@blamejs/pki 0.8.28 → 0.8.30

package/lib/inspect.js

@@ -31,6 +31,15 @@ var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
 var csr = require("./schema-csr");
 var cms = require("./schema-cms");
+var pkcs8 = require("./schema-pkcs8");
+var pkcs12 = require("./schema-pkcs12");
+var crmf = require("./schema-crmf");
+var cmp = require("./schema-cmp");
+var csrattrs = require("./schema-csrattrs");
+var trustanchor = require("./schema-trustanchor");
+var ocsp = require("./schema-ocsp");
+var tsp = require("./schema-tsp");
+var attrcert = require("./schema-attrcert");
 var schemaAll = require("./schema-all");
 var pkix = require("./schema-pkix");
 var guard = require("./guard-all");
@@ -84,7 +93,10 @@ function _algName(a) { return (a && (a.name || a.oid)) || "unknown"; }
 
 
 function _serial(cert, indent) {
-  var hex = cert.serialNumberHex || "";
+  /** @internal Only a hex string is read as one. A caller's pre-parsed object can carry anything here, and
+   *  the byte reader below faults on a value that is not a string rather than reporting an unreadable one. */
+  var hex = typeof cert.serialNumberHex === "string" && _isHexDigits(cert.serialNumberHex)
+    ? cert.serialNumberHex : "";
   if (hex.length % 2) hex = "0" + hex;
   var buf = Buffer.from(hex, "hex");
   if (buf.length > 1 && buf[0] === 0x00 && (buf[1] & 0x80)) buf = buf.subarray(1);
@@ -485,6 +497,15 @@ function _extension(ext, pad) {
       if (body != null) return header + "\n" + body;
     } catch (_e) { }
   }
+  /** @internal An extension whose own parser decoded it, which is how the attribute-certificate and
+   *  revocation-list tables reach here: the certificate decoders above do not know those OIDs, and without
+   *  this the decoded value fell through to a hex dump of the bytes it was decoded from. */
+  if (ext.decoded && typeof ext.decoded === "object" && ext.decoded.opaque !== true) {
+    var fromParser = _decodedRecord(ext.decoded, inner);
+    if (fromParser) return header + "\n" + fromParser;
+  }
+  var enriched = _extraFields(ext, _ROW_PLUMBING, inner);
+  if (enriched) return header + "\n" + enriched;
   return header + "\n" + _fallback(ext.value, inner);
 }
 
@@ -596,6 +617,7 @@ function _parseCms(input) { return _coerce(input, { marker: "contentType", looks
 
 
 var OID_EXTENSION_REQUEST = oid.byName("extensionRequest");
+var OID_SUBJECT_KEY_ID = oid.byName("subjectKeyIdentifier");
 var OID_CONTENT_TYPE = oid.byName("contentType");
 var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_SIGNING_TIME = oid.byName("signingTime");
@@ -686,6 +708,75 @@ function crlReport(input) {
 }
 
 
+/** @internal Whether a value is one of the four shapes the name renderer reads: a parsed Name, a
+ *  GeneralNames list, a decoded GeneralName, or a raw one still carrying its context tag. Anything else is a
+ *  record and is rendered as its fields. */
+function _looksLikeName(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return false;
+  if (v.dn !== undefined || Array.isArray(v.rdns) || Array.isArray(v.names)) return true;
+  return typeof v.tagNumber === "number" && (v.value !== undefined || Buffer.isBuffer(v.bytes));
+}
+
+/** @internal A decoded record as label/value lines. Each field is rendered by the vocabulary that already
+ *  exists for its kind, because the alternative is string conversion, which prints a decoded value as its
+ *  object notation. Depth is bounded so a record carrying a parsed structure cannot walk the whole of it. */
+function _decodedRecord(rec, pad, depth) {
+  if (depth === undefined) depth = 3;
+  var lines = [];
+  Object.keys(rec).forEach(function (k) {
+    var v = rec[k];
+    if (v === null || v === undefined || k === "opaque") return;
+    if (Buffer.isBuffer(v)) { lines.push(pad + k + ": " + _hexColon(v, {})); return; }
+    if (v instanceof Date) { lines.push(pad + k + ": " + _date(v)); return; }
+    if (typeof v !== "object") { lines.push(pad + k + ": " + _clean(String(v))); return; }
+    /** @internal Only a value that LOOKS like a name is rendered as one. Asked of every record, the name
+     *  renderer answers a non-name with the truthy `tag<undefined>:`, and that answer then stood in for the
+     *  record's own fields: a group attribute rendered as that string instead of its memberships. */
+    if (_looksLikeName(v)) {
+      var asName = _nameOrGn(v);
+      if (asName && asName !== "(none)" && asName !== "(empty)" && asName !== "(unrecognized name form)") {
+        lines.push(pad + k + ": " + asName);
+        return;
+      }
+    }
+    if (depth <= 0) return;
+    if (Array.isArray(v)) {
+      if (!v.length) return;
+      lines.push(pad + k + ":");
+      v.forEach(function (m) {
+        if (m === null || typeof m !== "object" || Buffer.isBuffer(m)) {
+          lines.push(pad + "    " + (Buffer.isBuffer(m) ? _hexColon(m, {}) : _clean(String(m))));
+        } else {
+          var sub = _decodedRecord(m, pad + "    ", depth - 1);
+          if (sub) lines.push(sub);
+        }
+      });
+      return;
+    }
+    var nested = _decodedRecord(v, pad + "    ", depth - 1);
+    if (nested) { lines.push(pad + k + ":"); lines.push(nested); }
+  });
+  return lines.join("\n");
+}
+
+/** @internal The fields a parser ENRICHED a row with, which are whatever it carries beyond the plumbing every
+ *  row has. A table that decodes its own values attaches them here rather than under `decoded`, and routing
+ *  such a row through a renderer that knows only the plumbing printed the bytes the parser had already read:
+ *  an EST key-size constraint as its DER, an OCSP archive cutoff as a GeneralizedTime's octets. */
+function _extraFields(row, skip, pad) {
+  var extra = Object.create(null), any = false;
+  Object.keys(row).forEach(function (k) {
+    if (skip.indexOf(k) !== -1) return;
+    var v = row[k];
+    if (v === null || v === undefined || v === false) return;
+    extra[k] = v;
+    any = true;
+  });
+  return any ? _decodedRecord(extra, pad) : "";
+}
+var _ROW_PLUMBING = ["oid", "name", "critical", "value", "valueBytes", "bytes", "scope", "index",
+  "containerIndex", "state", "code", "decoded", "kind", "values", "type", "extensions"];
+
 function _attribute(attr, pad) {
   var inner = pad + "    ";
   if (attr.type === OID_EXTENSION_REQUEST && Array.isArray(attr.extensions)) {
@@ -693,8 +784,27 @@ function _attribute(attr, pad) {
     attr.extensions.forEach(function (ext) { lines.push(_extension(ext, inner)); });
     return lines.join("\n");
   }
-  var header = pad + (attr.name || oid.name(attr.type) || attr.type) + ":";
-  var vals = (attr.values || []).map(function (v) { return _attrValue(attr.type, v, inner); });
+  /** @internal The registry lookup takes a dotted identifier, and a caller's object can carry anything in
+   *  `type`: asked about a number it refuses with its own code, which is not this verb's contract. */
+  var registryName = null;
+  if (!attr.name && typeof attr.type === "string") {
+    try { registryName = oid.name(attr.type); }
+    // allow:swallow-unverified drop-silent display fallback: an unreadable type prints as itself
+    catch (_notAnIdentifier) { registryName = null; }
+  }
+  var header = pad + (attr.name || registryName || String(attr.type)) + ":";
+  /** @internal Where the parser DECODED the value, render that rather than the bytes it decoded from: an
+   *  attribute certificate's whole content is the attributes it asserts, and a role naming a URI printed as
+   *  a hex run said nothing a reader could act on. An entry the decoder left opaque still prints as bytes. */
+  var vals;
+  if (Array.isArray(attr.decoded) && attr.decoded.length === _list(attr.values).length) {
+    vals = attr.decoded.map(function (d, i) {
+      if (!d || typeof d !== "object" || d.opaque === true) return _attrValue(attr.type, attr.values[i], inner);
+      return _decodedRecord(d, inner) || _attrValue(attr.type, attr.values[i], inner);
+    });
+  } else {
+    vals = _list(attr.values).map(function (v) { return _attrValue(attr.type, v, inner); });
+  }
   return vals.length ? header + "\n" + vals.join("\n") : header;
 }
 
@@ -864,7 +974,1022 @@ function cmsReport(input) {
 }
 
 
-var _INSPECT_BY_FORMAT = Object.assign(Object.create(null), { x509: certificate, crl: crlReport, csr: csrReport, cms: cmsReport });
+/** @internal The remaining detected formats, each composing the vocabulary above and each a named verb as
+ *  well as a route from `any`.
