@blamejs/pki 0.8.10 → 0.8.12

package/lib/path-validate.js

@@ -622,39 +622,118 @@ function absorbNameConstraints(state, decoded) {
 }
 
 
-function rootNode() {
-  return { depth: 0, validPolicy: OID.anyPolicy, qualifierSet: [], expectedPolicySet: [OID.anyPolicy], children: [], parent: null };
-}
-function treeWithoutParent(node) {
-  if (!node) return null;
-  return {
-    depth: node.depth,
-    validPolicy: node.validPolicy,
-    qualifierSet: node.qualifierSet,
-    expectedPolicySet: node.expectedPolicySet,
-    children: node.children.map(treeWithoutParent),
-  };
-}
-function leavesAt(tree, depth) {
+/**
+ * @internal The RFC 9618 valid_policy_graph. RFC 5280 sec. 6.1.3 step (d)(1)(i) creates one child per
+ * matching parent, so a chain where several issuer policies map to one subject policy multiplies the
+ * structure at every level: measured on a conforming chain carrying four policies mapped to each
+ * other, the tree wants 5461 nodes at six certificates against this graph's 25, and the node cap
+ * refuses the path. RFC 9618 sec. 5.2 keeps at most ONE node per (depth, policy identifier) and
+ * gives it several parents instead, which holds the same information in linear size.
+ *
+ * `state.policyIndex[depth]` maps a policy identifier to the one node at that depth, so the "is there
+ * already a node here for this policy" question every step asks is a lookup rather than a walk.
+ */
+function graphRoot() {
+  return { depth: 0, validPolicy: OID.anyPolicy, qualifierSet: [], expectedPolicySet: [OID.anyPolicy], children: [], parents: [] };
+}
+function policyLayer(state, depth) {
+  var layer = state.policyIndex[depth];
+  if (layer === undefined) { layer = intrinsic.create(null); state.policyIndex[depth] = layer; }
+  return layer;
+}
+function nodeAt(state, depth, policyOid) {
+  var layer = state.policyIndex[depth];
+  if (layer === undefined || !intrinsic.hasOwn(layer, policyOid)) return null;
+  return layer[policyOid];
+}
+function nodesAt(state, depth) {
+  var layer = state.policyIndex[depth];
+  if (layer === undefined) return [];
   var out = [];
-  if (!tree) return out;
-  (function walk(node) {
-    if (node.depth === depth) { guard.list.append(out, node); return; }
-    node.children.forEach(walk);
-  })(tree);
+  intrinsic.forEach(intrinsic.keys(layer), function (k) { guard.list.append(out, layer[k]); });
   return out;
 }
-function pruneChildless(tree, depth) {
+/** @internal One node per (depth, policy). Meeting the same pair twice joins the parents onto the
+ *  node that is already there rather than making a second one, which is the invariant the wrap-up
+ *  procedure's single-parent test depends on. */
+function addPolicyNode(state, depth, validPolicy, qualifiers, expectedPolicySet, parents) {
+  if (parents.length === 0) return null;
+  var node = nodeAt(state, depth, validPolicy);
+  if (node === null) {
+    if (state.policyNodeCount >= state.maxPolicyNodes) { state._capHit = true; return null; }
+    node = { depth: depth, validPolicy: validPolicy, qualifierSet: qualifiers ? [qualifiers] : [],
+      expectedPolicySet: expectedPolicySet, children: [], parents: [] };
