "csr", what: "certification request", topSchema: CERTIFICATION_REQUEST, ns: NS }, "csr");
 
 /**
@@ -228,14 +188,6 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "CERTIFIC
  */
 function pemEncode(der, label) { return pkix.pemEncode(der, label || "CERTIFICATE REQUEST", PemError); }
 
-// A CertificationRequest shares the outer SEQUENCE-of-3 shape with a certificate
-// and a CRL; a CSR is distinguished by its CertificationRequestInfo -- a SEQUENCE
-// of EXACTLY four children {version INTEGER, subject SEQUENCE, subjectPKInfo
-// SEQUENCE, attributes [0]}. The mandatory trailing context-[0] attributes
-// element is what a cert (whose tbs leads with [0] EXPLICIT version or an INTEGER
-// serial and never ends the leading run this way) and a CRL (whose tbs reaches a
-// bare Time at the validity position) never present, so the three detectors are
-// mutually exclusive.
 function matches(root) {
   var TAGS = asn1.TAGS;
   var cri = pkix.signedEnvelopeTbs(root);
@@ -253,10 +205,5 @@ module.exports = {
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
-  // The top schema, exposed (not on the curated pki.schema.csr surface) so a
-  // composer can drive the encode direction -- schema.encode(schema, v) -> a
-  // CertificationRequest -- and prove the round-trip. The EST builder uses it
-  // to re-encode a CSR with added attributes (the crmf certReqMessagesSchema
-  // precedent).
   certificationRequestSchema: CERTIFICATION_REQUEST,
 };

package/lib/schema-csrattrs.js

@@ -55,37 +55,19 @@ var CsrattrsError = frameworkError.CsrattrsError;
 var NS = pkix.makeNS("csrattrs", CsrattrsError, oid);
 var T = asn1.TAGS;
 
-// The base Attribute is SET SIZE(1..MAX); ATTRIBUTE_KEYTYPE lowers the floor to 0
-// only for the ecPublicKey / rsaEncryption key-type hints, whose empty values SET
-// means "any key of this type" (RFC 9908 sec. 3.2). Every other attribute, and
-// every template inner attribute, keeps the non-empty floor, so an empty
-// challengePassword or unknown attribute still fails closed.
-// ATTRIBUTE keeps the base SET SIZE(1..MAX); ATTRIBUTE_OPTIONAL_VALUES lowers the
-// floor to 0. Only the recognized NON-KEY attributes that require a value
-// (id-ExtensionReq, the request-info template) use the strict form; a key-type
-// hint's empty SET means "any key of this type" (RFC 9908 sec. 3.2), and an
-// UNKNOWN attribute (a key type this build does not know yet, or any other OID) is
-// TOLERATED with an empty SET too -- RFC 8951 ignores what it does not recognize,
-// so an unfamiliar OID must not fail the whole response.
 var ATTRIBUTE = pkix.attribute(NS);
 var ATTRIBUTE_OPTIONAL_VALUES = pkix.attribute(NS, { minValues: 0 });
 var EXTENSIONS = pkix.extensions(NS);
 var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
 
-// The RFC 9908 semantically-meaningful attribute OIDs (registry, never literals).
-var OID_EXTENSION_REQUEST = oid.byName("extensionRequest");                  // id-ExtensionReq
+var OID_EXTENSION_REQUEST = oid.byName("extensionRequest");
 var OID_EC_PUBLIC_KEY = oid.byName("ecPublicKey");
 var OID_RSA_ENCRYPTION = oid.byName("rsaEncryption");
 var OID_TEMPLATE = oid.byName("certificationRequestInfoTemplate");
 var OID_EXT_REQ_TEMPLATE = oid.byName("extensionReqTemplate");
 
-// The recognized non-key attributes that MUST carry a value (empty SET rejected).
 var STRICT_VALUES_OIDS = new Set([OID_EXTENSION_REQUEST, OID_TEMPLATE]);
 
