@blamejs/pki 0.6.14 → 0.6.16

package/lib/schema-pkix.js

@@ -1,32 +1,14 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) blamejs contributors
 "use strict";
-//
-// @internal -- no operator-facing namespace. The documented surface is the
-// parsers that compose these factories (pki.schema.x509, pki.schema.crl, ...).
-//
-// Shared PKIX structure-schema factories (RFC 5280). Each is a namespace-
-// parameterized FACTORY: given an error namespace `ns` ({ prefix, E, oid }) it
-// returns an asn1-schema that walks the corresponding ASN.1 structure and emits
-// the caller's own <prefix>/* error codes. x509.js, crl.js, and future CMS/CSR
-// parsers compose these so AlgorithmIdentifier / Name / Extension are defined
-// once, not re-derived per format. This module is internal infrastructure: the
-// operator-facing surface is the parsers that consume it.
+// @internal
 
 var asn1 = require("./asn1-der");
 var constants = require("./constants");
 var schema = require("./schema-engine");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
-// Own-key membership through an operation taken at load. Written out, the question reads two
-// replaceable properties to answer one thing, and here it decides which version numbers a format
-// accepts -- shared by every format module, so one admitted name widens all of them at once.
 var _hasOwn = intrinsic.hasOwn;
-// The rest of the operations this module decides with, taken at load for the same reason. What
-// these factories produce is what a consumer compares an identity against -- a certificate's
-// subject alternative names against an enrollment's own, a distinguished name against an issuer's
-// -- so a name that traversal, folding or a byte copy invents here is a name the encoded structure
-// never carried, and the comparison downstream still answers true.
 var _forEach = intrinsic.forEach;
 var _map = intrinsic.map;
 var _push = intrinsic.push;
@@ -53,10 +35,6 @@ var _WeakMapI = intrinsic.WeakMap;
 var _arrayFrom = Array.from;
 var _getUTCFullYear = intrinsic.uncurry(Date.prototype.getUTCFullYear);
 
-// The JavaScript regex `\s` class, decided by code point, so the whitespace tests below match
-// exactly what `/\s/` and `/\S/` matched with no caller-replaceable match protocol standing in for
-// them. Set = ECMAScript WhiteSpace + LineTerminator: TAB LF VT FF CR SP, U+00A0, U+1680,
-// U+2000..U+200A, U+2028, U+2029, U+202F, U+205F, U+3000, U+FEFF.
 function _isJsWhitespace(c) {
   return c === 0x09 || c === 0x0a || c === 0x0b || c === 0x0c || c === 0x0d || c === 0x20 ||
          c === 0xa0 || c === 0x1680 || (c >= 0x2000 && c <= 0x200a) || c === 0x2028 || c === 0x2029 ||
@@ -70,33 +48,18 @@ function _hasNonWhitespace(s) {
   for (var i = 0; i < s.length; i++) { if (!_isJsWhitespace(_charCodeAt(s, i))) return true; }
   return false;
 }
-// Charset validation by character scan (the shared home for the `/^[chars]+$/`-family regexes format
-// modules used to carry): `charTable` builds a code-point membership table from a string of the allowed
-// characters, and `allCharsIn` checks that a NON-EMPTY string is composed only of them (`+`, not `*`).
-// One data-table loop, not a per-charset inlined character-class chain.
 function _charTable(chars) { var t = []; for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true; return t; }
 function _allCharsIn(s, table) {
   if (s.length === 0) return false;
   for (var i = 0; i < s.length; i++) { if (!table[_charCodeAt(s, i)]) return false; }
   return true;
 }
-// ct is a leaf format module (requires only the codec / oid / constants / error
-// core, never pkix) so the SCT-list extension VALUE decoder registers here as a
-// registry row, not a switch. The one-directional edge keeps the layering acyclic.
 var ct = require("./ct");
 
-// PEM armor markers, matched literally so no regex -- with its live, replaceable match protocol and
-// the backreference the END repeats -- stands between the parser and the wire.
 var _PEM_BEGIN = "-----BEGIN ";
 var _PEM_END = "-----END ";
 var _PEM_DASHES = "-----";
 
-// The next PEM block at or after `from`: "-----BEGIN <label>-----<body>-----END <label>-----" where
-// the label is one or more of [A-Z0-9 ] (RFC 7468 label octets, spaces included) and the END label
-// repeats the BEGIN label exactly (the backreference). Returns { index, label, body, end } -- `index`
-// the BEGIN offset, `end` the offset past the closing dashes -- or null when no such block remains.
-// A "-----BEGIN " with no valid label or no matching END is skipped, mirroring the regex trying each
-// start position; the body is the shortest span to the first matching END (the lazy quantifier).
 function _findPemBlock(text, from) {
   var searchFrom = from;
   for (;;) {
@@ -105,7 +68,7 @@ function _findPemBlock(text, from) {
     var p = bi + _PEM_BEGIN.length, ls = p;
     while (p < text.length) {
       var c = _charCodeAt(text, p);
-      if (!((c >= 65 && c <= 90) || (c >= 48 && c <= 57) || c === 32)) break; // A-Z 0-9 space
+      if (!((c >= 65 && c <= 90) || (c >= 48 && c <= 57) || c === 32)) break;
       p += 1;
     }
     if (p === ls || _strSlice(text, p, p + 5) !== _PEM_DASHES) { searchFrom = bi + 1; continue; }
@@ -118,7 +81,6 @@ function _findPemBlock(text, from) {
   }
 }
 
-// All ASCII CR / LF / TAB / SPACE removed (the base64 body's permitted layout whitespace).
 function _stripB64Whitespace(s) {
   var out = "", runStart = 0, i;
   for (i = 0; i < s.length; i++) {
@@ -132,8 +94,6 @@ function _stripB64Whitespace(s) {
   return out;
 }
 
-// A base64 string wrapped to 64-column lines joined by LF, no trailing LF (matching (.{64})->"$1\n"
-// then a trailing-newline strip; base64 output carries no newline of its own to strip).
 function _wrap64(s) {
   var out = "";
   for (var i = 0; i < s.length; i += 64) {
@@ -143,22 +103,8 @@ function _wrap64(s) {
   return out;
 }
 
-// ---- shared parse-entry ----------------------------------------------
-// Input handling, PEM unwrapping (with the size cap), DER-decode wrapping, and
-// the walk are defined ONCE here so no format can diverge on a guard. Each
-// format supplies only its labels, error class, code prefix, and top schema.
-
-// pemDecode(text, label, PemError): `label` (when truthy) is enforced, else the
-// first block is taken. Applies the LIMITS.PEM_MAX_BYTES cap before scanning.
-// The body must be CANONICAL base64 (RFC 4648 sec. 3.5): whole 4-character
-// groups, no stray padding, zero trailing bits in the final symbol. Node's
-// lenient Buffer.from would otherwise let several distinct PEM texts alias one
-// DER (PEM-layer malleability) and silently drop trailing content bits.
+
 function pemDecode(text, label, PemError) {
-  // guard.text.decode caps the raw byte length before the latin1 string copy:
-  // converting first would allocate a full-size string for input the cap is
-  // about to reject, and a buffer above Node's max string length would escape as
-  // an untyped ERR_STRING_TOO_LONG instead of pem/too-large.
   text = guard.text.decode(text, constants.LIMITS.PEM_MAX_BYTES, PemError, {
     charset: "latin1", tooLarge: "pem/too-large", badInput: "pem/bad-input", label: "PEM input",
   });
@@ -166,16 +112,9 @@ function pemDecode(text, label, PemError) {
   if (!m) throw new PemError("pem/no-block", "no PEM block found");
   if (label && m.label !== label) throw new PemError("pem/label-mismatch", "expected " + _stringify(label) + " block, got " + _stringify(m.label));
   var b64 = _stripB64Whitespace(m.body);
-  // Strict canonical base64 (RFC 4648 sec. 3.5) via the shared encoding guard.
   return guard.encoding.base64(b64, null, function (c, msg) { return new PemError(c, msg); }, "pem/bad-base64", "PEM base64 body");
 }
 
-// pemDecodeAll(text, label, PemError): decode every PEM block under the strict
-// RFC 7468 profile for application/pem-certificate-chain (RFC 8555 sec. 9.1) --
-// each block must carry `label` (default CERTIFICATE), explanatory text MUST NOT
-// appear before/between/after blocks (errata 5983: certchain = stricttextualmsg
-// *(eol stricttextualmsg)), and at least one block is required. Every block's
-// base64 body is canonical (the pemDecode rule); returns an array of DER buffers.
 function pemDecodeAll(text, label, PemError) {
   label = label || "CERTIFICATE";
   text = guard.text.decode(text, constants.LIMITS.PEM_MAX_BYTES, PemError, {
@@ -195,14 +134,6 @@ function pemDecodeAll(text, label, PemError) {
   return blocks;
 }
 
-// The label must be re-readable by this module's own PEM label scan (uppercase
-// alphanumeric words separated by single spaces, a subset of the RFC 7468
-// sec. 3 label grammar). Anything else (lowercase, a leading/trailing space,
-// an embedded "-----" or newline) would emit armor pemDecode itself rejects
-// or corrupt the armor grammar: a config-time authoring fault, thrown here.
-// The armor label grammar, decided character by character (no regex protocol on the emit path):
-// one or more A-Z0-9 words joined by single spaces -- so no leading/trailing space and no doubled
-// space, and every other character in [A-Z0-9].
 function _isPemLabel(s) {
   var n = s.length;
   if (n === 0) return false;
@@ -221,16 +152,11 @@ function pemEncode(der, label, PemError) {
   if (typeof label !== "string" || !_isPemLabel(label)) {
     throw new PemError("pem/bad-label", "pemEncode requires an uppercase A-Z0-9 label with single spaces");
   }
-  // Re-view through the byte guard: a string input would silently utf8-armor into
-  // a bogus PEM, and a detached-backed Buffer would armor an empty body; both
-  // fail closed (a Uint8Array / Buffer of real DER re-views cleanly).
   var buf = guard.bytes.view(der, PemError, "pem/bad-input", "pemEncode DER input");
   var b64 = _wrap64(_bufToString(buf, "base64"));
   return "-----BEGIN " + label + "-----\n" + b64 + "\n-----END " + label + "-----\n";
 }
 
-// Only the base64 alphabet (A-Z a-z 0-9 + / =) kept, every other character dropped -- the lenient
-// filter of the historic signer-certificate path, by character scan.
 function _keepBase64(s) {
   var out = "", runStart = 0, i;
   for (i = 0; i < s.length; i++) {
@@ -244,11 +170,7 @@ function _keepBase64(s) {
   return out;
 }
 
-// The @internal LENIENT PEM decode of a fixed-`label` block (the historic signer-certificate path,
-// distinct from the strict canonical `pemDecode` above): the body of the first
-// "-----BEGIN <label>-----...-----END <label>-----" block with any non-base64 character stripped,
-// decoded through Node's lenient base64. Returns the DER Buffer, or null when no such block exists so
-// the caller keeps its own domain error. NOT for verified input -- pemDecode is the fail-closed door.
+// @internal
 function pemDecodeLenient(text, label) {
   var begin = _PEM_BEGIN + label + _PEM_DASHES;
   var end = _PEM_END + label + _PEM_DASHES;
@@ -260,27 +182,15 @@ function pemDecodeLenient(text, label) {
   return _bufferFrom(_keepBase64(_strSlice(text, bodyStart, ei)), "base64");
 }
 
-// Coerce parse input to DER bytes. A PEM string OR a PEM Buffer (a .pem file
-// read with fs.readFileSync) is unwrapped with opts.pemLabel; a DER Buffer or
-// Uint8Array is taken as bytes. opts: { pemLabel, PemError, ErrorClass, prefix }.
 function coerceToDer(input, opts) {
   if (typeof input === "string") return pemDecode(input, opts.pemLabel, opts.PemError);
   if (guard.bytes.isByteSource(input)) {
-    // Route any DER BufferSource (Buffer, typed array, DataView, or ArrayBuffer) through the shared byte
-    // guard so a detached backing store fails closed here for every format that composes this boundary
-    // (x509/crl/csr/pkcs8/cms/pkcs12), not per-format, and its byte view is read from the slot -- a
-    // cross-realm ArrayBuffer or an offset DataView reaches the decoder exactly as a Buffer does.
     var buf = guard.bytes.source(input, opts.ErrorClass, opts.prefix + "/bad-input", "parse");
     return _isPemArmor(buf) ? pemDecode(buf, opts.pemLabel, opts.PemError) : buf;
   }
   throw new opts.ErrorClass(opts.prefix + "/bad-input", "parse expects a DER BufferSource (Buffer, typed array, DataView, or ArrayBuffer) or a PEM string");
 }
 