+    policyLayer(state, depth)[validPolicy] = node;
+    state.policyNodeCount++;
+  }
+  for (var i = 0; i < parents.length; i++) {
+    if (node.parents.indexOf(parents[i]) !== -1) continue;
+    guard.list.append(node.parents, parents[i]);
+    guard.list.append(parents[i].children, node);
+  }
+  return node;
+}
+function removePolicyNode(state, node) {
+  node.parents.forEach(function (p) {
+    var idx = p.children.indexOf(node);
+    if (idx !== -1) p.children.splice(idx, 1);
+  });
+  node.children.forEach(function (c) {
+    var idx = c.parents.indexOf(node);
+    if (idx !== -1) c.parents.splice(idx, 1);
+  });
+  node.parents = [];
+  var layer = state.policyIndex[node.depth];
+  if (layer !== undefined && layer[node.validPolicy] === node) delete layer[node.validPolicy];
+  state.policyNodeCount--;
+}
+/** @internal RFC 9618 sec. 5.3 step (d)(3): delete every node of depth `depth` or less that has no
+ *  children, and repeat, since deleting one can leave its own parents childless. Depth zero is the
+ *  root, which is never deleted: an empty graph is a root with no children, which the caller reads
+ *  as NULL. */
+function prunePolicyChildless(state, depth) {
   for (var d = depth; d > 0; d--) {
-    leavesAt(tree, d).forEach(function (node) {
-      if (node.children.length === 0 && node.parent) {
-        var idx = node.parent.children.indexOf(node);
-        if (idx !== -1) node.parent.children.splice(idx, 1);
-      }
+    nodesAt(state, d).forEach(function (node) {
+      if (node.children.length === 0) removePolicyNode(state, node);
     });
   }
 }
-function treeIsEmpty(tree) { return tree.children.length === 0; }
+function graphIsEmpty(state) { return state.validPolicyGraph.children.length === 0; }
+/**
+ * @internal The graph a caller reads, as a flat list of nodes linked by index. A graph is not a
+ * tree, and handing back a root to walk would invite the caller to recurse into every child and
+ * rebuild the exponential structure this replaced: `JSON.stringify` on such a value re-expands a
+ * shared node once per path that reaches it. A node list is linear however it is read, holds the
+ * parent relation the wrap-up procedure needs, and carries no cycle to serialize. The root is
+ * index 0.
+ */
+function graphSnapshot(root) {
+  if (!root) return null;
+  var originals = [];
+  var indexOfNode = new intrinsic.Map();
+  (function walk(node) {
+    if (intrinsic.mapHas(indexOfNode, node)) return;
+    intrinsic.mapSet(indexOfNode, node, originals.length);
+    guard.list.append(originals, node);
+    node.children.forEach(walk);
+  })(root);
+  function idsOf(list) {
+    var out = [];
+    for (var j = 0; j < list.length; j++) {
+      if (intrinsic.mapHas(indexOfNode, list[j])) guard.list.append(out, intrinsic.mapGet(indexOfNode, list[j]));
+    }
+    return out;
+  }
+  var nodes = [];
+  for (var i = 0; i < originals.length; i++) {
+    var o = originals[i];
+    guard.list.append(nodes, {
+      id: i, depth: o.depth, validPolicy: o.validPolicy, qualifierSet: o.qualifierSet,
+      expectedPolicySet: o.expectedPolicySet, parents: idsOf(o.parents), children: idsOf(o.children),
+    });
+  }
+  return { nodes: nodes };
+}
 