-// The recognized public-key type OIDs -- used to FLAG a parsed attribute isKeyType
-// for the enroll planner (rsaEncryption / ecPublicKey are only the RFC 9908 sec. 3.2
-// examples; a no-parameter key like Ed25519 or an ML-DSA / SLH-DSA / ML-KEM type is
-// equally valid). Built by registered NAME (a typo fails at load), never literals.
 var KEY_TYPE_OIDS = new Set([
   "rsaEncryption", "ecPublicKey", "Ed25519", "Ed448", "X25519", "X448",
   "id-ml-dsa-44", "id-ml-dsa-65", "id-ml-dsa-87",
@@ -100,19 +82,13 @@ var KEY_TYPE_OIDS = new Set([
   return d;
 }));
 
-// ---- RFC 9908 sec. 3.4 CertificationRequestInfoTemplate ------------------
 
-// version MUST be v1(0). A dedicated leaf (not pkix.versionReader) so the reject
-// carries the template-specific code the RFC 9908 sec. 3.4 MUST names.
 var TEMPLATE_VERSION = schema.decode(function (n, ctx) {
   var v = asn1.read.integer(n);
   if (v !== 0n) throw ctx.E("csrattrs/bad-template-version", "CertificationRequestInfoTemplate version must be v1(0) (RFC 9908 sec. 3.4)");
   return 0;
 }, function () { return asn1.build.integer(0n); });
 
-// SingleAttributeTemplate ::= SEQUENCE { type OID, value ANY OPTIONAL }, where a
-// value-absent element means "the client fills this in" (RFC 9908 sec. 3.4). The
-// trailing OPTIONAL ANY is the algorithmIdentifier-parameters shape.
 var SINGLE_ATTR_TEMPLATE = schema.seq([
   schema.field("type", schema.oidLeaf()),
   schema.optional("value", schema.any(), { whenAny: true }),
@@ -124,29 +100,19 @@ var SINGLE_ATTR_TEMPLATE = schema.seq([
   },
 });
 
-// RelativeDistinguishedNameTemplate ::= SET SIZE (1..MAX) OF SingleAttributeTemplate.
 var RDN_TEMPLATE = schema.setOf(SINGLE_ATTR_TEMPLATE, {
   assert: "set", min: 1, code: "csrattrs/bad-name-template", what: "RelativeDistinguishedNameTemplate",
   build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
 });
-// NameTemplate ::= RDNSequence (a SEQUENCE OF RDN-template SETs) -> array of RDNs,
-// each an array of { type, name, value } (value null = "the client fills it in").
 var NAME_TEMPLATE = schema.seqOf(RDN_TEMPLATE, {
   assert: "sequence", code: "csrattrs/bad-name-template", what: "NameTemplate",
   build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
 });
 
-// SubjectPublicKeyInfoTemplate ::= SEQUENCE { algorithm AlgorithmIdentifier,
-//   subjectPublicKey BIT STRING OPTIONAL }, where the key is OPTIONAL (present
-//   only as an RSA modulus-size placeholder), so pkix.spki (key required, arity 2)
-//   cannot be reused.
 var SPKI_TEMPLATE = schema.seq([
   schema.field("algorithm", ALGORITHM_IDENTIFIER),
   schema.optional("placeholderKey", schema.bitString(), { whenUniversal: [T.BIT_STRING] }),
 ], {
-  // subjectPKInfo is [0] IMPLICIT (RFC 9908 sec. 3.4), so the context tag replaces
-  // the universal SEQUENCE tag, so the node is context-[0] constructed and its
-  // children are read directly (the pwri keyDerivationAlgorithm [0] precedent).
   assert: "implicit", implicitTag: 0, arity: { min: 1, max: 2 }, code: "csrattrs/bad-spki-template", what: "SubjectPublicKeyInfoTemplate",
   build: function (m) {
     return { algorithm: m.fields.algorithm.value.result,
@@ -154,11 +120,6 @@ var SPKI_TEMPLATE = schema.seq([
   },
 });
 