-// Does a Buffer carry PEM armor (a .pem read with fs.readFileSync) instead of
-// raw DER? It does iff "-----BEGIN" appears and everything before it is TEXT
-// (UTF-8 BOM / whitespace / RFC 7468 explanatory preamble). DER is binary and its
-// leading tag+length bytes are non-printable, so a non-SEQUENCE DER (a bare
-// SET / INTEGER) is not misrouted here; it decodes and fails closed structurally.
 function _isPemArmor(buf) {
   var head = _bufToString(_subarray(buf, 0, 4096), "latin1");
   var idx = _strIndexOf(head, "-----BEGIN");
@@ -288,56 +198,29 @@ function _isPemArmor(buf) {
   for (var i = 0; i < idx; i++) {
     var c = buf[i];
     var textByte = (c >= 0x20 && c < 0x7f) || c === 0x09 || c === 0x0a || c === 0x0d ||
-      c === 0xef || c === 0xbb || c === 0xbf; // printable ASCII, tab/newlines, UTF-8 BOM
+      c === 0xef || c === 0xbb || c === 0xbf;
     if (!textByte) return false;
   }
   return true;
 }
 
-// Decode the DER root, wrapping a codec fault in the caller's <prefix>/bad-der.
 function decodeRoot(der, opts) {
-  // A format whose wire encoding is normatively BER (RFC 7292 PKCS#12) opts
-  // in to the codec's ber mode for the whole decode. BER-vs-DER divergence is
-  // not always a decode-time throw: a definite-length constructed IMPLICIT
-  // OCTET STRING decodes strictly and only diverges at the typed reader, so
-  // a strict-first-retry-on-throw boundary would miss legal BER shapes. A
-  // strict-DER input decodes identically under the ber mode, every other
-  // strictness verdict included.
   try { return asn1.decode(der, opts.ber ? { ber: true } : undefined); }
   catch (e) {
     throw new opts.ErrorClass(opts.prefix + "/bad-der", (opts.what || "input") + " DER did not decode: " + ((e && e.message) || _String(e)), e);
   }
 }
 
-// The shared parse entry: coerce -> decode -> walk the top schema. A format's
-// parse() is one call to this; the guard-parity bug class (a new format not
-// mirroring an existing format's input handling) is structurally impossible.
 function runParse(input, opts) {
   return schema.walk(opts.topSchema, decodeRoot(coerceToDer(input, opts), opts), opts.ns).result;
 }
 
-// Distinguished-name attribute short labels (RFC 4514 sec. 3 + common use).
-// RFC 4514 short names for the DN string representation; the single source is
-// pki.C.NAMES.DN_SHORT (shared with the human-readable renderer so the two can't drift).
 var DN_SHORT = constants.NAMES.DN_SHORT;
 
-// AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY OPTIONAL }
-// The error/OID namespace every format module walks its schema under:
-// { prefix, E:(code,message,cause)=>new ErrorClass(...), oid }. Factored so a
-// format declares it in one line instead of repeating the error-constructor
-// closure (a caller that never passes a cause is unaffected, since withCause ignores
-// an undefined third arg).
 function makeNS(prefix, ErrorClass, oidModule) {
   return { prefix: prefix, E: function (code, message, cause) { return new ErrorClass(code, message, cause); }, oid: oidModule };
 }
 
-// A bounded universal-INTEGER version reader. `accept` maps each legal wire value
-// (as a decimal string) to its surfaced version number; any other value is a
-// <prefix>/bad-version fault. The one genuine per-format divergence, the cert
-// rejects 0 and maps 1->2/2->3, a CRL accepts only 1->2, a CSR only 0->1, a PKCS#8
-// 0->1/1->2, is expressed purely as the accept map (RFC 5280 sec. 4.1.2.1 / sec. 5.1.2.1,
-// RFC 2986 sec. 4.1, RFC 5958 sec. 2). read.integer is strict, so an ENUMERATED-tagged
-// version is rejected at the leaf (asn1/*).
 function versionReader(ns, accept) {
   return schema.decode(function (n) {
     var key = _bigIntToString(asn1.read.integer(n));
@@ -346,22 +229,6 @@ function versionReader(ns, accept) {
   });
 }
 
-// opts.implicitTag (optional): read the AlgorithmIdentifier as a [tag] IMPLICIT
-// SEQUENCE (a context-class constructed node whose children are algorithm + parameters),
-// for the RFC 5652 sec. 6.2.4 pwri.keyDerivationAlgorithm [0]. With no opts the shape is a
-// universal SEQUENCE, byte-identical to every existing caller.
-//
-// Parameter-rule tiering: only the params-MUST-BE-ABSENT families (ML-DSA,
-// SLH-DSA, the Edwards/Montgomery curves), new registrations with no legacy
-// corpus) are enforced at parse time, in the build below. The CLASSICAL
-// per-OID rules (RSA parameters MUST be NULL, RFC 3279 sec. 2.2.1/2.3.1;
-// ecdsa-with-SHA2 parameters MUST be omitted, RFC 5758 sec. 3.2) are
-// deliberately not parse-time rejects: a long tail of deployed certificates
-// omits the RSA NULL, so the parse tier stays interop-lenient for those
-// families and the strict classical check runs on the signature-verification
-// path (path-validate's signature-algorithm registry), where the verdict
-// matters. SPKI key AlgorithmIdentifiers follow the same tiering: lenient at
-// parse, validated by the key-import layer that consumes them.
 function algorithmIdentifier(ns, opts) {
   opts = opts || {};
   return schema.seq([
@@ -372,13 +239,6 @@ function algorithmIdentifier(ns, opts) {
     arity: { min: 1 }, code: ns.prefix + "/bad-algorithm-identifier", what: "AlgorithmIdentifier",
     build: function (m, ctx) {
       var dotted = m.fields.algorithm.value;
-      // The registry marks several algorithm families parameters-absent: the PQC
-      // signature families (ML-DSA RFC 9881, SLH-DSA RFC 9909/9814), the
-      // Edwards/Montgomery curves (RFC 8410), ML-KEM (RFC 9936), and the HKDF
-      // identifiers (RFC 8619). For all of them the `parameters` field MUST be
-      // absent: no explicit NULL, no bytes. Enforced ONCE here so every consumer of the
-      // shared AlgorithmIdentifier inherits the rule; the guard-parity bug
-      // class is structurally impossible.
       if (m.fields.parameters.present && ctx.oid.paramsMustBeAbsent(dotted)) {
         throw ctx.E(ctx.prefix + "/bad-algorithm-parameters",
           "the " + (ctx.oid.name(dotted) || dotted) + " AlgorithmIdentifier parameters field MUST be absent");
@@ -388,10 +248,6 @@ function algorithmIdentifier(ns, opts) {
   });
 }
 
-// pbkdf2Params(ns): PBKDF2-params (RFC 8018 sec. 5.2) constrained to the RFC 9579 PBMAC1 profile, where the
-// salt uses the OCTET STRING choice and keyLength MUST be present (a MacData / PKIProtection consumer
-// cannot infer the derived MAC key size, RFC 9579 sec. 4.b/5). Shared by the PKCS#12 MacData reader and
-// the CMP PBMAC1 protection reader: one ns-parameterized decoder so neither format re-derives the shape.
 function pbkdf2Params(ns) {
   return schema.seq([
     schema.field("salt", schema.octetString()),
@@ -405,28 +261,13 @@ function pbkdf2Params(ns) {
       if (!m.fields.keyLength.present) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "PBMAC1 PBKDF2-params must carry keyLength (RFC 9579 sec. 5)");
       }
-      // guard.range.positiveInt31 bounds + narrows each counter atomically, so a value past the bound
-      // would round silently and hand a verifier wrong inputs.
       var iterationCount = guard.range.positiveInt31(m.fields.iterationCount.value, ctx.E, ctx.prefix + "/bad-mac-data", "PBKDF2 iterationCount");
       var keyLength = guard.range.positiveInt31(m.fields.keyLength.value, ctx.E, ctx.prefix + "/bad-mac-data", "PBKDF2 keyLength");
       var prf = m.fields.prf.present ? m.fields.prf.value.result : null;
-      // X.690 sec. 11.5: the prf DEFAULT is algid-hmacWithSHA1 (hmacWithSHA1 with NULL parameters,
-      // i.e. the 2-byte DER 05 00, RFC 8018 sec. 5.2); an explicit prf byte-equal to that default is
-      // non-canonical and rejects. hmacWithSHA1 with ABSENT parameters is a different value and decodes.
-      // This is a public structural check on the algorithm parameters, not a secret compare, so a
-      // direct byte test on the (fixed 2-octet) NULL encoding, not a timing-safe comparison.
       var pp = prf ? prf.parameters : null;
-      // pp is the public algorithm-identifier parameters field, a fixed 2-octet NULL encoding.
-      // No MAC, tag or secret is involved, so a timing-safe compare has nothing to protect.
-      // nosemgrep: pki-non-constant-time-secret-compare
       if (prf && prf.oid === hmacSha1 && pp !== null && pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "a PBKDF2 prf equal to its DEFAULT algid-hmacWithSHA1 must be omitted (X.690 sec. 11.5, RFC 8018 sec. 5.2)");
       }
-      // The PBKDF2 prf HMAC AlgorithmIdentifier likewise carries NULL (or absent) parameters (RFC 8018 App. B.1):
-      // reject a present-but-non-NULL prf parameter (e.g. an INTEGER) instead of discarding it, since the prf
-      // hash is dispatched by OID alone. (An absent prf, and hmacWithSHA1 with absent params, remain valid above.)
-      // pp is the public algorithm-identifier parameters node.
-      // nosemgrep: pki-non-constant-time-secret-compare
       if (prf && pp !== null && !(pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBKDF2 prf parameters must be absent or NULL (RFC 8018 App. B.1)");
       }
@@ -441,11 +282,6 @@ function pbkdf2Params(ns) {
   });
 }
 
-// pbmac1Params(ns): PBMAC1-params ::= SEQUENCE { keyDerivationFunc AlgorithmIdentifier{PBKDF2},
-// messageAuthScheme AlgorithmIdentifier } (RFC 8018 App. A.5 / RFC 9579 sec. 4). The PBKDF2 prf and the
-// messageAuthScheme HMAC are INDEPENDENT (a SHA-512 prf with a SHA-256 HMAC is legal). Shared by PKCS#12
-// MacData and CMP PBMAC1 protection; returns { kdf: { salt, iterationCount, keyLength, prfOid, prfName },
-// schemeOid, schemeName }.
 function pbmac1Params(ns) {
   return schema.seq([
     schema.field("keyDerivationFunc", schema.seq([
@@ -461,14 +297,7 @@ function pbmac1Params(ns) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "PBMAC1 keyDerivationFunc must be PBKDF2 (RFC 9579 sec. 4)");
       }
       var scheme = m.fields.messageAuthScheme.value.result;
-      // RFC 8018 App. B.1: an HMAC messageAuthScheme AlgorithmIdentifier carries NULL (or absent) parameters,
-      // matching the builder (_hmacAlgId emits the 2-byte 05 00). Any other parameter encoding is
-      // rejected: _verifyMac dispatches by the scheme OID alone, so a mismatched / malformed
-      // parameter (e.g. an INTEGER) must not slip through unvalidated. A direct byte test on the fixed 2-octet
-      // NULL encoding of the PUBLIC parameters, not a secret compare.
       var sp = scheme.parameters;
-      // sp is the public algorithm-identifier parameters node.
-      // nosemgrep: pki-non-constant-time-secret-compare
       if (sp !== null && !(sp.length === 2 && sp[0] === 0x05 && sp[1] === 0x00)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBMAC1 messageAuthScheme parameters must be absent or NULL (RFC 8018 App. B.1)");
       }
@@ -481,18 +310,6 @@ function pbmac1Params(ns) {
   });
 }
 