 
 function isSubtreeBaseValid(tag, base) {
@@ -727,8 +806,17 @@ function _anchorSubtreeSeeds(anchor) {
 
 function initialize(certs, params, seeds, anchor) {
   var n = certs.length;
+  var state = _initialState(certs, params, seeds, anchor, n);
+  /** @internal The root is the depth-zero anyPolicy node, and it is indexed like any other, so the
+   * "is there a node at this depth for this policy" lookup answers for depth zero too. */
+  policyLayer(state, 0)[OID.anyPolicy] = state.validPolicyGraph;
+  return state;
+}
+
+function _initialState(certs, params, seeds, anchor, n) {
   return {
-    validPolicyTree: rootNode(),
+    validPolicyGraph: graphRoot(),
+    policyIndex: [],
     policyNodeCount: 1,
     maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
     minRsaModulusBits: params.minRsaModulusBits !== undefined ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
@@ -757,55 +845,61 @@ function processPolicies(state, cert, i, checks) {
   try { cp = decodeExt(cert, OID.certificatePolicies); }
   catch (e) { guard.list.append(checks,{ name: "policies", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
 
-  if (cp && state.validPolicyTree) {
+  if (cp && state.validPolicyGraph) {
     var policies = cp.value;
-    var depth = i - 1;
+    var prev = i - 1;
     var anyPolicyActive = state.inhibitAnyPolicy > 0 || (i < state._n && selfIssued(cert));
     var anyPolicyPresent = false;
     var anyPolicyQualifiers = null;
+
+    /** @internal RFC 9618 sec. 5.3 step (d)(1): ONE node per policy, carrying every depth i-1 node
+     * that expected it. Creating one per parent instead is what made the structure exponential. */
     policies.forEach(function (p) {
       if (p.policyIdentifier === OID.anyPolicy) { anyPolicyPresent = true; anyPolicyQualifiers = p.qualifiersBytes; return; }
-      var matched = false;
-      leavesAt(state.validPolicyTree, depth).forEach(function (node) {
-        if (contains(node.expectedPolicySet, p.policyIdentifier)) {
-          addChild(state, node, p.policyIdentifier, p.qualifiersBytes, [p.policyIdentifier], checks);
-          matched = true;
-        }
+      var parents = intrinsic.filter(nodesAt(state, prev), function (node) {
+        return contains(node.expectedPolicySet, p.policyIdentifier);
       });
-      if (!matched) {
-        leavesAt(state.validPolicyTree, depth).forEach(function (node) {
-          if (node.validPolicy === OID.anyPolicy) addChild(state, node, p.policyIdentifier, p.qualifiersBytes, [p.policyIdentifier], checks);
-        });
+      if (parents.length === 0) {
+        /** @internal (d)(1)(ii): no node expected it, so it hangs off the anyPolicy node if there
+         * is one. That single anyPolicy parent is what step (g)(2) later reads. */
+        var anyPrev = nodeAt(state, prev, OID.anyPolicy);
+        if (anyPrev === null) return;
+        parents = [anyPrev];
       }
+      addPolicyNode(state, i, p.policyIdentifier, p.qualifiersBytes, [p.policyIdentifier], parents);
     });
+
+    /** @internal (d)(2): for each policy some depth i-1 node expects, if depth i has no node for it
+     * yet, one node carrying every parent that expected it. */
     if (anyPolicyPresent && anyPolicyActive) {
-      leavesAt(state.validPolicyTree, depth).forEach(function (node) {
+      var expected = [];
+      nodesAt(state, prev).forEach(function (node) {
         node.expectedPolicySet.forEach(function (ep) {
-          var already = guard.list.anyMatches(node.children, function (ch) { return ch.validPolicy === ep; });
-          if (!already) addChild(state, node, ep, anyPolicyQualifiers, [ep], checks);
+          if (expected.indexOf(ep) === -1) guard.list.append(expected, ep);
+        });
+      });
+      expected.forEach(function (ep) {
+        if (nodeAt(state, i, ep) !== null) return;
+        var parents = intrinsic.filter(nodesAt(state, prev), function (node) {
+          return contains(node.expectedPolicySet, ep);
         });
+        addPolicyNode(state, i, ep, anyPolicyQualifiers, [ep], parents);
       });
     }
-    if (state._capHit) return { fatal: true, error: E("path/policy-tree-cap", "policy tree exceeded the node cap") };
-    pruneChildless(state.validPolicyTree, depth);
-    if (treeIsEmpty(state.validPolicyTree)) state.validPolicyTree = null;
+
+    if (state._capHit) return { fatal: true, error: E("path/policy-tree-cap", "policy graph exceeded the node cap") };
+    prunePolicyChildless(state, prev);
+    if (graphIsEmpty(state)) state.validPolicyGraph = null;
   } else if (!cp) {
-    state.validPolicyTree = null;
+    state.validPolicyGraph = null;
   }
 
