@blamejs/pki 0.8.28 → 0.8.31

package/lib/inspect.js

@@ -31,6 +31,15 @@ var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
 var csr = require("./schema-csr");
 var cms = require("./schema-cms");
+var pkcs8 = require("./schema-pkcs8");
+var pkcs12 = require("./schema-pkcs12");
+var crmf = require("./schema-crmf");
+var cmp = require("./schema-cmp");
+var csrattrs = require("./schema-csrattrs");
+var trustanchor = require("./schema-trustanchor");
+var ocsp = require("./schema-ocsp");
+var tsp = require("./schema-tsp");
+var attrcert = require("./schema-attrcert");
 var schemaAll = require("./schema-all");
 var pkix = require("./schema-pkix");
 var guard = require("./guard-all");
@@ -84,7 +93,10 @@ function _algName(a) { return (a && (a.name || a.oid)) || "unknown"; }
 
 
 function _serial(cert, indent) {
-  var hex = cert.serialNumberHex || "";
+  /** @internal Only a hex string is read as one. A caller's pre-parsed object can carry anything here, and
+   *  the byte reader below faults on a value that is not a string rather than reporting an unreadable one. */
+  var hex = typeof cert.serialNumberHex === "string" && _isHexDigits(cert.serialNumberHex)
+    ? cert.serialNumberHex : "";
   if (hex.length % 2) hex = "0" + hex;
   var buf = Buffer.from(hex, "hex");
   if (buf.length > 1 && buf[0] === 0x00 && (buf[1] & 0x80)) buf = buf.subarray(1);
@@ -485,6 +497,15 @@ function _extension(ext, pad) {
       if (body != null) return header + "\n" + body;
     } catch (_e) { }
   }
+  /** @internal An extension whose own parser decoded it, which is how the attribute-certificate and
+   *  revocation-list tables reach here: the certificate decoders above do not know those OIDs, and without
+   *  this the decoded value fell through to a hex dump of the bytes it was decoded from. */
+  if (ext.decoded && typeof ext.decoded === "object" && ext.decoded.opaque !== true) {
+    var fromParser = _decodedRecord(ext.decoded, inner);
+    if (fromParser) return header + "\n" + fromParser;
+  }
+  var enriched = _extraFields(ext, _ROW_PLUMBING, inner);
+  if (enriched) return header + "\n" + enriched;
   return header + "\n" + _fallback(ext.value, inner);
 }
 
@@ -596,6 +617,7 @@ function _parseCms(input) { return _coerce(input, { marker: "contentType", looks
 
 
 var OID_EXTENSION_REQUEST = oid.byName("extensionRequest");
+var OID_SUBJECT_KEY_ID = oid.byName("subjectKeyIdentifier");
 var OID_CONTENT_TYPE = oid.byName("contentType");
 var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_SIGNING_TIME = oid.byName("signingTime");
@@ -686,6 +708,75 @@ function crlReport(input) {
 }
 
 
+/** @internal Whether a value is one of the four shapes the name renderer reads: a parsed Name, a
+ *  GeneralNames list, a decoded GeneralName, or a raw one still carrying its context tag. Anything else is a
+ *  record and is rendered as its fields. */
+function _looksLikeName(v) {
+  if (!v || typeof v !== "object" || Array.isArray(v)) return false;
+  if (v.dn !== undefined || Array.isArray(v.rdns) || Array.isArray(v.names)) return true;
+  return typeof v.tagNumber === "number" && (v.value !== undefined || Buffer.isBuffer(v.bytes));
+}
+
+/** @internal A decoded record as label/value lines. Each field is rendered by the vocabulary that already
+ *  exists for its kind, because the alternative is string conversion, which prints a decoded value as its
+ *  object notation. Depth is bounded so a record carrying a parsed structure cannot walk the whole of it. */
+function _decodedRecord(rec, pad, depth) {
+  if (depth === undefined) depth = 3;
+  var lines = [];
+  Object.keys(rec).forEach(function (k) {
+    var v = rec[k];
+    if (v === null || v === undefined || k === "opaque") return;
+    if (Buffer.isBuffer(v)) { lines.push(pad + k + ": " + _hexColon(v, {})); return; }
+    if (v instanceof Date) { lines.push(pad + k + ": " + _date(v)); return; }
+    if (typeof v !== "object") { lines.push(pad + k + ": " + _clean(String(v))); return; }
+    /** @internal Only a value that LOOKS like a name is rendered as one. Asked of every record, the name
+     *  renderer answers a non-name with the truthy `tag<undefined>:`, and that answer then stood in for the
+     *  record's own fields: a group attribute rendered as that string instead of its memberships. */
+    if (_looksLikeName(v)) {
+      var asName = _nameOrGn(v);
+      if (asName && asName !== "(none)" && asName !== "(empty)" && asName !== "(unrecognized name form)") {
+        lines.push(pad + k + ": " + asName);
+        return;
+      }
+    }
+    if (depth <= 0) return;
+    if (Array.isArray(v)) {
+      if (!v.length) return;
+      lines.push(pad + k + ":");
+      v.forEach(function (m) {
+        if (m === null || typeof m !== "object" || Buffer.isBuffer(m)) {
+          lines.push(pad + "    " + (Buffer.isBuffer(m) ? _hexColon(m, {}) : _clean(String(m))));
+        } else {
+          var sub = _decodedRecord(m, pad + "    ", depth - 1);
+          if (sub) lines.push(sub);
+        }
+      });
+      return;
+    }
+    var nested = _decodedRecord(v, pad + "    ", depth - 1);
+    if (nested) { lines.push(pad + k + ":"); lines.push(nested); }
+  });
+  return lines.join("\n");
+}
+
+/** @internal The fields a parser ENRICHED a row with, which are whatever it carries beyond the plumbing every
+ *  row has. A table that decodes its own values attaches them here rather than under `decoded`, and routing
+ *  such a row through a renderer that knows only the plumbing printed the bytes the parser had already read:
+ *  an EST key-size constraint as its DER, an OCSP archive cutoff as a GeneralizedTime's octets. */
+function _extraFields(row, skip, pad) {
+  var extra = Object.create(null), any = false;
+  Object.keys(row).forEach(function (k) {
+    if (skip.indexOf(k) !== -1) return;
+    var v = row[k];
+    if (v === null || v === undefined || v === false) return;
+    extra[k] = v;
+    any = true;
+  });
+  return any ? _decodedRecord(extra, pad) : "";
+}
+var _ROW_PLUMBING = ["oid", "name", "critical", "value", "valueBytes", "bytes", "scope", "index",
+  "containerIndex", "state", "code", "decoded", "kind", "values", "type", "extensions"];
+
 function _attribute(attr, pad) {
   var inner = pad + "    ";
   if (attr.type === OID_EXTENSION_REQUEST && Array.isArray(attr.extensions)) {
@@ -693,8 +784,27 @@ function _attribute(attr, pad) {
     attr.extensions.forEach(function (ext) { lines.push(_extension(ext, inner)); });
     return lines.join("\n");
   }
-  var header = pad + (attr.name || oid.name(attr.type) || attr.type) + ":";
-  var vals = (attr.values || []).map(function (v) { return _attrValue(attr.type, v, inner); });
+  /** @internal The registry lookup takes a dotted identifier, and a caller's object can carry anything in
+   *  `type`: asked about a number it refuses with its own code, which is not this verb's contract. */
+  var registryName = null;
+  if (!attr.name && typeof attr.type === "string") {
+    try { registryName = oid.name(attr.type); }
+    // allow:swallow-unverified drop-silent display fallback: an unreadable type prints as itself
+    catch (_notAnIdentifier) { registryName = null; }
+  }
+  var header = pad + (attr.name || registryName || String(attr.type)) + ":";
+  /** @internal Where the parser DECODED the value, render that rather than the bytes it decoded from: an
+   *  attribute certificate's whole content is the attributes it asserts, and a role naming a URI printed as
+   *  a hex run said nothing a reader could act on. An entry the decoder left opaque still prints as bytes. */
+  var vals;
+  if (Array.isArray(attr.decoded) && attr.decoded.length === _list(attr.values).length) {
+    vals = attr.decoded.map(function (d, i) {
+      if (!d || typeof d !== "object" || d.opaque === true) return _attrValue(attr.type, attr.values[i], inner);
+      return _decodedRecord(d, inner) || _attrValue(attr.type, attr.values[i], inner);
+    });
+  } else {
+    vals = _list(attr.values).map(function (v) { return _attrValue(attr.type, v, inner); });
+  }
   return vals.length ? header + "\n" + vals.join("\n") : header;
 }
 
@@ -864,7 +974,1440 @@ function cmsReport(input) {
 }
 
 
-var _INSPECT_BY_FORMAT = Object.assign(Object.create(null), { x509: certificate, crl: crlReport, csr: csrReport, cms: cmsReport });
+/** @internal The remaining detected formats, each composing the vocabulary above and each a named verb as
+ *  well as a route from `any`.
