@blamejs/pki 0.8.2 → 0.8.4

package/CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.4 — 2026-09-25
+
+A decode cap bounds every structure a parse reads, and a refusal caused by a cap is no longer reported as malformed input.
+
+### Added
+
+- `pki.schema.engine.decodeNested(bytes, ctx, label, opts?)`, the decode to perform on a value already read out of a parse's input. It applies the caps carried on the walk context and records a resource refusal against the parse before re-throwing, which is what a format parser composed on the engine needs so its embedded payloads answer to the caller's caps.
+- `pki.schema.engine.withResources(ns, source)` carries a parse's caps and budget onto another namespace, for a format whose structure is carried inside another one. The structure is still walked in its own namespace, so a fault in it keeps that format's error class and code. `pki.schema.engine.isResourceRefusal(err)` reports whether a codec error was a limit rather than a claim about the bytes.
+
+### Changed
+
+- An input refused for exceeding a decode limit reports `<format>/too-large` in cases where it previously reported the format's own malformed-value code, such as `cms/bad-aead-params` or `cmp/bad-body`. A parser that decodes a value out of its input wraps a decode failure in a code of its own, and that code sent a reader to inspect bytes that were fine and a cap that was too small. A caller matching on one of those codes to detect malformed input will stop seeing over-budget inputs under it. The wrapped error is carried on the refusal as its `cause`.
+
+### Fixed
+
+- A decode cap bounds every structure a parse reads, not the input alone. An embedded `OCTET STRING` payload, an encapsulated protocol body, a `SafeContents` inside a PKCS#12 store and an attribute value are all decoded under the caps the caller named. The 0.8.3 notes recorded that a structure decoded from inside the input kept the built-in `pki.C.LIMITS` defaults; it no longer does.
+- `pki.schema.cmc.parse` applies the caller's caps to the `PKIData` or `PKIResponse` body. It read the caps, bounded the CMS carrier with them, and then decoded the body that carries the request or response with the built-in defaults.
+- A parse cannot return a result after a decode limit has refused something inside that parse, whatever the code between the two does with the failure. A parser that catches a resource refusal and re-throws its own typed error is the common shape, and that shape previously carried the parse past the latch the budget sets. The door now reads the latch on the failure path as well as on the success path.
+
+## v0.8.3 — 2026-09-25
+
+A parser takes decode caps from its caller, and a resource refusal says so instead of reading as malformed input.
+
+### Added
+
+- Every parse function takes an optional second argument of decode caps: `maxBytes`, `maxDepth` and `maxItems`. That includes `pki.schema.parse`, the format-detecting door, where the caps bound both the detection decode and the decode of whichever format matches. Each may tighten below the corresponding `pki.C.LIMITS` default and is refused with `<format>/bad-input` if it names a value above it, so a caller can bound a parse more strictly than the toolkit does and cannot grant itself more resource than the built-in refusal allows. An option outside that set is named in the refusal rather than ignored.
+- A new `<format>/too-large` code on each format, reported when a decode limit refuses the input.
+
+### Changed
+
+- An input refused for exceeding a decode limit reports `<format>/too-large` where it previously reported `<format>/bad-der`. The two say different things to whoever reads them: one is answered by raising a cap, the other by fixing the bytes. A caller matching on `bad-der` to detect malformed input will stop seeing oversized and over-nested inputs under that code.
+
+### Fixed
+
+- A parse that exhausts its decode budget cannot report anything but a refusal, even when code inside the parse catches the failure. The budget latches on exhaustion, and each parser door re-reads that latch after its walk and before returning a result, so a `catch` between the two can absorb the exception and still not produce a value. This is the guarantee that makes the caps worth relying on: without it any of the toolkit's error-absorbing paths could turn `over budget` into an ordinary absent value and change a verdict.
+- The caps a caller names are read into a fresh object, and no flag is ever written onto the object the caller passed or onto the one the decode receives. A resource option therefore cannot alter which encodings a parse accepts; the strictness of a parse is the same whatever caps are asked for.
+
+### Documentation
+
+- The caps bound the decode of the input a parser is given, which is what bounds a parse overall, since everything a parse reads comes from those bytes. A structure decoded separately from inside that input keeps the built-in `pki.C.LIMITS` defaults rather than a tighter figure the caller named.
+
 ## v0.8.2 — 2026-09-25
 
 A distinguished name can be read back from its string form, and twelve attributes the name table published can finally be encoded.