-  if (!(state.explicitPolicy > 0 || state.validPolicyTree !== null)) {
+  if (!(state.explicitPolicy > 0 || state.validPolicyGraph !== null)) {
     guard.list.append(checks,{ name: "policy", ok: false, code: "path/policy-required" });
-    return { fatal: true, error: E("path/policy-required", "explicit policy required but the valid-policy tree is empty") };
+    return { fatal: true, error: E("path/policy-required", "explicit policy required but the valid-policy graph is empty") };
   }
-  return { fatal: false };
-}
-
-function addChild(state, parent, validPolicy, qualifiers, expectedPolicySet, checks) {
-  if (state.policyNodeCount >= state.maxPolicyNodes) { state._capHit = true; return; }
-  var node = { depth: parent.depth + 1, validPolicy: validPolicy, qualifierSet: qualifiers ? [qualifiers] : [], expectedPolicySet: expectedPolicySet, children: [], parent: parent };
-  guard.list.append(parent.children, node);
-  state.policyNodeCount++;
   void checks;
+  return { fatal: false };
 }
 
 function isNullOrAbsentParams(p) {
@@ -859,7 +953,7 @@ function prepareNext(state, cert, i, checks) {
   if (pm) {
     var badAny = mapsAnyPolicy(pm.value);
     if (badAny) { guard.list.append(checks,{ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: E("path/bad-policy", "policyMappings must not map to or from anyPolicy (RFC 5280 6.1.4(a))") }; }
-    if (state.validPolicyTree) applyPolicyMappings(state, pm.value, i);
+    if (state.validPolicyGraph) applyPolicyMappings(state, pm.value, i);
   }
 
   state.workingIssuerName = cert.subject;
@@ -919,36 +1013,49 @@ function prepareNext(state, cert, i, checks) {
   return { fatal: false };
 }
 
+/** @internal RFC 9618 sec. 5.4 rewrites RFC 5280 sec. 6.1.4 step (b) over the graph. Each clause is
+ *  singular where the tree's was plural, because at most one node at a depth carries a given policy.
+ *
+ * A mapping naming anyPolicy on either side is skipped here as well as refused by the caller
+ * (sec. 6.1.4(a)), because mapping one in would rewrite the anyPolicy node's expected policy set and
+ * the graph's invariant is that it is always {anyPolicy}. The caller refusing it keeps that from
+ * happening today; skipping it here is what keeps it true of this function. */
 function applyPolicyMappings(state, mappings, i) {
-  var depth = i;
   if (state.policyMapping > 0) {
     var mappedFrom = intrinsic.create(null);
-    mappings.forEach(function (m) { guard.list.append(mappedFrom[m.issuerDomainPolicy] = mappedFrom[m.issuerDomainPolicy] || [], m.subjectDomainPolicy); });
-    var depthI = leavesAt(state.validPolicyTree, depth);
-    var anyNodes = depthI.filter(function (nd) { return nd.validPolicy === OID.anyPolicy; });
-    Object.keys(mappedFrom).forEach(function (idp) {
-      var idpNodes = depthI.filter(function (nd) { return nd.validPolicy === idp; });
-      if (idpNodes.length) {
-        idpNodes.forEach(function (nd) { nd.expectedPolicySet = mappedFrom[idp].slice(); });
-      } else {
-        anyNodes.forEach(function (anyNode) {
-          if (anyNode.parent) addChild(state, anyNode.parent, idp, anyNode.qualifierSet[0] || null, mappedFrom[idp].slice(), []);
-        });
-      }
+    mappings.forEach(function (m) {
+      if (m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy) return;
+      guard.list.append(mappedFrom[m.issuerDomainPolicy] = mappedFrom[m.issuerDomainPolicy] || [], m.subjectDomainPolicy);
     });
-  } else {
-    var mappedSet = intrinsic.create(null);
-    mappings.forEach(function (m) { mappedSet[m.issuerDomainPolicy] = true; });
-    if (!state.validPolicyTree) return;
-    leavesAt(state.validPolicyTree, depth).forEach(function (node) {
-      if (mappedSet[node.validPolicy] && node.parent) {
-        var idx = node.parent.children.indexOf(node);
-        if (idx !== -1) node.parent.children.splice(idx, 1);
+    intrinsic.forEach(intrinsic.keys(mappedFrom), function (idp) {
+      var node = nodeAt(state, i, idp);
+      if (node !== null) {
+        /** @internal (b)(1) */
+        node.expectedPolicySet = mappedFrom[idp].slice();
+        return;
       }
+      /** @internal (b)(2): no node for the issuer domain policy, so one is generated under the
+       * anyPolicy node at depth i-1, taking the depth-i anyPolicy node's qualifiers. */
+      var anyHere = nodeAt(state, i, OID.anyPolicy);
+      if (anyHere === null) return;
+      var anyPrev = nodeAt(state, i - 1, OID.anyPolicy);
+      if (anyPrev === null) return;
+      addPolicyNode(state, i, idp, anyHere.qualifierSet[0] || null, mappedFrom[idp].slice(), [anyPrev]);
     });
-    pruneChildless(state.validPolicyTree, depth - 1);
-    if (treeIsEmpty(state.validPolicyTree)) state.validPolicyTree = null;
-  }
+    return;
+  }
+  /** @internal (b)(3): mapping is inhibited, so the node for each issuer domain policy is deleted
+   * and every ancestor it leaves childless goes with it. */
+  if (!state.validPolicyGraph) return;
+  var deleted = false;
+  mappings.forEach(function (m) {
+    if (m.issuerDomainPolicy === OID.anyPolicy) return;
+    var node = nodeAt(state, i, m.issuerDomainPolicy);
+    if (node !== null) { removePolicyNode(state, node); deleted = true; }
+  });
+  if (!deleted) return;
+  prunePolicyChildless(state, i - 1);
+  if (graphIsEmpty(state)) state.validPolicyGraph = null;
 }
 