-// attrValueToString(ns): the AttributeValue decode-leaf. A malformed KNOWN
-// string type (invalid UTF-8, a non-IA5 byte, a PrintableString character
-// outside its set, ...) surfaces as an asn1/bad-* content error and must fail
-// closed. Do not hex-encode it away, or the decoder's strict string validation
-// is silently bypassed on the DN path. A value that is simply not a decodable
-// primitive string is not malformed and stays representable: an ANY-typed
-// non-string tag (asn1/expected-string) or a constructed universal type such as
-// a SEQUENCE (asn1/expected-primitive) renders per RFC 4514 sec. 2.4 as "#" plus the
-// hex of its complete DER encoding (node.bytes), round-tripping intact.
-// A GENUINE string whose first character is '#' or '\' is surfaced with a
-// leading '\' escape (RFC 4514 sec. 2.4) so it can never collide with the
-// '#'+hex form; the encode direction strips that one leading escape back off.
 function attrValueToString(ns) {
   return schema.decode(function (node) {
     var s;
@@ -501,12 +318,6 @@ function attrValueToString(ns) {
       if (!e || (e.code !== "asn1/expected-string" && e.code !== "asn1/expected-primitive")) {
         throw ns.E(ns.prefix + "/bad-atv", "malformed string in attribute value: " + ((e && e.message) || _String(e)));
       }
-      // asn1.read.string does not read NumericString, and that is deliberate: a value that returns a plain
-      // string joins the RFC 5280 sec. 7.1 name-comparison identity class, and NumericString is not a
-      // DirectoryString type.
-      // It does have its own strict reader though, so VALIDATE the content here (an out-of-alphabet value is
-      // malformed DER and must not be accepted merely because it falls to the opaque form) while still
-      // surfacing it in the type-distinct RFC 4514 hex form, which keeps it out of that identity class.
       if (node.tagClass === "universal" && node.tagNumber === asn1.TAGS.NUMERIC_STRING) {
         try { asn1.read.numericString(node); }
         catch (e2) { throw ns.E(ns.prefix + "/bad-atv", "malformed NumericString in attribute value: " + ((e2 && e2.message) || _String(e2))); }
@@ -516,21 +327,12 @@ function attrValueToString(ns) {
     if (_charAt(s, 0) === "#" || _charAt(s, 0) === "\\") return "\\" + s;
     return s;
   }, function (value) {
-    // encode: a leading '\' escapes the next character (the decode's escape of a
-    // literal '#'/'\'); a "#hex" form (RFC 4514 sec. 2.4) round-trips its raw DER
-    // verbatim. The hex is validated (even-length hex digits encoding exactly one
-    // DER TLV) and throws on anything else, since Buffer.from(str, "hex") stops at
-    // the first invalid character and would emit truncated bytes. Any other
-    // string encodes as UTF8String (the decode does not preserve the original
-    // string type, so this is the canonical re-encoding, not a byte-exact one).
     if (typeof value === "string" && _charAt(value, 0) === "\\") return asn1.build.utf8(_strSlice(value, 1));
     if (typeof value === "string" && _charAt(value, 0) === "#") {
       var hex = _strSlice(value, 1);
       if (hex.length === 0) {
         throw ns.E(ns.prefix + "/bad-atv", "a #hex attribute value must be a non-empty even run of hex digits (RFC 4514 sec. 2.4)");
       }
-      // Strict canonical hex via the shared encoding guard (even-length, canonical,
-      // no silent truncation at the first non-hex character).
       var raw = guard.encoding.hex(hex, null, ns.E, ns.prefix + "/bad-atv", "a #hex attribute value");
       try { asn1.decode(raw); }
       catch (e) { throw ns.E(ns.prefix + "/bad-atv", "a #hex attribute value must encode exactly one DER TLV", e); }
@@ -540,38 +342,14 @@ function attrValueToString(ns) {
   });
 }
 
-// The always-escape specials of RFC 4514 sec. 2.4, plus its positional rules:
-// NUL escapes as \00, a trailing space as '\ ', and a leading '#' or space as
-// '\#' / '\ '. Without them the rendered dn is ambiguous (a literal '#0500'
-// value would be indistinguishable from the hexstring form) and leading /
-// trailing spaces would be silently significant.
-// RFC 4514 sec. 2.4 attribute-value escaping is the single guard-name primitive
-// (pki.inspect reuses the dn this produces and does not re-escape the already-
-// escaped value), so the display escaper can't diverge from a re-inline elsewhere.
 var _escapeDnValue = guard.name.escapeDnValue;
 
-// The dn RENDERING of a surfaced AttributeValue: the '#'-leading hex form (a
-// non-string value) renders bare, since escaping its '#' would turn the RFC 4514
-// hexstring form into an escaped literal. A genuine string (surfaced
-// with its leading '#'/'\' escape, see attrValueToString) is unescaped back to
-// the semantic string and then rendered with the full escape set.
 function _dnDisplayValue(v) {
   if (typeof v !== "string") return v;
   if (_charAt(v, 0) === "#") return v;
   return _escapeDnValue(_charAt(v, 0) === "\\" ? _strSlice(v, 1) : v);
 }
 
-// time(ns): the RFC 5280 Time production under its profile encoding rule
-// (sec. 4.1.2.5 for certificate validity, restated for the CRL fields in
-// sec. 5.1.2.4-5.1.2.6): a date through the year 2049 MUST be UTCTime and
-// GeneralizedTime is reserved for 2050 onward, so a GeneralizedTime carrying a
-// 1950..2049 date is a non-conforming second encoding of a representable value
-// and is rejected (<prefix>/bad-time); accepting it would let two wire forms
-// alias one abstract time (a parser-differential channel). The engine's
-// schema.time already applies the cutover on ENCODE; this leaf composes it and
-// enforces the same rule on DECODE. A GeneralizedTime-only field (an RFC 3161
-// genTime, a CRL invalidityDate, an RFC 5755 AttCertValidityPeriod) must not
-// take this leaf, whose syntax has no UTCTime alternative to cut over to.
 function time(ns) {
   var base = schema.time(ns);
   return schema.decode(function (n, ctx) {
@@ -586,10 +364,6 @@ function time(ns) {
   }, base.write);
 }
 
-// Name ::= RDNSequence ::= SEQUENCE OF RelativeDistinguishedName; RDN ::= SET OF
-// AttributeTypeAndValue ::= SEQUENCE { type OID, value ANY }. The atv asserts
-// its SEQUENCE tag (a SET-tagged body is a different ASN.1 type), and repeated
-// RDN attribute types stay legal (no uniqueness).
 function attributeTypeAndValue(ns) {
   return schema.seq([
     schema.field("type", schema.oidLeaf()),
@@ -603,25 +377,16 @@ function attributeTypeAndValue(ns) {
   });
 }
 function relativeDistinguishedName(ns) {
-  // RelativeDistinguishedName ::= SET SIZE (1..MAX), so an empty SET {} is malformed.
   return schema.setOf(attributeTypeAndValue(ns), { assert: "set", min: 1, code: ns.prefix + "/bad-rdn", what: "RelativeDistinguishedName" });
 }
-// opts.implicitTag (optional): read the Name as a [tag] IMPLICIT RDNSequence. The
-// context tag REPLACES the universal SEQUENCE tag, so the node is a context-class
-// constructed [tag] whose children ARE the RDN SETs (the CRMF CertTemplate issuer
-// [3] / subject [5] IMPLICIT arm, RFC 4211 sec. 5). With no opts the shape is a bare
-// universal SEQUENCE OF, byte-identical to every existing caller.
 function name(ns, opts) {
   opts = opts || {};
   function nameBuild(m) {
     var rdns = [], parts = [];
-    // Through the captured traversal: `rdns` is the parsed subject a consumer reads a common name
-    // out of, so a replaced Array.prototype.forEach or push could drop the name the certificate
-    // carries and seat one it does not.
     _forEach(m.items, function (rdnItem) {
       var atvs = [], atvParts = [];
       _forEach(rdnItem.value.items, function (atvItem) {
-        var a = atvItem.value.result; // atvItem.value = the atv seq-match; .result = its build result
+        var a = atvItem.value.result;
         _push(atvs, a);
         var label = (a.name && _hasOwn(DN_SHORT, a.name) && DN_SHORT[a.name]) || a.name || a.type;
         _push(atvParts, label + "=" + _dnDisplayValue(a.value));
@@ -629,15 +394,6 @@ function name(ns, opts) {
       _push(rdns, atvs);
       _push(parts, _join(atvParts, "+"));
     });
-    // `dn` is a DISPLAY string, and its spelling is `openssl x509 -subject`: the RDNs in the
-    // certificate's own order, joined by ", ". That is deliberately not the RFC 4514 / LDAP
-    // distinguishedName, which reverses the RDNs and joins them with a bare comma (`openssl -nameopt
-    // RFC2253`), so this string must never be handed to an LDAP client. What IS taken from RFC 4514
-    // is sec. 2.4 value escaping, so an attribute value holding a comma cannot read as two RDNs. The
-    // interop gate pins this against openssl's own output. Identity never flows through this string:
-    // guard.name.dnEqual compares the DER under RFC 5280 sec. 7.1, and `bytes` below carries the raw
-    // Name DER for a consumer that needs the exact octets (the EST re-enroll subject MUST). Every
-    // renderer in the toolkit uses this one spelling, so a certificate has one dn whichever parsed it.
     return { rdns: rdns, dn: _join(parts, ", "), bytes: opts.implicitTag != null ? asn1.sequenceTlv(m.node) : m.node.bytes };
   }
   if (opts.implicitTag != null) {
@@ -648,32 +404,6 @@ function name(ns, opts) {
     assert: "sequence", code: ns.prefix + "/bad-name", what: "Name", build: nameBuild });
 }
 
-// GeneralName ::= CHOICE (RFC 5280 sec. 4.2.1.6). A validate-and-surface-raw leaf for a
-// caller that keeps the value raw but needs it to be a well-formed GeneralName: it
-// checks the chosen alternative's tag, form (constructed vs primitive per X.690
-// sec. 10.2), and content, then surfaces the value raw ({ bytes, tagClass, tagNumber }).
-// The content rule per alternative: otherName [0] is a SEQUENCE { type-id OID, value [0] EXPLICIT
-// }; x400Address [3] / ediPartyName [5] are non-empty constructed; directoryName [4]
-// EXPLICIT wraps a valid Name; rfc822Name [1] / dNSName [2] / uniformResourceIdentifier
-// [6] are primitive non-empty IA5String (7-bit); iPAddress [7] is a 4- or 16-octet
-// OCTET STRING; registeredID [8] is a primitive OBJECT IDENTIFIER.
-// `opts.code` is the caller's error code
-// (e.g. ocsp/bad-requestor-name, tsp/bad-tsa). Shared so the two parsers cannot drift.
-// opts.decodeValue (default false): in addition to the raw { bytes, tagClass,
-//   tagNumber }, surface the DECODED `value` per arm: IA5 text (string), an
-//   iPAddress Buffer, a directoryName { rdns, dn }, a registeredID OID string,
-//   or an otherName { typeId, valueBytes }. The path validator's name-constraint
-//   matcher needs the decoded value; the tsp/ocsp/attrcert consumers pass no
-//   flag and get the byte-identical raw-only shape.
-// opts.subtreeBase (default false): the GeneralSubtree.base form (RFC 5280
-//   sec. 4.2.1.10). An iPAddress base is an address+mask (8 octets IPv4 / 32 IPv6),
-//   and not the 4/16-octet SAN address form. Only the iPAddress size rule changes.
-// A GeneralizedTime-only leaf. Several formats fix their times to
-// GeneralizedTime and reject UTCTime (OCSP RFC 6960, TSP RFC 3161 sec. 2.4.2,
-// CMP RFC 9810 sec. 5.1.1, attribute-certificate validity RFC 5755 sec. 4.2.6);
-// a single ns-parameterized factory owns the tag assert, so the per-format code and
-// message differ but the check cannot drift. opts.allowFractional enables the
-// X.690 sec. 11.7 fractional-seconds profile (the RFC 3161 genTime).
 function generalizedTime(ns, opts) {
   opts = opts || {};
   var code = opts.code || (ns.prefix + "/bad-time");
@@ -687,8 +417,6 @@ function generalizedTime(ns, opts) {
   });
 }
 
-// A UTF8String-only leaf -- the PKIFreeText element shape (RFC 3161 sec. 2.4.2,
-// RFC 9810 sec. 5.1.1) shared by the TSP and CMP parsers.
 function utf8Text(ns, opts) {
   opts = opts || {};
   var code = opts.code || (ns.prefix + "/bad-freetext");
@@ -701,11 +429,6 @@ function utf8Text(ns, opts) {
   });
 }
 
-// A raw NON-EMPTY universal SEQUENCE leaf -- surfaces the exact TLV bytes of an
-// embedded element (a Certificate, a CertificateList, a PKIPublicationInfo)
-// after asserting the SEQUENCE tag and at least one child. An empty SEQUENCE
-// (30 00) has the right tag but is none of those structures, so it rejects and
-// no degenerate bytes reach certificate processing.
 function rawNonEmptySequence(ns, opts) {
   opts = opts || {};
   var code = opts.code || (ns.prefix + "/bad-sequence");
@@ -718,19 +441,8 @@ function rawNonEmptySequence(ns, opts) {
   });
 }
 