+ *
+ *  NO REPORT PRINTS PRIVATE KEY MATERIAL. A PKCS#8 and a PKCS#12 both carry a private key, and a renderer
+ *  that wrote one out would make an inspection tool a way of reading a key out of a file somebody opened
+ *  only to look at it. Each shows the algorithm, the public half where the structure carries one, and that
+ *  a private key is present, never its bytes. `inspect-formats.test.js` searches each report for byte runs
+ *  of the key in hex, base64 and colon-hex, so the rule is measured rather than stated here. */
+
+/** @internal Each predicate asks whether the object has the STRUCTURE its parser returns, not whether it
+ *  carries the marker property, because an object that merely has the marker is a caller's own object and
+ *  a report rendered from one says what the caller wrote rather than what any bytes encode. The marker
+ *  selects the predicate; the predicate is what admits the object. */
+function _looksParsedPkcs8(o) {
+  return typeof o.version === "number" && o.privateKeyAlgorithm && typeof o.privateKeyAlgorithm === "object" &&
+    Buffer.isBuffer(o.privateKey) && Array.isArray(o.attributes);
+}
+function _looksParsedPkcs12(o) {
+  return typeof o.version === "number" && typeof o.integrityMode === "string" &&
+    Array.isArray(o.safeBags) && Array.isArray(o.encryptedSafes);
+}
+/** @internal Every message has to carry the structure the renderer reads. Checking only that `messages` is
+ *  an array admitted `{ messages: [{}] }`, and the renderer then dereferenced a certTemplate that was not
+ *  there, so a caller's own object left an untyped TypeError where this door promises inspect/bad-input. */
+function _looksParsedCrmf(o) {
+  if (!Array.isArray(o.messages) || !o.messages.length) return false;
+  return o.messages.every(function (m) {
+    return !!m && typeof m === "object" && !!m.certReq && typeof m.certReq === "object" &&
+      !!m.certReq.certTemplate && typeof m.certReq.certTemplate === "object";
+  });
+}
+function _looksParsedCmp(o) {
+  return o.header && typeof o.header === "object" && o.body && typeof o.body === "object" &&
+    typeof o.body.arm === "string";
+}
+/** @internal Every item has to be one of the two shapes the parser produces, a bare object identifier or an
+ *  attribute carrying a values array, because the report reads both: an array of nullish or wrong-typed
+ *  members faulted the renderer where this door promises a typed refusal. */
+function _looksParsedCsrattrs(o) {
+  if (!Array.isArray(o.items)) return false;
+  return o.items.every(function (it) {
+    if (!it || typeof it !== "object") return false;
+    if (it.kind === "oid") return true;
+    return it.kind === "attribute" && (it.values === undefined || it.values === null || Array.isArray(it.values));
+  });
+}
+/** @internal Each anchor has to carry the member its own kind names, because that is what the report reads:
+ *  an anchor with a kind and nothing under it faulted the renderer where this door promises a typed
+ *  refusal. */
+function _looksParsedTrustAnchor(o) {
+  if (!Array.isArray(o.anchors) || !o.anchors.length) return false;
+  return o.anchors.every(function (a) {
+    if (!a || typeof a !== "object" || typeof a.kind !== "string") return false;
+    var held = a.kind === "certificate" ? a.certificate : (a.kind === "tbsCert" ? a.tbsCert : a.taInfo);
+    return !!held && typeof held === "object";
+  });
+}
+function _looksParsedOcspReq(o) {
+  if (typeof o.version !== "number" || !Array.isArray(o.requestList) || !Buffer.isBuffer(o.tbsRequestBytes)) return false;
+  return o.requestList.every(function (r) { return !!r && typeof r === "object" && !!r.certID && typeof r.certID === "object"; });
+}
+function _looksParsedOcspResp(o) {
+  var st = o.responseStatus;
+  if (!st || typeof st !== "object" || typeof st.code !== "number" || typeof st.name !== "string") return false;
+  var br = o.basicResponse;
+  /** @internal A response with no basic response is a status-only answer the report handles, but one that
+   *  HAS a basic response has to carry the answers the report walks: a responderID and a responses list whose
+   *  entries name a CertID and a status. */
+  if (br === null || br === undefined) return true;
+  if (typeof br !== "object" || !br.responderID || typeof br.responderID !== "object") return false;
+  if (!Array.isArray(br.responses)) return false;
+  return br.responses.every(function (r) {
+    return !!r && typeof r === "object" && !!r.certID && typeof r.certID === "object" &&
+      !!r.certStatus && typeof r.certStatus === "object";
+  });
+}
+/** @internal A rejected or waiting response carries `timeStampToken: null`, which is the shape RFC 3161
+ *  sec. 2.4.2 gives a non-granted status, so the token is required to be PRESENT as a key and not to be an
+ *  object. Requiring an object here refused a parsed rejection that the same bytes rendered fine. */
+/** @internal RFC 3161 sec. 2.4.2's PKIStatus. */
+var TSP_STATUS_NAMES = Object.assign(Object.create(null), {
+  0: "granted", 1: "grantedWithMods", 2: "rejection", 3: "waiting",
+  4: "revocationWarning", 5: "revocationNotification",
+});
+
+function _looksParsedTsp(o) {
+  if (typeof o.status !== "number" || !("timeStampToken" in o)) return false;
+  /** @internal PKIFailureInfo is a bit record whose asserted names are an array, so a present failInfo of any
+   *  other shape is a caller's own object and not this parser's output. The readers below still fault on
+   *  nothing, and this makes an obviously wrong shape a typed refusal rather than an empty line. */
+  if (o.failInfo !== null && o.failInfo !== undefined) {
+    if (typeof o.failInfo !== "object" || !Array.isArray(o.failInfo.bits)) return false;
+  }
+  var tok = o.timeStampToken;
+  return tok === null || (!!tok && typeof tok === "object" && !!tok.tstInfo && typeof tok.tstInfo === "object");
+}
+function _looksParsedAttrCert(o) {
+  return typeof o.version === "number" && o.holder && typeof o.holder === "object" &&
+    !!o.issuer && typeof o.issuer === "object" &&
+    Array.isArray(o.attributes) && o.signatureAlgorithm && typeof o.signatureAlgorithm === "object";
+}
+
+function _parsePkcs8(input) { return _coerce(input, { marker: "privateKeyAlgorithm", looksParsed: _looksParsedPkcs8, parsedName: "pki.schema.pkcs8.parse", parse: pkcs8.parse, badCode: "inspect/bad-pkcs8", what: "PKCS#8 private key" }); }
+function _parsePkcs12(input) { return _coerce(input, { marker: "safeBags", looksParsed: _looksParsedPkcs12, parsedName: "pki.schema.pkcs12.parse", parse: pkcs12.parse, badCode: "inspect/bad-pkcs12", what: "PKCS#12 store" }); }
+function _parseCrmf(input) { return _coerce(input, { marker: "messages", looksParsed: _looksParsedCrmf, parsedName: "pki.schema.crmf.parse", parse: crmf.parse, badCode: "inspect/bad-crmf", what: "CRMF certificate request message" }); }
+function _parseCmp(input) { return _coerce(input, { marker: "header", looksParsed: _looksParsedCmp, parsedName: "pki.schema.cmp.parse", parse: cmp.parse, badCode: "inspect/bad-cmp", what: "CMP message" }); }
+function _parseCsrattrs(input) { return _coerce(input, { marker: "items", looksParsed: _looksParsedCsrattrs, parsedName: "pki.schema.csrattrs.parse", parse: csrattrs.parse, badCode: "inspect/bad-csrattrs", what: "CSR attributes response" }); }
+function _parseTrustAnchor(input) { return _coerce(input, { marker: "anchors", looksParsed: _looksParsedTrustAnchor, parsedName: "pki.schema.trustanchor.parse", parse: trustanchor.parse, badCode: "inspect/bad-trustanchor", what: "trust anchor list" }); }
+function _parseOcspReq(input) { return _coerce(input, { marker: "requestList", looksParsed: _looksParsedOcspReq, parsedName: "pki.schema.ocsp.parseRequest", parse: ocsp.parseRequest, badCode: "inspect/bad-ocsp-request", what: "OCSP request" }); }
+function _parseOcspResp(input) { return _coerce(input, { marker: "responseStatus", looksParsed: _looksParsedOcspResp, parsedName: "pki.schema.ocsp.parseResponse", parse: ocsp.parseResponse, badCode: "inspect/bad-ocsp-response", what: "OCSP response" }); }
+function _parseTsp(input) { return _coerce(input, { marker: "timeStampToken", looksParsed: _looksParsedTsp, parsedName: "pki.schema.tsp.parseResponse", parse: tsp.parseResponse, badCode: "inspect/bad-tsp", what: "timestamp response" }); }
+function _parseAttrCert(input) { return _coerce(input, { marker: "holder", looksParsed: _looksParsedAttrCert, parsedName: "pki.schema.attrcert.parse", parse: attrcert.parse, badCode: "inspect/bad-attrcert", what: "attribute certificate" }); }