package/lib/guard-limits.js

@@ -65,4 +65,51 @@ function byteCap(buf, max, E, code, label) {
   return buf;
 }
 
-module.exports = _freeze({ cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap });
+/** @internal Thrown when a parse exhausts its resource budget. It is not a PkiError subclass,
+ *  so a `catch (e) { if (e instanceof PkiError) ...; throw e; }` re-throws it. A parser door
+ *  converts it to that door's typed refusal, so the public contract is unchanged. */
+function BudgetExceeded(message) {
+  var e = new Error(message);
+  e.name = "BudgetExceeded";
+  e.budgetExceeded = true;
+  return e;
+}
+
+function isBudgetExceeded(e) {
+  return !!(e && e.budgetExceeded === true);
+}
+
+/** @internal One budget per top-level parse, carried into every nested decode. `exhausted`
+ *  latches, and the object is frozen, so a caller that catches the throw cannot clear it. A
+ *  door that re-reads the latch before returning a result therefore still refuses, whatever
+ *  code between the two caught the exception. */
+function budget(limits) {
+  var spent = 0;
+  var exhausted = false;
+  var max = cap(limits ? limits.maxBytes : undefined, "maxBytes", constants.LIMITS.DER_MAX_BYTES);
+  var self = {
+    spend: function (n, what) {
+      if (!_isInteger(n) || n < 0) throw new TypeError("guard.limits.budget: spend takes a non-negative integer");
+      spent += n;
+      if (spent > max) {
+        exhausted = true;
+        throw BudgetExceeded((what || "the parse") + " exceeds the " + max + "-byte budget for this parse");
+      }
+      return n;
+    },
+    trip: function (what) {
+      exhausted = true;
+      throw BudgetExceeded((what || "the parse") + " exceeds the budget for this parse");
+    },
+    exhausted: function () { return exhausted; },
+    spent: function () { return spent; },
+    remaining: function () { return max - spent; },
+    max: function () { return max; },
+  };
+  return _freeze(self);
+}
+
+module.exports = _freeze({
+  cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap,
+  budget: budget, isBudgetExceeded: isBudgetExceeded,
+});

package/lib/guard-parsed.js

@@ -144,10 +144,10 @@ var PROVENANCE = new _WeakMap();
 
 // @enforced-by guard-shape-reinlined -- shares the fromTrustedSource shape below; a
 function recordingParser(kind, parse, ErrorClass, code, label) {
-  return function (input) {
+  return function (input, callerOpts) {
     var isText = typeof input === "string";
     var snap = isText ? input : bytes.snapshotSource(input, ErrorClass, code, label);
-    var out = parse(snap);
+    var out = parse(snap, callerOpts);
     if (out && typeof out === "object") {
       _weakSet(PROVENANCE, out, { kind: kind, source: isText ? snap : _bufferFrom(snap),
         shape: _shapeOf(out) });
@@ -158,8 +158,8 @@ function recordingParser(kind, parse, ErrorClass, code, label) {
 
 // @enforced-by guard-shape-reinlined -- shares recordingParser's shape below: the PROVENANCE.set
 function recordingWalker(kind, walkNode, decodeBytes) {
-  return function (node) {
-    var out = walkNode(node);
+  return function (node, ctx) {
+    var out = walkNode(node, ctx);
     if (out && typeof out === "object" && node && _isBytes(node.bytes)) {
       _weakSet(PROVENANCE, out, {
         kind: kind,