+ *
+ *  NO REPORT PRINTS PRIVATE KEY MATERIAL. A PKCS#8 and a PKCS#12 both carry a private key, and a renderer
+ *  that wrote one out would make an inspection tool a way of reading a key out of a file somebody opened
+ *  only to look at it. Each shows the algorithm, the public half where the structure carries one, and that
+ *  a private key is present, never its bytes. `inspect-formats.test.js` searches each report for byte runs
+ *  of the key in hex, base64 and colon-hex, so the rule is measured rather than stated here. */
+
+/** @internal Each predicate asks whether the object has the STRUCTURE its parser returns, not whether it
+ *  carries the marker property, because an object that merely has the marker is a caller's own object and
+ *  a report rendered from one says what the caller wrote rather than what any bytes encode. The marker
+ *  selects the predicate; the predicate is what admits the object. */
+function _looksParsedPkcs8(o) {
+  return typeof o.version === "number" && o.privateKeyAlgorithm && typeof o.privateKeyAlgorithm === "object" &&
+    Buffer.isBuffer(o.privateKey) && Array.isArray(o.attributes);
+}
+function _looksParsedPkcs12(o) {
+  return typeof o.version === "number" && typeof o.integrityMode === "string" &&
+    Array.isArray(o.safeBags) && Array.isArray(o.encryptedSafes);
+}
+/** @internal Every message has to carry the structure the renderer reads. Checking only that `messages` is
+ *  an array admitted `{ messages: [{}] }`, and the renderer then dereferenced a certTemplate that was not
+ *  there, so a caller's own object left an untyped TypeError where this door promises inspect/bad-input. */
+function _looksParsedCrmf(o) {
+  if (!Array.isArray(o.messages) || !o.messages.length) return false;
+  return o.messages.every(function (m) {
+    return !!m && typeof m === "object" && !!m.certReq && typeof m.certReq === "object" &&
+      !!m.certReq.certTemplate && typeof m.certReq.certTemplate === "object";
+  });
+}
+function _looksParsedCmp(o) {
+  return o.header && typeof o.header === "object" && o.body && typeof o.body === "object" &&
+    typeof o.body.arm === "string";
+}
+/** @internal Every item has to be one of the two shapes the parser produces, a bare object identifier or an
+ *  attribute carrying a values array, because the report reads both: an array of nullish or wrong-typed
+ *  members faulted the renderer where this door promises a typed refusal. */
+function _looksParsedCsrattrs(o) {
+  if (!Array.isArray(o.items)) return false;
+  return o.items.every(function (it) {
+    if (!it || typeof it !== "object") return false;
+    if (it.kind === "oid") return true;
+    return it.kind === "attribute" && (it.values === undefined || it.values === null || Array.isArray(it.values));
+  });
+}
+/** @internal Each anchor has to carry the member its own kind names, because that is what the report reads:
+ *  an anchor with a kind and nothing under it faulted the renderer where this door promises a typed
+ *  refusal. */
+function _looksParsedTrustAnchor(o) {
+  if (!Array.isArray(o.anchors) || !o.anchors.length) return false;
+  return o.anchors.every(function (a) {
+    if (!a || typeof a !== "object" || typeof a.kind !== "string") return false;
+    var held = a.kind === "certificate" ? a.certificate : (a.kind === "tbsCert" ? a.tbsCert : a.taInfo);
+    return !!held && typeof held === "object";
+  });
+}
+function _looksParsedOcspReq(o) {
+  if (typeof o.version !== "number" || !Array.isArray(o.requestList) || !Buffer.isBuffer(o.tbsRequestBytes)) return false;
+  return o.requestList.every(function (r) { return !!r && typeof r === "object" && !!r.certID && typeof r.certID === "object"; });
+}
+function _looksParsedOcspResp(o) {
+  var st = o.responseStatus;
+  if (!st || typeof st !== "object" || typeof st.code !== "number" || typeof st.name !== "string") return false;
+  var br = o.basicResponse;
+  /** @internal A response with no basic response is a status-only answer the report handles, but one that
+   *  HAS a basic response has to carry the answers the report walks: a responderID and a responses list whose
+   *  entries name a CertID and a status. */
+  if (br === null || br === undefined) return true;
+  if (typeof br !== "object" || !br.responderID || typeof br.responderID !== "object") return false;
+  if (!Array.isArray(br.responses)) return false;
+  return br.responses.every(function (r) {
+    return !!r && typeof r === "object" && !!r.certID && typeof r.certID === "object" &&
+      !!r.certStatus && typeof r.certStatus === "object";
+  });
+}
+/** @internal A rejected or waiting response carries `timeStampToken: null`, which is the shape RFC 3161
+ *  sec. 2.4.2 gives a non-granted status, so the token is required to be PRESENT as a key and not to be an
+ *  object. Requiring an object here refused a parsed rejection that the same bytes rendered fine. */
+/** @internal RFC 3161 sec. 2.4.2's PKIStatus. */
+var TSP_STATUS_NAMES = Object.assign(Object.create(null), {
+  0: "granted", 1: "grantedWithMods", 2: "rejection", 3: "waiting",
+  4: "revocationWarning", 5: "revocationNotification",
+});
+
+function _looksParsedTsp(o) {
+  if (typeof o.status !== "number" || !("timeStampToken" in o)) return false;
+  /** @internal PKIFailureInfo is a bit record whose asserted names are an array, so a present failInfo of any
+   *  other shape is a caller's own object and not this parser's output. The readers below still fault on
+   *  nothing, and this makes an obviously wrong shape a typed refusal rather than an empty line. */
+  if (o.failInfo !== null && o.failInfo !== undefined) {
+    if (typeof o.failInfo !== "object" || !Array.isArray(o.failInfo.bits)) return false;
+  }
+  var tok = o.timeStampToken;
+  return tok === null || (!!tok && typeof tok === "object" && !!tok.tstInfo && typeof tok.tstInfo === "object");
+}
+function _looksParsedAttrCert(o) {
+  return typeof o.version === "number" && o.holder && typeof o.holder === "object" &&
+    !!o.issuer && typeof o.issuer === "object" &&
+    Array.isArray(o.attributes) && o.signatureAlgorithm && typeof o.signatureAlgorithm === "object";
+}
+
+function _parsePkcs8(input) { return _coerce(input, { marker: "privateKeyAlgorithm", looksParsed: _looksParsedPkcs8, parsedName: "pki.schema.pkcs8.parse", parse: pkcs8.parse, badCode: "inspect/bad-pkcs8", what: "PKCS#8 private key" }); }
+function _parsePkcs12(input) { return _coerce(input, { marker: "safeBags", looksParsed: _looksParsedPkcs12, parsedName: "pki.schema.pkcs12.parse", parse: pkcs12.parse, badCode: "inspect/bad-pkcs12", what: "PKCS#12 store" }); }
+function _parseCrmf(input) { return _coerce(input, { marker: "messages", looksParsed: _looksParsedCrmf, parsedName: "pki.schema.crmf.parse", parse: crmf.parse, badCode: "inspect/bad-crmf", what: "CRMF certificate request message" }); }
+function _parseCmp(input) { return _coerce(input, { marker: "header", looksParsed: _looksParsedCmp, parsedName: "pki.schema.cmp.parse", parse: cmp.parse, badCode: "inspect/bad-cmp", what: "CMP message" }); }
+function _parseCsrattrs(input) { return _coerce(input, { marker: "items", looksParsed: _looksParsedCsrattrs, parsedName: "pki.schema.csrattrs.parse", parse: csrattrs.parse, badCode: "inspect/bad-csrattrs", what: "CSR attributes response" }); }
+function _parseTrustAnchor(input) { return _coerce(input, { marker: "anchors", looksParsed: _looksParsedTrustAnchor, parsedName: "pki.schema.trustanchor.parse", parse: trustanchor.parse, badCode: "inspect/bad-trustanchor", what: "trust anchor list" }); }
+function _parseOcspReq(input) { return _coerce(input, { marker: "requestList", looksParsed: _looksParsedOcspReq, parsedName: "pki.schema.ocsp.parseRequest", parse: ocsp.parseRequest, badCode: "inspect/bad-ocsp-request", what: "OCSP request" }); }
+function _parseOcspResp(input) { return _coerce(input, { marker: "responseStatus", looksParsed: _looksParsedOcspResp, parsedName: "pki.schema.ocsp.parseResponse", parse: ocsp.parseResponse, badCode: "inspect/bad-ocsp-response", what: "OCSP response" }); }
+function _parseTsp(input) { return _coerce(input, { marker: "timeStampToken", looksParsed: _looksParsedTsp, parsedName: "pki.schema.tsp.parseResponse", parse: tsp.parseResponse, badCode: "inspect/bad-tsp", what: "timestamp response" }); }
+function _parseAttrCert(input) { return _coerce(input, { marker: "holder", looksParsed: _looksParsedAttrCert, parsedName: "pki.schema.attrcert.parse", parse: attrcert.parse, badCode: "inspect/bad-attrcert", what: "attribute certificate" }); }
+
+/** @internal A GeneralName, a distinguished name, a GeneralNames list, or nothing, whichever the field
+ *  carries. These structures reach a name through four different shapes and a report reads one the same
+ *  way wherever it sits. The list form arrives with each member still raw, carrying its context tag and
+ *  its bytes and no decoded value, so each is read through the attribute-certificate module's own
+ *  GeneralName reader rather than rendered from the wrapper, which is what printed the whole list as one
+ *  hex run under a tag number the wrapper does not have. */
+function _nameOrGn(v) {
+  if (!v || typeof v !== "object") return "(none)";
+  if (v.dn !== undefined || Array.isArray(v.rdns)) return _dnString(v) || "(empty)";
+  if (Array.isArray(v.names)) {
+    var parts = v.names.map(function (n) {
+      if (n && n.value !== undefined) return _gn(n);
+      if (n && Buffer.isBuffer(n.bytes)) {
+        try { return _gn(attrcert.readGeneralName(n.bytes)); }
+        // allow:swallow-unverified drop-silent display fallback: an unreadable name prints as its bytes
+        catch (_unreadable) { return _gnRaw(n.bytes); }
+      }
+      return "";
+    }).filter(function (s) { return s !== ""; });
+    return parts.length ? parts.join(", ") : "(empty)";
+  }
+  /** @internal A STANDALONE GeneralName arrives raw from some parsers exactly as a list member does, and it
+   *  needs the same decode: passed straight to the renderer, a directoryName printed as its label with no
+   *  name after it and every other form printed its bytes. The list path had this and the single path did
+   *  not, which is one rule applied to one of its two callers. */
+  if (v.value === undefined && Buffer.isBuffer(v.bytes) && typeof v.tagNumber === "number") {
+    try { return _gn(attrcert.readGeneralName(v.bytes)); }
+    // allow:swallow-unverified drop-silent display fallback: an unreadable name prints as its bytes
+    catch (_unreadableSingle) { return _gnRaw(v.bytes); }
+  }
+  var g = _gn(v);
+  return g || "(unrecognized name form)";
+}
+function _optLine(L, pad, label, v) { if (v !== null && v !== undefined) L.push(pad + label + ": " + v); }
+
+/** @internal Join a short list the way a sentence does. */
+function _joinAnd(list) {
+  if (list.length <= 1) return list.join("");
+  return list.slice(0, -1).join(", ") + " and " + list[list.length - 1];
+}
+
+/** @internal A list is a list only when it IS one. `x && x.length` is true of a string and of anything else
+ *  carrying a length, and `(x || [])` passes a truthy non-array straight through, so both admitted a value
+ *  the following forEach then faulted on. These reports take a caller's pre-parsed object, whose members no
+ *  door can validate to arbitrary depth, so a report must not fault on any shape it is handed. */
+function _list(v) { return Array.isArray(v) ? v : []; }
+/** @internal The same for a member a loop body dereferences. */
+function _obj(v) { return (v !== null && typeof v === "object") ? v : {}; }
+
+/** @internal A serial reads the same wherever a report carries one, through the certificate report's own
+ *  presentation: small values as decimal with the hex beside them, long ones as wrapped colon-hex. Printed
+ *  as bare hex, the serial 99 renders "63" and reads as the decimal 63. */
+function _serialLine(hexOrValue, pad) {
+  if (hexOrValue === null || hexOrValue === undefined) return null;
+  /** @internal Only the two forms a parser produces, a hex string or a bigint. Anything else is a caller's
+   *  own value, and `toString(16)` on it reaches the hex reader with something that is not hex. */
+  var hex;
+  if (typeof hexOrValue === "string") hex = hexOrValue;
+  else if (typeof hexOrValue === "bigint" || typeof hexOrValue === "number") hex = hexOrValue.toString(16);
+  else return null;
+  if (!_isHexDigits(hex)) return null;
+  return pad + _serial({ serialNumberHex: hex }, pad.length + 4);
+}
+/** @internal Whether every character is a hex digit, by character code so no regex is involved. */
+function _isHexDigits(s) {
+  if (typeof s !== "string" || s.length === 0) return false;
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charCodeAt(i);
+    var ok = (c >= 0x30 && c <= 0x39) || (c >= 0x61 && c <= 0x66) || (c >= 0x41 && c <= 0x46);
+    if (!ok) return false;
+  }
+  return true;
+}
+function _serialInto(L, pad, hexOrValue) {
+  var line = _serialLine(hexOrValue, pad);
+  if (line !== null) L.push(line);
+}
+
+/**
+ * @primitive pki.inspect.pkcs8
+ * @signature pki.inspect.pkcs8(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 5958
+ * @related pki.schema.pkcs8.parse, pki.inspect.pkcs12
+ *
+ * Render a PKCS#8 private key as a text report: the version, the key algorithm and
+ * its parameters, the presence and length of the private key and of a public half,
+ * and the type of each attribute. No byte string from inside the file is rendered.
+ * That is structural rather than a screen on the private key, because RFC 5958 has
+ * the parser check that a v2 `OneAsymmetricKey` HAS a public half and well formed
+ * attributes, never that either is unrelated to the private key: private bytes can
+ * sit in the public `BIT STRING` or in any attribute value, so a report that wrote
+ * either out could be made to write the key out. `pki.key.export` is the verb for
+ * the bytes themselves.