+
+/** @internal A GeneralName, a distinguished name, a GeneralNames list, or nothing, whichever the field
+ *  carries. These structures reach a name through four different shapes and a report reads one the same
+ *  way wherever it sits. The list form arrives with each member still raw, carrying its context tag and
+ *  its bytes and no decoded value, so each is read through the attribute-certificate module's own
+ *  GeneralName reader rather than rendered from the wrapper, which is what printed the whole list as one
+ *  hex run under a tag number the wrapper does not have. */
+function _nameOrGn(v) {
+  if (!v || typeof v !== "object") return "(none)";
+  if (v.dn !== undefined || Array.isArray(v.rdns)) return _dnString(v) || "(empty)";
+  if (Array.isArray(v.names)) {
+    var parts = v.names.map(function (n) {
+      if (n && n.value !== undefined) return _gn(n);
+      if (n && Buffer.isBuffer(n.bytes)) {
+        try { return _gn(attrcert.readGeneralName(n.bytes)); }
+        // allow:swallow-unverified drop-silent display fallback: an unreadable name prints as its bytes
+        catch (_unreadable) { return _gnRaw(n.bytes); }
+      }
+      return "";
+    }).filter(function (s) { return s !== ""; });
+    return parts.length ? parts.join(", ") : "(empty)";
+  }
+  /** @internal A STANDALONE GeneralName arrives raw from some parsers exactly as a list member does, and it
+   *  needs the same decode: passed straight to the renderer, a directoryName printed as its label with no
+   *  name after it and every other form printed its bytes. The list path had this and the single path did
+   *  not, which is one rule applied to one of its two callers. */
+  if (v.value === undefined && Buffer.isBuffer(v.bytes) && typeof v.tagNumber === "number") {
+    try { return _gn(attrcert.readGeneralName(v.bytes)); }
+    // allow:swallow-unverified drop-silent display fallback: an unreadable name prints as its bytes
+    catch (_unreadableSingle) { return _gnRaw(v.bytes); }
+  }
+  var g = _gn(v);
+  return g || "(unrecognized name form)";
+}
+function _optLine(L, pad, label, v) { if (v !== null && v !== undefined) L.push(pad + label + ": " + v); }
+
+/** @internal Join a short list the way a sentence does. */
+function _joinAnd(list) {
+  if (list.length <= 1) return list.join("");
+  return list.slice(0, -1).join(", ") + " and " + list[list.length - 1];
+}
+
+/** @internal A list is a list only when it IS one. `x && x.length` is true of a string and of anything else
+ *  carrying a length, and `(x || [])` passes a truthy non-array straight through, so both admitted a value
+ *  the following forEach then faulted on. These reports take a caller's pre-parsed object, whose members no
+ *  door can validate to arbitrary depth, so a report must not fault on any shape it is handed. */
+function _list(v) { return Array.isArray(v) ? v : []; }
+/** @internal The same for a member a loop body dereferences. */
+function _obj(v) { return (v !== null && typeof v === "object") ? v : {}; }
+
+/** @internal A serial reads the same wherever a report carries one, through the certificate report's own
+ *  presentation: small values as decimal with the hex beside them, long ones as wrapped colon-hex. Printed
+ *  as bare hex, the serial 99 renders "63" and reads as the decimal 63. */
+function _serialLine(hexOrValue, pad) {
+  if (hexOrValue === null || hexOrValue === undefined) return null;
+  /** @internal Only the two forms a parser produces, a hex string or a bigint. Anything else is a caller's
+   *  own value, and `toString(16)` on it reaches the hex reader with something that is not hex. */
+  var hex;
+  if (typeof hexOrValue === "string") hex = hexOrValue;
+  else if (typeof hexOrValue === "bigint" || typeof hexOrValue === "number") hex = hexOrValue.toString(16);
+  else return null;
+  if (!_isHexDigits(hex)) return null;
+  return pad + _serial({ serialNumberHex: hex }, pad.length + 4);
+}
+/** @internal Whether every character is a hex digit, by character code so no regex is involved. */
+function _isHexDigits(s) {
+  if (typeof s !== "string" || s.length === 0) return false;
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charCodeAt(i);
+    var ok = (c >= 0x30 && c <= 0x39) || (c >= 0x61 && c <= 0x66) || (c >= 0x41 && c <= 0x46);
+    if (!ok) return false;
+  }
+  return true;
+}
+function _serialInto(L, pad, hexOrValue) {
+  var line = _serialLine(hexOrValue, pad);
+  if (line !== null) L.push(line);
+}
+
+/**
+ * @primitive pki.inspect.pkcs8
+ * @signature pki.inspect.pkcs8(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 5958
+ * @related pki.schema.pkcs8.parse, pki.inspect.pkcs12
+ *
+ * Render a PKCS#8 private key as a text report: the version, the key algorithm and
+ * its parameters, the presence and length of the private key and of a public half,
+ * and the type of each attribute. No byte string from inside the file is rendered.
+ * That is structural rather than a screen on the private key, because RFC 5958 has
+ * the parser check that a v2 `OneAsymmetricKey` HAS a public half and well formed
+ * attributes, never that either is unrelated to the private key: private bytes can
+ * sit in the public `BIT STRING` or in any attribute value, so a report that wrote
+ * either out could be made to write the key out. `pki.key.export` is the verb for
+ * the bytes themselves.
+ * `input` is a PEM string, a DER Buffer, or a `pki.schema.pkcs8.parse` result; a
+ * non-PKCS#8 throws `inspect/bad-pkcs8`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   pki.inspect.pkcs8(await pki.key.export(pair.privateKey)).split("\n")[0];  // "PKCS#8 Private Key:"
+ */
+function pkcs8Report(input) {
+  var k = _parsePkcs8(input);
+  var L = ["PKCS#8 Private Key:", "    Version: " + k.version];
+  L.push("    Private Key Algorithm: " + _algName(k.privateKeyAlgorithm));
+  /** @internal The algorithm's PARAMETERS say which curve an EC key is on, and without them an EC report
+   *  named only `ecPublicKey` and identified nothing. They are public: an AlgorithmIdentifier's parameters
+   *  describe the algorithm, not the key, so rendering them discloses nothing the key itself holds. */
+  var alg = k.privateKeyAlgorithm;
+  if (alg && Buffer.isBuffer(alg.parameters)) {
+    var paramName;
+    try { paramName = oid.name(asn1.read.oid(asn1.decode(alg.parameters))); }
+    // allow:swallow-unverified drop-silent display fallback: parameters that are not an OID are not named
+    catch (_notAnOid) { paramName = null; }
+    /** @internal Named or not rendered. An AlgorithmIdentifier's parameters are whatever the file's author
+     *  put there, so a hex fallback here is another way to write the private key out: the parameters of an
+     *  unknown algorithm can hold a copy of it and the parser has no reason to refuse that. */
+    L.push("    Algorithm Parameters: " + (paramName ||
+      ("present, " + alg.parameters.length + " bytes (not rendered)")));
+  }
+  L.push("    Private Key: present, " + k.privateKey.length + " bytes (not rendered)");
+  /** @internal The public half is rendered only when the bytes are actually there: an RFC 5958 OneAsymmetricKey
+   *  carries it as a BIT STRING record and a caller's object can carry anything, and the byte renderer faults
+   *  on a value that is not a buffer rather than reporting one it cannot read. */
+  /** @internal THIS REPORT RENDERS NO BYTES FROM THE FILE, and the rule is structural rather than a
+   *  comparison because a comparison loses. RFC 5958's parser checks that a v2 OneAsymmetricKey HAS a public
+   *  half and that its attributes are well formed, never that either is unrelated to the private key, so
+   *  private bytes can sit in the public BIT STRING or in any attribute value. Screening each against the
+   *  private key needs the key's algorithm-specific inner encoding, since an Ed25519 privateKey is
+   *  `04 20 || seed` and a crafted public half carrying the seed alone matches neither direction of a
+   *  whole-buffer compare; deriving the public half instead would be a key operation, which this synchronous
+   *  renderer cannot do. So nothing from inside the file is written out: the report names the algorithm, its
+   *  parameters, what is present and how long, and the attribute types, and there is nothing left to screen.