package/lib/schema-all.js

@@ -60,85 +60,85 @@ var FORMATS = [
     name: "cms",
     module: cms,
     detect: cms.matches,
-    parse: function (input) { return cms.parse(input); },
+    parse: function (input, caps) { return cms.parse(input, caps); },
   },
   {
     name: "tsp",
     module: tsp,
     detect: tsp.matches,
-    parse: function (input) { return tsp.parse(input); },
+    parse: function (input, caps) { return tsp.parse(input, caps); },
   },
   {
     name: "crmf",
     module: crmf,
     detect: crmf.matches,
-    parse: function (input) { return crmf.parse(input); },
+    parse: function (input, caps) { return crmf.parse(input, caps); },
   },
   {
     name: "cmp",
     module: cmp,
     detect: cmp.matches,
-    parse: function (input) { return cmp.parse(input); },
+    parse: function (input, caps) { return cmp.parse(input, caps); },
   },
   {
     name: "csrattrs",
     module: csrattrs,
     detect: csrattrs.matches,
-    parse: function (input) { return csrattrs.parse(input); },
+    parse: function (input, caps) { return csrattrs.parse(input, caps); },
   },
   {
     name: "ocsp-request",
     module: ocsp,
     detect: ocsp.matchesRequest,
-    parse: function (input) { return ocsp.parseRequest(input); },
+    parse: function (input, caps) { return ocsp.parseRequest(input, caps); },
   },
   {
     name: "ocsp-response",
     module: ocsp,
     detect: ocsp.matchesResponse,
-    parse: function (input) { return ocsp.parseResponse(input); },
+    parse: function (input, caps) { return ocsp.parseResponse(input, caps); },
   },
   {
     name: "pkcs12",
     module: pkcs12,
     detect: pkcs12.matches,
-    parse: function (input) { return pkcs12.parse(input); },
+    parse: function (input, caps) { return pkcs12.parse(input, caps); },
   },
   {
     name: "pkcs8",
     module: pkcs8,
     detect: pkcs8.matches,
-    parse: function (input) { return pkcs8.parse(input); },
+    parse: function (input, caps) { return pkcs8.parse(input, caps); },
   },
   {
     name: "csr",
     module: csr,
     detect: csr.matches,
-    parse: function (input) { return csr.parse(input); },
+    parse: function (input, caps) { return csr.parse(input, caps); },
   },
   {
     name: "attrcert",
     module: attrcert,
     detect: attrcert.matches,
-    parse: function (input) { return attrcert.parse(input); },
+    parse: function (input, caps) { return attrcert.parse(input, caps); },
   },
   {
     name: "attrcert-v1",
     module: attrcert,
     detect: attrcert.matchesV1,
-    parse: function (input) { return attrcert.parseV1(input); },
+    parse: function (input, caps) { return attrcert.parseV1(input, caps); },
   },
   {
     name: "crl",
     module: crl,
     detect: crl.matches,
-    parse: function (input) { return crl.parse(input); },
+    parse: function (input, caps) { return crl.parse(input, caps); },
   },
   {
     name: "x509",
     module: x509,
     detect: x509.matches,
-    parse: function (input) { return x509.parse(input); },
+    parse: function (input, caps) { return x509.parse(input, caps); },
   },
 ];
 
@@ -159,7 +159,7 @@ function all() { return FORMATS.map(function (f) { return f.name; }); }
 
 /**
  * @primitive  pki.schema.parse
- * @signature  pki.schema.parse(input) -> parsed
+ * @signature  pki.schema.parse(input, caps?) -> parsed
  * @since      0.1.7
  * @status     stable
  * @spec       RFC 5280
@@ -171,6 +171,13 @@ function all() { return FORMATS.map(function (f) { return f.name; }); }
  * the bytes match no registered format; the underlying decode / structural
  * errors of the matched format propagate unchanged.
  *
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. They bound the detection decode
+ *     and the decode of whichever format matches, and a parse that exceeds one is refused
+ *     with the `/too-large` code of that format.
+ *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var der = await pki.x509.sign({ subject: "example.com", subjectPublicKey: await pki.key.export(pair.publicKey),
@@ -178,11 +185,15 @@ function all() { return FORMATS.map(function (f) { return f.name; }); }
  *     { key: await pki.key.export(pair.privateKey) });
  *   var parsed = pki.schema.parse(der);  // cert -> the pki.schema.x509 shape
  */
-function parse(input) {
+function parse(input, callerOpts) {
+  /** @internal The caps are validated once here and the snapshot is what the chosen format
+   *  receives, so the detection decode and the format's own decode are held to the same
+   *  figures a caller named, read once. */
+  var caps = pkix.parseCaps(callerOpts, ENTRY);
   var der = pkix.coerceToDer(input, ENTRY);
-  var root = pkix.decodeRoot(der, ENTRY);
+  var root = pkix.decodeRoot(der, ENTRY, caps);
   for (var i = 0; i < FORMATS.length; i++) {
-    if (FORMATS[i].detect(root)) return FORMATS[i].parse(der);
+    if (FORMATS[i].detect(root)) return FORMATS[i].parse(der, caps);
   }
   throw new SchemaError("schema/unknown-format", "input does not match any registered PKI format (" + all().join(", ") + ")");
 }