-// CRLReason ::= ENUMERATED (RFC 5280 sec. 5.3.1). Value 7 is unused/reserved.
-// The single canonical value->name table every consumer validates against: the
-// CRL reasonCode decoder surfaces the numeric code, the OCSP RevokedInfo
-// decoder the name; both draw the legal set from here so they cannot drift.
-// CRLReason ENUMERATED value names -- the single source is pki.C.NAMES.CRL_REASON
-// (shared with the OCSP revoked-status decoder, which surfaces the same numeric code).
 var CRL_REASON_NAMES = constants.NAMES.CRL_REASON;
 
-// Which GeneralName alternatives are constructed, and which carry an IA5String. Both tables answer
-// off a tag number the encoded value supplies, and both decide which validation an alternative
-// gets, so neither may inherit: with an ordinary prototype a planted numeric property routes a tag
-// down another alternative's arm, and a dNSName then reaches the IA5 arm's control-byte reject as
-// a constructed value, or misses it altogether.
 var GN_CONSTRUCTED = _assign(_create(null), { 0: 1, 3: 1, 4: 1, 5: 1 });
 var GN_IA5 = _assign(_create(null), { 1: 1, 2: 1, 6: 1 });
 function generalName(ns, opts) {
@@ -749,7 +461,6 @@ function generalName(ns, opts) {
     if (GN_CONSTRUCTED[t]) {
       if (!constructed || n.children.length < 1) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty constructed value (RFC 5280 sec. 4.2.1.6)");
       if (t === 0) {
-        // otherName ::= SEQUENCE { type-id OBJECT IDENTIFIER, value [0] EXPLICIT ANY }.
         if (n.children.length !== 2) throw ctx.E(code, "GeneralName otherName [0] must be a SEQUENCE { type-id, value [0] }");
         var typeId;
         try { typeId = asn1.read.oid(n.children[0]); }
@@ -760,7 +471,6 @@ function generalName(ns, opts) {
         }
         if (decodeValue) value = { typeId: typeId, valueBytes: ov.children[0].bytes };
       } else if (t === 4) {
-        // directoryName [4] EXPLICIT Name: validate the wrapped RDNSequence.
         if (n.children.length !== 1) throw ctx.E(code, "GeneralName directoryName [4] must wrap exactly one Name");
         var dnMatch = schema.walk(NAME, n.children[0], ctx);
         if (decodeValue) value = dnMatch.result;
@@ -769,8 +479,6 @@ function generalName(ns, opts) {
       if (constructed) throw ctx.E(code, "GeneralName [" + t + "] must be primitive (X.690 sec. 10.2)");
       if (GN_IA5[t]) {
         if (n.content.length === 0) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty IA5String");
-        // 7-bit IA5, no C0/DEL control byte. An embedded NUL/control in a
-        // dNSName/rfc822Name/URI enables a name-truncation bypass (CVE-2009-2408).
         guard.name.assertPrintableIa5(n.content, ctx.E, code, "GeneralName [" + t + "]");
         if (decodeValue) value = _bufToString(n.content, "latin1");
       } else if (t === 7) {
@@ -779,8 +487,6 @@ function generalName(ns, opts) {
         } else if (n.content.length !== 4 && n.content.length !== 16) {
           throw ctx.E(code, "GeneralName iPAddress [7] must be a 4- or 16-octet address");
         }
-        // n.content is proven non-null here (the primitive-form guard above
-        // threw on a constructed node); copy the octets out.
         if (decodeValue) value = _bufferConcat([n.content]);
       } else if (t === 8) {
         var regId;
@@ -795,26 +501,10 @@ function generalName(ns, opts) {
   });
 }
 
-// GeneralNames ::= SEQUENCE OF GeneralName (RFC 5280 sec. 4.2.1.6), SIZE (1..MAX). Every
-// element is validated by generalName (its CHOICE alternative's form + content) and
-// surfaced raw, so a caller carrying a GeneralNames field cannot accept a malformed
-// element by treating the whole sequence as opaque bytes. Returns { names, bytes }
-// where each `names[i]` is the generalName leaf's return: { bytes, tagClass,
-// tagNumber } plus, when opts.decodeValue is set, the decoded `value`. `bytes`
-// is the raw outer DER.
-// `opts.implicitTag` handles a [tag] IMPLICIT GeneralNames, where the context tag REPLACES
-// the universal SEQUENCE tag (RFC 5755 Holder.entityName [1]); otherwise it is a bare
-// universal SEQUENCE OF. `opts.code` is the caller's error code. Shared so the x509 /
-// attribute-certificate / (future) CRMF parsers validate a GeneralNames identically.
 function generalNames(ns, opts) {
   opts = opts || {};
   var code = opts.code || (ns.prefix + "/bad-general-names");
-  // decodeValue / subtreeBase thread through to each element (the path
-  // validator's constraint matcher passes decodeValue:true).
   var gn = generalName(ns, { code: code, decodeValue: opts.decodeValue === true, subtreeBase: opts.subtreeBase === true });
-  // Through the captured traversal: the names this yields are what a consumer compares an identity
-  // against -- a certificate's subject alternative names against an enrollment's own -- and a
-  // replaced Array.prototype.map could present a name the encoded GeneralNames does not carry.
   function build(m) { return { names: _map(m.items, function (it) { return it.value; }), bytes: m.node.bytes }; }
   if (opts.implicitTag != null) {
     return schema.implicitSeqOf(opts.implicitTag, gn, { min: 1, code: code, what: opts.what || "GeneralNames", build: build });
@@ -822,29 +512,12 @@ function generalNames(ns, opts) {
   return schema.seqOf(gn, { assert: "sequence", min: 1, code: code, what: opts.what || "GeneralNames", build: build });
 }
 
-// DistributionPointName ::= CHOICE { fullName [0] IMPLICIT GeneralNames,
-// nameRelativeToCRLIssuer [1] IMPLICIT RelativeDistinguishedName } (RFC 5280
-// sec. 4.2.1.13). The caller hands the CHOICE node itself: the alternative
-// inside the [0]-tagged distributionPoint field wrapper (a context tag on a
-// CHOICE-typed field is always EXPLICIT, so the wire nests [0]{ [0]|[1] ... }).
-// fullName surfaces each element's raw GeneralName DER as { kind: "fullName",
-// names: [Buffer, ...] }, the byte-exact comparison key the sec. 5.2.5
-// "identical encoding MUST be used" correspondence rule requires;
-// nameRelativeToCRLIssuer surfaces its full [1]-tagged TLV as { kind: "rdn",
-// bytes: Buffer } (byte-identical [1] TLVs are byte-identical RDN fragments).
-// An empty fullName (GeneralNames is SIZE 1..MAX), a malformed element, or any
-// other alternative throws the caller's `code`. Shared by the
-// cRLDistributionPoints / freshestCRL extension decoders and the CRL checker's
-// IssuingDistributionPoint decode, so the two sides of the sec. 6.3.3(b)(2)(i)
-// correspondence comparison cannot drift.
 function distributionPointName(ns, node, code) {
   if (node && node.tagClass === "context" && node.tagNumber === 0) {
     var gns = schema.walk(generalNames(ns, { implicitTag: 0, code: code, what: "DistributionPointName fullName" }), node, ns).result;
     return { kind: "fullName", names: _map(gns.names, function (n) { return n.bytes; }) };
   }
   if (node && node.tagClass === "context" && node.tagNumber === 1) {
-    // In [1] IMPLICIT RelativeDistinguishedName the context tag replaces the
-    // SET tag, so the node's direct children are the AttributeTypeAndValues.
     schema.walk(schema.implicitSetOf(1, attributeTypeAndValue(ns), {
       min: 1, code: code, what: "DistributionPointName nameRelativeToCRLIssuer" }), node, ns);
     return { kind: "rdn", bytes: node.bytes };
@@ -852,20 +525,7 @@ function distributionPointName(ns, node, code) {
   throw ns.E(code, "DistributionPointName must be fullName [0] or nameRelativeToCRLIssuer [1] (RFC 5280 sec. 4.2.1.13)");
 }
 
-// A certificate's keyUsage as the named booleans the shared sec. 4.2.1 decoder produces, or null
-// when the certificate carries no keyUsage extension. An absent extension places no restriction
-// (sec. 4.2.1.3), a distinct answer from "carries one that permits nothing".
-//
-// Declared here because "may this certificate do X" is asked at five boundaries and the answer has
-// to be the same at all of them. keyUsage is a NamedBitList: DER drops its trailing zero bits
-// (X.690 sec. 11.2.2) and sec. 4.2.1.3 requires at least one bit set. A boundary that reads the
-// bits with a plain BIT STRING read applies neither, so the same certificate is authorized there
-// and rejected as malformed by the issuing side and the path validator. One extension gets two
-// readings, and the permissive one decides.
-//
-// `E(code, message, cause)` is the caller's typed error factory, so each boundary keeps its own
-// domain while the RULE stays single-homed.
-var _KU_DECODER = new _WeakMapI();     // one decoder table per namespace, built on first use
+var _KU_DECODER = new _WeakMapI();
 function keyUsageOf(ns, cert, E, code, label) {
   var exts = (cert && cert.extensions) || [];
   var want = ns.oid.byName("keyUsage");
@@ -879,26 +539,6 @@ function keyUsageOf(ns, cert, E, code, label) {
   return null;
 }
 
-// IssuingDistributionPoint ::= SEQUENCE { distributionPoint [0] OPTIONAL,
-// onlyContainsUserCerts [1] DEFAULT FALSE, onlyContainsCACerts [2] DEFAULT FALSE,
-// onlySomeReasons [3] ReasonFlags OPTIONAL, indirectCRL [4] DEFAULT FALSE,
-// onlyContainsAttributeCerts [5] DEFAULT FALSE } (RFC 5280 sec. 5.2.5).
-//
-// It is declared here and not in a consumer because the extension answers the
-// question "which certificates does this CRL speak for", which both the path
-// validator and the standalone CRL verbs act on, and a scope flag read by a hand
-// walk over the raw children is read by the reader's own rules instead of the
-// encoding's. Each flag is an IMPLICIT BOOLEAN, so `implicitBoolean` is what
-// holds it to one content octet of 0x00 or 0xFF (X.690 sec. 11.1); a hand walk
-// testing a content byte reads an EMPTY [4] as absent and a multi-octet one by
-// whichever byte it happens to index, and "absent" is the reading that grants
-// permission to answer. `trailing` supplies the rest of the grammar: strictly
-// ascending tags, each field at most once, nothing outside 0..5.
-//
-// A present DEFAULT-FALSE flag encoding FALSE is well-formed at the leaf but is
-// still an encoding DER forbids (X.690 sec. 11.5 omits the default), so the
-// caller decides what that means for it. It is reported as a value of `false`
-// against a `present` of true, never silently normalized away.
 function issuingDistributionPoint(code) {
   return schema.seq([
     schema.trailing([
@@ -912,28 +552,8 @@ function issuingDistributionPoint(code) {
   ], { assert: "sequence", code: code, what: "IssuingDistributionPoint" });
 }
 
-// certExtensionDecoders(ns) -- the ns-parameterized RFC 5280 sec. 4.2.1 extension
-// VALUE decoders. `x509.parse` surfaces each extension as { oid, name, critical,
-// value } with `value` the raw inner OCTET-STRING content (a Buffer); the path
-// validator and the future complete-extension-set surface need the STRUCTURE
-// inside. Each decoder takes that raw Buffer and returns the decoded value, or
-// throws a typed `<prefix>/bad-*` code, mirroring the CRL's fail-closed
-// `decodeExt` pattern (asn1.decode -> read.* / schema.walk, wrapped). Returns
-// { byOid } keyed by dotted OID so a consumer dispatches by ext.oid. The decoded
-// set spans the RFC 5280 sec. 4.2.1 extensions plus the RFC 3739 sec. 3.2.6 /
-// ETSI EN 319 412-5 qualified-certificate `qcStatements` extension (each known
-// statement decoded, an unknown statementId preserved opaque).
 var _T = asn1.TAGS;
 
-// assertPolicyQualifiers(qNode, fail) -- RFC 5280 sec. 4.2.1.4: a PolicyInformation's
-// policyQualifiers is a non-empty SEQUENCE OF PolicyQualifierInfo, each a SEQUENCE
-// { policyQualifierId OID, qualifier } of exactly two members led by an OID. The
-// structure is validated fail-closed; the qualifier body stays opaque (surfaced
-// raw by the caller). `fail(msg)` throws the caller's typed code. Shared by the
-// certificatePolicies extension decoder and the RFC 5035 ESS SigningCertificate
-// policies field so the same PolicyInformation shape cannot drift between them.
-// `fail(msg, cause?)` throws the caller's typed code, carrying the underlying
-// leaf fault as the error cause when one is available.
 function assertPolicyQualifiers(qNode, fail) {
   if (qNode.tagClass !== "universal" || qNode.tagNumber !== _T.SEQUENCE || !qNode.children || !qNode.children.length) {
     fail("policyQualifiers must be a non-empty SEQUENCE (RFC 5280 sec. 4.2.1.4)");
@@ -946,68 +566,25 @@ function assertPolicyQualifiers(qNode, fail) {
   });
 }
 