+   *  `pki.key.export` is the verb for the bytes themselves. */
+  var pubBytes = Buffer.isBuffer(k.publicKey) ? k.publicKey : _obj(k.publicKey).bytes;
+  if (Buffer.isBuffer(pubBytes)) {
+    L.push("    Public Key: present, " + pubBytes.length + " bytes (not rendered)");
+  } else if (k.publicKey) {
+    L.push("    Public Key: present, not readable as bytes");
+  }
+  L.push("    Attributes:");
+  if (_list(k.attributes).length) {
+    _list(k.attributes).forEach(function (raw) {
+      var a = _obj(raw);
+      /** @internal The registry takes a dotted identifier and refuses anything else with its own code, which
+       *  is not this verb's contract: a caller's object can carry any `type`. */
+      var known = null;
+      if (!a.name && typeof a.type === "string") {
+        try { known = oid.name(a.type); }
+        // allow:swallow-unverified drop-silent display fallback: an unreadable type prints as itself
+        catch (_notAnIdentifier) { known = null; }
+      }
+      L.push("        " + (a.name || known || String(a.type)) + ": " +
+        _list(a.values).length + " value(s) (not rendered)");
+    });
+  } else {
+    L.push("        (none)");
+  }
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.pkcs12
+ * @signature pki.inspect.pkcs12(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 7292
+ * @related pki.schema.pkcs12.parse, pki.pkcs12.open
+ *
+ * Render a PKCS#12 store's outer structure as a text report: the version, the
+ * integrity mode, the MAC algorithm and its iteration count, and one line per safe
+ * bag giving its type. No private key is rendered, and an encrypted safe's contents
+ * are not decrypted, because this verb takes no password: the report names
+ * `pki.pkcs12.open` as what reads the contents. `input` is a PEM string, a DER
+ * Buffer, or a `pki.schema.pkcs12.parse` result; a non-PKCS#12 throws
+ * `inspect/bad-pkcs12`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "p12.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var store = await pki.pkcs12.build({ safeContents: [{ bags: [{ type: "cert", cert: cert }] }] }, { password: "1234" });
+ *   pki.inspect.pkcs12(store).split("\n")[0];  // "PKCS#12 Store:"
+ */
+/** @internal A salt's LENGTH is what says anything about the protection; its value says nothing a reader acts
+ *  on. And `pki.pkcs12.build` takes a caller-supplied salt, so a store can carry the private key bytes there
+ *  and a report printing the value would write the key out. Length only, for the same reason the key report
+ *  renders no bytes at all. */
+function _saltLine(L, salt) {
+  if (Buffer.isBuffer(salt)) L.push("        Salt: " + salt.length + " bytes (not rendered)");
+}
+
+/** @internal Whether any signer of a signed authSafe has NO certificate embedded beside it. A store can embed
+ *  a chain certificate while leaving the signer's own out, so counting the certificates answered the wrong
+ *  question: verification needs the certificate that MATCHES the signer. A SignerInfo names itself by issuer
+ *  and serial or by subject key identifier, and an embedded certificate arrives raw, so each is parsed to
+ *  compare. A certificate this parser refuses simply matches nothing. */
+function _someSignerUnmatched(signed) {
+  var signers = _list(signed.signerInfos);
+  if (!signers.length) return false;
+  var parsed = [];
+  _list(signed.certificates).forEach(function (raw) {
+    var bytes = Buffer.isBuffer(raw) ? raw : _obj(raw).bytes;
+    if (!Buffer.isBuffer(bytes)) return;
+    // allow:swallow-unverified drop-silent display fallback: a certificate this parser refuses matches nothing
+    try { parsed.push(x509.parse(bytes)); } catch (_unreadableCert) { return; }
+  });
+  return signers.some(function (rawSigner) {
+    var sid = _obj(_obj(rawSigner).sid);
+    return !parsed.some(function (c) { return _certMatchesSid(c, sid); });
+  });
+}
+function _certMatchesSid(cert, sid) {
+  if (Buffer.isBuffer(sid.subjectKeyIdentifier)) {
+    var ski = _list(cert.extensions).filter(function (e) { return _obj(e).oid === OID_SUBJECT_KEY_ID; })[0];
+    if (!ski) return false;
+    // allow:swallow-unverified drop-silent display fallback: an unreadable key id matches nothing
+    try { return asn1.read.octetString(asn1.decode(_obj(ski).value)).equals(sid.subjectKeyIdentifier); }
+    catch (_unreadableSki) { return false; }
+  }
+  if (!sid.issuer || sid.serialNumberHex === undefined) return false;
+  if (cert.serialNumberHex !== sid.serialNumberHex) return false;
+  /** @internal The RFC 5280 sec. 7.1 canonical comparison, through the shared home, because two encodings of
+   *  one name are one name: compared as bytes, a certificate whose issuer DN is encoded differently from the
+   *  SignerInfo's matched nothing and the report asked for a certificate the store already had. */
+  var a = _obj(cert.issuer).rdns, b2 = _obj(sid.issuer).rdns;
+  if (Array.isArray(a) && Array.isArray(b2)) {
+    // allow:swallow-unverified drop-silent display fallback: a name the comparison refuses falls back to bytes
+    try { return guard.name.dnEqual(a, b2, _err, "inspect/bad-input", "the signer name") === true; }
+    catch (_notComparable) { return false; }
+  }
+  var issuerBytes = _obj(sid.issuer).bytes;
+  return Buffer.isBuffer(issuerBytes) && Buffer.isBuffer(_obj(cert.issuer).bytes) &&
+    _obj(cert.issuer).bytes.equals(issuerBytes);
+}
+
+function pkcs12Report(input) {
+  var p = _parsePkcs12(input);
+  var L = ["PKCS#12 Store:", "    Version: " + p.version];
+  L.push("    Integrity Mode: " + p.integrityMode);
+  if (p.mac) {
+    L.push("    MAC:");
+    L.push("        Kind: " + p.mac.kind);
+    /** @internal RFC 9579's PBMAC1 carries the parameters that actually protect the store inside its own
+     *  structure, and the outer MacData fields then describe nothing: read from there, a store with 2048
+     *  PBKDF2 iterations reported one iteration, an empty salt, and "pbmac1" as its digest. */
+    if (p.mac.pbmac1) {
+      var kdf = p.mac.pbmac1.kdf || {};
+      _optLine(L, "        ", "Digest", p.mac.pbmac1.schemeName || p.mac.pbmac1.schemeOid);
+      _optLine(L, "        ", "Key Derivation", kdf.prfName || kdf.prfOid);
+      _optLine(L, "        ", "Iterations", kdf.iterationCount);
+      _optLine(L, "        ", "Key Length", kdf.keyLength);
+      _saltLine(L, kdf.salt);
+    } else {
+      _optLine(L, "        ", "Digest", p.mac.hashName || p.mac.hashOid);
+      _optLine(L, "        ", "Iterations", p.mac.iterations);
+      _saltLine(L, p.mac.macSalt);
+    }
+  } else {
+    L.push("    MAC: (none)");
+  }
+  L.push("    Safe Bags: " + _list(p.safeBags).length);
+  /** @internal RFC 7292 sec. 4.2.6's safeContentsBag holds further bags, and reporting only the container
+   *  made a container of keys and certificates read the same as an empty one. The no-key-material rule
+   *  carries into the nested level, because a key inside a container is still a key. */
+  (function walkBags(bags, pad) {
+    _list(bags).forEach(function (rawBag, i) {
+      var bag = _obj(rawBag);
+      /** @internal The PARSER's vocabulary, which is the ASN.1 bag-type name, not the builder's shorthand:
+       *  keyed on `shroudedKey` and `key` the marker never once fired, because a parsed bag reports itself as
+       *  `pkcs8ShroudedKeyBag` or `keyBag`. */
+      var isKey = bag.type === "pkcs8ShroudedKeyBag" || bag.type === "keyBag";
+      L.push(pad + "[" + i + "] " + bag.type + (isKey ? "  (private key, not rendered)" : "") +
+        (Array.isArray(bag.nested) ? "  (" + bag.nested.length + " nested)" : ""));
+      if (Array.isArray(bag.nested) && bag.nested.length) walkBags(bag.nested, pad + "    ");
+    });
+  })(p.safeBags, "        ");
+  L.push("    Encrypted Safes: " + _list(p.encryptedSafes).length);
+  var needsRecipientKey = false, needsSafePassword = false;
+  _list(p.encryptedSafes).forEach(function (rawSafe, i) {
+    var safe = _obj(rawSafe);
+    if (safe.type === "envelopedData") needsRecipientKey = true;
+    else needsSafePassword = true;
+    /** @internal An encrypted safe is a CMS EncryptedData, so the algorithm that protects it sits on that
+     *  structure's encryptedContentInfo rather than on the safe. Read off the safe it was absent and every
+     *  encrypted store reported its algorithm as unknown. */
+    var eci = _obj(safe.content).encryptedContentInfo;
+    /** @internal The safe's TYPE says which credential opens it, so the row names it: RFC 7292 sec. 4.1's
+     *  password privacy is an EncryptedData and its public-key privacy an EnvelopedData, and the two are
+     *  opened by different things. */
+    L.push("        [" + i + "] " + (safe.type ? safe.type + ": " : "") +
+      _algName(_obj(eci).contentEncryptionAlgorithm) + "  (not decrypted)");
+  });
+  /** @internal WHICH credential opens the contents, because naming the wrong one sends an operator to look
+   *  for something the store does not want: RFC 7292 sec. 4.1's public-key privacy is opened with a recipient
+   *  key and `pki.pkcs12.open` refuses it with pkcs12/no-recipient-key, not with a password prompt. */
+  var needs = [];
+  /** @internal Derived from what the store IS, not from whether it has encrypted safes: a public-key-integrity
+   *  store of plaintext bags is opened by its signature, a MAC-less one needs opts.allowUnauthenticated, and a
+   *  password is wanted for the MAC, for a password-encrypted safe, or for a shrouded key bag. Read off an
+   *  empty encryptedSafes list, the report asked for a password from stores that do not want one. */
+  var hasShroudedKey = (function anyShrouded(bags) {
+    return _list(bags).some(function (raw) {
+      var bag = _obj(raw);
+      return bag.type === "pkcs8ShroudedKeyBag" || anyShrouded(bag.nested);
+    });
+  })(p.safeBags);
+  if (p.integrityMode === "password" || needsSafePassword || hasShroudedKey) needs.push("the password");
+  if (needsRecipientKey) needs.push("opts.recipientKey for the enveloped safe");
+  /** @internal A store can want a credential AND be unauthenticated, and `pki.pkcs12.open` checks both: a
+   *  MAC-less store holding a shrouded key needs the password for the key and the opt for the missing MAC.