package/lib/schema-attrcert.js

@@ -147,7 +147,7 @@ var V2_FORM = schema.seq([
     if (issuerName.names[0].tagNumber !== 4) {
       throw ctx.E("attrcert/bad-issuer-name", "the issuerName GeneralName must be a directoryName [4] (RFC 5755 sec. 4.2.3)");
     }
-    var dirName = asn1.decode(issuerName.names[0].bytes).children[0];
+    var dirName = pkix.decodeNested(issuerName.names[0].bytes, ctx, "the issuerName directoryName").children[0];
     if (!dirName.children || dirName.children.length < 1) {
       throw ctx.E("attrcert/bad-issuer-name", "the issuerName directoryName must be a non-empty distinguished name (RFC 5755 sec. 4.2.3)");
     }
@@ -217,14 +217,14 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
     var attributes = acinfo.fields.attributes.value.result;
     attributes.forEach(function (a) {
       var dec = _ATTR_VALUE_DECODERS[a.type];
-      a.decoded = a.values.map(function (v) { return dec ? dec(v) : { opaque: true, bytes: v }; });
+      a.decoded = a.values.map(function (v) { return dec ? dec(v, ctx) : { opaque: true, bytes: v }; });
     });
 
     var extField = acinfo.fields.extensions;
     var extensions = (extField && extField.present) ? extField.value.result : [];
     extensions.forEach(function (x) {
       var dec = _AC_EXT_DECODERS[x.oid];
-      x.decoded = dec ? dec(x.value) : { opaque: true, bytes: x.value };
+      x.decoded = dec ? dec(x.value, ctx) : { opaque: true, bytes: x.value };
     });
 
     return {
@@ -248,7 +248,7 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
 
 /**
  * @primitive  pki.schema.attrcert.parse
- * @signature  pki.schema.attrcert.parse(input) -> attributeCertificate
+ * @signature  pki.schema.attrcert.parse(input, caps?) -> attributeCertificate
  * @since      0.1.14
  * @status     stable
  * @spec       RFC 5755, X.509
@@ -279,25 +279,32 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
  *   var ac = pki.schema.attrcert.parse(der);
  *   ac.attributes[0].name;   // "role"
  *   ac.validity.notAfterTime;// Date
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-var PARSE_OPTS = intrinsic.assign(intrinsic.create(null), { pemLabel: "ATTRIBUTE CERTIFICATE", PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" });
+var PARSE_OPTS = intrinsic.assign(intrinsic.create(null), { pemLabel: "ATTRIBUTE CERTIFICATE", PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate", ns: NS });
 
 function _legacyV1Error() {
   return new AttrCertError("attrcert/legacy-v1-not-supported", "AttributeCertificateV1 (X.509-1997) is obsolete and not parsed by this build (RFC 5755 sec. 1)");
 }
 
-function _parseAc(input) {
-  var root = pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
-  if (matchesV1(root)) throw _legacyV1Error();
-  return schema.walk(ATTRIBUTE_CERTIFICATE, root, NS).result;
+function _parseAc(input, callerOpts) {
+  return pkix.runParseWith(input, PARSE_OPTS, callerOpts, function (root, ns) {
+    if (matchesV1(root)) throw _legacyV1Error();
+    return schema.walk(ATTRIBUTE_CERTIFICATE, root, ns).result;
+  });
 }
 
 var parse = guard.parsed.recordingParser("attributeCertificate", _parseAc,
   AttrCertError, "attrcert/bad-input", "an attribute certificate");
 
-function parseV1(input) {
-  pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
-  throw _legacyV1Error();
+function parseV1(input, callerOpts) {
+  return pkix.runParseWith(input, PARSE_OPTS, callerOpts, function () {
+    throw _legacyV1Error();
+  });
 }
 
 /**
@@ -391,12 +398,13 @@ function _oneGN(node, code) {
 
 // @internal
 function readGeneralName(der, code) {
+  // allow:bare-decode reached from the builder, not from a parse, so no parse context carries caps here.
   return _oneGN(asn1.decode(der), code || "attrcert/bad-input");
 }
 
 function _svceAuthInfo(authInfoAllowed, code) {
-  return function (buf) {
-    var kids = _seqChildren(buf, code, "SvceAuthInfo");
+  return function (buf, ctx) {
+    var kids = _seqChildren(buf, code, "SvceAuthInfo", ctx);
     if (kids.length < 2 || kids.length > 3) throw NS.E(code, "SvceAuthInfo must be a SEQUENCE { service, ident, authInfo? }");
     var service = _oneGN(kids[0], code);
     var ident = _oneGN(kids[1], code);
@@ -410,12 +418,12 @@ function _svceAuthInfo(authInfoAllowed, code) {
   };
 }
 