+ * `input` is a PEM string, a DER Buffer, or a `pki.schema.pkcs8.parse` result; a
+ * non-PKCS#8 throws `inspect/bad-pkcs8`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   pki.inspect.pkcs8(await pki.key.export(pair.privateKey)).split("\n")[0];  // "PKCS#8 Private Key:"
+ */
+function pkcs8Report(input) {
+  var k = _parsePkcs8(input);
+  var L = ["PKCS#8 Private Key:", "    Version: " + k.version];
+  L.push("    Private Key Algorithm: " + _algName(k.privateKeyAlgorithm));
+  /** @internal The algorithm's PARAMETERS say which curve an EC key is on, and without them an EC report
+   *  named only `ecPublicKey` and identified nothing. They are public: an AlgorithmIdentifier's parameters
+   *  describe the algorithm, not the key, so rendering them discloses nothing the key itself holds. */
+  var alg = k.privateKeyAlgorithm;
+  if (alg && Buffer.isBuffer(alg.parameters)) {
+    var paramName;
+    try { paramName = oid.name(asn1.read.oid(asn1.decode(alg.parameters))); }
+    // allow:swallow-unverified drop-silent display fallback: parameters that are not an OID are not named
+    catch (_notAnOid) { paramName = null; }
+    /** @internal Named or not rendered. An AlgorithmIdentifier's parameters are whatever the file's author
+     *  put there, so a hex fallback here is another way to write the private key out: the parameters of an
+     *  unknown algorithm can hold a copy of it and the parser has no reason to refuse that. */
+    L.push("    Algorithm Parameters: " + (paramName ||
+      ("present, " + alg.parameters.length + " bytes (not rendered)")));
+  }
+  L.push("    Private Key: present, " + k.privateKey.length + " bytes (not rendered)");
+  /** @internal The public half is rendered only when the bytes are actually there: an RFC 5958 OneAsymmetricKey
+   *  carries it as a BIT STRING record and a caller's object can carry anything, and the byte renderer faults
+   *  on a value that is not a buffer rather than reporting one it cannot read. */
+  /** @internal THIS REPORT RENDERS NO BYTES FROM THE FILE, and the rule is structural rather than a
+   *  comparison because a comparison loses. RFC 5958's parser checks that a v2 OneAsymmetricKey HAS a public
+   *  half and that its attributes are well formed, never that either is unrelated to the private key, so
+   *  private bytes can sit in the public BIT STRING or in any attribute value. Screening each against the
+   *  private key needs the key's algorithm-specific inner encoding, since an Ed25519 privateKey is
+   *  `04 20 || seed` and a crafted public half carrying the seed alone matches neither direction of a
+   *  whole-buffer compare; deriving the public half instead would be a key operation, which this synchronous
+   *  renderer cannot do. So nothing from inside the file is written out: the report names the algorithm, its
+   *  parameters, what is present and how long, and the attribute types, and there is nothing left to screen.
+   *  `pki.key.export` is the verb for the bytes themselves. */
+  var pubBytes = Buffer.isBuffer(k.publicKey) ? k.publicKey : _obj(k.publicKey).bytes;
+  if (Buffer.isBuffer(pubBytes)) {
+    L.push("    Public Key: present, " + pubBytes.length + " bytes (not rendered)");
+  } else if (k.publicKey) {
+    L.push("    Public Key: present, not readable as bytes");
+  }
+  L.push("    Attributes:");
+  if (_list(k.attributes).length) {
+    _list(k.attributes).forEach(function (raw) {
+      var a = _obj(raw);
+      /** @internal The registry takes a dotted identifier and refuses anything else with its own code, which
+       *  is not this verb's contract: a caller's object can carry any `type`. */
+      var known = null;
+      if (!a.name && typeof a.type === "string") {
+        try { known = oid.name(a.type); }
+        // allow:swallow-unverified drop-silent display fallback: an unreadable type prints as itself
+        catch (_notAnIdentifier) { known = null; }
+      }
+      L.push("        " + (a.name || known || String(a.type)) + ": " +
+        _list(a.values).length + " value(s) (not rendered)");
+    });
+  } else {
+    L.push("        (none)");
+  }
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.pkcs12
+ * @signature pki.inspect.pkcs12(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 7292
+ * @related pki.schema.pkcs12.parse, pki.pkcs12.open
+ *
+ * Render a PKCS#12 store's outer structure as a text report: the version, the
+ * integrity mode, the MAC algorithm and its iteration count, and one line per safe
+ * bag giving its type. No private key is rendered, and an encrypted safe's contents
+ * are not decrypted, because this verb takes no password: the report names
+ * `pki.pkcs12.open` as what reads the contents. `input` is a PEM string, a DER
+ * Buffer, or a `pki.schema.pkcs12.parse` result; a non-PKCS#12 throws
+ * `inspect/bad-pkcs12`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "p12.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var store = await pki.pkcs12.build({ safeContents: [{ bags: [{ type: "cert", cert: cert }] }] }, { password: "1234" });
+ *   pki.inspect.pkcs12(store).split("\n")[0];  // "PKCS#12 Store:"
+ */
+/** @internal A salt's LENGTH is what says anything about the protection; its value says nothing a reader acts
+ *  on. And `pki.pkcs12.build` takes a caller-supplied salt, so a store can carry the private key bytes there
+ *  and a report printing the value would write the key out. Length only, for the same reason the key report
+ *  renders no bytes at all. */
+function _saltLine(L, salt) {
+  if (Buffer.isBuffer(salt)) L.push("        Salt: " + salt.length + " bytes (not rendered)");
+}
+
+/** @internal Whether any signer of a signed authSafe has NO certificate embedded beside it. A store can embed
+ *  a chain certificate while leaving the signer's own out, so counting the certificates answered the wrong
+ *  question: verification needs the certificate that MATCHES the signer. A SignerInfo names itself by issuer
+ *  and serial or by subject key identifier, and an embedded certificate arrives raw, so each is parsed to
+ *  compare. A certificate this parser refuses simply matches nothing. */
+function _someSignerUnmatched(signed) {
+  var signers = _list(signed.signerInfos);
+  if (!signers.length) return false;
+  var parsed = [];
+  _list(signed.certificates).forEach(function (raw) {
+    var bytes = Buffer.isBuffer(raw) ? raw : _obj(raw).bytes;
+    if (!Buffer.isBuffer(bytes)) return;
+    // allow:swallow-unverified drop-silent display fallback: a certificate this parser refuses matches nothing
+    try { parsed.push(x509.parse(bytes)); } catch (_unreadableCert) { return; }
+  });
+  return signers.some(function (rawSigner) {
+    var sid = _obj(_obj(rawSigner).sid);
+    return !parsed.some(function (c) { return _certMatchesSid(c, sid); });
+  });
+}
+function _certMatchesSid(cert, sid) {
+  if (Buffer.isBuffer(sid.subjectKeyIdentifier)) {
+    var ski = _list(cert.extensions).filter(function (e) { return _obj(e).oid === OID_SUBJECT_KEY_ID; })[0];
+    if (!ski) return false;
+    // allow:swallow-unverified drop-silent display fallback: an unreadable key id matches nothing
+    try { return asn1.read.octetString(asn1.decode(_obj(ski).value)).equals(sid.subjectKeyIdentifier); }
+    catch (_unreadableSki) { return false; }
+  }
+  if (!sid.issuer || sid.serialNumberHex === undefined) return false;
+  if (cert.serialNumberHex !== sid.serialNumberHex) return false;
+  /** @internal The RFC 5280 sec. 7.1 canonical comparison, through the shared home, because two encodings of
+   *  one name are one name: compared as bytes, a certificate whose issuer DN is encoded differently from the
+   *  SignerInfo's matched nothing and the report asked for a certificate the store already had. */
+  var a = _obj(cert.issuer).rdns, b2 = _obj(sid.issuer).rdns;
+  if (Array.isArray(a) && Array.isArray(b2)) {
+    // allow:swallow-unverified drop-silent display fallback: a name the comparison refuses falls back to bytes
+    try { return guard.name.dnEqual(a, b2, _err, "inspect/bad-input", "the signer name") === true; }
+    catch (_notComparable) { return false; }
+  }
+  var issuerBytes = _obj(sid.issuer).bytes;
+  return Buffer.isBuffer(issuerBytes) && Buffer.isBuffer(_obj(cert.issuer).bytes) &&
+    _obj(cert.issuer).bytes.equals(issuerBytes);
+}
+
+function pkcs12Report(input) {
+  var p = _parsePkcs12(input);
+  var L = ["PKCS#12 Store:", "    Version: " + p.version];
+  L.push("    Integrity Mode: " + p.integrityMode);
+  if (p.mac) {
+    L.push("    MAC:");
+    L.push("        Kind: " + p.mac.kind);
+    /** @internal RFC 9579's PBMAC1 carries the parameters that actually protect the store inside its own
+     *  structure, and the outer MacData fields then describe nothing: read from there, a store with 2048
+     *  PBKDF2 iterations reported one iteration, an empty salt, and "pbmac1" as its digest. */
+    if (p.mac.pbmac1) {
+      var kdf = p.mac.pbmac1.kdf || {};
+      _optLine(L, "        ", "Digest", p.mac.pbmac1.schemeName || p.mac.pbmac1.schemeOid);
+      _optLine(L, "        ", "Key Derivation", kdf.prfName || kdf.prfOid);
+      _optLine(L, "        ", "Iterations", kdf.iterationCount);
+      _optLine(L, "        ", "Key Length", kdf.keyLength);
+      _saltLine(L, kdf.salt);
+    } else {
+      _optLine(L, "        ", "Digest", p.mac.hashName || p.mac.hashOid);
+      _optLine(L, "        ", "Iterations", p.mac.iterations);
+      _saltLine(L, p.mac.macSalt);
+    }
+  } else {
+    L.push("    MAC: (none)");
+  }
+  L.push("    Safe Bags: " + _list(p.safeBags).length);
+  /** @internal RFC 7292 sec. 4.2.6's safeContentsBag holds further bags, and reporting only the container
+   *  made a container of keys and certificates read the same as an empty one. The no-key-material rule
+   *  carries into the nested level, because a key inside a container is still a key. */
+  (function walkBags(bags, pad) {
+    _list(bags).forEach(function (rawBag, i) {
+      var bag = _obj(rawBag);
+      /** @internal The PARSER's vocabulary, which is the ASN.1 bag-type name, not the builder's shorthand:
+       *  keyed on `shroudedKey` and `key` the marker never once fired, because a parsed bag reports itself as
+       *  `pkcs8ShroudedKeyBag` or `keyBag`. */
+      var isKey = bag.type === "pkcs8ShroudedKeyBag" || bag.type === "keyBag";
+      L.push(pad + "[" + i + "] " + bag.type + (isKey ? "  (private key, not rendered)" : "") +
+        (Array.isArray(bag.nested) ? "  (" + bag.nested.length + " nested)" : ""));
+      if (Array.isArray(bag.nested) && bag.nested.length) walkBags(bag.nested, pad + "    ");
+    });
+  })(p.safeBags, "        ");
+  L.push("    Encrypted Safes: " + _list(p.encryptedSafes).length);
+  var needsRecipientKey = false, needsSafePassword = false;
+  _list(p.encryptedSafes).forEach(function (rawSafe, i) {
+    var safe = _obj(rawSafe);
+    if (safe.type === "envelopedData") needsRecipientKey = true;
+    else needsSafePassword = true;
+    /** @internal An encrypted safe is a CMS EncryptedData, so the algorithm that protects it sits on that
+     *  structure's encryptedContentInfo rather than on the safe. Read off the safe it was absent and every
+     *  encrypted store reported its algorithm as unknown. */
+    var eci = _obj(safe.content).encryptedContentInfo;
+    /** @internal The safe's TYPE says which credential opens it, so the row names it: RFC 7292 sec. 4.1's
+     *  password privacy is an EncryptedData and its public-key privacy an EnvelopedData, and the two are
+     *  opened by different things. */
+    L.push("        [" + i + "] " + (safe.type ? safe.type + ": " : "") +
+      _algName(_obj(eci).contentEncryptionAlgorithm) + "  (not decrypted)");
+  });
+  /** @internal WHICH credential opens the contents, because naming the wrong one sends an operator to look
+   *  for something the store does not want: RFC 7292 sec. 4.1's public-key privacy is opened with a recipient
+   *  key and `pki.pkcs12.open` refuses it with pkcs12/no-recipient-key, not with a password prompt. */
+  var needs = [];
+  /** @internal Derived from what the store IS, not from whether it has encrypted safes: a public-key-integrity
+   *  store of plaintext bags is opened by its signature, a MAC-less one needs opts.allowUnauthenticated, and a
+   *  password is wanted for the MAC, for a password-encrypted safe, or for a shrouded key bag. Read off an
+   *  empty encryptedSafes list, the report asked for a password from stores that do not want one. */
+  var hasShroudedKey = (function anyShrouded(bags) {
+    return _list(bags).some(function (raw) {
+      var bag = _obj(raw);
+      return bag.type === "pkcs8ShroudedKeyBag" || anyShrouded(bag.nested);
+    });
+  })(p.safeBags);
+  if (p.integrityMode === "password" || needsSafePassword || hasShroudedKey) needs.push("the password");
+  if (needsRecipientKey) needs.push("opts.recipientKey for the enveloped safe");
+  /** @internal A store can want a credential AND be unauthenticated, and `pki.pkcs12.open` checks both: a
+   *  MAC-less store holding a shrouded key needs the password for the key and the opt for the missing MAC.