+   *  Offered as an alternative to the others, the opt went unmentioned for exactly those stores. */
+  if (p.integrityMode === "none") needs.push("opts.allowUnauthenticated, since the store carries no MAC");
+  /** @internal A public-key-integrity store is verified against the signer's certificate, and its SignedData
+   *  may carry none: then the certificate has to be supplied, and a report naming only the privacy credentials
+   *  left out an input without which opening fails. */
+  if (p.integrityMode === "public-key" && _someSignerUnmatched(_obj(p.authSafeSigned))) {
+    needs.push("opts.signerCerts, since the signed authSafe carries no certificate matching its signer");
+  }
+  if (needs.length) {
+    L.push("    The bag contents are read with pki.pkcs12.open, which needs " + _joinAnd(needs) + ".");
+  } else {
+    L.push("    The bag contents are read with pki.pkcs12.open. This store's integrity is its signature and its bags are not encrypted, so it needs no password.");
+  }
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.crmf
+ * @signature pki.inspect.crmf(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 4211
+ * @related pki.schema.crmf.parse, pki.inspect.csr
+ *
+ * Render CRMF certificate request messages as a text report: one block per message
+ * giving its request id, the certificate template's subject, issuer, validity and
+ * public key, the requested extensions, and whether a proof of possession and
+ * registration controls are present. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.crmf.parse` result; a non-CRMF throws `inspect/bad-crmf`, a
+ * wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var der = await pki.crmf.build({ certReqId: 0, certTemplate: { subject: "crmf.example",
+ *     publicKey: await pki.key.export(pair.publicKey) } }, { key: await pki.key.export(pair.privateKey) });
+ *   pki.inspect.crmf(der).split("\n")[0];  // "CRMF Certificate Request Messages:"
+ */
+function crmfReport(input) {
+  var m = _parseCrmf(input);
+  var L = ["CRMF Certificate Request Messages:", "    Messages: " + m.messages.length];
+  m.messages.forEach(function (msg, i) {
+    var req = msg.certReq, t = req.certTemplate;
+    L.push("    [" + i + "] Certificate Request:");
+    _optLine(L, "        ", "Request ID", req.certReqId === undefined ? null : String(req.certReqId));
+    /** @internal RFC 4211 sec. 5 carries the DER value, so 2 names v3, exactly as a certificate's does. The
+     *  raw value read as a request for v2, which is the opposite of what the template asks for, and the
+     *  certificate report beside it writes the same number the other way. */
+    _optLine(L, "        ", "Version", t.version === undefined || t.version === null
+      ? null : (Number(t.version) + 1) + " (0x" + Number(t.version).toString(16) + ")");
+    if (t.serialNumber !== undefined && t.serialNumber !== null) L.push("        Serial Number: " + t.serialNumber);
+    if (t.issuer) L.push("        Issuer: " + _nameOrGn(t.issuer));
+    if (t.subject) L.push("        Subject: " + _nameOrGn(t.subject));
+    if (t.signingAlg) L.push("        Signing Algorithm: " + _algName(t.signingAlg));
+    if (t.validity) {
+      L.push("        Validity:");
+      _optLine(L, "            ", "Not Before", t.validity.notBefore ? _date(t.validity.notBefore) : null);
+      _optLine(L, "            ", "Not After", t.validity.notAfter ? _date(t.validity.notAfter) : null);
+    }
+    if (t.publicKey) { L.push("        Subject Public Key Info:"); L.push(_keyBlock(t.publicKey, "            ")); }
+    if (_list(t.extensions).length) {
+      L.push("        Requested Extensions:");
+      _list(t.extensions).forEach(function (e) { L.push(_extension(_obj(e), "            ")); });
+    }
+    /** @internal WHICH proof of possession a request carries is the difference between a key whose holder
+     *  proved possession by signing and one an RA vouched for, so the form is named rather than reported as
+     *  merely present. */
+    L.push("        Proof of Possession: " + (msg.popo ? (msg.popo.type || "present") : "(none)"));
+    L.push("        Registration Controls: " + ((req.controls && req.controls.length) || 0));
+    L.push("        Registration Info: " + ((msg.regInfo && msg.regInfo.length) || 0));
+  });
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.cmp
+ * @signature pki.inspect.cmp(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 9810
+ * @related pki.schema.cmp.parse, pki.inspect.crmf
+ *
+ * Render a CMP message as a text report: the header's protocol version, sender and
+ * recipient, transaction id and nonces, the body arm the message carries, and
+ * whether protection and extra certificates are present. The body's inner content
+ * is named rather than expanded, since each arm is its own structure that its own
+ * verb reads. `input` is a PEM string, a DER Buffer, or a `pki.schema.cmp.parse`
+ * result; a non-CMP throws `inspect/bad-cmp`, a wrong-type input
+ * `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "cmp.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var der = await pki.cmp.build({ header: { sender: { directoryName: "CN=cmp.example" },
+ *     recipient: { directoryName: "CN=A CA" } },
+ *     body: { ir: { certTemplate: { subject: [{ commonName: "cmp.example" }], publicKey: await pki.key.export(pair.publicKey) } } } },
+ *     { cert: cert, key: key });
+ *   pki.inspect.cmp(der).split("\n")[0];  // "CMP Message:"
+ */
+function cmpReport(input) {
+  var m = _parseCmp(input);
+  var h = m.header, body = m.body;
+  var L = ["CMP Message:", "    Header:"];
+  _optLine(L, "        ", "Protocol Version", h.pvno);
+  L.push("        Sender: " + _nameOrGn(h.sender));
+  L.push("        Recipient: " + _nameOrGn(h.recipient));
+  if (h.messageTime) L.push("        Message Time: " + _date(h.messageTime));
+  if (h.protectionAlg) L.push("        Protection Algorithm: " + _algName(h.protectionAlg));
+  if (Buffer.isBuffer(h.transactionID)) L.push("        Transaction ID: " + _hexColon(h.transactionID, {}));
+  if (Buffer.isBuffer(h.senderNonce)) L.push("        Sender Nonce: " + _hexColon(h.senderNonce, {}));
+  if (Buffer.isBuffer(h.recipNonce)) L.push("        Recipient Nonce: " + _hexColon(h.recipNonce, {}));
+  if (Buffer.isBuffer(h.senderKID)) L.push("        Sender Key ID: " + _hexColon(h.senderKID, {}));
+  L.push("        General Info: " + ((h.generalInfo && h.generalInfo.length) || 0));
+  L.push("    Body:");
+  L.push("        Arm: " + body.arm);
+  /** @internal The error arm is expanded where the others are only named, because its CONTENT is the whole
+   *  diagnostic and no other verb renders it: a reader of an error message wants the status, the failure bits
+   *  and the code, and naming the arm alone told them only that something went wrong. */
+  if (body.arm === "error" && body.decoded && typeof body.decoded === "object") {
+    var errText = _decodedRecord(body.decoded, "            ");
+    if (errText) L.push(errText);
+  }
+  L.push("    Protection: " + (m.protection ? "present" : "(none)"));
+  L.push("    Extra Certificates: " + ((m.extraCerts && m.extraCerts.length) || 0));
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.csrattrs
+ * @signature pki.inspect.csrattrs(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 7030, RFC 8951
+ * @related pki.schema.csrattrs.parse, pki.inspect.csr
+ *
+ * Render an EST CSR Attributes response as a text report: one line per item, each
+ * either a bare object identifier the server asks the client to supply or an
+ * attribute with its type and values. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.csrattrs.parse` result; a non-CsrAttrs throws
+ * `inspect/bad-csrattrs`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var b = pki.asn1.build;
+ *   var der = b.sequence([b.oid("1.2.840.113549.1.9.7")]);
+ *   pki.inspect.csrattrs(der).split("\n")[0];  // "EST CSR Attributes:"
+ */
+function csrattrsReport(input) {
+  var a = _parseCsrattrs(input);
+  var L = ["EST CSR Attributes:", "    Items: " + a.items.length];
+  a.items.forEach(function (item, i) {
+    var label = item.kind === "oid" ? "OID" : "Attribute";
+    var name = item.name || item.oid || "unknown";
+    L.push("    [" + i + "] " + label + ": " + name + (item.name && item.oid ? " (" + item.oid + ")" : ""));
+    /** @internal The CONSTRAINT a client has to act on is what the parser added beside the raw value: a key
+     *  size, a curve set, a template. Printed as its DER, a request for a 2048-bit key read as four bytes. */
+    var constraint = _extraFields(item, _ROW_PLUMBING, "        ");
+    if (constraint) L.push(constraint);
+    if (item.kind !== "oid" && _list(item.values).length) {