-function _ietfAttrSyntax(buf) {
+function _ietfAttrSyntax(buf, ctx) {
   var C = "attrcert/bad-ietf-attr";
-  var kids = _seqChildren(buf, C, "IetfAttrSyntax");
+  var kids = _seqChildren(buf, C, "IetfAttrSyntax", ctx);
   if (!kids.length || kids.length > 2) throw NS.E(C, "IetfAttrSyntax must be a SEQUENCE { policyAuthority [0]?, values }");
   var policyAuthority = null, i = 0;
-  if (_isCtx(kids[0], 0)) { policyAuthority = schema.walk(_GNS_0, kids[0], NS).result; i = 1; }
+  if (_isCtx(kids[0], 0)) { policyAuthority = schema.walk(_GNS_0, kids[0], schema.withResources(NS, ctx)).result; i = 1; }
   var valuesNode = kids[i];
   if (!valuesNode || !_isU(valuesNode, TAGS.SEQUENCE) || !valuesNode.children || !valuesNode.children.length) {
     throw NS.E(C, "IetfAttrSyntax values must be a non-empty SEQUENCE OF value");
@@ -431,12 +439,12 @@ function _ietfAttrSyntax(buf) {
   return { policyAuthority: policyAuthority, values: values, homogeneous: Object.keys(kinds).length === 1 };
 }
 
-function _role(buf) {
+function _role(buf, ctx) {
   var C = "attrcert/bad-role";
-  var kids = _seqChildren(buf, C, "RoleSyntax");
+  var kids = _seqChildren(buf, C, "RoleSyntax", ctx);
   if (!kids.length || kids.length > 2) throw NS.E(C, "RoleSyntax must be a SEQUENCE { roleAuthority [0]?, roleName [1] }");
   var roleAuthority = null, i = 0;
-  if (_isCtx(kids[0], 0)) { roleAuthority = schema.walk(_GNS_0, kids[0], NS).result; i = 1; }
+  if (_isCtx(kids[0], 0)) { roleAuthority = schema.walk(_GNS_0, kids[0], schema.withResources(NS, ctx)).result; i = 1; }
   var rn = kids[i];
   if (!_isCtx(rn, 1) || !rn.children || rn.children.length !== 1) throw NS.E(C, "RoleSyntax roleName must be an EXPLICIT [1] wrapping exactly one GeneralName");
   if (i + 1 !== kids.length) throw NS.E(C, "RoleSyntax has unexpected trailing fields");
@@ -466,9 +474,9 @@ function _securityCategory(node, C) {
   if (!_isCtx(valueNode, 1) || !valueNode.children || valueNode.children.length !== 1) throw NS.E(C, "SecurityCategory value must be an EXPLICIT [1] wrapping one element");
   return { type: type, valueBytes: Buffer.concat([valueNode.children[0].bytes]) };
 }
-function _clearance(buf) {
+function _clearance(buf, ctx) {
   var C = "attrcert/bad-clearance";
-  var kids = _seqChildren(buf, C, "Clearance");
+  var kids = _seqChildren(buf, C, "Clearance", ctx);
   if (!kids.length || kids.length > 3) throw NS.E(C, "Clearance must be a SEQUENCE { policyId, classList?, securityCategories? }");
   if (!_isU(kids[0], TAGS.OBJECT_IDENTIFIER)) throw NS.E(C, "Clearance policyId must be an OBJECT IDENTIFIER");
   var policyId; try { policyId = asn1.read.oid(kids[0]); } catch (e) { throw NS.E(C, "Clearance policyId must be an OBJECT IDENTIFIER", e); }
@@ -501,16 +509,16 @@ _ATTR_VALUE_DECODERS[_Oav("chargingIdentity")] = _ietfAttrSyntax;
 _ATTR_VALUE_DECODERS[_Oav("group")] = _ietfAttrSyntax;
 
 
-function _acAuditIdentity(buf) {
+function _acAuditIdentity(buf, ctx) {
   var C = "attrcert/bad-audit-identity";
-  var n = _decodeTop(buf, C, "AuditIdentity");
+  var n = _decodeTop(buf, C, "AuditIdentity", ctx);
   if (!_isU(n, TAGS.OCTET_STRING)) throw NS.E(C, "AuditIdentity must be an OCTET STRING");
   return Buffer.concat([asn1.read.octetString(n)]);
 }
 