+   *  Offered as an alternative to the others, the opt went unmentioned for exactly those stores. */
+  if (p.integrityMode === "none") needs.push("opts.allowUnauthenticated, since the store carries no MAC");
+  /** @internal A public-key-integrity store is verified against the signer's certificate, and its SignedData
+   *  may carry none: then the certificate has to be supplied, and a report naming only the privacy credentials
+   *  left out an input without which opening fails. */
+  if (p.integrityMode === "public-key" && _someSignerUnmatched(_obj(p.authSafeSigned))) {
+    needs.push("opts.signerCerts, since the signed authSafe carries no certificate matching its signer");
+  }
+  if (needs.length) {
+    L.push("    The bag contents are read with pki.pkcs12.open, which needs " + _joinAnd(needs) + ".");
+  } else {
+    L.push("    The bag contents are read with pki.pkcs12.open. This store's integrity is its signature and its bags are not encrypted, so it needs no password.");
+  }
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.crmf
+ * @signature pki.inspect.crmf(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 4211
+ * @related pki.schema.crmf.parse, pki.inspect.csr
+ *
+ * Render CRMF certificate request messages as a text report: one block per message
+ * giving its request id, the certificate template's subject, issuer, validity and
+ * public key, the requested extensions, and whether a proof of possession and
+ * registration controls are present. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.crmf.parse` result; a non-CRMF throws `inspect/bad-crmf`, a
+ * wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var der = await pki.crmf.build({ certReqId: 0, certTemplate: { subject: "crmf.example",
+ *     publicKey: await pki.key.export(pair.publicKey) } }, { key: await pki.key.export(pair.privateKey) });
+ *   pki.inspect.crmf(der).split("\n")[0];  // "CRMF Certificate Request Messages:"
+ */
+function crmfReport(input) {
+  var m = _parseCrmf(input);
+  var L = ["CRMF Certificate Request Messages:", "    Messages: " + m.messages.length];
+  m.messages.forEach(function (msg, i) {
+    var req = msg.certReq, t = req.certTemplate;
+    L.push("    [" + i + "] Certificate Request:");
+    _optLine(L, "        ", "Request ID", req.certReqId === undefined ? null : String(req.certReqId));
+    /** @internal RFC 4211 sec. 5 carries the DER value, so 2 names v3, exactly as a certificate's does. The
+     *  raw value read as a request for v2, which is the opposite of what the template asks for, and the
+     *  certificate report beside it writes the same number the other way. */
+    _optLine(L, "        ", "Version", t.version === undefined || t.version === null
+      ? null : (Number(t.version) + 1) + " (0x" + Number(t.version).toString(16) + ")");
+    if (t.serialNumber !== undefined && t.serialNumber !== null) L.push("        Serial Number: " + t.serialNumber);
+    if (t.issuer) L.push("        Issuer: " + _nameOrGn(t.issuer));
+    if (t.subject) L.push("        Subject: " + _nameOrGn(t.subject));
+    if (t.signingAlg) L.push("        Signing Algorithm: " + _algName(t.signingAlg));
+    if (t.validity) {
+      L.push("        Validity:");
+      _optLine(L, "            ", "Not Before", t.validity.notBefore ? _date(t.validity.notBefore) : null);
+      _optLine(L, "            ", "Not After", t.validity.notAfter ? _date(t.validity.notAfter) : null);
+    }
+    if (t.publicKey) { L.push("        Subject Public Key Info:"); L.push(_keyBlock(t.publicKey, "            ")); }
+    if (_list(t.extensions).length) {
+      L.push("        Requested Extensions:");
+      _list(t.extensions).forEach(function (e) { L.push(_extension(_obj(e), "            ")); });
+    }
+    /** @internal WHICH proof of possession a request carries is the difference between a key whose holder
+     *  proved possession by signing and one an RA vouched for, so the form is named rather than reported as
+     *  merely present. */
+    L.push("        Proof of Possession: " + (msg.popo ? (msg.popo.type || "present") : "(none)"));
+    L.push("        Registration Controls: " + ((req.controls && req.controls.length) || 0));
+    L.push("        Registration Info: " + ((msg.regInfo && msg.regInfo.length) || 0));
+  });
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.cmp
+ * @signature pki.inspect.cmp(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 9810
+ * @related pki.schema.cmp.parse, pki.inspect.crmf
+ *
+ * Render a CMP message as a text report: the header's protocol version, sender and
+ * recipient, transaction id and nonces, the body arm the message carries, and
+ * whether protection and extra certificates are present. The body's inner content
+ * is named rather than expanded, since each arm is its own structure that its own
+ * verb reads. `input` is a PEM string, a DER Buffer, or a `pki.schema.cmp.parse`
+ * result; a non-CMP throws `inspect/bad-cmp`, a wrong-type input
+ * `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "cmp.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var der = await pki.cmp.build({ header: { sender: { directoryName: "CN=cmp.example" },
+ *     recipient: { directoryName: "CN=A CA" } },
+ *     body: { ir: { certTemplate: { subject: [{ commonName: "cmp.example" }], publicKey: await pki.key.export(pair.publicKey) } } } },
+ *     { cert: cert, key: key });
+ *   pki.inspect.cmp(der).split("\n")[0];  // "CMP Message:"
+ */
+function cmpReport(input) {
+  var m = _parseCmp(input);
+  var h = m.header, body = m.body;
+  var L = ["CMP Message:", "    Header:"];
+  _optLine(L, "        ", "Protocol Version", h.pvno);
+  L.push("        Sender: " + _nameOrGn(h.sender));
+  L.push("        Recipient: " + _nameOrGn(h.recipient));
+  if (h.messageTime) L.push("        Message Time: " + _date(h.messageTime));
+  if (h.protectionAlg) L.push("        Protection Algorithm: " + _algName(h.protectionAlg));
+  if (Buffer.isBuffer(h.transactionID)) L.push("        Transaction ID: " + _hexColon(h.transactionID, {}));
+  if (Buffer.isBuffer(h.senderNonce)) L.push("        Sender Nonce: " + _hexColon(h.senderNonce, {}));
+  if (Buffer.isBuffer(h.recipNonce)) L.push("        Recipient Nonce: " + _hexColon(h.recipNonce, {}));
+  if (Buffer.isBuffer(h.senderKID)) L.push("        Sender Key ID: " + _hexColon(h.senderKID, {}));
+  L.push("        General Info: " + ((h.generalInfo && h.generalInfo.length) || 0));
+  L.push("    Body:");
+  L.push("        Arm: " + body.arm);
+  /** @internal The error arm is expanded where the others are only named, because its CONTENT is the whole
+   *  diagnostic and no other verb renders it: a reader of an error message wants the status, the failure bits
+   *  and the code, and naming the arm alone told them only that something went wrong. */
+  if (body.arm === "error" && body.decoded && typeof body.decoded === "object") {
+    var errText = _decodedRecord(body.decoded, "            ");
+    if (errText) L.push(errText);
+  }
+  L.push("    Protection: " + (m.protection ? "present" : "(none)"));
+  L.push("    Extra Certificates: " + ((m.extraCerts && m.extraCerts.length) || 0));
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.csrattrs
+ * @signature pki.inspect.csrattrs(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 7030, RFC 8951
+ * @related pki.schema.csrattrs.parse, pki.inspect.csr
+ *
+ * Render an EST CSR Attributes response as a text report: one line per item, each
+ * either a bare object identifier the server asks the client to supply or an
+ * attribute with its type and values. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.csrattrs.parse` result; a non-CsrAttrs throws
+ * `inspect/bad-csrattrs`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var b = pki.asn1.build;
+ *   var der = b.sequence([b.oid("1.2.840.113549.1.9.7")]);
+ *   pki.inspect.csrattrs(der).split("\n")[0];  // "EST CSR Attributes:"
+ */
+function csrattrsReport(input) {
+  var a = _parseCsrattrs(input);
+  var L = ["EST CSR Attributes:", "    Items: " + a.items.length];
+  a.items.forEach(function (item, i) {
+    var label = item.kind === "oid" ? "OID" : "Attribute";
+    var name = item.name || item.oid || "unknown";
+    L.push("    [" + i + "] " + label + ": " + name + (item.name && item.oid ? " (" + item.oid + ")" : ""));
+    /** @internal The CONSTRAINT a client has to act on is what the parser added beside the raw value: a key
+     *  size, a curve set, a template. Printed as its DER, a request for a 2048-bit key read as four bytes. */
+    var constraint = _extraFields(item, _ROW_PLUMBING, "        ");
+    if (constraint) L.push(constraint);
+    if (item.kind !== "oid" && _list(item.values).length) {
+      L.push("        Values: " + _list(item.values).length);
+      _list(item.values).forEach(function (v) {
+        /** @internal An attribute value a server chose is escaped for the reason a distinguished name is. */
+        L.push("            " + (Buffer.isBuffer(v) ? _hexColon(v, {}) : _clean(String(v))));
+      });
+    }
+  });
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.trustanchor
+ * @signature pki.inspect.trustanchor(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 5914
+ * @related pki.schema.trustanchor.parse, pki.inspect.certificate
+ *
+ * Render an RFC 5914 trust anchor list as a text report: one block per anchor
+ * giving which of the three forms it takes, its public key, key identifier and
+ * title where present, and the certificate path controls that bound what it may
+ * anchor. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.trustanchor.parse` result; a non-list throws
+ * `inspect/bad-trustanchor`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var b = pki.asn1.build;
+ *   var spki = await pki.key.export(pair.publicKey);
+ *   var der = b.sequence([b.explicit(2, b.sequence([b.raw(spki), b.octetString(Buffer.alloc(20, 1))]))]);
+ *   pki.inspect.trustanchor(der).split("\n")[0];  // "Trust Anchor List:"
+ */
+function trustAnchorReport(input) {
+  var t = _parseTrustAnchor(input);
+  var L = ["Trust Anchor List:", "    Anchors: " + t.anchors.length];
+  t.anchors.forEach(function (a, i) {
+    L.push("    [" + i + "] Form: " + a.kind);
+    /** @internal RFC 5914 sec. 3 gives three forms, and only the TrustAnchorInfo one carries its key and
+     *  name at the top: the other two hold a certificate, whose subject and subjectPublicKeyInfo are what
+     *  name the anchor. Read as though every form were TrustAnchorInfo, a certificate anchor rendered its
+     *  form and nothing else, so two different anchors produced the same report. */
+    var held = a.kind === "certificate" ? a.certificate : (a.kind === "tbsCert" ? a.tbsCert : null);
+    if (held) {
+      if (held.subject) L.push("        Subject: " + _dnString(held.subject));
+      if (held.issuer) L.push("        Issuer: " + _dnString(held.issuer));
+      if (held.serialNumberHex) _serialInto(L, "        ", held.serialNumberHex);
+      if (held.subjectPublicKeyInfo) {
+        L.push("        Subject Public Key Info:");
+        L.push(_keyBlock(held.subjectPublicKeyInfo, "            "));
