@blamejs/pki 0.8.3 → 0.8.5

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.5 — 2026-09-25
+
+A key this process cannot export can sign, and every verb that signs proves its signature first.
+
+### Added
+
+- A signer `{ algorithm, publicKey, sign }` is accepted wherever a signing verb takes a private key: `pki.x509.sign`, `pki.crl.sign`, `pki.csr.sign`, `pki.cms.sign` and its countersignatures, `pki.attrcert.sign`, `pki.cmp.build`, `pki.crmf.build`, `pki.ocsp.buildRequest`, `pki.ocsp.sign` and `pki.tsp.sign`. `sign(bytes)` is handed the bytes WebCrypto would be handed and returns the bytes WebCrypto would return, or a promise of them; for ECDSA that is the fixed-width `r || s` of RFC 9053 sec. 2.1, and a DER `SEQUENCE` is refused by name rather than encoded a second time. The private half never reaches the toolkit.
+- A signer's declared `algorithm` is held to the algorithm of the key the artifact certifies, and its declared `publicKey` to the key the signature is verified against, both before the callback is asked to sign. The caller's object is read once, in the synchronous prologue, so an accessor cannot answer one way to the check and another to the use. For an ECDSA key, whose curve is named but whose digest is chosen per signature, the digest the signer declares is checked on its own, before any remote signing request. The bytes the callback is handed are a copy in an allocation of its own, so a callback that rewrites them rewrites only its own copy and cannot reach the bytes the artifact carries. The bytes it returns are copied before use. Hold a client or any mutable state in the callback's closure: a signing verb snapshots its options, so the signer object the callback sees is a copy of the one you passed. A composite ML-DSA signature is refused by name, since it is produced from both component private keys and one callback cannot do that.
+
+### Fixed
+
+- `pki.ocsp.sign`, `pki.ocsp.buildRequest` and `pki.cms.sign`'s countersignature path verify the signature they produced against the public key the artifact declares, which the other signing verbs already did. A signer holding a key that does not match the certificate it signs under produced an OCSP response, an OCSP request or a countersignature that no relying party could validate, and the emitting side reported success.
+
+## v0.8.4 — 2026-09-25
+
+A decode cap bounds every structure a parse reads, and a refusal caused by a cap is no longer reported as malformed input.
+
+### Added
+
+- `pki.schema.engine.decodeNested(bytes, ctx, label, opts?)`, the decode to perform on a value already read out of a parse's input. It applies the caps carried on the walk context and records a resource refusal against the parse before re-throwing, which is what a format parser composed on the engine needs so its embedded payloads answer to the caller's caps.
+- `pki.schema.engine.withResources(ns, source)` carries a parse's caps and budget onto another namespace, for a format whose structure is carried inside another one. The structure is still walked in its own namespace, so a fault in it keeps that format's error class and code. `pki.schema.engine.isResourceRefusal(err)` reports whether a codec error was a limit rather than a claim about the bytes.
+
+### Changed
+
+- An input refused for exceeding a decode limit reports `<format>/too-large` in cases where it previously reported the format's own malformed-value code, such as `cms/bad-aead-params` or `cmp/bad-body`. A parser that decodes a value out of its input wraps a decode failure in a code of its own, and that code sent a reader to inspect bytes that were fine and a cap that was too small. A caller matching on one of those codes to detect malformed input will stop seeing over-budget inputs under it. The wrapped error is carried on the refusal as its `cause`.
+
+### Fixed
+
+- A decode cap bounds every structure a parse reads, not the input alone. An embedded `OCTET STRING` payload, an encapsulated protocol body, a `SafeContents` inside a PKCS#12 store and an attribute value are all decoded under the caps the caller named. The 0.8.3 notes recorded that a structure decoded from inside the input kept the built-in `pki.C.LIMITS` defaults; it no longer does.
+- `pki.schema.cmc.parse` applies the caller's caps to the `PKIData` or `PKIResponse` body. It read the caps, bounded the CMS carrier with them, and then decoded the body that carries the request or response with the built-in defaults.