+      L.push("        Values: " + _list(item.values).length);
+      _list(item.values).forEach(function (v) {
+        /** @internal An attribute value a server chose is escaped for the reason a distinguished name is. */
+        L.push("            " + (Buffer.isBuffer(v) ? _hexColon(v, {}) : _clean(String(v))));
+      });
+    }
+  });
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.trustanchor
+ * @signature pki.inspect.trustanchor(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 5914
+ * @related pki.schema.trustanchor.parse, pki.inspect.certificate
+ *
+ * Render an RFC 5914 trust anchor list as a text report: one block per anchor
+ * giving which of the three forms it takes, its public key, key identifier and
+ * title where present, and the certificate path controls that bound what it may
+ * anchor. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.trustanchor.parse` result; a non-list throws
+ * `inspect/bad-trustanchor`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var b = pki.asn1.build;
+ *   var spki = await pki.key.export(pair.publicKey);
+ *   var der = b.sequence([b.explicit(2, b.sequence([b.raw(spki), b.octetString(Buffer.alloc(20, 1))]))]);
+ *   pki.inspect.trustanchor(der).split("\n")[0];  // "Trust Anchor List:"
+ */
+function trustAnchorReport(input) {
+  var t = _parseTrustAnchor(input);
+  var L = ["Trust Anchor List:", "    Anchors: " + t.anchors.length];
+  t.anchors.forEach(function (a, i) {
+    L.push("    [" + i + "] Form: " + a.kind);
+    /** @internal RFC 5914 sec. 3 gives three forms, and only the TrustAnchorInfo one carries its key and
+     *  name at the top: the other two hold a certificate, whose subject and subjectPublicKeyInfo are what
+     *  name the anchor. Read as though every form were TrustAnchorInfo, a certificate anchor rendered its
+     *  form and nothing else, so two different anchors produced the same report. */
+    var held = a.kind === "certificate" ? a.certificate : (a.kind === "tbsCert" ? a.tbsCert : null);
+    if (held) {
+      if (held.subject) L.push("        Subject: " + _dnString(held.subject));
+      if (held.issuer) L.push("        Issuer: " + _dnString(held.issuer));
+      if (held.serialNumberHex) _serialInto(L, "        ", held.serialNumberHex);
+      if (held.subjectPublicKeyInfo) {
+        L.push("        Subject Public Key Info:");
+        L.push(_keyBlock(held.subjectPublicKeyInfo, "            "));
+      }
+      /** @internal Rendered, not counted, and for the same reason the TrustAnchorInfo arm renders its own:
+       *  the extensions bound what trusting the anchor means, so a count made a path-limited anchor read the
+       *  same as an unlimited one. One rule, both arms. */
+      if (_list(held.extensions).length) {
+        L.push("        Extensions:");
+        _list(held.extensions).forEach(function (e) { L.push(_extension(_obj(e), "            ")); });
+      }
+      return;
+    }
+    var info = a.taInfo;
+    if (info.pubKey) { L.push("        Subject Public Key Info:"); L.push(_keyBlock(info.pubKey, "            ")); }
+    if (Buffer.isBuffer(info.keyId)) L.push("        Key Identifier: " + _hexColon(info.keyId, {}));
+    /** @internal A taTitle is text whoever wrote the anchor list chose, so it is escaped as the rest are. */
+    _optLine(L, "        ", "Title", info.taTitle == null ? null : _clean(String(info.taTitle)));
+    /** @internal RFC 5914 sec. 3's exts carry certificate extensions that bound what trusting the anchor
+     *  means, a basicConstraints path length among them. Skipped, an anchor carrying one read the same as one
+     *  carrying none. */
+    if (_list(info.exts).length) {
+      L.push("        Extensions:");
+      _list(info.exts).forEach(function (e) { L.push(_extension(_obj(e), "            ")); });
+    }
+    /** @internal RFC 5914 sec. 3 excludes some extension types from `exts`, and the parser drops one it finds
+     *  there while recording its identifier. Unmentioned, an anchor that tried to carry a name constraint in
+     *  that field read the same as one that carried nothing, and the constraint it named is not in force. */
+    if (_list(info.excludedExtensions).length) {
+      L.push("        Extensions the profile excludes here, dropped and not in force:");
+      _list(info.excludedExtensions).forEach(function (o) {
+        L.push("            " + (oid.name(String(o)) || String(o)) + " (" + String(o) + ")");
+      });
+    }
+    var cpc = info.certPath;
+    if (cpc) {
+      L.push("        Certificate Path Controls:");
+      if (cpc.taName) L.push("            Name: " + _nameOrGn(cpc.taName));
+      _optLine(L, "            ", "Path Length", cpc.pathLenConstraint);
+      /** @internal The policy IDENTIFIERS, because a count made two anchors restricted to different single
+       *  policies read the same, and which policies an anchor is restricted to is what a reader asks. */
+      if (_list(cpc.policySet).length) {
+        L.push("            Policies:");
+        _list(cpc.policySet).forEach(function (pol) {
+          var p = _obj(pol);
+          L.push("                " + (p.name ? p.name + " (" + p.policyIdentifier + ")" : String(p.policyIdentifier)));
+        });
+      }
+      /** @internal RFC 5914 sec. 3's policyFlags is a BIT STRING the parser decodes to a record of named
+       *  booleans, so it has no length: read as an array the line never ran and a trust anchor's active
+       *  policy restrictions were absent from the report rather than shown as off. */
+      if (cpc.policyFlags) {
+        var onFlags = Object.keys(cpc.policyFlags).filter(function (n) { return cpc.policyFlags[n] === true; });
+        L.push("            Policy Flags: " + (onFlags.length ? onFlags.join(", ") : "(none set)"));
+      }
+      /** @internal The subtrees an anchor may certify within are what a reader inspects an anchor to learn,
+       *  and omitted they made a restricted anchor read identically to an unrestricted one. The shape is the
+       *  certificate extension's own, so the extension renderer formats it rather than a second copy. */
+      if (cpc.nameConstr) {
+        var ncText = EXT_RENDERERS.nameConstraints(cpc.nameConstr, "                ");
+        if (ncText) { L.push("            Name Constraints:"); L.push(ncText); }
+      }
+    }
+  });
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.ocspRequest
+ * @signature pki.inspect.ocspRequest(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 6960
+ * @related pki.schema.ocsp.parseRequest, pki.inspect.ocspResponse
+ *
+ * Render an OCSP request as a text report: the version, the requestor name where
+ * one is given, one block per requested certificate giving the CertID's hash
+ * algorithm and the issuer name and key hashes with the serial asked about, the
+ * request extensions, and whether the request is signed. `input` is a PEM string, a
+ * DER Buffer, or a `pki.schema.ocsp.parseRequest` result; a non-request throws
+ * `inspect/bad-ocsp-request`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "ocsp.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var der = await pki.ocsp.buildRequest({ cert: cert, issuer: cert });
+ *   pki.inspect.ocspRequest(der).split("\n")[0];  // "OCSP Request:"
+ */
+function ocspRequestReport(input) {
+  var r = _parseOcspReq(input);
+  var L = ["OCSP Request:", "    Version: " + r.version];
+  L.push("    Requestor Name: " + (r.requestorName ? _nameOrGn(r.requestorName) : "(none)"));
+  L.push("    Requests: " + r.requestList.length);
+  r.requestList.forEach(function (req, i) {
+    var id = req.certID;
+    L.push("        [" + i + "] Certificate ID:");
+    L.push("            Hash Algorithm: " + _algName(id.hashAlgorithm));
+    if (Buffer.isBuffer(id.issuerNameHash)) L.push("            Issuer Name Hash: " + _hexColon(id.issuerNameHash, {}));
+    if (Buffer.isBuffer(id.issuerKeyHash)) L.push("            Issuer Key Hash: " + _hexColon(id.issuerKeyHash, {}));
+    _serialInto(L, "            ", id.serialNumberHex || id.serialNumber);
+    if (_list(req.singleRequestExtensions).length) {
+      L.push("            Single Request Extensions:");
+      _list(req.singleRequestExtensions).forEach(function (e) { L.push(_extension(_obj(e), "                ")); });
+    }
+  });
+  if (_list(r.requestExtensions).length) {
+    L.push("    Request Extensions:");
+    _list(r.requestExtensions).forEach(function (e) { L.push(_extension(_obj(e), "        ")); });
+  } else {
+    L.push("    Request Extensions: (none)");
+  }
+  L.push("    Signature: " + (r.optionalSignature ? "present" : "(unsigned)"));
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.ocspResponse
+ * @signature pki.inspect.ocspResponse(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 6960