+      }
+      /** @internal Rendered, not counted, and for the same reason the TrustAnchorInfo arm renders its own:
+       *  the extensions bound what trusting the anchor means, so a count made a path-limited anchor read the
+       *  same as an unlimited one. One rule, both arms. */
+      if (_list(held.extensions).length) {
+        L.push("        Extensions:");
+        _list(held.extensions).forEach(function (e) { L.push(_extension(_obj(e), "            ")); });
+      }
+      return;
+    }
+    var info = a.taInfo;
+    if (info.pubKey) { L.push("        Subject Public Key Info:"); L.push(_keyBlock(info.pubKey, "            ")); }
+    if (Buffer.isBuffer(info.keyId)) L.push("        Key Identifier: " + _hexColon(info.keyId, {}));
+    /** @internal A taTitle is text whoever wrote the anchor list chose, so it is escaped as the rest are. */
+    _optLine(L, "        ", "Title", info.taTitle == null ? null : _clean(String(info.taTitle)));
+    /** @internal RFC 5914 sec. 3's exts carry certificate extensions that bound what trusting the anchor
+     *  means, a basicConstraints path length among them. Skipped, an anchor carrying one read the same as one
+     *  carrying none. */
+    if (_list(info.exts).length) {
+      L.push("        Extensions:");
+      _list(info.exts).forEach(function (e) { L.push(_extension(_obj(e), "            ")); });
+    }
+    /** @internal RFC 5914 sec. 3 excludes some extension types from `exts`, and the parser drops one it finds
+     *  there while recording its identifier. Unmentioned, an anchor that tried to carry a name constraint in
+     *  that field read the same as one that carried nothing, and the constraint it named is not in force. */
+    if (_list(info.excludedExtensions).length) {
+      L.push("        Extensions the profile excludes here, dropped and not in force:");
+      _list(info.excludedExtensions).forEach(function (o) {
+        L.push("            " + (oid.name(String(o)) || String(o)) + " (" + String(o) + ")");
+      });
+    }
+    var cpc = info.certPath;
+    if (cpc) {
+      L.push("        Certificate Path Controls:");
+      if (cpc.taName) L.push("            Name: " + _nameOrGn(cpc.taName));
+      _optLine(L, "            ", "Path Length", cpc.pathLenConstraint);
+      /** @internal The policy IDENTIFIERS, because a count made two anchors restricted to different single
+       *  policies read the same, and which policies an anchor is restricted to is what a reader asks. */
+      if (_list(cpc.policySet).length) {
+        L.push("            Policies:");
+        _list(cpc.policySet).forEach(function (pol) {
+          var p = _obj(pol);
+          L.push("                " + (p.name ? p.name + " (" + p.policyIdentifier + ")" : String(p.policyIdentifier)));
+        });
+      }
+      /** @internal RFC 5914 sec. 3's policyFlags is a BIT STRING the parser decodes to a record of named
+       *  booleans, so it has no length: read as an array the line never ran and a trust anchor's active
+       *  policy restrictions were absent from the report rather than shown as off. */
+      if (cpc.policyFlags) {
+        var onFlags = Object.keys(cpc.policyFlags).filter(function (n) { return cpc.policyFlags[n] === true; });
+        L.push("            Policy Flags: " + (onFlags.length ? onFlags.join(", ") : "(none set)"));
+      }
+      /** @internal The subtrees an anchor may certify within are what a reader inspects an anchor to learn,
+       *  and omitted they made a restricted anchor read identically to an unrestricted one. The shape is the
+       *  certificate extension's own, so the extension renderer formats it rather than a second copy. */
+      if (cpc.nameConstr) {
+        var ncText = EXT_RENDERERS.nameConstraints(cpc.nameConstr, "                ");
+        if (ncText) { L.push("            Name Constraints:"); L.push(ncText); }
+      }
+    }
+  });
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.ocspRequest
+ * @signature pki.inspect.ocspRequest(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 6960
+ * @related pki.schema.ocsp.parseRequest, pki.inspect.ocspResponse
+ *
+ * Render an OCSP request as a text report: the version, the requestor name where
+ * one is given, one block per requested certificate giving the CertID's hash
+ * algorithm and the issuer name and key hashes with the serial asked about, the
+ * request extensions, and whether the request is signed. `input` is a PEM string, a
+ * DER Buffer, or a `pki.schema.ocsp.parseRequest` result; a non-request throws
+ * `inspect/bad-ocsp-request`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "ocsp.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var der = await pki.ocsp.buildRequest({ cert: cert, issuer: cert });
+ *   pki.inspect.ocspRequest(der).split("\n")[0];  // "OCSP Request:"
+ */
+function ocspRequestReport(input) {
+  var r = _parseOcspReq(input);
+  var L = ["OCSP Request:", "    Version: " + r.version];
+  L.push("    Requestor Name: " + (r.requestorName ? _nameOrGn(r.requestorName) : "(none)"));
+  L.push("    Requests: " + r.requestList.length);
+  r.requestList.forEach(function (req, i) {
+    var id = req.certID;
+    L.push("        [" + i + "] Certificate ID:");
+    L.push("            Hash Algorithm: " + _algName(id.hashAlgorithm));
+    if (Buffer.isBuffer(id.issuerNameHash)) L.push("            Issuer Name Hash: " + _hexColon(id.issuerNameHash, {}));
+    if (Buffer.isBuffer(id.issuerKeyHash)) L.push("            Issuer Key Hash: " + _hexColon(id.issuerKeyHash, {}));
+    _serialInto(L, "            ", id.serialNumberHex || id.serialNumber);
+    if (_list(req.singleRequestExtensions).length) {
+      L.push("            Single Request Extensions:");
+      _list(req.singleRequestExtensions).forEach(function (e) { L.push(_extension(_obj(e), "                ")); });
+    }
+  });
+  if (_list(r.requestExtensions).length) {
+    L.push("    Request Extensions:");
+    _list(r.requestExtensions).forEach(function (e) { L.push(_extension(_obj(e), "        ")); });
+  } else {
+    L.push("    Request Extensions: (none)");
+  }
+  L.push("    Signature: " + (r.optionalSignature ? "present" : "(unsigned)"));
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.ocspResponse
+ * @signature pki.inspect.ocspResponse(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 6960
+ * @related pki.schema.ocsp.parseResponse, pki.inspect.ocspRequest
+ *
+ * Render an OCSP response as a text report: the response status, and for a basic
+ * response the responder id, the time it was produced, one block per answer giving
+ * the CertID, the certificate's status with its revocation time and reason where it
+ * is revoked, and the validity window of the answer, plus the response extensions
+ * and the certificates carried for the relying party to chain. `input` is a PEM
+ * string, a DER Buffer, or a `pki.schema.ocsp.parseResponse` result; a non-response
+ * throws `inspect/bad-ocsp-response`, a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var cert = await pki.x509.sign({ subject: "ocsp.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var der = await pki.ocsp.sign({ responderID: "byName",
+ *     responses: [{ cert: cert, issuer: cert, status: "good", thisUpdate: new Date("2026-01-02T00:00:00Z") }] },
+ *     { cert: cert, key: key });
+ *   pki.inspect.ocspResponse(der).split("\n")[0];  // "OCSP Response:"
+ */
+function ocspResponseReport(input) {
+  var r = _parseOcspResp(input);
+  var st = r.responseStatus;
+  var L = ["OCSP Response:", "    Response Status: " + st.name];
+  if (r.responseBytes) L.push("    Response Type: " + (r.responseBytes.responseTypeName || r.responseBytes.responseType));
+  var br = r.basicResponse;
+  if (!br) { L.push("    (no basic response to render)"); return L.join("\n") + "\n"; }
+  L.push("    Version: " + br.version);
+  /** @internal RFC 6960 sec. 4.2.1 gives ResponderID two forms, and the key form is a hash rather than a
+   *  name: passed to the name renderer it printed neither, so a responder that identifies itself by key was
+   *  not identified in the report at all. */
+  L.push("    Responder ID: " + (Buffer.isBuffer(br.responderID.byKey)
+    ? "keyHash:" + _hexColon(br.responderID.byKey, {})
+    : _nameOrGn(br.responderID.byName)));
+  if (br.producedAt) L.push("    Produced At: " + _date(br.producedAt));
+  L.push("    Responses: " + br.responses.length);
+  br.responses.forEach(function (one, i) {
+    var id = one.certID;
+    L.push("        [" + i + "] Certificate ID:");
+    L.push("            Hash Algorithm: " + _algName(id.hashAlgorithm));
+    if (Buffer.isBuffer(id.issuerNameHash)) L.push("            Issuer Name Hash: " + _hexColon(id.issuerNameHash, {}));
+    if (Buffer.isBuffer(id.issuerKeyHash)) L.push("            Issuer Key Hash: " + _hexColon(id.issuerKeyHash, {}));
+    _serialInto(L, "            ", id.serialNumberHex || id.serialNumber);
+    var status = one.certStatus;
+    L.push("            Cert Status: " + status.type);
+    if (status.revocationTime) L.push("            Revocation Time: " + _date(status.revocationTime));
+    _optLine(L, "            ", "Revocation Reason", status.revocationReason);
+    if (one.thisUpdate) L.push("            This Update: " + _date(one.thisUpdate));
+    L.push("            Next Update: " + (one.nextUpdate ? _date(one.nextUpdate) : "NONE"));
+    if (_list(one.singleExtensions).length) {
+      L.push("            Single Extensions:");
+      _list(one.singleExtensions).forEach(function (e) { L.push(_extension(_obj(e), "                ")); });
+    }
+  });
+  if (_list(br.responseExtensions).length) {
+    L.push("    Response Extensions:");
+    _list(br.responseExtensions).forEach(function (e) { L.push(_extension(_obj(e), "        ")); });
+  }
+  if (br.signatureAlgorithm) L.push("    Signature Algorithm: " + _algName(br.signatureAlgorithm));
+  L.push("    Certificates: " + ((br.certs && br.certs.length) || 0));
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.tsp
+ * @signature pki.inspect.tsp(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 3161
+ * @related pki.schema.tsp.parseResponse, pki.inspect.cms
+ *
+ * Render an RFC 3161 timestamp response as a text report: the PKI status with its
+ * status strings and failure info, and the TSTInfo inside the token, giving the
+ * policy, the message imprint, the serial, the time it was stamped with its
+ * accuracy and ordering, the nonce, and the TSA name. The token's own CMS structure,
+ * its signer identifier and its signed attributes, is what `pki.inspect.cms`
+ * renders, and a bare timestamp TOKEN is a CMS ContentInfo rather than a response,
+ * so that verb reads one of those directly. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.tsp.parseResponse` result; a non-response throws `inspect/bad-tsp`,
+ * a wrong-type input `inspect/bad-input`.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey), spki = await pki.key.export(pair.publicKey);
+ *   var ca = await pki.x509.sign({ subject: "tsa.example", subjectPublicKey: spki,
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