 var TARGET_UNPROCESSED_IF_CRITICAL = intrinsic.create(null);
@@ -1028,11 +1135,20 @@ function _revocationRow(row, rv) {
  * are validated at the entry point. A mis-shaped value throws `path/bad-input`,
  * so it cannot silently go unapplied. Returns `{ valid, revocationChecked, anchorConstraints,
  * path, results, workingPublicKey, workingPublicKeyAlgorithm,
- * workingPublicKeyParameters, validPolicyTree, userConstrainedPolicySet }` where `results[i].checks`
+ * workingPublicKeyParameters, validPolicyGraph, userConstrainedPolicySet }` where `results[i].checks`
  * carries a per-check reason code (`path/*`) for every step. Pure and
  * re-entrant: no input object is mutated. An empty path or a missing anchor
  * throws a typed `PathError`.
  *
+ * Certificate policies are processed as the RFC 9618 `valid_policy_graph`, which replaces the
+ * RFC 5280 sec. 6.1 `valid_policy_tree`. `validPolicyGraph` is a directed acyclic graph holding at
+ * most one node per depth and policy identifier; a node reached from several policies carries them
+ * all in `parents`, where the tree held a separate node under each. The graph is linear in the
+ * number of policies and mappings on the path, so a chain whose tree would not fit inside
+ * `maxPolicyNodes` validates. It is `{ nodes }`, a flat list linked by index, each entry
+ * `{ id, depth, validPolicy, qualifierSet, expectedPolicySet, parents, children }` where `parents`
+ * and `children` hold the ids of other entries and the root is id 0.
+ *
  * A certificate signed with the RFC 9802 stateful hash-based algorithm
  * `id-alg-hss-lms-hashsig` is verified like any other, through the toolkit's own
  * HSS engine rather than the crypto engine. The signature covers the whole
@@ -1488,28 +1604,42 @@ async function _validate(path, opts, run) {
     workingPublicKey: state.workingPublicKey,
     workingPublicKeyAlgorithm: state.workingPublicKeyAlgorithm,
     workingPublicKeyParameters: state.workingPublicKeyParameters,
-    validPolicyTree: treeWithoutParent(state.validPolicyTree),
+    validPolicyGraph: graphSnapshot(state.validPolicyGraph),
     userConstrainedPolicySet: ucps,
   });
 }
 