+- A parse cannot return a result after a decode limit has refused something inside that parse, whatever the code between the two does with the failure. A parser that catches a resource refusal and re-throws its own typed error is the common shape, and that shape previously carried the parse past the latch the budget sets. The door now reads the latch on the failure path as well as on the success path.
+
 ## v0.8.3 — 2026-09-25
 
 A parser takes decode caps from its caller, and a resource refusal says so instead of reading as malformed input.

package/README.md

@@ -190,6 +190,33 @@ var ok  = await subtle.verify({ name: "ML-DSA-65" }, kp.publicKey, sig, data); /
 // same call shape, and every key it exports is OpenSSL/NSS-interoperable.
 ```
 
+### Sign with a key this process cannot export
+
+Every signing verb takes a signer object wherever it takes a private key, for a
+key held in a hardware security module, a cloud key management service, a PKCS#11
+token, a PIV slot or a Trusted Platform Module. The private half never reaches
+the toolkit.
+
+```js
+var signer = {
+  algorithm: { name: "ECDSA", namedCurve: "P-256", hash: { name: "SHA-256" } },
+  publicKey: spkiDer,                       // the SPKI DER of the public half
+  sign: function (bytes) { return kms.sign(keyId, bytes); },   // bytes or a promise of them
+};
+
+var cert = await pki.x509.sign(spec, { key: signer, cert: caCert });
+```
+
+`sign(bytes)` is handed the bytes WebCrypto would be handed and returns the bytes
+WebCrypto would return: for ECDSA the fixed-width `r || s` of RFC 9053 §2.1, not a
+DER `SEQUENCE`. `algorithm` is held to the certificate's key algorithm, `publicKey`
+is held to the key the signature is verified against, and the signature is
+verified before the artifact is returned. The bytes handed to the callback are a
+copy, so rewriting them rewrites nothing the artifact carries. Hold the client and
+any mutable state in the callback's closure, as the example does: a signing verb
+snapshots its options, so the signer object the callback sees is a copy of the one
+you passed.
+
 ## What ships today
 
 Everything below is callable now; nothing is a stub. The whole documented

package/lib/cms-sign.js

@@ -214,7 +214,10 @@ function _keyOnlyCertStandIn(spkiDer) {
     if (e && typeof e.code === "string" && e.code.indexOf("cms/") === 0) throw e;
     throw _err("cms/bad-input", "a key-only signer's spki is not a SubjectPublicKeyInfo", e);
   }
-  return { subjectPublicKeyInfo: { algorithm: alg } };
+  /** @internal The SPKI bytes travel with the stand-in, because the key this signature is verified
+   * against is what a signer's declared publicKey is held to, and this form names that key by SPKI
+   * rather than by certificate. */
+  return { subjectPublicKeyInfo: { bytes: spkiDer, algorithm: alg } };
 }
 
 function _keyOnlyKeyId(so) {
@@ -432,11 +435,18 @@ function _buildCountersignature(targetSigOctets, countersigner, opts) {
       return _buildSignedAttrs(pairs.concat(extra));
     });
   }).then(function (attrs) {
-    return signScheme.signOverTbs(scheme, soKey, attrs ? attrs.setOf : targetSigOctets, _signE).then(function (sig) {
-      var fields = [b.integer(BigInt(sidv.version)), sidv.sid, scheme.digestAlgId];
-      if (attrs) fields.push(attrs.wire);
-      fields.push(scheme.sigAlgId, b.octetString(sig));
-      return { value: b.sequence(fields), certDer: certDer };
+    var preimage = attrs ? attrs.setOf : targetSigOctets;
+    return signScheme.signOverTbs(scheme, soKey, preimage, _signE).then(function (sig) {
+      /** @internal The countersignature is held to the same proof the signature is: it verifies