+ *     extensions: { keyUsage: ["digitalSignature"], extendedKeyUsage: ["timeStamping"], extendedKeyUsageCritical: true } },
+ *     { key: key });
+ *   var imprint = { hashAlgorithm: "sha256", hashedMessage: Buffer.alloc(32, 7) };
+ *   var token = await pki.tsp.sign(imprint, { cert: ca, key: key }, { policy: "1.2.3", serialNumber: 1 });
+ *   pki.inspect.tsp(pki.tsp.response(token, {})).split("\n")[0];  // "Timestamp Response:"
+ */
+function tspReport(input) {
+  var r = _parseTsp(input);
+  /** @internal RFC 3161 sec. 2.4.2's PKIStatus values need different handling from each other, and a bare
+   *  integer said which only to a reader who knows the table: a rejection and a response still being waited
+   *  on both read as a number. */
+  var statusName = TSP_STATUS_NAMES[r.status];
+  var L = ["Timestamp Response:",
+    "    Status: " + r.status + (statusName ? " (" + statusName + ")" : "")];
+  /** @internal A statusString is text a responder chose, so it reaches the report through the same escape
+   *  every other caller-controlled string does: copied raw, a newline forges a report line and a terminal
+   *  escape rewrites the screen around it. */
+  if (r.statusString) {
+    var strings = Array.isArray(r.statusString) ? r.statusString : [r.statusString];
+    L.push("    Status String: " + strings.map(function (s) { return _clean(String(s)); }).join("; "));
+  }
+  /** @internal PKIFailureInfo is a BIT STRING, and the parser decodes it to a record carrying the named
+   *  bits it asserts in `bits`. Read as an array or a string it rendered as its own object notation and the
+   *  reason a request was rejected, which is the one thing this line is for, was lost. */
+  if (r.failInfo) L.push("    Failure Info: " + _list(_obj(r.failInfo).bits).join(", "));
+  var tok = r.timeStampToken;
+  if (!tok) { L.push("    Token: (none)"); return L.join("\n") + "\n"; }
+  var t = tok.tstInfo;
+  L.push("    TSTInfo:");
+  _optLine(L, "        ", "Version", t.version);
+  _optLine(L, "        ", "Policy", t.policyName ? t.policyName + " (" + t.policy + ")" : t.policy);
+  if (t.messageImprint) {
+    L.push("        Message Imprint:");
+    L.push("            Hash Algorithm: " + _algName(t.messageImprint.hashAlgorithm));
+    if (Buffer.isBuffer(t.messageImprint.hashedMessage)) {
+      L.push("            Hashed Message:");
+      L.push(_hexColon(t.messageImprint.hashedMessage, { wrap: 16, indent: 16 }));
+    }
+  }
+  _serialInto(L, "        ", t.serialNumberHex || t.serialNumber);
+  /** @internal A timestamp's value is the instant it names, and RFC 3161 sec. 2.4.2 puts the sub-second part
+   *  in the GeneralizedTime's fraction, which the shared date renderer does not carry. Dropped, two stamps a
+   *  fraction of a second apart read as the same instant. */
+  if (t.genTime) {
+    L.push("        Gen Time: " + _date(t.genTime) +
+      (t.genTimeFraction ? "  (fraction: ." + t.genTimeFraction + ")" : ""));
+  }
+  if (t.accuracy) {
+    var acc = [];
+    if (t.accuracy.seconds != null) acc.push(t.accuracy.seconds + "s");
+    if (t.accuracy.millis != null) acc.push(t.accuracy.millis + "ms");
+    if (t.accuracy.micros != null) acc.push(t.accuracy.micros + "us");
+    L.push("        Accuracy: " + (acc.length ? acc.join(" ") : "(empty)"));
+  } else {
+    L.push("        Accuracy: (none stated)");
+  }
+  L.push("        Ordering: " + (t.ordering === true));
+  if (t.nonceHex) L.push("        Nonce: " + t.nonceHex);
+  if (t.tsa) L.push("        TSA: " + _nameOrGn(t.tsa));
+  if (_list(t.extensions).length) {
+    L.push("        Extensions:");
+    _list(t.extensions).forEach(function (e) { L.push(_extension(_obj(e), "            ")); });
+  }
+  L.push("    Certificates: " + _list(tok.certificates).length);
+  return L.join("\n") + "\n";
+}
+
+/**
+ * @primitive pki.inspect.attrcert
+ * @signature pki.inspect.attrcert(input) -> string
+ * @since 0.8.29
+ * @status stable
+ * @spec RFC 5755
+ * @related pki.schema.attrcert.parse, pki.inspect.certificate
+ *
+ * Render an RFC 5755 attribute certificate as a text report: the version, the
+ * holder and the issuer in whichever form each takes, the serial, the validity
+ * period, the attributes the certificate asserts, its extensions, and the signature
+ * algorithm. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.attrcert.parse` result; a non-attribute-certificate throws
+ * `inspect/bad-attrcert`, a wrong-type input `inspect/bad-input`. An
+ * X.509-1997 v1 attribute certificate is not parsed by this build, and the report
+ * surfaces that refusal rather than rendering a partial one.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var der = await pki.attrcert.sign({ holder: { entityName: { directoryName: "CN=Alice" } },
+ *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
+ *     attributes: { role: { roleName: { uniformResourceIdentifier: "urn:role:admin" } } } },
+ *     { name: "CN=An AA", publicKey: await pki.key.export(pair.publicKey), key: await pki.key.export(pair.privateKey) });
+ *   pki.inspect.attrcert(der).split("\n")[0];  // "Attribute Certificate:"
+ */
+function attrCertReport(input) {
+  var a = _parseAttrCert(input);
+  var L = ["Attribute Certificate:", "    Data:"];
+  L.push("        Version: " + a.version);
+  var holder = a.holder;
+  L.push("        Holder:");
+  if (holder.entityName) L.push("            Entity Name: " + _nameOrGn(holder.entityName));
+  if (holder.baseCertificateID) {
+    var bid = holder.baseCertificateID;
+    L.push("            Base Certificate ID:");
+    if (bid.issuer) L.push("                Issuer: " + _nameOrGn(bid.issuer));
+    /** @internal RFC 5755's IssuerSerial carries an optional issuerUID, which distinguishes two issuers that
+     *  share a name, so a holder identified with one was reported without the field that identifies it. */
+    if (bid.issuerUID) {
+      var uid = Buffer.isBuffer(bid.issuerUID) ? bid.issuerUID : _obj(bid.issuerUID).bytes;
+      if (Buffer.isBuffer(uid)) L.push("                Issuer Unique ID: " + _hexColon(uid, {}));
+    }
+    /** @internal RFC 5755's IssuerSerial names its field `serial`, which the parser surfaces as `serial`
+     *  and `serialHex`, not as the `serialNumber` a certificate carries. Read by the certificate's names
+     *  both operands were undefined and the holder's serial was dropped, leaving two holders under one
+     *  issuer indistinguishable in the report. */
+    _serialInto(L, "                ", bid.serialHex || bid.serial);
+  }
+  /** @internal The DIGEST is what identifies a holder named this way, so the algorithm alone left every
+   *  holder identified by one digest algorithm reading the same. The object type says what was hashed. */
+  if (holder.objectDigestInfo) {
+    var odi = holder.objectDigestInfo;
+    L.push("            Object Digest Info:");
+    L.push("                Digested Object Type: " +
+      ((odi.digestedObjectType && odi.digestedObjectType.name) || "unspecified"));
+    if (odi.otherObjectTypeID) L.push("                Other Object Type: " + odi.otherObjectTypeID);
+    L.push("                Digest Algorithm: " + _algName(odi.digestAlgorithm));
+    var digestBytes = odi.objectDigest && (Buffer.isBuffer(odi.objectDigest) ? odi.objectDigest : odi.objectDigest.bytes);
+    if (Buffer.isBuffer(digestBytes)) {
+      L.push("                Digest:");
+      L.push(_hexColon(digestBytes, { wrap: 16, indent: 20 }));
+    }
+  }
+  /** @internal RFC 5755 sec. 4.2.3's V2Form names the issuer by name, by a base certificate id, or by an
+   *  object digest, and only the first was rendered: an issuer identified either other way appeared as
+   *  nothing at all. The v1Form is a GeneralNames list, which the name renderer reads. */
+  var iss = a.issuer;
+  var issuedBy = iss.v2Form ? _nameOrGn(iss.v2Form.issuerName) : _nameOrGn(iss.v1Form || iss);
+  if (issuedBy === "(none)" && iss.v2Form) {
+    var v2 = iss.v2Form;
+    if (v2.baseCertificateID) {
+      issuedBy = "baseCertificateID " + _nameOrGn(v2.baseCertificateID.issuer) +
+        (v2.baseCertificateID.serialHex ? " serial " + v2.baseCertificateID.serialHex : "");
+    } else if (v2.objectDigestInfo) {
+      issuedBy = "objectDigest " + _algName(v2.objectDigestInfo.digestAlgorithm);
+    }
+  }
+  L.push("        Issuer: " + issuedBy);
+  if (iss.form) L.push("        Issuer Form: " + iss.form);
+  L.push("        " + _serial(a, 12));
+  if (a.validity) {
+    L.push("        Validity:");
+    if (a.validity.notBeforeTime) L.push("            Not Before: " + _date(a.validity.notBeforeTime));
+    if (a.validity.notAfterTime) L.push("            Not After : " + _date(a.validity.notAfterTime));
+  }
+  /** @internal RFC 5755's optional top-level issuerUniqueID, which tells two issuers sharing a name apart the
+   *  way the holder's own does, and which the report left out entirely. */
+  if (a.issuerUniqueID) {
+    var acUid = Buffer.isBuffer(a.issuerUniqueID) ? a.issuerUniqueID : _obj(a.issuerUniqueID).bytes;
+    if (Buffer.isBuffer(acUid)) L.push("        Issuer Unique ID: " + _hexColon(acUid, {}));
+  }
+  L.push("        Attributes:");
+  if (_list(a.attributes).length) _list(a.attributes).forEach(function (at) { L.push(_attribute(_obj(at), "            ")); });
+  else L.push("            (none)");
+  if (_list(a.extensions).length) {
+    L.push("        Extensions:");
+    _list(a.extensions).forEach(function (e) { L.push(_extension(_obj(e), "            ")); });
+  }
+  L.push("    Signature Algorithm: " + _algName(a.signatureAlgorithm));
+  return L.join("\n") + "\n";
+}
+
+/** @internal The tag names, inverted out of `asn1.TAGS` so the dump cannot name a universal type
+ *  the codec does not have. Tag 0 is the end-of-contents marker X.690 sec. 8.1.5 reserves; the codec
+ *  consumes it rather than naming it, and the header walk renders it as a node of its own. */
+var _DUMP_TAG_NAMES = (function () {
+  var out = Object.create(null);
+  out[0] = "EOC";
+  Object.keys(asn1.TAGS).forEach(function (key) {
+    var name = "";
+    for (var i = 0; i < key.length; i++) name += key[i] === "_" ? " " : key[i];
+    out[asn1.TAGS[key]] = name;
+  });
+  return out;
+})();
+var _DUMP_CLASS_LABEL = Object.assign(Object.create(null), {
+  universal: "UNIVERSAL", application: "APPLICATION", private: "PRIVATE",
+});
+var _DUMP_CLASS_OF = Object.assign(Object.create(null), {
+  0x00: "universal", 0x40: "application", 0x80: "context", 0xc0: "private",
+});
+var _DUMP_TEXT_TAGS = Object.assign(Object.create(null),
+  { 12: 1, 18: 1, 19: 1, 20: 1, 22: 1, 23: 1, 24: 1, 26: 1, 27: 1, 28: 1, 30: 1 });
+var _DUMP_MAX_SAFE = BigInt(Number.MAX_SAFE_INTEGER);
+var _DUMP_NAME_COLUMN = 26;
+var _DUMP_OFFSET_COLUMN = 5;
+var _DUMP_LENGTH_COLUMN = 4;
+var _DUMP_MAX_TAG_OCTETS = 4;
+var _DUMP_MAX_LENGTH_OCTETS = 6;
+
+function _padLeft(s, w) { return s.length >= w ? s : " ".repeat(w - s.length) + s; }
+
+/** @internal `length` decides one name: X.690 sec. 8.1.5 gives the end-of-contents value a zero
+ *  length, so a tag-0 value carrying content is not one and is named for its class and number.