-function _noRevAvail(buf) {
+function _noRevAvail(buf, ctx) {
   var C = "attrcert/bad-no-rev-avail";
-  var n = _decodeTop(buf, C, "NoRevAvail");
+  var n = _decodeTop(buf, C, "NoRevAvail", ctx);
   try { asn1.read.nullValue(n); } catch (e) { throw NS.E(C, "NoRevAvail must be a DER NULL (RFC 5755 sec. 4.3.6)", e); }
   return { noRevAvail: true };
 }
@@ -539,13 +547,13 @@ function _acDecodeTargets(node, C, allowTargetCert) {
   if (!_isU(node, TAGS.SEQUENCE) || !node.children || !node.children.length) throw NS.E(C, "Targets must be a non-empty SEQUENCE OF Target");
   return node.children.map(function (t) { return _acTarget(t, C, allowTargetCert); });
 }
-function _seqOfTargets(buf, C, allowTargetCert) {
-  var kids = _seqChildren(buf, C, "SEQUENCE OF Targets");
+function _seqOfTargets(buf, C, allowTargetCert, ctx) {
+  var kids = _seqChildren(buf, C, "SEQUENCE OF Targets", ctx);
   if (!kids.length) throw NS.E(C, "a SEQUENCE OF Targets must be non-empty");
   return kids.map(function (targetsNode) { return _acDecodeTargets(targetsNode, C, allowTargetCert); });
 }
-function _targetInformation(buf) { return _seqOfTargets(buf, "attrcert/bad-targets", true); }
-function _acProxying(buf) { return _seqOfTargets(buf, "attrcert/bad-proxy-info", false); }
+function _targetInformation(buf, ctx) { return _seqOfTargets(buf, "attrcert/bad-targets", true, ctx); }
+function _acProxying(buf, ctx) { return _seqOfTargets(buf, "attrcert/bad-proxy-info", false, ctx); }
 
 function _acAttrSpec(node, C) {
   if (!node.children) throw NS.E(C, "an AttrSpec must be a SEQUENCE OF OBJECT IDENTIFIER");
@@ -554,9 +562,9 @@ function _acAttrSpec(node, C) {
     try { return asn1.read.oid(o); } catch (e) { throw NS.E(C, "an AttrSpec element must be an OBJECT IDENTIFIER", e); }
   });
 }
-function _aaControls(buf) {
+function _aaControls(buf, ctx) {
   var C = "attrcert/bad-aa-controls";
-  var kids = _seqChildren(buf, C, "AAControls");
+  var kids = _seqChildren(buf, C, "AAControls", ctx);
   if (kids.length > 4) throw NS.E(C, "AAControls has too many fields");
   var out = { pathLenConstraint: null, permittedAttrs: null, excludedAttrs: null, permitUnSpecified: true }, i = 0;
   if (kids[i] && _isU(kids[i], TAGS.INTEGER)) { out.pathLenConstraint = guard.range.uint31(_readInt(kids[i], C, "pathLenConstraint"), NS.E, C, "AAControls pathLenConstraint"); i++; }
@@ -581,9 +589,18 @@ _AC_EXT_DECODERS[_Oav("acProxying")] = _acProxying;
  *  through the certificate decoders, so a relying party running the sec. 6 "pointer in AC" scheme
  *  reads the distribution point and the OCSP location off the parse rather than off raw bytes. */
 var _CERT_EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
-_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = _CERT_EXT_DECODERS[_Oav("authorityKeyIdentifier")];
-_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = _CERT_EXT_DECODERS[_Oav("authorityInfoAccess")];
-_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = _CERT_EXT_DECODERS[_Oav("cRLDistributionPoints")];
+/** @internal The certificate decoders close over the namespace they were built with, so a parse
+ *  that named caps gets its own table and every decode below these three reads the caller's
+ *  figure. A caller outside a parse passes no context and reuses the module's table. */
+function _certExtDecoder(name) {
+  var key = _Oav(name);
+  return function (buf, ctx) {
+    return (ctx ? pkix.certExtensionDecoders(schema.withResources(NS, ctx)).byOid : _CERT_EXT_DECODERS)[key](buf);
+  };
+}
+_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = _certExtDecoder("authorityKeyIdentifier");
+_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = _certExtDecoder("authorityInfoAccess");
+_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = _certExtDecoder("cRLDistributionPoints");
 
 // @internal
 function validateAttributeValue(type, valueDer) {