-// ExtensionTemplate ::= SEQUENCE { extnID OID, critical BOOLEAN DEFAULT FALSE,
-//   extnValue OCTET STRING OPTIONAL }, where extnValue absent means "client supplies";
-//   an explicit critical FALSE is non-DER (BOOLEAN DEFAULT FALSE). Not reusable
-//   from pkix.extension (whose extnValue is required), so the DER-critical rule
-//   is applied here directly.
 var EXTENSION_TEMPLATE = schema.decode(function (n, ctx) {
   if (!schema.isUniversal(n, T.SEQUENCE) || !n.children || n.children.length < 1 || n.children.length > 3) {
     throw ctx.E("csrattrs/bad-extension-template", "ExtensionTemplate must be a SEQUENCE of {extnID, critical?, extnValue?}");
@@ -176,20 +137,11 @@ var EXTENSION_TEMPLATE = schema.decode(function (n, ctx) {
   return { oid: extnID, name: ctx.oid.name(extnID) || null, critical: critical, value: value };
 });
 
-// ExtensionReqTemplate ::= ExtensionTemplates ::= SEQUENCE SIZE (1..MAX) OF
-// ExtensionTemplate (RFC 9908 sec. 3.4) -- the id-aa-extensionReqTemplate value
-// is a SEQUENCE OF ExtensionTemplate, not a single one.
 var EXTENSION_REQ_TEMPLATE = schema.seqOf(EXTENSION_TEMPLATE, {
   assert: "sequence", min: 1, code: "csrattrs/bad-extension-template", what: "ExtensionReqTemplate",
   build: function (m) { return m.items.map(function (it) { return it.value; }); },
 });
 
-// CertificationRequestInfoTemplate ::= SEQUENCE { version, subject NameTemplate
-//   OPTIONAL, subjectPKInfo [0] IMPLICIT OPTIONAL, attributes [1] IMPLICIT
-//   Attributes }. attributes is present (may be an empty SET). The RFC 9908
-//   sec. 3.4 inner-attribute MUSTs (<=1 extensionReqTemplate; not both
-//   extension-request kinds; a values SET of exactly one ExtensionTemplate) are
-//   enforced in the build.
 var CERT_REQ_INFO_TEMPLATE = schema.seq([
   schema.field("version", TEMPLATE_VERSION),
   schema.optional("subject", NAME_TEMPLATE, { whenUniversal: [T.SEQUENCE] }),
@@ -205,16 +157,11 @@ var CERT_REQ_INFO_TEMPLATE = schema.seq([
       if (a.type === OID_EXTENSION_REQUEST) {
         hasExtReq = true;
         extReqs += 1;
-        // A template id-ExtensionReq carries one Extensions value (RFC 9908 sec. 3.2);
-        // decode it so a client reads the requirements off .extensions instead of
-        // re-parsing raw bytes (the top-level extensionRequest exposes it the same way).
         if (a.values.length !== 1) throw NS.E("csrattrs/bad-template-attrs", "a template id-ExtensionReq values must be a SET of exactly one Extensions (RFC 9908 sec. 3.2)");
         extensions = schema.walk(EXTENSIONS, asn1.decode(a.values[0]), ctx).result;
       }
       if (a.type === OID_EXT_REQ_TEMPLATE) {
         extReqTemplates += 1;
-        // The attribute's values SET holds exactly one ExtensionReqTemplate
-        // (RFC 9908 sec. 3.4); that value is itself a SEQUENCE OF ExtensionTemplate.
         if (a.values.length !== 1) throw NS.E("csrattrs/bad-template-attrs", "an id-aa-extensionReqTemplate values must be a SET of exactly one ExtensionReqTemplate (RFC 9908 sec. 3.4)");
         extensionTemplates = extensionTemplates.concat(schema.walk(EXTENSION_REQ_TEMPLATE, asn1.decode(a.values[0]), ctx).result);
       }
@@ -233,35 +180,24 @@ var CERT_REQ_INFO_TEMPLATE = schema.seq([
   },
 });
 