+ *  Pass -1 where the length is indefinite, which an end-of-contents value never is. */
+function _dumpTagName(tagClass, tagNumber, length) {
+  if (tagClass === "context") return "[" + tagNumber + "]";
+  if (tagClass === "universal" && tagNumber === 0 && length !== 0) return _DUMP_CLASS_LABEL.universal + " [0]";
+  if (tagClass === "universal" && _DUMP_TAG_NAMES[tagNumber] !== undefined) return _DUMP_TAG_NAMES[tagNumber];
+  return _DUMP_CLASS_LABEL[tagClass] + " [" + tagNumber + "]";
+}
+
+function _dumpLine(offset, depth, hl, len, constructed, name, value) {
+  var head = _padLeft(String(offset), _DUMP_OFFSET_COLUMN) + ":d=" + depth + "  hl=" + hl +
+    " l=" + _padLeft(String(len), _DUMP_LENGTH_COLUMN) + (constructed ? " cons:" : " prim:");
+  var field = " ".repeat(depth) + name;
+  if (value === null) return head + " " + field;
+  /** @internal One space always separates the name from the value, so a field the column cannot
+   *  hold (a long type name at depth) gets that space rather than running into the colon. */
+  var pad = _DUMP_NAME_COLUMN - field.length;
+  return head + " " + field + (pad > 0 ? " ".repeat(pad) : " ") + ":" + value;
+}
+
+function _dumpPrefixed(prefix, omitted) {
+  if (omitted === 0) return prefix;
+  var note = "(" + omitted + " more byte" + (omitted === 1 ? "" : "s") + " not rendered)";
+  return prefix.length === 0 ? note : prefix + " " + note;
+}
+
+function _dumpHex(buf, limit) {
+  if (buf.length === 0) return "(empty)";
+  var keep = buf.length <= limit ? buf.length : limit;
+  return _dumpPrefixed(_hexColon(buf.subarray(0, keep), {}), buf.length - keep);
+}
+
+function _dumpText(buf, limit) {
+  var keep = buf.length <= limit ? buf.length : limit;
+  return _dumpPrefixed(buf.subarray(0, keep).toString("latin1"), buf.length - keep);
+}
+
+/** @internal The magnitude read from the content bytes as a two's-complement BigInt in one pass,
+ *  behind the same per-value byte cap `asn1.read.integer` applies, because a byte-at-a-time
+ *  accumulate over attacker-length content is quadratic. Past that cap the bytes are rendered and
+ *  no magnitude is computed. The hex beside a magnitude is the content as written, so a leading zero
+ *  octet survives; a magnitude rendered back to hex would drop it. */
+function _dumpInteger(content, limit) {
+  if (content.length === 0) return "(empty)";
+  if (content.length > constants.LIMITS.DER_MAX_INTEGER_BYTES + 1) return _dumpHex(content, limit);
+  var mag = BigInt("0x" + content.toString("hex"));
+  var v = (content[0] & 0x80) !== 0 ? mag - (1n << BigInt(content.length * 8)) : mag;
+  var text = v.toString();
+  if (v <= _DUMP_MAX_SAFE && v >= -_DUMP_MAX_SAFE) return text;
+  return text + " (0x" + content.toString("hex") + ")";
+}
+
+function _dumpBitString(content, limit) {
+  if (content.length === 0) return "(empty)";
+  return content[0] + " unused bits, " + _dumpHex(content.subarray(1), limit);
+}
+
+function _dumpOid(content, limit) {
+  var dotted;
+  try { dotted = asn1.decodeOidContent(content); }
+  catch (_e) { return _dumpHex(content, limit); }
+  var name = oid.name(dotted);
+  return name === undefined ? dotted : dotted + " (" + name + ")";
+}
+
+/** @internal `maxValueBytes` bounds every rendering whose size grows with the content length. A hex
+ *  dump and a text rendering are truncated and the omitted count stated, because a prefix of either
+ *  is still true of the value. A magnitude and a dotted OID are read from the whole content and
+ *  cannot be rendered from a prefix at all, so past the cap the bytes are what the report can
+ *  honestly show. A decoded form of fixed size renders whatever the cap is, since it cannot grow the
+ *  report: a BOOLEAN's verdict, and a BIT STRING's unused-bit count above its capped body. */
+function _dumpValue(tagClass, tagNumber, content, limit) {
+  if (tagClass !== "universal") return _dumpHex(content, limit);
+  if (tagNumber === asn1.TAGS.BOOLEAN) {
+    if (content.length === 1 && content[0] === 0xff) return "TRUE";
+    if (content.length === 1 && content[0] === 0x00) return "FALSE";
+    return _dumpHex(content, limit);
+  }
+  if (tagNumber === asn1.TAGS.INTEGER || tagNumber === asn1.TAGS.ENUMERATED) {
+    return content.length <= limit ? _dumpInteger(content, limit) : _dumpHex(content, limit);
+  }
+  if (tagNumber === asn1.TAGS.BIT_STRING) return _dumpBitString(content, limit);
+  if (tagNumber === asn1.TAGS.NULL) return content.length === 0 ? null : _dumpHex(content, limit);
+  if (tagNumber === asn1.TAGS.OBJECT_IDENTIFIER) {
+    return content.length <= limit ? _dumpOid(content, limit) : _dumpHex(content, limit);
+  }
+  if (_DUMP_TEXT_TAGS[tagNumber] === 1 && _printable(content)) return _dumpText(content, limit);
+  return _dumpHex(content, limit);
+}
+
+function _dumpBytes(n) { return n + (n === 1 ? " byte" : " bytes"); }
+function _dumpNodes(n) { return n + (n === 1 ? " node" : " nodes"); }
+function _dumpRemaining(n) { return _dumpBytes(n) + (n === 1 ? " that remains." : " that remain."); }
+
+/** @internal The node cap records the offset it stopped at, not only that it fired: a report that
+ *  covers part of a file has to name where that part ends or a reader cannot tell what it covers. */
+function _dumpCapped(st, offset) {
+  st.capped = true;
+  st.capOffset = offset;
+  return -1;
+}
+
+/** @internal Renders a tree the strict decoder produced. It applies the node cap and not the depth
+ *  cap, because the decode that built this tree was given the same depth cap and refuses a deeper
+ *  one, so no node reaching here is past it. */
+function _dumpNode(node, depth, st) {
+  if (st.capped) return;
+  if (st.nodes >= st.maxNodes) { _dumpCapped(st, node.header.start); return; }
+  st.nodes += 1;
+  var hl = node.header.end - node.header.start;
+  var name = _dumpTagName(node.tagClass, node.tagNumber, node.length);
+  /** @internal `content` and `children` are read without a fallback: a decode gives every primitive
+   *  a Buffer content, empty where the value is, and every constructed node a children array. A
+   *  fallback for either would be dead code standing in for a shape the decoder guarantees. */
+  if (!node.constructed) {
+    st.lines.push(_dumpLine(node.header.start, depth, hl, node.length, false, name,
+      _dumpValue(node.tagClass, node.tagNumber, node.content, st.maxValueBytes)));
+    return;
+  }
+  st.lines.push(_dumpLine(node.header.start, depth, hl, node.length, true, name, null));
+  var kids = node.children;
+  for (var i = 0; i < kids.length; i++) {
+    _dumpNode(kids[i], depth + 1, st);
+    if (st.capped) return;
+  }
+}
+
+/** @internal The header-by-header walk that runs when the strict decoder refuses the input. It reads
+ *  a tag and a length, renders the node, and on the first byte it cannot read records the offset and
+ *  the reason and unwinds. It returns the offset one past the value, or -1 once a stop or the node cap
+ *  has been recorded. It produces text and never a node, so nothing a lax read accepted can reach a
+ *  verify path, and it carries the caller's depth and node caps because it walks hostile nesting
+ *  exactly as a parse does. */
+function _dumpWalk(buf, start, limit, depth, st) {
+  if (st.stop !== null || st.capped) return -1;
+  if (depth > st.maxDepth) {
+    st.stop = { offset: start, reason: "nesting exceeds the depth cap " + st.maxDepth + "." };
+    return -1;
+  }
+  if (st.nodes >= st.maxNodes) return _dumpCapped(st, start);
+  var p = start;
+  if (p >= limit) {
+    st.stop = { offset: start, reason: "the input ends where an identifier octet was expected." };
+    return -1;
+  }
+  var first = buf[p]; p += 1;
+  var constructed = (first & 0x20) !== 0;
+  var tagClass = _DUMP_CLASS_OF[first & 0xc0];
+  var tagNumber = first & 0x1f;
+  if (tagNumber === 0x1f) {
+    tagNumber = 0;
+    var seen = 0;
+    for (;;) {
+      if (p >= limit) {
+        st.stop = { offset: start, reason: "the high-tag-number form runs past the end of the input." };
+        return -1;
+      }
+      var tb = buf[p]; p += 1;
+      tagNumber = (tagNumber * 128) + (tb & 0x7f);
+      seen += 1;
+      if ((tb & 0x80) === 0) break;
+      if (seen >= _DUMP_MAX_TAG_OCTETS) {
+        st.stop = { offset: start, reason: "the tag number uses more than " + _DUMP_MAX_TAG_OCTETS + " octets." };
+        return -1;
+      }
+    }
+  }
+  if (p >= limit) {
+    st.stop = { offset: start, reason: "the input ends where a length octet was expected." };
+    return -1;
+  }
+  var lenByte = buf[p]; p += 1;
+  var indefinite = false;
+  var length = 0;
+  if (lenByte === 0x80) {
+    if (!constructed) {
+      st.stop = { offset: start,
+        reason: "an indefinite length on a primitive value has no end-of-contents octets to find." };
+      return -1;
+    }
+    indefinite = true;
+  } else if ((lenByte & 0x80) !== 0) {
+    var n = lenByte & 0x7f;
+    if (n > _DUMP_MAX_LENGTH_OCTETS) {
+      st.stop = { offset: start, reason: "the length uses more than " + _DUMP_MAX_LENGTH_OCTETS + " octets." };
+      return -1;
+    }
+    if (p + n > limit) {
+      st.stop = { offset: start, reason: "the long-form length runs past the end of the input." };
+      return -1;
+    }
+    for (var j = 0; j < n; j++) length = (length * 256) + buf[p + j];
+    p += n;
+  } else {
+    length = lenByte;
+  }
+  var hl = p - start;
+  var contentStart = p;
+  var name = _dumpTagName(tagClass, tagNumber, indefinite ? -1 : length);
+
+  if (!constructed) {
+    if (length > limit - contentStart) {
+      st.stop = { offset: start,
+        reason: "content length " + length + " overruns the " + _dumpRemaining(limit - contentStart) };
+      return -1;
+    }
+    st.nodes += 1;
+    st.lines.push(_dumpLine(start, depth, hl, length, false, name,
+      _dumpValue(tagClass, tagNumber, buf.subarray(contentStart, contentStart + length), st.maxValueBytes)));
+    return contentStart + length;
+  }
+
+  st.nodes += 1;
+  var cp = contentStart;
+  var kid;
+  if (indefinite) {
+    st.lines.push(_dumpLine(start, depth, hl, "inf", true, name, null));
+    for (;;) {
+      if (cp + 2 > limit) {
+        st.stop = { offset: start,
+          reason: "the indefinite-length value has no end-of-contents octets before the end of the input." };
+        return -1;
+      }
+      if (buf[cp] === 0x00 && buf[cp + 1] === 0x00) break;
+      kid = _dumpWalk(buf, cp, limit, depth + 1, st);
+      if (kid < 0) return -1;
+      cp = kid;
+    }
+    /** @internal The end-of-contents octets are the one node the walk emits without recursing, so
+     *  both caps are applied to them here. Without the depth check an indefinite-length value with
+     *  no children renders a node one level past the cap and the report still says it completed. */
+    if (depth + 1 > st.maxDepth) {
+      st.stop = { offset: cp, reason: "nesting exceeds the depth cap " + st.maxDepth + "." };
+      return -1;
+    }
+    if (st.nodes >= st.maxNodes) return _dumpCapped(st, cp);
+    st.nodes += 1;
+    st.lines.push(_dumpLine(cp, depth + 1, 2, 0, false, _DUMP_TAG_NAMES[0], null));
+    return cp + 2;
+  }
+  st.lines.push(_dumpLine(start, depth, hl, length, true, name, null));
+  var contentEnd = contentStart + length;
+  var childLimit = contentEnd > limit ? limit : contentEnd;
+  while (cp < childLimit) {
+    kid = _dumpWalk(buf, cp, childLimit, depth + 1, st);
+    if (kid < 0) return -1;
+    cp = kid;
+  }
+  if (contentEnd > limit) {
+    st.stop = { offset: start,
+      reason: "content length " + length + " overruns the " + _dumpRemaining(limit - contentStart) };
+    return -1;
+  }
+  return contentEnd;
+}
+
+var KNOWN_DUMP_OPTS = Object.assign(Object.create(null),
+  { maxBytes: 1, maxDepth: 1, maxNodes: 1, maxValueBytes: 1 });
+
+/**
+ * @primitive pki.inspect.asn1
+ * @signature pki.inspect.asn1(input, opts?) -> string
+ * @since 0.8.31
+ * @status stable
+ * @spec X.690, ISO/IEC 8825-1
+ * @defends ASN.1-parser-DoS (CWE-400)
+ * @related pki.asn1.decode, pki.inspect.any
+ *
+ * Render the TLV tree of `input` (a PEM string or DER Buffer) as a structural dump, one
+ * line per value, in the shape `openssl asn1parse` prints: the byte offset, the nesting
+ * depth, the header length, the content length, whether the value is constructed, the tag
+ * name, and for a primitive its rendered content. An OBJECT IDENTIFIER carries its dotted
+ * form and its registry name. A UTCTime or GeneralizedTime renders the bytes as written
+ * rather than a formatted date, so a malformed time is visible instead of normalized away.