+/**
+ * @internal RFC 9618 sec. 5.5 rewrites RFC 5280 sec. 6.1.5 step (g) over the graph. The set is read
+ * from the nodes whose only parent is the anyPolicy node, at ANY depth rather than at the deepest
+ * one, plus the anyPolicy node at depth n. Policy qualifiers are not collected: sec. 5.5 step
+ * (g)(4)(ii) lets an application that does not use them skip it, and this returns identifiers.
+ */
 function userConstrainedPolicies(state, n) {
-  if (!state.validPolicyTree) return [];
+  if (!state.validPolicyGraph) return [];
+  var authority = [];
+  function note(node) {
+    if (authority.indexOf(node.validPolicy) === -1) guard.list.append(authority, node.validPolicy);
+  }
+  /** @internal (g)(2) */
+  for (var d = 1; d <= n; d++) {
+    nodesAt(state, d).forEach(function (node) {
+      if (node.validPolicy === OID.anyPolicy) return;
+      if (node.parents.length === 1 && node.parents[0].validPolicy === OID.anyPolicy) note(node);
+    });
+  }
+  /** @internal (g)(3) */
+  var anyAtN = nodeAt(state, n, OID.anyPolicy);
+  if (anyAtN !== null) note(anyAtN);
+
+  /** @internal (g)(5) and (g)(6) */
   var uips = state.userInitialPolicySet;
-  var anyUser = contains(uips, OID.anyPolicy);
-  var leaves = leavesAt(state.validPolicyTree, n);
-  var explicit = intrinsic.create(null), hasAnyLeaf = false;
-  leaves.forEach(function (node) {
-    if (node.validPolicy === OID.anyPolicy) hasAnyLeaf = true;
-    else explicit[node.validPolicy] = true;
-  });
-  var set = intrinsic.create(null);
-  Object.keys(explicit).forEach(function (p) { if (anyUser || contains(uips, p)) set[p] = true; });
-  if (hasAnyLeaf) {
-    if (anyUser) set[OID.anyPolicy] = true;
-    else uips.forEach(function (p) { set[p] = true; });
+  if (contains(uips, OID.anyPolicy)) return authority;
+  var out = intrinsic.filter(authority, function (p) { return contains(uips, p); });
+  if (contains(authority, OID.anyPolicy)) {
+    uips.forEach(function (p) { if (out.indexOf(p) === -1) guard.list.append(out, p); });
   }
-  return Object.keys(set);
+  return out;
 }
 
 

package/lib/schema-all.js

@@ -345,10 +345,13 @@ function _detectOrNull(der, label) {
 
 module.exports = {
   engine: engine,
-  x509: { parse: x509.parse, pemDecode: x509.pemDecode, pemEncode: x509.pemEncode },
+  x509: { parse: x509.parse, pemDecode: x509.pemDecode, pemEncode: x509.pemEncode,
+    decodeExtensions: x509.decodeExtensions, decodeExtension: x509.decodeExtension },
   c509: { parse: c509.parse, encode: c509.encode },
-  crl:  { parse: crl.parse,  pemDecode: crl.pemDecode, pemEncode: crl.pemEncode },
-  csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
+  crl:  { parse: crl.parse,  pemDecode: crl.pemDecode, pemEncode: crl.pemEncode,
+    decodeExtensions: crl.decodeExtensions, decodeExtension: crl.decodeExtension },
+  csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode,
+    decodeExtensions: csr.decodeExtensions, decodeExtension: csr.decodeExtension },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },
   pkcs1: {
     parse: pkcs1.parse, parsePublic: pkcs1.parsePublic,
@@ -361,10 +364,12 @@ module.exports = {
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode, pemEncode: ocsp.pemEncode },
   tsp: { parse: tsp.parse, parseResponse: tsp.parseResponse, parseRequest: tsp.parseRequest, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode, pemEncode: tsp.pemEncode },
-  crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode, pemEncode: crmf.pemEncode },
+  crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode, pemEncode: crmf.pemEncode,
+    decodeExtensions: crmf.decodeExtensions, decodeExtension: crmf.decodeExtension },
   cmp: { parse: cmp.parse, pemDecode: cmp.pemDecode, pemEncode: cmp.pemEncode },
   csrattrs: { parse: csrattrs.parse },
-  attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode, pemEncode: attrcert.pemEncode },
+  attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode, pemEncode: attrcert.pemEncode,
+    decodeExtensions: attrcert.decodeExtensions, decodeExtension: attrcert.decodeExtension },
   smime: { parseSigningCertificate: smime.parseSigningCertificate, parseSigningCertificateV2: smime.parseSigningCertificateV2, parseSmimeCapabilities: smime.parseSmimeCapabilities, decodeAttribute: smime.decodeAttribute },
   cmc: { parse: cmc.parse, parsePkiData: cmc.parsePkiData, parsePkiResponse: cmc.parsePkiResponse },
   pem: {