+ * @related pki.schema.ocsp.parseResponse, pki.inspect.ocspRequest
+ *
+ * Render an OCSP response as a text report: the response status, and for a basic
+ * response the responder id, the time it was produced, one block per answer giving
+ * the CertID, the certificate's status with its revocation time and reason where it
+ * is revoked, and the validity window of the answer, plus the response extensions
+ * and the certificates carried for the relying party to chain. `input` is a PEM
+ * string, a DER Buffer, or a `pki.schema.ocsp.parseResponse` result; a non-response
+ * throws `inspect/bad-ocsp-response`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "ocsp.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var der = await pki.ocsp.sign({ responderID: "byName",
+ *     responses: [{ cert: cert, issuer: cert, status: "good", thisUpdate: new Date("2026-01-02T00:00:00Z") }] },
+ *     { cert: cert, key: key });
+ *   pki.inspect.ocspResponse(der).split("\n")[0];  // "OCSP Response:"
+ */
+function ocspResponseReport(input) {
+  var r = _parseOcspResp(input);
+  var st = r.responseStatus;
+  var L = ["OCSP Response:", "    Response Status: " + st.name];
+  if (r.responseBytes) L.push("    Response Type: " + (r.responseBytes.responseTypeName || r.responseBytes.responseType));
+  var br = r.basicResponse;
+  if (!br) { L.push("    (no basic response to render)"); return L.join("\n") + "\n"; }
+  L.push("    Version: " + br.version);
+  /** @internal RFC 6960 sec. 4.2.1 gives ResponderID two forms, and the key form is a hash rather than a
+   *  name: passed to the name renderer it printed neither, so a responder that identifies itself by key was
+   *  not identified in the report at all. */
+  L.push("    Responder ID: " + (Buffer.isBuffer(br.responderID.byKey)
+    ? "keyHash:" + _hexColon(br.responderID.byKey, {})
+    : _nameOrGn(br.responderID.byName)));
+  if (br.producedAt) L.push("    Produced At: " + _date(br.producedAt));
+  L.push("    Responses: " + br.responses.length);
+  br.responses.forEach(function (one, i) {
+    var id = one.certID;
+    L.push("        [" + i + "] Certificate ID:");
+    L.push("            Hash Algorithm: " + _algName(id.hashAlgorithm));
+    if (Buffer.isBuffer(id.issuerNameHash)) L.push("            Issuer Name Hash: " + _hexColon(id.issuerNameHash, {}));
+    if (Buffer.isBuffer(id.issuerKeyHash)) L.push("            Issuer Key Hash: " + _hexColon(id.issuerKeyHash, {}));
+    _serialInto(L, "            ", id.serialNumberHex || id.serialNumber);
+    var status = one.certStatus;
+    L.push("            Cert Status: " + status.type);
+    if (status.revocationTime) L.push("            Revocation Time: " + _date(status.revocationTime));
+    _optLine(L, "            ", "Revocation Reason", status.revocationReason);
+    if (one.thisUpdate) L.push("            This Update: " + _date(one.thisUpdate));
+    L.push("            Next Update: " + (one.nextUpdate ? _date(one.nextUpdate) : "NONE"));
+    if (_list(one.singleExtensions).length) {
+      L.push("            Single Extensions:");
+      _list(one.singleExtensions).forEach(function (e) { L.push(_extension(_obj(e), "                ")); });
+    }
+  });
+  if (_list(br.responseExtensions).length) {
+    L.push("    Response Extensions:");
+    _list(br.responseExtensions).forEach(function (e) { L.push(_extension(_obj(e), "        ")); });
+  }
+  if (br.signatureAlgorithm) L.push("    Signature Algorithm: " + _algName(br.signatureAlgorithm));
+  L.push("    Certificates: " + ((br.certs && br.certs.length) || 0));
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.tsp
+ * @signature pki.inspect.tsp(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 3161
+ * @related pki.schema.tsp.parseResponse, pki.inspect.cms
+ *
+ * Render an RFC 3161 timestamp response as a text report: the PKI status with its
+ * status strings and failure info, and the TSTInfo inside the token, giving the
+ * policy, the message imprint, the serial, the time it was stamped with its
+ * accuracy and ordering, the nonce, and the TSA name. The token's own CMS structure,
+ * its signer identifier and its signed attributes, is what `pki.inspect.cms`
+ * renders, and a bare timestamp TOKEN is a CMS ContentInfo rather than a response,
+ * so that verb reads one of those directly. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.tsp.parseResponse` result; a non-response throws `inspect/bad-tsp`,
+ * a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey), spki = await pki.key.export(pair.publicKey);
+ *   var ca = await pki.x509.sign({ subject: "tsa.example", subjectPublicKey: spki,
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
+ *     extensions: { keyUsage: ["digitalSignature"], extendedKeyUsage: ["timeStamping"], extendedKeyUsageCritical: true } },
+ *     { key: key });
+ *   var imprint = { hashAlgorithm: "sha256", hashedMessage: Buffer.alloc(32, 7) };
+ *   var token = await pki.tsp.sign(imprint, { cert: ca, key: key }, { policy: "1.2.3", serialNumber: 1 });
+ *   pki.inspect.tsp(pki.tsp.response(token, {})).split("\n")[0];  // "Timestamp Response:"
+ */
+function tspReport(input) {
+  var r = _parseTsp(input);
+  /** @internal RFC 3161 sec. 2.4.2's PKIStatus values need different handling from each other, and a bare
+   *  integer said which only to a reader who knows the table: a rejection and a response still being waited
+   *  on both read as a number. */
+  var statusName = TSP_STATUS_NAMES[r.status];
+  var L = ["Timestamp Response:",
+    "    Status: " + r.status + (statusName ? " (" + statusName + ")" : "")];
+  /** @internal A statusString is text a responder chose, so it reaches the report through the same escape
+   *  every other caller-controlled string does: copied raw, a newline forges a report line and a terminal
+   *  escape rewrites the screen around it. */
+  if (r.statusString) {
+    var strings = Array.isArray(r.statusString) ? r.statusString : [r.statusString];
+    L.push("    Status String: " + strings.map(function (s) { return _clean(String(s)); }).join("; "));
+  }
+  /** @internal PKIFailureInfo is a BIT STRING, and the parser decodes it to a record carrying the named
+   *  bits it asserts in `bits`. Read as an array or a string it rendered as its own object notation and the
+   *  reason a request was rejected, which is the one thing this line is for, was lost. */
+  if (r.failInfo) L.push("    Failure Info: " + _list(_obj(r.failInfo).bits).join(", "));
+  var tok = r.timeStampToken;
+  if (!tok) { L.push("    Token: (none)"); return L.join("\n") + "\n"; }
+  var t = tok.tstInfo;
+  L.push("    TSTInfo:");
+  _optLine(L, "        ", "Version", t.version);
+  _optLine(L, "        ", "Policy", t.policyName ? t.policyName + " (" + t.policy + ")" : t.policy);
+  if (t.messageImprint) {
+    L.push("        Message Imprint:");
+    L.push("            Hash Algorithm: " + _algName(t.messageImprint.hashAlgorithm));
+    if (Buffer.isBuffer(t.messageImprint.hashedMessage)) {
+      L.push("            Hashed Message:");
+      L.push(_hexColon(t.messageImprint.hashedMessage, { wrap: 16, indent: 16 }));
+    }
+  }
+  _serialInto(L, "        ", t.serialNumberHex || t.serialNumber);
+  /** @internal A timestamp's value is the instant it names, and RFC 3161 sec. 2.4.2 puts the sub-second part
+   *  in the GeneralizedTime's fraction, which the shared date renderer does not carry. Dropped, two stamps a
+   *  fraction of a second apart read as the same instant. */
+  if (t.genTime) {
+    L.push("        Gen Time: " + _date(t.genTime) +
+      (t.genTimeFraction ? "  (fraction: ." + t.genTimeFraction + ")" : ""));
+  }
+  if (t.accuracy) {
+    var acc = [];
+    if (t.accuracy.seconds != null) acc.push(t.accuracy.seconds + "s");
+    if (t.accuracy.millis != null) acc.push(t.accuracy.millis + "ms");
+    if (t.accuracy.micros != null) acc.push(t.accuracy.micros + "us");
+    L.push("        Accuracy: " + (acc.length ? acc.join(" ") : "(empty)"));
+  } else {
+    L.push("        Accuracy: (none stated)");
+  }
+  L.push("        Ordering: " + (t.ordering === true));
+  if (t.nonceHex) L.push("        Nonce: " + t.nonceHex);
+  if (t.tsa) L.push("        TSA: " + _nameOrGn(t.tsa));
+  if (_list(t.extensions).length) {
+    L.push("        Extensions:");
+    _list(t.extensions).forEach(function (e) { L.push(_extension(_obj(e), "            ")); });
+  }
+  L.push("    Certificates: " + _list(tok.certificates).length);
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.attrcert
+ * @signature pki.inspect.attrcert(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 5755
+ * @related pki.schema.attrcert.parse, pki.inspect.certificate
+ *