+ *
+ * Two routes produce a report and the first line names which one ran. `pki.asn1.decode`
+ * reads the input first, so a conforming file is rendered from the same decoder the rest of
+ * the toolkit parses with. When that decode refuses the bytes, the report names the refusal
+ * and a header-by-header walk renders what it can read: a truncated file, trailing bytes, a
+ * non-minimal length, an indefinite length, a segmented string. The last line of every report
+ * states the outcome: the offset where the structure ends, or the value the walk could not read
+ * through and why, or the bytes that follow the top-level value, or the cap that stopped the
+ * report and where the next value begins. A partial dump cannot be mistaken for a whole
+ * structure. The walk returns text and never a node tree, and it carries the depth and node
+ * caps, so tolerating a broken encoding here relaxes nothing the parsers enforce.
+ *
+ * No value is withheld here. Where the other reports name a key and print none of it, this
+ * one prints bytes, private key material included, which is what a byte-level dump is for.
+ * The caps bound how much of a value is rendered, not whether it is. `pki.inspect.any` and
+ * `pki.inspect.pkcs8` are the reports that name a key without printing it.
+ *
+ * @opts
+ *   maxBytes:      number,  // default and ceiling: C.LIMITS.DER_MAX_BYTES (16 MiB); refuses a
+ *                           // longer input, and tightens only -- a larger value is refused
+ *   maxDepth:      number,  // default: C.LIMITS.DER_MAX_DEPTH (64); stops at this nesting depth
+ *   maxNodes:      number,  // default: C.LIMITS.DUMP_MAX_NODES; stops after this many nodes
+ *   maxValueBytes: number,  // default: C.LIMITS.DUMP_MAX_VALUE_BYTES; renders at most this
+ *                           // many bytes of one value and counts the rest
+ *
+ * @example
+ *   var b = pki.asn1.build;
+ *   var der = b.sequence([b.integer(1), b.oid("2.5.4.3"), b.nullValue()]);
+ *   console.log(pki.inspect.asn1(der));
+ *   // ASN.1 structure: 12 bytes, decoded as DER
+ *   //     0:d=0  hl=2 l=  10 cons: SEQUENCE
+ *   //     2:d=1  hl=2 l=   1 prim:  INTEGER                  :1
+ *   //     5:d=1  hl=2 l=   3 prim:  OBJECT IDENTIFIER        :2.5.4.3 (commonName)
+ *   //    10:d=1  hl=2 l=   0 prim:  NULL
+ *   // Complete: the structure ends at offset 12, the end of the input.
+ *   console.log(pki.inspect.asn1(der.subarray(0, 7)));
+ *   // ASN.1 structure: 7 bytes, header walk
+ *   // DER decode refused: asn1/truncated: content length overruns the buffer
+ *   //     0:d=0  hl=2 l=  10 cons: SEQUENCE
+ *   //     2:d=1  hl=2 l=   1 prim:  INTEGER                  :1
+ *   // Incomplete: the walk could not read the value at offset 5: content length 3 overruns the 0 bytes that remain.
+ */
+function asn1Dump(input, opts) {
+  if (opts === undefined || opts === null) opts = {};
+  if (typeof opts !== "object" || Array.isArray(opts)) {
+    throw _err("inspect/bad-input", "pki.inspect.asn1 options must be an object");
+  }
+  guard.identifier.assertKnownKeys(opts, KNOWN_DUMP_OPTS, _err, "inspect/bad-input",
+    "pki.inspect.asn1 has an unknown option ");
+  var o = guard.identifier.snapshotOptions(opts, KNOWN_DUMP_OPTS);
+  /** @internal `maxBytes` tightens and never raises. The shared parse door carries its own byte
+   *  ceiling and applies it before this verb sees the bytes, so a larger value could not take effect;
+   *  bounding it here refuses that value instead of accepting it and then contradicting it. */
+  var maxBytes = guard.limits.cap(o.maxBytes, "maxBytes", constants.LIMITS.DER_MAX_BYTES,
+    { max: constants.LIMITS.DER_MAX_BYTES });
+  var maxDepth = guard.limits.depthCap(o.maxDepth, "maxDepth", constants.LIMITS.DER_MAX_DEPTH);
+  var maxNodes = guard.limits.cap(o.maxNodes, "maxNodes", constants.LIMITS.DUMP_MAX_NODES);
+  var maxValueBytes = guard.limits.cap(o.maxValueBytes, "maxValueBytes", constants.LIMITS.DUMP_MAX_VALUE_BYTES);
+
+  var der;
+  try { der = pkix.coerceToDer(input, _INSPECT_ENTRY); }
+  catch (e) { throw _err("inspect/bad-input", "input must be a DER Buffer or a PEM block", e); }
+  if (der.length === 0) throw _err("inspect/bad-input", "input is empty");
+  if (der.length > maxBytes) {
+    throw _err("inspect/bad-input", "input " + der.length + " bytes exceeds the cap " + maxBytes);
+  }
+
+  var head = ["ASN.1 structure: " + der.length + " bytes, decoded as DER"];
+  var node = null;
+  var refusal = null;
+  /** @internal The decoder builds the whole node tree before the renderer counts a line, so the
+   *  report's node cap reaches it as an item cap or a file of small values allocates a tree the
+   *  report will never print. It is given one node more than the report prints, so a structure just
+   *  past the cap is still read strictly and the report says it stopped at the cap; further past it,
+   *  the decoder refuses, the report names that refusal, and the walk renders the bounded prefix. */
+  try {
+    node = asn1.decode(der, { maxBytes: maxBytes, maxDepth: maxDepth, maxItems: maxNodes + 1 });
+  }
+  catch (e) {
+    refusal = e;
+    head = ["ASN.1 structure: " + der.length + " bytes, header walk",
+      "DER decode refused: " + (e.code || "error") + ": " + e.message];
+  }
+
+  var st = { lines: [], nodes: 0, maxNodes: maxNodes, maxDepth: maxDepth,
+    maxValueBytes: maxValueBytes, capped: false, capOffset: 0, stop: null };
+  var end;
+  if (refusal === null) {
+    _dumpNode(node, 0, st);
+    end = node.header.start + node.bytes.length;
+  } else {
+    end = _dumpWalk(der, 0, der.length, 0, st);
+  }
+
+  /** @internal Every stop names the value the walk could not read THROUGH, which is not the offset
+   *  reading had reached: an unterminated indefinite length is read to the end of the input and the
+   *  value at fault is still the one that opened it. */
+  var tail;
+  if (st.stop !== null) {
+    tail = "Incomplete: the walk could not read the value at offset " + st.stop.offset + ": " +
+      st.stop.reason;
+  } else if (st.capped) {
+    tail = "Incomplete: the report stopped after " + _dumpNodes(maxNodes) + ", the cap on one dump; " +
+      "the next value begins at offset " + st.capOffset + ".";
+  } else if (end < der.length) {
+    tail = "Incomplete: " + _dumpBytes(der.length - end) + " at offset " + end +
+      " follow the top-level value.";
+  } else {
+    tail = "Complete: the structure ends at offset " + end + ", the end of the input.";
+  }
+  return head.concat(st.lines, [tail]).join("\n");
+}
+
+var _INSPECT_BY_FORMAT = Object.assign(Object.create(null), {
+  x509: certificate, crl: crlReport, csr: csrReport, cms: cmsReport,
+  pkcs8: pkcs8Report, pkcs12: pkcs12Report, crmf: crmfReport, cmp: cmpReport,
+  csrattrs: csrattrsReport, trustanchor: trustAnchorReport,
+  "ocsp-request": ocspRequestReport, "ocsp-response": ocspResponseReport,
+  tsp: tspReport, attrcert: attrCertReport,
+});
 
 /**
  * @primitive pki.inspect.any
@@ -875,11 +2418,12 @@ var _INSPECT_BY_FORMAT = Object.assign(Object.create(null), { x509: certificate,
  * @related pki.schema.detectFormat, pki.inspect.certificate
  *
  * Detect which PKI format `input` (a PEM string or DER Buffer) encodes and render
- * it with the matching report, the inspect analogue of `pki.schema.parse`. Routes
- * a certificate / CRL / CSR / CMS to `certificate` / `crl` / `csr` / `cms`; a
- * detected but out-of-scope format (OCSP, TSP, PKCS#8/#12, CRMF, CMP, ...) throws
- * `inspect/unsupported-format` naming it, and an unrecognized input
- * `inspect/bad-input`.
+ * it with the matching report, the inspect analogue of `pki.schema.parse`. Every
+ * format `pki.schema.all()` detects has a report and its own named verb, so the
+ * same bytes render the same whether the format is detected or asked for by name.
+ * An X.509-1997 v1 attribute certificate is detected so it can be named, and it is
+ * refused with the reason its own parser gives rather than as an unsupported
+ * format. An unrecognized input throws `inspect/bad-input`.
  *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -896,7 +2440,17 @@ function any(input) {
   } catch (e) { throw _err("inspect/bad-input", "input is not a decodable DER Buffer or PEM string", e); }
   if (fmt === null) throw _err("inspect/bad-input", "input does not match any registered PKI format");
   var render = _INSPECT_BY_FORMAT[fmt];
-  if (!render) throw _err("inspect/unsupported-format", "inspect does not support the detected format \"" + fmt + "\" (supported: certificate, crl, csr, cms)");
+  /** @internal A format with no renderer is one whose parser refuses the bytes outright, and the reason
+   *  it refuses is what a reader of that file needs. `attrcert-v1` is the case: an X.509-1997 attribute
+   *  certificate is detected so it can be named rather than misread as the v2 form, and its parser
+   *  throws `attrcert/legacy-v1-not-supported`. Reporting "inspect does not support this format" would
+   *  send an operator looking for a missing feature instead of telling them which form they hold, so the
+   *  format's own parse runs and its error propagates. */
+  if (!render) {
+    schemaAll.parse(der);
+    throw _err("inspect/unsupported-format", "inspect does not support the detected format \"" + fmt +
+      "\" (supported: " + Object.keys(_INSPECT_BY_FORMAT).sort().join(", ") + ")");
+  }
   return render(der);
 }
 
@@ -905,6 +2459,17 @@ module.exports = {
   crl: crlReport,
   csr: csrReport,
   cms: cmsReport,
+  pkcs8: pkcs8Report,
+  pkcs12: pkcs12Report,
+  crmf: crmfReport,
+  cmp: cmpReport,
+  csrattrs: csrattrsReport,
+  trustanchor: trustAnchorReport,
+  ocspRequest: ocspRequestReport,
+  ocspResponse: ocspResponseReport,
+  tsp: tspReport,
+  attrcert: attrCertReport,
+  asn1: asn1Dump,
   any: any,
   renderedExtensions: Object.keys(EXT_RENDERERS),
 };