-// ---- AttrOrOID + the semantic enrichment ---------------------------------
 
-// Decode the three RFC 9908-meaningful attribute types onto an already-walked
-// Attribute { type, name, values }. Unknown types keep only their raw values.
-// A recognized public-key type is flagged isKeyType so a consumer (the pki.est
-// enroll planner) treats every accepted key type uniformly, not just RSA/EC.
 function _enrichAttribute(item, ctx) {
   if (KEY_TYPE_OIDS.has(item.oid)) item.isKeyType = true;
   if (item.oid === OID_EXTENSION_REQUEST) {
     if (item.values.length !== 1) throw ctx.E("csrattrs/bad-extension-req", "an id-ExtensionReq attribute values must be a SET of exactly one Extensions (RFC 9908 sec. 3.2)");
     item.extensions = schema.walk(EXTENSIONS, asn1.decode(item.values[0]), ctx).result;
   } else if (item.oid === OID_EC_PUBLIC_KEY) {
-    // A key-type hint's values SET is empty ("any curve") or a singleton naming
-    // one curve (RFC 9908 sec. 3.2); a multi-valued SET is ambiguous, so it fails
-    // closed instead of letting DER ordering pick the advertised constraint.
     if (item.values.length > 1) throw ctx.E("csrattrs/bad-key-type-attr", "an ecPublicKey attribute values must be empty or a SET of exactly one named-curve OBJECT IDENTIFIER (RFC 9908 sec. 3.2)");
     if (item.values.length === 1) {
       try { item.curve = asn1.read.oid(asn1.decode(item.values[0])); }
       catch (e) { throw ctx.E("csrattrs/bad-key-type-attr", "an ecPublicKey attribute value must be a named-curve OBJECT IDENTIFIER (RFC 9908 sec. 3.2)", e); }
     }
   } else if (item.oid === OID_RSA_ENCRYPTION) {
-    // Empty ("any size") or a singleton naming one key size; reject a multi-valued SET.
     if (item.values.length > 1) throw ctx.E("csrattrs/bad-key-type-attr", "an rsaEncryption attribute values must be empty or a SET of exactly one INTEGER key size (RFC 9908 sec. 3.2)");
     if (item.values.length === 1) {
       var sz;
       try { sz = asn1.read.integer(asn1.decode(item.values[0])); }
       catch (e) { throw ctx.E("csrattrs/bad-key-type-attr", "an rsaEncryption attribute value must be an INTEGER key size (RFC 9908 sec. 3.2)", e); }
-      // Bound before narrowing to a Number: an RSA modulus-size hint of 1..65536
-      // bits covers every real key; a value past 2^53 would round silently.
       if (sz < 1n || sz > 65536n) throw ctx.E("csrattrs/bad-key-type-attr", "the rsaEncryption key size " + sz + " is out of range (1..65536 bits)");
       item.keySize = Number(sz);
     }
@@ -271,36 +207,25 @@ function _enrichAttribute(item, ctx) {
   }
 }
 