-// DisplayText ::= CHOICE { ia5String, visibleString, bmpString, utf8String } each SIZE (1..200)
-// -- RFC 5280 sec. 4.2.1.4. The bound is deliberately not enforced here. That is a normative
-// requirement and not a gap: the same section closes with "While the explicitText has a maximum
-// size of 200 characters, some non-conforming CAs exceed this limit. Therefore, certificate users
-// SHOULD gracefully handle explicitText with more than 200 characters." A decoder IS the certificate
-// user that note addresses, so refusing an over-long notice would violate a SHOULD and reject
-// certificates that are in the wild and otherwise valid. The bound belongs to the two layers that
-// can act on it: an issuer, which must not MINT one, and pki.lint, which reports it as an advisory.
-//
-// Measured in CHARACTERS, not octets: a conforming 200-character UTF8String notice can occupy 800
-// octets, so `.length` (UTF-16 units) or a byte count would misjudge a valid value. Exported so
-// every layer that reports the bound counts it identically instead of keeping its own copy.
 var DISPLAY_TEXT_MAX = 200;
 function displayTextChars(str) { return _arrayFrom(str).length; }
 
 // @internal
-// userNoticeTexts(qualifier) -- the DisplayText values of a decoded UserNotice qualifier, as
-// [{ field, tagNumber, text, chars }] in encounter order. `field` is "explicitText" or
-// "organization" (the NoticeReference member), so a caller that must treat the two alike (the
-// SIZE bound applies to both) and one that must not (only explicitText carries the encoding and
-// normalization rules) can each select correctly.
-//
-// UserNotice ::= SEQUENCE { noticeRef NoticeReference OPTIONAL, explicitText DisplayText OPTIONAL }
-// NoticeReference ::= SEQUENCE { organization DisplayText, noticeNumbers SEQUENCE OF INTEGER }
-// Both members are OPTIONAL and distinguished by tag, so a leading SEQUENCE is the noticeRef and any
-// DisplayText member is the explicitText. Returns [] for a qualifier that is not a UserNotice --
-// this reads an already-decoded node for display and reporting, and is never a validity verdict.
 var _DISPLAY_TEXT_TAGS = null;
 function _isDisplayTextNode(n) {
   if (!_DISPLAY_TEXT_TAGS) {
-    // Indexed by a tag number the encoded value supplies, so it holds no prototype: an inherited
-    // numeric name would make an unregistered universal tag read as a DisplayText alternative.
     _DISPLAY_TEXT_TAGS = _create(null);
     _DISPLAY_TEXT_TAGS[_T.IA5_STRING] = 1; _DISPLAY_TEXT_TAGS[_T.VISIBLE_STRING] = 1;
     _DISPLAY_TEXT_TAGS[_T.BMP_STRING] = 1; _DISPLAY_TEXT_TAGS[_T.UTF8_STRING] = 1;
   }
   return !!n && n.tagClass === "universal" && _DISPLAY_TEXT_TAGS[n.tagNumber] === 1;
 }
-// Decoded through the STRICT reader, which validates each arm against its own declared string type
-// (invalid UTF-8, a high bit in an IA5String, an odd-length or lone-surrogate BMPString all throw).
-// Reading the content bytes directly would repair the value instead: `toString("utf8")` substitutes
-// U+FFFD for invalid sequences and a hand-rolled UCS-2 loop drops a trailing odd octet, so a caller
-// would render or measure text the certificate does not contain. Returns null when the value does
-// not decode, leaving the fallback to the caller.
-// An undecodable value yields an entry whose `text` and `chars` are null but whose `field` and
-// `tagNumber` are still present. The two are separable facts: which ASN.1 string type was used is
-// established by the tag alone, so a rule about the ENCODING stays answerable even when the contents
-// do not decode, while every rule that reads the TEXT must skip the entry and not analyze a
-// repair. Collapsing both into "not analyzable" would let a prohibited encoding escape its finding
-// by also being malformed inside.
 function _dtEntry(field, node) {
   var text;
   // allow:swallow-unverified an undecodable DisplayText keeps its tag and drops its text; the callers branch on text === null
   try { text = asn1.read.string(node); } catch (_e) { text = null; }
   return { field: field, tagNumber: node.tagNumber, text: text, chars: text === null ? null : displayTextChars(text) };
 }
-// A NoticeReference names its notice by ORGANIZATION **and** NUMBER. The organization alone does not
-// identify which notice is meant, so a consumer that surfaced only the text would lose the lookup key.
-// Returns null when the numbers are absent, wrongly shaped, or contain a member that is not a readable
-// INTEGER: an incompletely decoded reference must not be presentable, because dropping the members that
-// failed would render a partial reference indistinguishable from a whole one. That is the same defect as
-// omitting the numbers entirely, in a form that is harder to notice. Numbers are decimal strings.
 function _noticeNumbers(node) {
   if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children) return null;
   var nums = [], ok = true;
@@ -1017,22 +594,11 @@ function _noticeNumbers(node) {
   });
   return ok ? nums : null;
 }
-// Every DisplayText member is returned, including one whose contents did not decode; that entry
-// carries its tag with a null `text`. A caller that RENDERS the notice must check that every entry
-// decoded before showing any of it (a partial notice is indistinguishable from a complete one); a
-// caller that only classifies the encoding can read the tags regardless.
-// The LAYOUT is validated before any member is read: UserNotice fixes the order (noticeRef first) and
-// the cardinality (each member at most once, nothing else present). Collecting every recognized member
-// and ignoring the rest would accept a duplicated explicitText, a reversed order, or an extra member.
-// The caller can only see whether the entries it got look complete, so it would then present
-// a structurally invalid notice as a whole one. A malformed layout yields NO entries, so a renderer
-// falls back to hex and a reporter measures nothing.
 function userNoticeTexts(qualifier) {
   if (!qualifier || qualifier.tagClass !== "universal" || qualifier.tagNumber !== _T.SEQUENCE || !qualifier.children) return [];
   var kids = qualifier.children;
   if (kids.length > 2) return [];
   var i = 0, out = [];
-  // noticeRef [absent | first]: a SEQUENCE of { organization DisplayText, noticeNumbers }.
   if (i < kids.length && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.SEQUENCE) {
     var nr = kids[i];
     if (!nr.children || nr.children.length !== 2 || !_isDisplayTextNode(nr.children[0])) return [];
@@ -1041,7 +607,6 @@ function userNoticeTexts(qualifier) {
     _push(out, org);
     i++;
   }
-  // explicitText [absent | last]: a DisplayText. Anything else remaining is not a UserNotice member.
   if (i < kids.length) {
     if (!_isDisplayTextNode(kids[i])) return [];
     _push(out, _dtEntry("explicitText", kids[i]));
@@ -1050,9 +615,6 @@ function userNoticeTexts(qualifier) {
   return i === kids.length ? out : [];
 }
 
-// Shared imperative decode helpers for the certExtensionDecoders + attrValueDecoders factories. Both
-// take the caller's ns, so the helpers close over ns.E / ns.oid; extracted once so the two factories
-// share one copy (a per-OID value-decoder body is the identical idiom to a per-OID extension body).
 function _decodeHelpers(ns) {
   function decodeTop(buf, code, what) {
     var n;
@@ -1071,8 +633,6 @@ function _decodeHelpers(ns) {
     try { return asn1.read.integer(node); }
     catch (e) { throw ns.E(code, what + " must be an INTEGER", e); }
   }
-  // Resolve a registered OID name -> dotted string, throwing at module load on a typo (a decoder keyed
-  // by an unresolved name would silently never match, treating a real extension/attribute as opaque).
   function O(nm) {
     var d = ns.oid.byName(nm);
     if (typeof d !== "string") throw new TypeError("pki.schema.pkix: " + _stringify(nm) + " is not a registered OID name");
@@ -1085,7 +645,6 @@ function certExtensionDecoders(ns) {
   var GN_SUBTREE = generalName(ns, { decodeValue: true, subtreeBase: true, code: ns.prefix + "/bad-name-constraints" });
   var _h = _decodeHelpers(ns), decodeTop = _h.decodeTop, seqChildren = _h.seqChildren, readInt = _h.readInt, O = _h.O;
 
-  // basicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLen INTEGER (0..MAX) OPTIONAL }
   function basicConstraints(buf) {
     var C = ns.prefix + "/bad-basic-constraints";
     var kids = seqChildren(buf, C, "BasicConstraints");
@@ -1099,16 +658,12 @@ function certExtensionDecoders(ns) {
     if (kids[i] && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.INTEGER) {
       if (!cA) throw ns.E(C, "BasicConstraints pathLenConstraint is only permitted when cA is TRUE (RFC 5280 sec. 4.2.1.9)");
       var pl = readInt(kids[i], C, "pathLenConstraint");
-      // guard.range.uint31 bounds the decoded BigInt and narrows atomically. A
-      // value past the safe-integer range would otherwise round silently and be
-      // compared as a path-length ceiling.
       pathLen = guard.range.uint31(pl, ns.E, C, "BasicConstraints pathLenConstraint (RFC 5280 sec. 4.2.1.9)"); i++;
     }
     if (i !== kids.length) throw ns.E(C, "BasicConstraints has unexpected trailing fields");
     return { cA: cA, pathLenConstraint: pathLen };
   }
 
-  // keyUsage ::= BIT STRING (named bits). At least one bit MUST be set.
   var KU_BITS = ["digitalSignature", "nonRepudiation", "keyEncipherment", "dataEncipherment",
     "keyAgreement", "keyCertSign", "cRLSign", "encipherOnly", "decipherOnly"];
   function keyUsage(buf) {
@@ -1117,21 +672,15 @@ function certExtensionDecoders(ns) {
     if (n.tagClass !== "universal" || n.tagNumber !== _T.BIT_STRING) throw ns.E(C, "KeyUsage must be a BIT STRING (RFC 5280 sec. 4.2.1.3)");
     var bs;
     try { bs = asn1.read.bitString(n); } catch (e) { throw ns.E(C, "KeyUsage must be a well-formed BIT STRING", e); }
-    // At least one bit MUST be set (RFC 5280 sec. 4.2.1.3), so an all-zero value (a
-    // non-empty byte run of only zero bits, e.g. 03 02 07 00) is malformed too.
     var anyBit = false;
     for (var z = 0; z < bs.bytes.length; z++) { if (bs.bytes[z] !== 0) { anyBit = true; break; } }
     if (!anyBit) throw ns.E(C, "KeyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
-    // KeyUsage is a NamedBitList -- enforce the shared X.690 sec. 11.2.2 minimal-DER rule.
     schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw ns.E(C, m); });
     var out = {};
     _forEach(KU_BITS, function (nm, bit) {
       var byte = bit >> 3, mask = 0x80 >> (bit & 7);
       out[nm] = byte < bs.bytes.length && (bs.bytes[byte] & mask) !== 0;
     });
-    // Any bit beyond the 9 named positions is a reserved/unknown usage. RFC 5280 tolerates it,
-    // but a "MUST be the ONLY bit" rule (e.g. RFC 9935 sec. 5 ML-KEM keyEncipherment-only) needs
-    // to see it, so bits >= 9 are surfaced on `reservedBitsSet`.
     var reserved = false;
     for (var bit2 = KU_BITS.length; bit2 < bs.bytes.length * 8 && !reserved; bit2++) {
       if ((bs.bytes[bit2 >> 3] & (0x80 >> (bit2 & 7))) !== 0) reserved = true;
@@ -1140,11 +689,7 @@ function certExtensionDecoders(ns) {
     return out;
   }
 
-  // GeneralSubtree ::= SEQUENCE { base GeneralName, minimum [0] DEFAULT 0, maximum [1] OPTIONAL }
   function subtreeList(node, C) {
-    // node is the [0]/[1] IMPLICIT SEQUENCE OF GeneralSubtree (context-constructed).
-    // GeneralSubtrees is SIZE(1..MAX) -- an explicitly present but empty subtree
-    // list (a0 00) absorbs no constraint and is malformed, not a no-op.
     if (!node.children || node.children.length < 1) throw ns.E(C, "NameConstraints permittedSubtrees/excludedSubtrees must be a non-empty GeneralSubtrees (SIZE 1..MAX, RFC 5280 sec. 4.2.1.10)");
     return _map(node.children, function (st) {
       if (st.tagClass !== "universal" || st.tagNumber !== _T.SEQUENCE || !st.children || st.children.length < 1) {
@@ -1176,18 +721,12 @@ function certExtensionDecoders(ns) {
     return { permittedSubtrees: permitted, excludedSubtrees: excluded };
   }
 