+       * against the public key the countersigner's certificate declares. */
+      return guard.async.deferred(function () {
+        return _b.assertSignatureVerifies(preimage, sig, cert.subjectPublicKeyInfo.bytes, scheme);
+      }).then(function () {
+        var fields = [b.integer(BigInt(sidv.version)), sidv.sid, scheme.digestAlgId];
+        if (attrs) fields.push(attrs.wire);
+        fields.push(scheme.sigAlgId, b.octetString(sig));
+        return { value: b.sequence(fields), certDer: certDer };
+      });
     });
   });
 }

package/lib/cms-verify.js

@@ -721,7 +721,8 @@ function _addCert(out, der) {
  * S/MIME signed mail, RFC 3161 timestamp tokens, and code signing rest on, and exactly what
  * `pki.cms.verify` consumes and OpenSSL `cms -verify` validates. Each `signers[i]` is
  * `{ cert, key, digestAlgorithm?, pss? }`: `cert` the signer certificate (PEM or DER), `key`
- * its private key (a WebCrypto `CryptoKey` or a PKCS#8 DER `Buffer` / PEM string; for a composite
+ * its private key (a WebCrypto `CryptoKey`, a PKCS#8 DER `Buffer` / PEM string, or a signer
+ * `{ algorithm, publicKey, sign }` for a key held outside this process; for a composite
  * ML-DSA signer, the two component keys `{ mldsa, trad }`, each PKCS#8). The
  * signature covers the RFC 5652 sec. 5.4 preimage: with signed attributes (the default) the
  * message-digest attribute is bound to the content digest and the signature is over the

package/lib/csr-sign.js

@@ -77,7 +77,8 @@ function _challengePassword(pw) {
  * `challengePassword`. An extension the issuing CA assigns (authorityKeyIdentifier, the
  * certificate-transparency pair, the CA version and previous-certificate hash, ocspNoCheck) is not a
  * request and is refused by name. `key` (or
- * `{ key }`) is the subject's own PKCS#8 private key / WebCrypto CryptoKey, so the request is self-signed
+ * `{ key }`) is the subject's own PKCS#8 private key, WebCrypto CryptoKey, or signer
+ * `{ algorithm, publicKey, sign }`, so the request is self-signed
  * to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the
  * request is returned. The signature algorithm is resolved from the subject key (RSA PKCS#1 v1.5 or PSS,
  * ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm). Returns DER, or a PEM `CERTIFICATE REQUEST` with

package/lib/guard-parsed.js

@@ -158,8 +158,8 @@ function recordingParser(kind, parse, ErrorClass, code, label) {
 
 // @enforced-by guard-shape-reinlined -- shares recordingParser's shape below: the PROVENANCE.set
 function recordingWalker(kind, walkNode, decodeBytes) {
-  return function (node) {
-    var out = walkNode(node);
+  return function (node, ctx) {
+    var out = walkNode(node, ctx);
     if (out && typeof out === "object" && node && _isBytes(node.bytes)) {
       _weakSet(PROVENANCE, out, {
         kind: kind,

package/lib/ocsp.js

@@ -45,6 +45,9 @@ var b = asn1.build;
 function O(name) { return oid.byName(name); }
 function _err(code, message, cause) { return new OcspError(code, message, cause); }
 function _signE(kind, message, cause) { return new OcspError("ocsp/" + kind, message, cause); }
+/** @internal Only the signature self-check is taken from the shared builder here; the name and
+ * SPKI schemas it also serves belong to the certificate verbs, and this module reads neither. */
+var _b = pkiBuild.makeBuilder({ ErrorClass: OcspError, prefix: "ocsp", O: O, NS: null, NAME_SCHEMA: null, SPKI_SCHEMA: null, EXT_DECODERS: {} });
 
 var HASH_WC = Object.assign(Object.create(null), { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var REASON_CODE = Object.create(null);
@@ -214,8 +217,12 @@ function _buildRequest(query, opts) {