package/lib/schema-attrcert.js

@@ -590,19 +590,9 @@ _AC_EXT_DECODERS[_Oav("acProxying")] = _acProxying;
 /** @internal The three RFC 5280 extensions RFC 5755 sec. 4.3.3 to 4.3.5 profile for an AC are read
  *  through the certificate decoders, so a relying party running the sec. 6 "pointer in AC" scheme
  *  reads the distribution point and the OCSP location off the parse rather than off raw bytes. */
-var _CERT_EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
-/** @internal The certificate decoders close over the namespace they were built with, so a parse
- *  that named caps gets its own table and every decode below these three reads the caller's
- *  figure. A caller outside a parse passes no context and reuses the module's table. */
-function _certExtDecoder(name) {
-  var key = _Oav(name);
-  return function (buf, ctx) {
-    return (ctx ? pkix.certExtensionDecoders(schema.withResources(NS, ctx)).byOid : _CERT_EXT_DECODERS)[key](buf);
-  };
-}
-_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = _certExtDecoder("authorityKeyIdentifier");
-_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = _certExtDecoder("authorityInfoAccess");
-_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = _certExtDecoder("cRLDistributionPoints");
+_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = pkix.scopedCertDecoder(NS, "authorityKeyIdentifier");
+_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = pkix.scopedCertDecoder(NS, "authorityInfoAccess");
+_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = pkix.scopedCertDecoder(NS, "cRLDistributionPoints");
 
 // @internal
 function validateAttributeValue(type, valueDer) {
@@ -614,6 +604,108 @@ function validateExtensionValue(extnOid, extnValueDer) {
   return dec ? dec(extnValueDer) : null;
 }
 