-  // certificatePolicies ::= SEQUENCE SIZE(1..MAX) OF PolicyInformation
   function certificatePolicies(buf) {
     var C = ns.prefix + "/bad-policy";
     var kids = seqChildren(buf, C, "CertificatePolicies");
     if (kids.length < 1) throw ns.E(C, "CertificatePolicies must contain at least one PolicyInformation (RFC 5280 sec. 4.2.1.4)");
-    // The duplicate-policy set answers off a dotted OID the encoded value supplies, so it holds no
-    // prototype: an inherited name would report a policy as already seen and reject a valid one.
     var seen = _create(null);
     return _map(kids, function (pi) {
-      // PolicyInformation ::= SEQUENCE { policyIdentifier, policyQualifiers
-      // SEQUENCE SIZE(1..MAX) OPTIONAL }. Exactly one or two fields; a second
-      // field, if present, MUST be a SEQUENCE. Extra/mis-typed fields are malformed.
       if (pi.tagClass !== "universal" || pi.tagNumber !== _T.SEQUENCE || !pi.children || pi.children.length < 1 || pi.children.length > 2) {
         throw ns.E(C, "PolicyInformation must be a SEQUENCE { policyIdentifier, policyQualifiers? }");
       }
@@ -1198,8 +737,6 @@ function certExtensionDecoders(ns) {
       var qualifiers = null;
       if (pi.children.length > 1) {
         var q = pi.children[1];
-        // PolicyQualifierInfo structure validated by the shared assertion; the
-        // qualifier body stays opaque (surfaced raw).
         assertPolicyQualifiers(q, function (msg, cause) { throw ns.E(C, msg, cause); });
         qualifiers = q.bytes;
       }
@@ -1207,7 +744,6 @@ function certExtensionDecoders(ns) {
     });
   }
 
-  // policyMappings ::= SEQUENCE SIZE(1..MAX) OF SEQUENCE { issuerDomainPolicy, subjectDomainPolicy }
   function policyMappings(buf) {
     var C = ns.prefix + "/bad-policy";
     var kids = seqChildren(buf, C, "PolicyMappings");
@@ -1223,7 +759,6 @@ function certExtensionDecoders(ns) {
     });
   }
 
-  // policyConstraints ::= SEQUENCE { requireExplicitPolicy [0] INTEGER OPT, inhibitPolicyMapping [1] INTEGER OPT }
   function policyConstraints(buf) {
     var C = ns.prefix + "/bad-policy";
     var kids = seqChildren(buf, C, "PolicyConstraints");
@@ -1235,8 +770,6 @@ function certExtensionDecoders(ns) {
       pcLastTag = k.tagNumber;
       var v;
       try { v = asn1.read.integerImplicit(k, k.tagNumber); } catch (e) { throw ns.E(C, "PolicyConstraints field must be an INTEGER", e); }
-      // guard.range.uint31 bounds + narrows atomically (a skip count past the
-      // safe-integer range would round silently).
       var skip = guard.range.uint31(v, ns.E, C, "PolicyConstraints skip count (RFC 5280 sec. 4.2.1.11)");
       if (k.tagNumber === 0) rep = skip;
       else if (k.tagNumber === 1) ipm = skip;
@@ -1245,31 +778,20 @@ function certExtensionDecoders(ns) {
     return { requireExplicitPolicy: rep, inhibitPolicyMapping: ipm };
   }
 
-  // inhibitAnyPolicy ::= INTEGER (0..MAX)
   function inhibitAnyPolicy(buf) {
     var C = ns.prefix + "/bad-policy";
     var n = decodeTop(buf, C, "InhibitAnyPolicy");
     if (n.tagClass !== "universal" || n.tagNumber !== _T.INTEGER) throw ns.E(C, "InhibitAnyPolicy must be an INTEGER (RFC 5280 sec. 4.2.1.14)");
     var v = readInt(n, C, "InhibitAnyPolicy");
-    // guard.range.uint31 bounds + narrows atomically (a skip count past the
-    // safe-integer range would round silently).
     return guard.range.uint31(v, ns.E, C, "InhibitAnyPolicy skip count (RFC 5280 sec. 4.2.1.14)");
   }
 
-  // subjectAltName / issuerAltName ::= GeneralNames, with decoded values surfaced.
   function altName(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var n = decodeTop(buf, C, "GeneralNames");
     return schema.walk(generalNames(ns, { decodeValue: true, code: C }), n, ns).result;
   }
 
-  // authorityInfoAccess ::= AuthorityInfoAccessSyntax ::= SEQUENCE SIZE(1..MAX) OF AccessDescription
-  // (RFC 5280 sec. 4.2.2.1); AccessDescription ::= SEQUENCE { accessMethod OBJECT IDENTIFIER, accessLocation
-  // GeneralName }. Surfaces [{ accessMethod: <dotted OID>, accessLocation: { tag, value } }] in wire order --
-  // accessLocation is the shared generalName leaf (its context tag number + decoded value, so a control-byte
-  // URI is rejected by the CVE-2009-2408 guard). Both accessMethods surface (id-ad-caIssuers AND id-ad-ocsp):
-  // a consumer filters by accessMethod (caIssuers for issuer fetching, ocsp for responder discovery). An empty
-  // SEQUENCE violates SIZE(1..MAX) and is malformed. A composed decoder + registry row, not a hand-roll.
   function authorityInfoAccess(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var descs = seqChildren(buf, C, "AuthorityInfoAccessSyntax");
@@ -1282,12 +804,11 @@ function certExtensionDecoders(ns) {
       var method;
       try { method = asn1.read.oid(d.children[0]); }
       catch (e) { throw ns.E(C, "AccessDescription accessMethod must be an OBJECT IDENTIFIER", e); }
-      var loc = schema.walk(GN, d.children[1], ns);   // a decode leaf returns its value directly (no .result wrapper)
+      var loc = schema.walk(GN, d.children[1], ns);
       return { accessMethod: method, accessLocation: { tag: loc.tagNumber, value: loc.value } };
     });
   }
 
-  // extKeyUsage ::= SEQUENCE SIZE(1..MAX) OF KeyPurposeId (OID)
   function extKeyUsage(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var kids = seqChildren(buf, C, "ExtKeyUsage");
@@ -1297,7 +818,6 @@ function certExtensionDecoders(ns) {
     });
   }
 
-  // authorityKeyIdentifier ::= SEQUENCE { keyIdentifier [0] OPT, authorityCertIssuer [1] OPT, authorityCertSerialNumber [2] OPT }
   function authorityKeyIdentifier(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var kids = seqChildren(buf, C, "AuthorityKeyIdentifier");
@@ -1305,13 +825,8 @@ function certExtensionDecoders(ns) {
     var lastTag = -1;
     _forEach(kids, function (k) {
       if (k.tagClass !== "context") throw ns.E(C, "AuthorityKeyIdentifier fields are context-tagged");
-      // DER: the OPTIONAL fields appear at most once and in ascending tag order.
       if (k.tagNumber <= lastTag) throw ns.E(C, "AuthorityKeyIdentifier fields must be unique and in ascending order (DER)");
       lastTag = k.tagNumber;
-      // keyIdentifier [0] IMPLICIT OCTET STRING and authorityCertSerialNumber
-      // [2] IMPLICIT INTEGER are primitive leaves; the readers enforce the
-      // primitive form fail-closed (a constructed context node is rejected,
-      // never dereferenced for its absent content).
       if (k.tagNumber === 0) { try { out.keyIdentifier = _bufferFrom(asn1.read.octetStringImplicit(k, 0)); } catch (e) { throw ns.E(C, "AuthorityKeyIdentifier keyIdentifier [0] must be an IMPLICIT OCTET STRING", e); } }
       else if (k.tagNumber === 1) out.authorityCertIssuer = schema.walk(generalNames(ns, { implicitTag: 1, decodeValue: true, code: C }), k, ns).result;
       else if (k.tagNumber === 2) { try { out.authorityCertSerialNumber = asn1.read.integerImplicit(k, 2); } catch (e) { throw ns.E(C, "authorityCertSerialNumber must be an INTEGER", e); } }
@@ -1323,7 +838,6 @@ function certExtensionDecoders(ns) {
     return out;
   }
 
-  // subjectKeyIdentifier ::= OCTET STRING
   function subjectKeyIdentifier(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var n = decodeTop(buf, C, "SubjectKeyIdentifier");
@@ -1331,21 +845,12 @@ function certExtensionDecoders(ns) {
     catch (e) { throw ns.E(C, "SubjectKeyIdentifier must be an OCTET STRING (RFC 5280 sec. 4.2.1.2)", e); }
   }
 
-  // signedCertificateTimestampList (RFC 6962 sec. 3.3) -- the extension value is a DER
-  // OCTET STRING wrapping the TLS-encoded SCT list. Delegated to the CT module,
-  // which owns the inner peel + the bounded TLS decode; structure is decoded, the
-  // signature stays raw and unverified. The registry contract is that a decoder
-  // throws a `<prefix>/bad-*` code, so the CT module's own `ct/*` fault is wrapped
-  // and carried as `.cause`, so a foreign namespace never leaks out here.
   function sctList(buf) {
     var C = ns.prefix + "/bad-extension-value";
     try { return ct.parseSctList(buf); }
     catch (e) { throw ns.E(C, "malformed signedCertificateTimestampList extension value (RFC 6962 sec. 3.3)", e); }
   }
 
-  // precertificatePoison (RFC 6962 sec. 3.1) -- a critical extension whose value is
-  // exactly ASN.1 NULL (05 00), the marker distinguishing a precertificate from
-  // a final certificate. Content-validated, not merely tag-checked.
   function precertPoison(buf) {
     var C = ns.prefix + "/bad-extension-value";
     var n = decodeTop(buf, C, "PrecertificatePoison");
@@ -1354,18 +859,6 @@ function certExtensionDecoders(ns) {
     return { poison: true };
   }
 
-  // cRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
-  // (RFC 5280 sec. 4.2.1.13); DistributionPoint ::= SEQUENCE {
-  // distributionPoint [0] DistributionPointName OPTIONAL, reasons [1]
-  // ReasonFlags OPTIONAL, cRLIssuer [2] GeneralNames OPTIONAL }. "a
-  // DistributionPoint MUST NOT consist of only the reasons field; either
-  // distributionPoint or cRLIssuer MUST be present". A reasons-only (or
-  // empty) DistributionPoint is malformed. The DistributionPointName is
-  // surfaced through the shared helper (raw name encodings, the sec. 5.2.5
-  // correspondence key); `reasons` stays a raw BIT STRING ({ unusedBits,
-  // bytes }); cRLIssuer is a validated GeneralNames with decoded values.
-  // FreshestCRL ::= CRLDistributionPoints (sec. 4.2.1.15), so the same decoder
-  // serves both OIDs: one codec, both registry rows.
   function crlDistributionPoints(buf) {
     var C = ns.prefix + "/bad-crl-distribution-points";
     var kids = seqChildren(buf, C, "CRLDistributionPoints");
@@ -1381,18 +874,12 @@ function certExtensionDecoders(ns) {
         if (f.tagNumber <= lastTag) throw ns.E(C, "DistributionPoint fields must be unique and in ascending order (DER)");
         lastTag = f.tagNumber;
         if (f.tagNumber === 0) {
-          // distributionPoint [0] EXPLICIT-wraps the DistributionPointName CHOICE.
           if (!f.children || f.children.length !== 1) throw ns.E(C, "DistributionPoint distributionPoint [0] must wrap exactly one DistributionPointName");
           out.distributionPoint = distributionPointName(ns, f.children[0], C);
         } else if (f.tagNumber === 1) {
           var bs;
           try { bs = asn1.read.bitStringImplicit(f, 1); }
           catch (e) { throw ns.E(C, "DistributionPoint reasons [1] must be an IMPLICIT ReasonFlags BIT STRING", e); }
-          // ReasonFlags is a NamedBitList, so DER requires trailing zero bits be
-          // dropped (X.690 sec. 11.2.2), the same rule the keyUsage decoder
-          // enforces above. Without it two different encodings of one reason set
-          // both parse, and RFC 5280 sec. 6.3.3(d)(1) would intersect the CRL's
-          // onlySomeReasons against a value the encoding rules forbid.
           schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (msg) { throw ns.E(C, "DistributionPoint reasons: " + msg); });
           out.reasons = { unusedBits: bs.unusedBits, bytes: bs.bytes };
         } else if (f.tagNumber === 2) {
@@ -1408,15 +895,11 @@ function certExtensionDecoders(ns) {
     });
   }
 