-// AttrOrOID ::= CHOICE { oid OBJECT IDENTIFIER, attribute Attribute }. The two
-// arms are the two universal tags; anything else is not an AttrOrOID. A decode
-// leaf (not schema.choice) so the enrichment + the paired write live together.
 var ATTR_OR_OID = schema.decode(function (n, ctx) {
   if (schema.isUniversal(n, T.OBJECT_IDENTIFIER) && !n.constructed) {
     var o = asn1.read.oid(n);
     return { kind: "oid", oid: o, name: ctx.oid.name(o) || null };
   }
   if (schema.isUniversal(n, T.SEQUENCE) && n.children) {
-    // Peek the type OID to choose the values-arity rule: only a recognized non-key
-    // attribute (id-ExtensionReq / template) requires SET SIZE(1..MAX); a key-type
-    // hint OR an unknown OID MAY carry an empty SET (RFC 9908 sec. 3.2 / RFC 8951).
     var typeOid = (n.children.length >= 1 && schema.isUniversal(n.children[0], T.OBJECT_IDENTIFIER) && !n.children[0].constructed) ? asn1.read.oid(n.children[0]) : null;
     var attrSchema = STRICT_VALUES_OIDS.has(typeOid) ? ATTRIBUTE : ATTRIBUTE_OPTIONAL_VALUES;
-    var a = schema.walk(attrSchema, n, ctx).result;          // { type, name, values:[bytes] }
+    var a = schema.walk(attrSchema, n, ctx).result;
     var item = { kind: "attribute", oid: a.type, name: a.name, values: a.values };
     _enrichAttribute(item, ctx);
     return item;
   }
   throw ctx.E("csrattrs/bad-attr-or-oid", "each CsrAttrs element must be an OBJECT IDENTIFIER or an Attribute SEQUENCE (RFC 8951 sec. 3.5)");
 }, function (item) {
-  // Paired encoder (one structure, both directions): reconstruct from the arm's
-  // identifying fields plus raw values, since the typed enrichment is decode-only.
   if (item.kind === "oid") return asn1.build.oid(item.oid);
   return asn1.build.sequence([asn1.build.oid(item.oid), asn1.build.set(item.values)]);
 });
 
-// CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID. min:0, because an empty SEQUENCE is
-// a complete valid document. The cross-element MUSTs (RFC 9908 sec. 3.2 single
-// id-ExtensionReq; sec. 3.4 single template) are enforced in the build.
 var CSR_ATTRS = schema.seqOf(ATTR_OR_OID, {
   assert: "sequence", code: "csrattrs/not-csrattrs", what: "CsrAttrs",
   build: function (m) {
@@ -347,21 +272,13 @@ var CSR_ATTRS = schema.seqOf(ATTR_OR_OID, {
  */
 var parse = pkix.makeParser({ pemLabel: null, PemError: frameworkError.PemError, ErrorClass: CsrattrsError, prefix: "csrattrs", what: "CsrAttrs", topSchema: CSR_ATTRS, ns: NS });
 
-// matches(root): a CsrAttrs is a universal SEQUENCE whose children are each a
-// bare universal OID or an Attribute (a universal SEQUENCE of exactly 2 whose
-// first child is an OID and second a SET). An empty SEQUENCE (30 00) is a valid
-// CsrAttrs and no other registered document root accepts it. Registered BEFORE
-// ocsp-request (a permissive superset probe) as the strict refinement, the same
-// resolution tsp / crmf already use.
 function matches(root) {
   var k = pkix.rootSequenceChildren(root, 0);
   if (!k) return false;
   if (k.length === 0) return true;
   for (var i = 0; i < k.length; i++) {
     var c = k[i];
-    // bare-OID arm: a primitive universal OBJECT IDENTIFIER.
     if (schema.isUniversal(c, T.OBJECT_IDENTIFIER) && !c.constructed) continue;
-    // Attribute arm: a universal SEQUENCE of exactly { OID, SET }.
     if (!schema.isUniversal(c, T.SEQUENCE) || !c.children || c.children.length !== 2) return false;
     if (!schema.isUniversal(c.children[0], T.OBJECT_IDENTIFIER)) return false;
     if (!(schema.isUniversal(c.children[1], T.SET) && c.children[1].children)) return false;
@@ -372,7 +289,5 @@ function matches(root) {
 module.exports = {
   parse: parse,
   matches: matches,
-  // The top schema, exposed (not on the curated pki.schema.csrattrs surface) so a
-  // composer can drive the encode direction and prove the round-trip.
   csrAttrsSchema: CSR_ATTRS,
 };