+ * Render an RFC 5755 attribute certificate as a text report: the version, the
+ * holder and the issuer in whichever form each takes, the serial, the validity
+ * period, the attributes the certificate asserts, its extensions, and the signature
+ * algorithm. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.attrcert.parse` result; a non-attribute-certificate throws
+ * `inspect/bad-attrcert`, a wrong-type input `inspect/bad-input`. An
+ * X.509-1997 v1 attribute certificate is not parsed by this build, and the report
+ * surfaces that refusal rather than rendering a partial one.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "CN=Alice" } },
+ *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
+ *     attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
+ *     { name: "CN=An AA", publicKey: await pki.key.export(pair.publicKey), key: await pki.key.export(pair.privateKey) });
+ *   pki.inspect.attrcert(der).split("\n")[0];  // "Attribute Certificate:"
+ */
+function attrCertReport(input) {
+  var a = _parseAttrCert(input);
+  var L = ["Attribute Certificate:", "    Data:"];
+  L.push("        Version: " + a.version);
+  var holder = a.holder;
+  L.push("        Holder:");
+  if (holder.entityName) L.push("            Entity Name: " + _nameOrGn(holder.entityName));
+  if (holder.baseCertificateID) {
+    var bid = holder.baseCertificateID;
+    L.push("            Base Certificate ID:");
+    if (bid.issuer) L.push("                Issuer: " + _nameOrGn(bid.issuer));
+    /** @internal RFC 5755's IssuerSerial carries an optional issuerUID, which distinguishes two issuers that
+     *  share a name, so a holder identified with one was reported without the field that identifies it. */
+    if (bid.issuerUID) {
+      var uid = Buffer.isBuffer(bid.issuerUID) ? bid.issuerUID : _obj(bid.issuerUID).bytes;
+      if (Buffer.isBuffer(uid)) L.push("                Issuer Unique ID: " + _hexColon(uid, {}));
+    }
+    /** @internal RFC 5755's IssuerSerial names its field `serial`, which the parser surfaces as `serial`
+     *  and `serialHex`, not as the `serialNumber` a certificate carries. Read by the certificate's names
+     *  both operands were undefined and the holder's serial was dropped, leaving two holders under one
+     *  issuer indistinguishable in the report. */
+    _serialInto(L, "                ", bid.serialHex || bid.serial);
+  }
+  /** @internal The DIGEST is what identifies a holder named this way, so the algorithm alone left every
+   *  holder identified by one digest algorithm reading the same. The object type says what was hashed. */
+  if (holder.objectDigestInfo) {
+    var odi = holder.objectDigestInfo;
+    L.push("            Object Digest Info:");
+    L.push("                Digested Object Type: " +
+      ((odi.digestedObjectType && odi.digestedObjectType.name) || "unspecified"));
+    if (odi.otherObjectTypeID) L.push("                Other Object Type: " + odi.otherObjectTypeID);
+    L.push("                Digest Algorithm: " + _algName(odi.digestAlgorithm));
+    var digestBytes = odi.objectDigest && (Buffer.isBuffer(odi.objectDigest) ? odi.objectDigest : odi.objectDigest.bytes);
+    if (Buffer.isBuffer(digestBytes)) {
+      L.push("                Digest:");
+      L.push(_hexColon(digestBytes, { wrap: 16, indent: 20 }));
+    }
+  }
+  /** @internal RFC 5755 sec. 4.2.3's V2Form names the issuer by name, by a base certificate id, or by an
+   *  object digest, and only the first was rendered: an issuer identified either other way appeared as
+   *  nothing at all. The v1Form is a GeneralNames list, which the name renderer reads. */
+  var iss = a.issuer;
+  var issuedBy = iss.v2Form ? _nameOrGn(iss.v2Form.issuerName) : _nameOrGn(iss.v1Form || iss);
+  if (issuedBy === "(none)" && iss.v2Form) {
+    var v2 = iss.v2Form;
+    if (v2.baseCertificateID) {
+      issuedBy = "baseCertificateID " + _nameOrGn(v2.baseCertificateID.issuer) +
+        (v2.baseCertificateID.serialHex ? " serial " + v2.baseCertificateID.serialHex : "");
+    } else if (v2.objectDigestInfo) {
+      issuedBy = "objectDigest " + _algName(v2.objectDigestInfo.digestAlgorithm);
+    }
+  }
+  L.push("        Issuer: " + issuedBy);
+  if (iss.form) L.push("        Issuer Form: " + iss.form);
+  L.push("        " + _serial(a, 12));
+  if (a.validity) {
+    L.push("        Validity:");
+    if (a.validity.notBeforeTime) L.push("            Not Before: " + _date(a.validity.notBeforeTime));
+    if (a.validity.notAfterTime) L.push("            Not After : " + _date(a.validity.notAfterTime));
+  }
+  /** @internal RFC 5755's optional top-level issuerUniqueID, which tells two issuers sharing a name apart the
+   *  way the holder's own does, and which the report left out entirely. */
+  if (a.issuerUniqueID) {
+    var acUid = Buffer.isBuffer(a.issuerUniqueID) ? a.issuerUniqueID : _obj(a.issuerUniqueID).bytes;
+    if (Buffer.isBuffer(acUid)) L.push("        Issuer Unique ID: " + _hexColon(acUid, {}));
+  }
+  L.push("        Attributes:");
+  if (_list(a.attributes).length) _list(a.attributes).forEach(function (at) { L.push(_attribute(_obj(at), "            ")); });
+  else L.push("            (none)");
+  if (_list(a.extensions).length) {
+    L.push("        Extensions:");
+    _list(a.extensions).forEach(function (e) { L.push(_extension(_obj(e), "            ")); });
+  }
+  L.push("    Signature Algorithm: " + _algName(a.signatureAlgorithm));
+  return L.join("\n") + "\n";
+}
+
+var _INSPECT_BY_FORMAT = Object.assign(Object.create(null), {
+  x509: certificate, crl: crlReport, csr: csrReport, cms: cmsReport,
+  pkcs8: pkcs8Report, pkcs12: pkcs12Report, crmf: crmfReport, cmp: cmpReport,
+  csrattrs: csrattrsReport, trustanchor: trustAnchorReport,
+  "ocsp-request": ocspRequestReport, "ocsp-response": ocspResponseReport,
+  tsp: tspReport, attrcert: attrCertReport,
+});
 
 /**
  * @primitive pki.inspect.any
@@ -875,11 +2000,12 @@ var _INSPECT_BY_FORMAT = Object.assign(Object.create(null), { x509: certificate,
  * @related pki.schema.detectFormat, pki.inspect.certificate
  *
  * Detect which PKI format `input` (a PEM string or DER Buffer) encodes and render
- * it with the matching report, the inspect analogue of `pki.schema.parse`. Routes
- * a certificate / CRL / CSR / CMS to `certificate` / `crl` / `csr` / `cms`; a
- * detected but out-of-scope format (OCSP, TSP, PKCS#8/#12, CRMF, CMP, ...) throws
- * `inspect/unsupported-format` naming it, and an unrecognized input
- * `inspect/bad-input`.
+ * it with the matching report, the inspect analogue of `pki.schema.parse`. Every
+ * format `pki.schema.all()` detects has a report and its own named verb, so the
+ * same bytes render the same whether the format is detected or asked for by name.
+ * An X.509-1997 v1 attribute certificate is detected so it can be named, and it is
+ * refused with the reason its own parser gives rather than as an unsupported
+ * format. An unrecognized input throws `inspect/bad-input`.
  *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -896,7 +2022,17 @@ function any(input) {
   } catch (e) { throw _err("inspect/bad-input", "input is not a decodable DER Buffer or PEM string", e); }
   if (fmt === null) throw _err("inspect/bad-input", "input does not match any registered PKI format");
   var render = _INSPECT_BY_FORMAT[fmt];
-  if (!render) throw _err("inspect/unsupported-format", "inspect does not support the detected format \"" + fmt + "\" (supported: certificate, crl, csr, cms)");
+  /** @internal A format with no renderer is one whose parser refuses the bytes outright, and the reason
+   *  it refuses is what a reader of that file needs. `attrcert-v1` is the case: an X.509-1997 attribute
+   *  certificate is detected so it can be named rather than misread as the v2 form, and its parser
+   *  throws `attrcert/legacy-v1-not-supported`. Reporting "inspect does not support this format" would
+   *  send an operator looking for a missing feature instead of telling them which form they hold, so the
+   *  format's own parse runs and its error propagates. */
+  if (!render) {
+    schemaAll.parse(der);
+    throw _err("inspect/unsupported-format", "inspect does not support the detected format \"" + fmt +
+      "\" (supported: " + Object.keys(_INSPECT_BY_FORMAT).sort().join(", ") + ")");
+  }
   return render(der);
 }
 
@@ -905,6 +2041,16 @@ module.exports = {
   crl: crlReport,
   csr: csrReport,
   cms: cmsReport,
+  pkcs8: pkcs8Report,
+  pkcs12: pkcs12Report,
+  crmf: crmfReport,
+  cmp: cmpReport,
+  csrattrs: csrattrsReport,
+  trustanchor: trustAnchorReport,
+  ocspRequest: ocspRequestReport,
+  ocspResponse: ocspResponseReport,
+  tsp: tspReport,
+  attrcert: attrCertReport,
   any: any,
   renderedExtensions: Object.keys(EXT_RENDERERS),
 };