-  // qcStatements ::= SEQUENCE OF QCStatement (RFC 3739 sec. 3.2.6). QCStatement ::= SEQUENCE {
-  // statementId OBJECT IDENTIFIER, statementInfo ANY DEFINED BY statementId OPTIONAL }. Known statementIds
-  // (RFC 3739 id-qcs + the ETSI EN 319 412-5 esi4 catalogue) decode their statementInfo; an unknown statementId
-  // is preserved OPAQUE (the RFC 3739 open type), never rejected. The DEFINED-BY selection is an OID re-dispatch.
   function _qcStr(node, tag, C, what) {
     if (!node || node.tagClass !== "universal" || node.tagNumber !== tag) throw ns.E(C, what);
     try { return asn1.read.string(node); } catch (e) { throw ns.E(C, what, e); }
   }
-  function _qcOidSeq(node, C, what) {   // a non-empty SEQUENCE OF OBJECT IDENTIFIER
+  function _qcOidSeq(node, C, what) {
     if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, what + " must be a non-empty SEQUENCE OF OBJECT IDENTIFIER");
     return _map(node.children, function (c) {
       if (c.tagClass !== "universal" || c.tagNumber !== _T.OBJECT_IDENTIFIER) throw ns.E(C, what + " members must be OBJECT IDENTIFIERs");
@@ -1424,8 +907,8 @@ function certExtensionDecoders(ns) {
     });
   }
   function _qcPresenceOnly(nm) { return function (node, C) { if (node) throw ns.E(C, nm + " carries no statementInfo (ETSI EN 319 412-5)"); return null; }; }
-  function _qcSemantics(node, C) {   // SemanticsInformation, WITH COMPONENTS at least one field present
-    if (node === null) return null;   // statementInfo OPTIONAL for id-qcs syntax statements
+  function _qcSemantics(node, C) {
+    if (node === null) return null;
     if (node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "SemanticsInformation must be a SEQUENCE with at least one field (RFC 3739 sec. 3.2.6.1)");
     var sid = null, i = 0;
     if (node.children[0].tagClass === "universal" && node.children[0].tagNumber === _T.OBJECT_IDENTIFIER) {
@@ -1434,36 +917,29 @@ function certExtensionDecoders(ns) {
     }
     var nras = [];
     if (node.children[i]) {
-      // nameRegistrationAuthorities ::= SEQUENCE SIZE (1..MAX) OF GeneralName. Decode and fully validate
-      // each element through the shared GeneralName decoder (context tag [0]..[8] + per-alternative
-      // structure); arbitrary bytes never surface as a name-registration authority.
       nras = schema.walk(generalNames(ns, { decodeValue: true, code: C }), node.children[i], ns).result.names;
       i++;
     }
     if (i !== node.children.length) throw ns.E(C, "SemanticsInformation has unexpected trailing fields");
     return { semanticsIdentifier: sid, nameRegistrationAuthorities: nras };
   }
-  // The per-statement decoder table answers off a dotted OID the encoded value supplies, so it holds
-  // no prototype: an inherited name would hand a statement a decoder nothing registered.
   var qcInfoByOid = _create(null);
   qcInfoByOid[O("qcCompliance")] = _qcPresenceOnly("QcCompliance");
   qcInfoByOid[O("qcSSCD")] = _qcPresenceOnly("QcSSCD");
   qcInfoByOid[O("qcsPkixQCSyntaxV1")] = _qcSemantics;
   qcInfoByOid[O("qcsPkixQCSyntaxV2")] = _qcSemantics;
   qcInfoByOid[O("qcType")] = function (node, C) {
-    var oids = _qcOidSeq(node, C, "QcType");   // SIZE(1) in EN 319 412-5 V2.5.1; accept >=1 for legacy certs
+    var oids = _qcOidSeq(node, C, "QcType");
     return { types: oids, typeNames: _map(oids, function (d) { return ns.oid.name(d) || null; }) };
   };
   qcInfoByOid[O("qcRetentionPeriod")] = function (node, C) {
     if (!node) throw ns.E(C, "QcRetentionPeriod requires an INTEGER statementInfo");
     return { years: guard.range.uint31(readInt(node, C, "QcRetentionPeriod"), ns.E, C, "QcRetentionPeriod (years)") };
   };
-  qcInfoByOid[O("qcLimitValue")] = function (node, C) {   // MonetaryValue ::= SEQUENCE { currency, amount, exponent }
+  qcInfoByOid[O("qcLimitValue")] = function (node, C) {
     if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || node.children.length !== 3) throw ns.E(C, "QcLimitValue must be a MonetaryValue SEQUENCE { currency, amount, exponent }");
     var cur = node.children[0], currency;
     if (cur.tagClass === "universal" && cur.tagNumber === _T.PRINTABLE_STRING) {
-      // Route through _qcStr so a disallowed PrintableString byte surfaces the decoder's typed
-      // bad-qc-statement error, not a leaked asn1/bad-printable-string from the raw leaf read.
       currency = _qcStr(cur, _T.PRINTABLE_STRING, C, "QcLimitValue alphabetic currency must be a PrintableString");
       if (currency.length !== 3) throw ns.E(C, "QcLimitValue alphabetic currency must be a 3-letter ISO 4217 code");
     } else if (cur.tagClass === "universal" && cur.tagNumber === _T.INTEGER) {
@@ -1471,19 +947,15 @@ function certExtensionDecoders(ns) {
     } else throw ns.E(C, "QcLimitValue currency must be a PrintableString(3) or INTEGER(1..999)");
     return {
       currency: currency,
-      // MonetaryValue amount and exponent are unconstrained INTEGERs (the amount non-negative in practice);
-      // bound each only to the safe-integer range so it narrows to a Number losslessly. An artificial
-      // tighter bound (uint31, or a small exponent window) would false-reject a valid MonetaryValue, and a
-      // wider one would round silently and mis-state the limit.
       amount: guard.range.int(readInt(node.children[1], C, "QcLimitValue amount"), 0n, 9007199254740991n, ns.E, C, "QcLimitValue amount"),
       exponent: guard.range.int(readInt(node.children[2], C, "QcLimitValue exponent"), -9007199254740991n, 9007199254740991n, ns.E, C, "QcLimitValue exponent"),
     };
   };
-  qcInfoByOid[O("qcCClegislation")] = function (node, C) {   // SEQUENCE OF CountryName (PrintableString SIZE 2)
+  qcInfoByOid[O("qcCClegislation")] = function (node, C) {
     if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "QcCClegislation must be a non-empty SEQUENCE OF CountryName");
     return { countries: _map(node.children, function (c) { var v = _qcStr(c, _T.PRINTABLE_STRING, C, "QcCClegislation CountryName must be a PrintableString"); if (v.length !== 2) throw ns.E(C, "QcCClegislation CountryName must be a 2-letter ISO 3166-1 code"); return v; }) };
   };
-  qcInfoByOid[O("qcPDS")] = function (node, C) {   // PdsLocations ::= SEQUENCE OF PdsLocation { url IA5, language Printable(2) }
+  qcInfoByOid[O("qcPDS")] = function (node, C) {
     if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "QcPDS must be a non-empty SEQUENCE OF PdsLocation");
     return { locations: _map(node.children, function (loc) {
       if (loc.tagClass !== "universal" || loc.tagNumber !== _T.SEQUENCE || !loc.children || loc.children.length !== 2) throw ns.E(C, "a QcPDS PdsLocation must be a SEQUENCE { url, language }");
@@ -1492,8 +964,6 @@ function certExtensionDecoders(ns) {
       return { url: _qcStr(loc.children[0], _T.IA5_STRING, C, "a QcPDS url must be an IA5String"), language: lang };
     }) };
   };
-  // ETSI EN 319 412-5 V2.5.1 additions: QcIdentMethod (SEQUENCE OF OID, like QcType) and
-  // QcQSCDlegislation (SEQUENCE OF CountryName, like QcCClegislation). Both are registered ids, decoded.
   qcInfoByOid[O("qcIdentMethod")] = function (node, C) {
     var oids = _qcOidSeq(node, C, "QcIdentMethod");
     return { methods: oids, methodNames: _map(oids, function (d) { return ns.oid.name(d) || null; }) };
@@ -1506,7 +976,7 @@ function certExtensionDecoders(ns) {
     var C = ns.prefix + "/bad-qc-statements", CS = ns.prefix + "/bad-qc-statement";
     var kids = seqChildren(buf, C, "QCStatements");
     if (!kids.length) throw ns.E(C, "QCStatements must contain at least one QCStatement (RFC 3739 sec. 3.2.6)");
-    var out = [];   // QCStatements ::= SEQUENCE OF QCStatement -- RFC 3739 imposes no statementId uniqueness; decode every statement in wire order (a linter may flag a repeat, the decoder must not drop it)
+    var out = [];
     for (var i = 0; i < kids.length; i++) {
       var st = kids[i];
       if (st.tagClass !== "universal" || st.tagNumber !== _T.SEQUENCE || !st.children || st.children.length < 1 || st.children.length > 2) {
@@ -1522,10 +992,6 @@ function certExtensionDecoders(ns) {
     return out;
   }
 
-  // [MS-WCCE] szOID-CERTIFICATE_TEMPLATE. CertificateTemplateOID ::= SEQUENCE {
-  //   templateID OID, templateMajorVersion INTEGER OPTIONAL, templateMinorVersion INTEGER OPTIONAL }.
-  // The two versions are DWORDs (0..2^32-1) and not uint31: a CA key/template revision with bit 31
-  // set is a legal DWORD, so bound to the whole safe-integer range, never guard.range.uint31.
   function msCertificateTemplate(buf) {
     var C = ns.prefix + "/bad-ms-certificate-template";
     var kids = seqChildren(buf, C, "CertificateTemplate");
@@ -1541,8 +1007,6 @@ function certExtensionDecoders(ns) {
     return { templateID: id, name: ns.oid.name(id) || null, templateMajorVersion: ver(1, "templateMajorVersion"), templateMinorVersion: ver(2, "templateMinorVersion") };
   }
 
-  // [MS-CRTD] szOID-ENROLL_CERTTYPE_EXTENSION carries the legacy v1 template name as a BARE BMPString.
-  // asn1.read.string accepts any universal string tag, so the explicit BMP_STRING assert is the guard.
   function msEnrollCertType(buf) {
     var C = ns.prefix + "/bad-ms-enroll-cert-type";
     var n = decodeTop(buf, C, "EnrollCertType");
@@ -1550,7 +1014,6 @@ function certExtensionDecoders(ns) {
     try { return asn1.read.string(n); } catch (e) { throw ns.E(C, "the enroll cert-type name must be a well-formed BMPString", e); }
   }
 
-  // [MS-WCCE] szOID-CERTSRV_CA_VERSION is an INTEGER (0..2^32-1) = (caKeyIndex << 16) | certIndex.
   function msCaVersion(buf) {
     var C = ns.prefix + "/bad-ms-ca-version";
     var n = decodeTop(buf, C, "CACertVersion");
@@ -1559,10 +1022,6 @@ function certExtensionDecoders(ns) {
     return { caVersion: v, caKeyIndex: v >>> 16, certIndex: v & 0xffff };
   }
 
-  // [MS-WCCE] szOID-CERTSRV_PREVIOUS_CERT_HASH holds the SHA-1 thumbprint of the prior CA certificate.
-  // AD CS stamps the Windows certificate THUMBPRINT here, which Windows computes with SHA-1 regardless
-  // of the certificate's signature algorithm, so the OCTET STRING is exactly 20 octets. An empty or
-  // other-length value is malformed renewal metadata and fails closed.
   function msPreviousCertHash(buf) {
     var C = ns.prefix + "/bad-ms-previous-cert-hash";
     var n = decodeTop(buf, C, "CAPrevCertHash");
@@ -1573,9 +1032,6 @@ function certExtensionDecoders(ns) {
     return hash;
   }
 
-  // The extension-decoder registry every consumer indexes with an OID read off the wire
-  // (path validation, inspection, the ACME certificate binding), so it holds no prototype: a
-  // planted dotted name would otherwise hand an extension a decoder nothing registered.
   var byOid = _create(null);
   byOid[O("qcStatements")] = qcStatements;
   byOid[O("basicConstraints")] = basicConstraints;
@@ -1599,21 +1055,12 @@ function certExtensionDecoders(ns) {
   byOid[O("msEnrollCertType")] = msEnrollCertType;
   byOid[O("msCaVersion")] = msCaVersion;
   byOid[O("msPreviousCertHash")] = msPreviousCertHash;
-  byOid[O("msApplicationPolicies")] = certificatePolicies;   // [MS-WCCE] = RFC 5280 certificatePolicies, reused not re-implemented
+  byOid[O("msApplicationPolicies")] = certificatePolicies;
   return { byOid: byOid };
 }
 