+/** @internal The criticality RFC 5755 fixes for each extension it profiles for an attribute
+ *  certificate. The AC signer refuses to write an extension against this table and the extension
+ *  door reports one that arrived against it, from this one row set. */
+var AC_FIXED_CRITICALITY_ROWS = [
+  ["acAuditIdentity", true, "RFC 5755 sec. 4.3.1"], ["targetInformation", true, "RFC 5755 sec. 4.3.2"],
+  ["authorityKeyIdentifier", false, "RFC 5755 sec. 4.3.3"], ["authorityInfoAccess", false, "RFC 5755 sec. 4.3.4"],
+  ["cRLDistributionPoints", false, "RFC 5755 sec. 4.3.5"], ["noRevAvail", false, "RFC 5755 sec. 4.3.6"],
+  ["acProxying", true, "RFC 5755 sec. 7.3"], ["aaControls", true, "RFC 5755 sec. 7.4"],
+];
+function extensionCriticality(oidRegistry) {
+  var table = intrinsic.create(null);
+  intrinsic.forEach(AC_FIXED_CRITICALITY_ROWS, function (r) {
+    table[oidRegistry.byName(r[0])] = { critical: r[1], citation: r[2] };
+  });
+  return table;
+}
+
+/** @internal The attribute-certificate scope. The table is this module's own, passed to the shared
+ *  door rather than reached for from it, because a registry in `schema-pkix.js` that required this
+ *  module would invert the dependency. */
+var AC_SCOPES = intrinsic.assign(intrinsic.create(null), {
+  "attribute-certificate": {
+    /** @internal Every decoder in this table takes the walk context and threads it into its own
+     *  decode, so the one table serves every call and the caller's caps still reach the value. */
+    decoders: function () { return _AC_EXT_DECODERS; },
+    criticality: extensionCriticality(oid),
+  },
+});
+
+var DOOR = pkix.extensionDoor({
+  ns: NS, ErrorClass: AttrCertError, key: "attrcert", kind: "attributeCertificate",
+  what: "the attribute certificate", parse: parse, scopes: AC_SCOPES,
+  defaultScope: "attribute-certificate",
+  segments: function (ac) { return [{ list: ac.extensions || [], scope: "attribute-certificate" }]; },
+});
+
+/**
+ * @primitive  pki.schema.attrcert.decodeExtensions
+ * @signature  pki.schema.attrcert.decodeExtensions(acOrBytes, opts?) -> rows
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 5755 sec. 4.2.9, RFC 5755 sec. 4.3
+ * @related    pki.schema.attrcert.parse, pki.schema.x509.decodeExtensions
+ *
+ * Read an attribute certificate's extensions as decoded records. The argument is the object `parse`
+ * returned or the bytes `parse` takes.
+ *
+ * Each row is `{ oid, name, critical, value, scope, index, containerIndex, state, decoded, code,
+ * profile }`, with `scope` `"attribute-certificate"` and `containerIndex` `null`. `state` is the
+ * discriminator, and `profile` reports the criticality RFC 5755 fixes for the extension.
+ *
+ * RFC 5755 sec. 5 item 7 has a verifier reject an AC carrying a critical extension it does not
+ * recognize. That is the caller's rule to apply, and the two facts it needs, `critical` and
+ * `state`, are on the row.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value. It does not turn an unrecognized OID into a throw.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var aaCert = await pki.x509.sign({ subject: "Example AA", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "CN=Holder" }] },
+ *     attributes: { role: { roleName: "https://example.test/role/admin" } }, serialNumber: 1n,
+ *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
+ *     extensions: { noRevAvail: true } }, { cert: aaCert, key: key });
+ *   var rows = pki.schema.attrcert.decodeExtensions(acDer);
+ *   rows.filter(function (r) { return r.critical && r.state === "unrecognized"; }).length;  // -> 0
+ */
+var decodeExtensions = DOOR.decodeExtensions;
+
+/**
+ * @primitive  pki.schema.attrcert.decodeExtension
+ * @signature  pki.schema.attrcert.decodeExtension(ext, opts?) -> row
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 5755 sec. 4.3
+ * @related    pki.schema.attrcert.decodeExtensions
+ *
+ * Read one attribute-certificate extension record as a decoded row, at scope
+ * `"attribute-certificate"`. The argument is `{ oid, name, critical, value }`.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var aaCert = await pki.x509.sign({ subject: "Example AA", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "CN=Holder" }] },
+ *     attributes: { role: { roleName: "https://example.test/role/admin" } }, serialNumber: 1n,
+ *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
+ *     extensions: { noRevAvail: true } }, { cert: aaCert, key: key });
+ *   var ac = pki.schema.attrcert.parse(acDer);
+ *   pki.schema.attrcert.decodeExtension(ac.extensions[0]).profile.citation;  // -> "RFC 5755 sec. 4.3.6"
+ */
+var decodeExtension = DOOR.decodeExtension;
+
 module.exports = {
   parse: parse,
   parseV1: parseV1,
@@ -621,6 +713,9 @@ module.exports = {
   pemEncode: pemEncode,
   matches: matches,
   matchesV1: matchesV1,
+  decodeExtensions: decodeExtensions,
+  decodeExtension: decodeExtension,
+  extensionCriticality: extensionCriticality,
   readGeneralName: readGeneralName,
   validateAttributeValue: validateAttributeValue,
   validateExtensionValue: validateExtensionValue,