-// Extension ::= SEQUENCE { extnID OID, critical BOOLEAN DEFAULT FALSE,
-// extnValue OCTET STRING }. `critical` is a universal BOOLEAN present-by-count
-// (not context-tagged), so the per-extension decode handles the 2-vs-3-child
-// shape directly; the seqOf centralizes the SEQUENCE / SIZE(1..MAX) assertion
-// and the RFC 5280 sec. 4.2 per-OID uniqueness.
 function extension(ns) {
   return schema.decode(function (ext) {
-    // Extension ::= SEQUENCE { extnID, critical DEFAULT FALSE, extnValue } is a
-    // UNIVERSAL SEQUENCE of exactly 2 (critical omitted) or 3 children. A
-    // context-tagged item (e.g. [5]{OID, OCTET STRING}) or a wrong child count
-    // is malformed; assert the tag, don't just count children (fail closed).
     if (!ext.children || ext.tagClass !== "universal" || ext.tagNumber !== asn1.TAGS.SEQUENCE ||
         ext.children.length < 2 || ext.children.length > 3) {
       throw ns.E(ns.prefix + "/bad-extension", "Extension must be a SEQUENCE of {extnID, critical?, extnValue}");
@@ -1622,8 +1069,6 @@ function extension(ns) {
     var critical = false, valueNode;
     if (ext.children.length === 3) {
       critical = asn1.read.boolean(ext.children[1]);
-      // critical is BOOLEAN DEFAULT FALSE -- DER omits the field when false, so an
-      // explicitly-encoded FALSE is a non-canonical form; reject it fail-closed.
       if (critical === false) throw ns.E(ns.prefix + "/bad-extension", "an explicit critical FALSE must be omitted (BOOLEAN DEFAULT FALSE)");
       valueNode = ext.children[2];
     } else {
@@ -1632,10 +1077,6 @@ function extension(ns) {
     return { oid: extnID, name: ns.oid.name(extnID) || null, critical: critical, value: asn1.read.octetString(valueNode) };
   });
 }
-// opts.implicitTag (optional): read Extensions as a [tag] IMPLICIT SEQUENCE OF
-// Extension, where the context tag REPLACES the universal SEQUENCE tag, for the CRMF
-// CertTemplate extensions [9] (RFC 4211 sec. 5). With no opts the shape is a bare
-// universal SEQUENCE OF, byte-identical to every existing caller.
 function extensions(ns, opts) {
   opts = opts || {};
   var EXT = extension(ns);
@@ -1648,15 +1089,6 @@ function extensions(ns, opts) {
   return schema.seqOf(EXT, _assign({ assert: "sequence" }, extOpts));
 }
 
-// SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier,
-// subjectPublicKey BIT STRING } (RFC 5280 sec. 4.1.2.7, RFC 2986 sec. 4.1). Asserted as a
-// universal SEQUENCE, so a context-tagged or SET-tagged constructed node carrying
-// two well-formed children is not a SubjectPublicKeyInfo. Shared by the
-// certificate and CSR parsers.
-// opts.implicitTag (optional): read the SubjectPublicKeyInfo as a [tag] IMPLICIT
-// SEQUENCE (a context-class constructed node whose children are algorithm +
-// subjectPublicKey), for the CRMF CertTemplate publicKey [6] (RFC 4211 sec. 5). With no
-// opts the shape is a universal SEQUENCE, byte-identical to every existing caller.
 function spki(ns, opts) {
   opts = opts || {};
   return schema.seq([
@@ -1669,22 +1101,12 @@ function spki(ns, opts) {
       return {
         algorithm: m.fields.algorithm.value.result,
         publicKey: { unusedBits: m.fields.subjectPublicKey.value.unusedBits, bytes: m.fields.subjectPublicKey.value.bytes },
-        // `bytes` is the importable SubjectPublicKeyInfo DER. In IMPLICIT [tag]
-        // mode the wire node leads with the context tag, so recover the SEQUENCE
-        // encoding a consumer imports / hashes, and not the [tag] wire form.
         bytes: opts.implicitTag != null ? asn1.sequenceTlv(m.node) : m.node.bytes,
       };
     },
   });
 }
 
-// Attribute ::= SEQUENCE { type OBJECT IDENTIFIER, values SET OF AttributeValue }.
-// AttributeValue is ANY, kept as raw DER (node.bytes), so an unrecognized attribute
-// type never fails the parse. values is SET SIZE (1..MAX) by default: an empty SET
-// is rejected; there is NO SET-OF uniqueness. Shared by the CSR (requested
-// attributes, RFC 2986 sec. 4.1) and PKCS#8 (private-key attributes, RFC 5958 sec. 2).
-// opts.minValues (default 1) lowers the floor to 0 for the EST CsrAttrs key-type
-// hints, whose empty values SET means "any key of this type" (RFC 9908 sec. 3.2).
 function attribute(ns, opts) {
   opts = opts || {};
   var minValues = opts.minValues === undefined ? 1 : opts.minValues;
@@ -1705,14 +1127,6 @@ function attribute(ns, opts) {
   });
 }
 
-// Certificate, CertificateList, and CertificationRequest share one outer shape:
-// SEQUENCE { toBeSigned SEQUENCE, signatureAlgorithm, signatureValue }. This
-// returns the first element (the to-be-signed info) when `root` is that
-// SEQUENCE-of-exactly-3 whose first child is itself a constructed universal
-// SEQUENCE, or null otherwise. Every format's `matches` detector shares this
-// preamble, so the signed-envelope shape is recognized in one place and the three
-// detectors cannot drift on it (the CRL detector historically omitted the
-// tbs-is-universal check this recovers).
 function signedEnvelopeTbs(root) {
   if (!schema.isUniversal(root, asn1.TAGS.SEQUENCE)) return null;
   if (!root.children || root.children.length !== 3) return null;
@@ -1721,10 +1135,6 @@ function signedEnvelopeTbs(root) {
   return tbs;
 }
 
-// rootSequenceChildren(root, minLen, maxLen) -- the shared root-shape guard the
-// format matches() detectors re-inline: returns root.children when root is a
-// NON-EMPTY universal SEQUENCE whose child count is within [minLen, maxLen]
-// (maxLen optional/Infinity), else null. Sibling of signedEnvelopeTbs.
 function rootSequenceChildren(root, minLen, maxLen) {
   if (!schema.isUniversal(root, asn1.TAGS.SEQUENCE) || !root.children) return null;
   var n = root.children.length;
@@ -1733,49 +1143,15 @@ function rootSequenceChildren(root, minLen, maxLen) {
   return root.children;
 }
 
-// Every format's `parse` is the shared runParse bound to that format's identity
-// (PEM label, error class, error-code prefix, top-level schema). This returns the
-// bound parser so a format declares its configuration once and never re-writes the
-// coerce -> decode -> walk wrapper. `opts`: { pemLabel, PemError, ErrorClass,
-// prefix, what, topSchema, ns }.
-// The top-level schema's reject code, the verdict for a DER that is not this
-// structure at all, is `<prefix>/not-a-<structure>` (x509/not-a-certificate,
-// cms/not-a-content-info, ...). Three codes predate that convention and stay
-// frozen on the public error-code surface (ocsp/bad-ocsp-response,
-// tsp/bad-response, crmf/bad-cert-req-messages); a new format follows the
-// not-a-* form, never those precedents.
 function makeParser(opts) {
   return function (input) { return runParse(input, opts); };
 }
 
-// makeRecordingParser(opts, kind) -> a parser that also records the bytes it read.
-//
-// The pairing lives here and is not repeated per format, because it is one decision, not four: a
-// structure whose parse feeds a VERDICT needs its fields bound to the byte string they came from,
-// since a parsed structure presents the signed range, the signature and the fields that range
-// encodes as separate properties, and a caller can hand back a genuine range beside substituted
-// fields. `kind` is the tag the matching door re-derives under, so a certificate cannot be presented
-// where a CRL is expected. The record lives in guard-parsed, off the object, unreachable through it.
 function makeRecordingParser(opts, kind) {
   return guard.parsed.recordingParser(kind, makeParser(opts), opts.ErrorClass,
     opts.prefix + "/bad-input", "a " + opts.what);
 }
 
-// The X.509 SIGNED{ToBeSigned} macro (RFC 5280 sec. 4.1.1.3): the outer
-// SEQUENCE { toBeSigned, signatureAlgorithm AlgorithmIdentifier,
-// signatureValue BIT STRING } shared by Certificate, CertificateList and
-// CertificationRequest. `tbsSchema` parses the first element; the SEQUENCE-of-3
-// shape, the arity, the signature extraction and the raw tbs / outer-signature
-// bytes (for the cert/CRL outer==inner agreement check) are owned here once, and
-// each format's `opts.build(envelope, ctx)` shapes its own object from the
-// envelope. A CSR's build simply omits the agreement check, since its CRI has no inner
-// signature AlgorithmIdentifier. The omission is structural, not a copy that
-// forgot a guard.
-// signatureValue is surfaced raw as { unusedBits, bytes }: for the envelope
-// family, octet alignment is a verify-layer rule (path-validate rejects
-// unusedBits != 0 for certification paths; an external verifier must do the
-// same). A format with no in-tree verify layer (OCSP, CMP protection, CRMF
-// POP) instead enforces alignment at parse.
 function signedEnvelope(ns, tbsSchema, opts) {
   return schema.seq([
     schema.field("toBeSigned", tbsSchema),
@@ -1787,8 +1163,8 @@ function signedEnvelope(ns, tbsSchema, opts) {
       var tbsMatch = m.fields.toBeSigned.value;
       var sigBits = m.fields.signatureValue.value;
       return opts.build({
-        tbsMatch: tbsMatch,                                    // raw seq-match: .fields.* / .result / .node
-        tbsBytes: tbsMatch.node.bytes,                         // the exact signed region
+        tbsMatch: tbsMatch,
+        tbsBytes: tbsMatch.node.bytes,
         outerSignatureAlgorithmBytes: m.fields.signatureAlgorithm.node.bytes,
         signatureAlgorithm: m.fields.signatureAlgorithm.value.result,
         signatureValue: { unusedBits: sigBits.unusedBits, bytes: sigBits.bytes },
@@ -1797,13 +1173,6 @@ function signedEnvelope(ns, tbsSchema, opts) {
   });
 }
 
-// dNSName syntax (RFC 5280 sec. 4.2.1.6 / RFC 1034 preferred name syntax, a representative CABF check): no
-// whitespace, no leading/trailing dot, no empty label, no underscore, LDH labels (1-63 octets, no leading /
-// trailing hyphen), <= 253 octets, an optional leftmost "*" wildcard. Returns a reason string, or null when
-// well-formed. The shared home so the linter AND an identity comparator (case-fold only a valid dNSName) agree.
-// One LDH label (RFC 1034 preferred syntax), decided character by character: every character an
-// ASCII letter/digit/hyphen, and a hyphen neither first nor last. The caller has already rejected
-// any label carrying a dot, whitespace, or underscore, so only the LDH shape remains to check.
 function _isLdhLabel(s) {
   var n = s.length;
   if (n === 0) return false;
@@ -1841,12 +1210,12 @@ module.exports = {
   pemDecodeAll: pemDecodeAll,
   pemDecodeLenient: pemDecodeLenient,
   pemEncode: pemEncode,
-  isJsWhitespace: _isJsWhitespace,   // the shared JS regex \s code-point predicate for char-scan parsers
-  stripBase64Whitespace: _stripB64Whitespace,   // shared CR/LF/TAB/SP strip for base64 bodies (PEM, MIME)
-  charTable: _charTable,   // build a code-point membership table from a string of allowed characters
-  allCharsIn: _allCharsIn,   // is a NON-EMPTY string composed only of table members (the /^[chars]+$/ family)
+  isJsWhitespace: _isJsWhitespace,
+  stripBase64Whitespace: _stripB64Whitespace,
+  charTable: _charTable,
+  allCharsIn: _allCharsIn,
   coerceToDer: coerceToDer,
-  isPemArmor: _isPemArmor,   // does a byte source carry a PEM "-----BEGIN" armor (RFC 7468 leading text allowed)
+  isPemArmor: _isPemArmor,
   decodeRoot: decodeRoot,
   runParse: runParse,
   makeNS: makeNS,