     if (signerCert === null) return _emitReq(b.sequence([tbsRequest]), opts);
     var scheme = signScheme.resolveSignScheme(signerCert, { combinedRsaSig: true }, true, _signE);
     return signScheme.signOverTbs(scheme, opts.signer.key, tbsRequest, _signE).then(function (sig) {
-      var optionalSignature = b.sequence([scheme.sigAlgId, b.bitString(sig, 0), b.explicit(0, b.sequence([b.raw(signerCertDer)]))]);
-      return _emitReq(b.sequence([tbsRequest, b.explicit(0, optionalSignature)]), opts);
+      /** @internal The request is held to the same proof a certificate is: the signature verifies
+       * against the public key the certificate it carries declares. */
+      return Promise.resolve(_b.assertSignatureVerifies(tbsRequest, sig, signerCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+        var optionalSignature = b.sequence([scheme.sigAlgId, b.bitString(sig, 0), b.explicit(0, b.sequence([b.raw(signerCertDer)]))]);
+        return _emitReq(b.sequence([tbsRequest, b.explicit(0, optionalSignature)]), opts);
+      });
     });
   });
 }
@@ -349,11 +356,15 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
       var responseDataDer = b.sequence(rdChildren);
       var scheme = signScheme.resolveSignScheme(respCert, { combinedRsaSig: true }, true, _signE);
       return signScheme.signOverTbs(scheme, responderKey, responseDataDer, _signE).then(function (sig) {
-        var basicChildren = [responseDataDer, scheme.sigAlgId, b.bitString(sig, 0)];
-        if (opts.embedCert !== false) basicChildren.push(b.explicit(0, b.sequence([b.raw(respCertDer)])));
-        var responseBytes = b.sequence([b.oid(OID_OCSP_BASIC), b.octetString(b.sequence(basicChildren))]);
-        var der = b.sequence([b.enumerated(0n), b.explicit(0, responseBytes)]);
-        return opts.pem ? ocspSchema.pemEncode(der, "OCSP RESPONSE") : der;
+        /** @internal The response is held to the same proof a certificate is: the signature verifies
+         * against the public key the responder certificate declares. */
+        return Promise.resolve(_b.assertSignatureVerifies(responseDataDer, sig, respCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+          var basicChildren = [responseDataDer, scheme.sigAlgId, b.bitString(sig, 0)];
+          if (opts.embedCert !== false) basicChildren.push(b.explicit(0, b.sequence([b.raw(respCertDer)])));
+          var responseBytes = b.sequence([b.oid(OID_OCSP_BASIC), b.octetString(b.sequence(basicChildren))]);
+          var der = b.sequence([b.enumerated(0n), b.explicit(0, responseBytes)]);
+          return opts.pem ? ocspSchema.pemEncode(der, "OCSP RESPONSE") : der;
+        });
       });
     });
   });

package/lib/pki-build.js

@@ -1290,7 +1290,7 @@ function makeBuilder(ctx) {
     var keyOid;
     try { keyOid = asn1.read.oid(alg.children[0]); }
     catch (e) { throw E("bad-input", "the signing key SPKI algorithm is not an OID", e); }
-    return { subjectPublicKeyInfo: { algorithm: { oid: keyOid, parameters: alg.children.length > 1 ? alg.children[1].bytes : undefined } } };
+    return { subjectPublicKeyInfo: { bytes: spkiDer, algorithm: { oid: keyOid, parameters: alg.children.length > 1 ? alg.children[1].bytes : undefined } } };
   }
 
   function assertSignatureVerifies(preimage, sig, spki, scheme) {

package/lib/schema-attrcert.js

@@ -147,7 +147,7 @@ var V2_FORM = schema.seq([
     if (issuerName.names[0].tagNumber !== 4) {
       throw ctx.E("attrcert/bad-issuer-name", "the issuerName GeneralName must be a directoryName [4] (RFC 5755 sec. 4.2.3)");
     }
-    var dirName = asn1.decode(issuerName.names[0].bytes).children[0];
+    var dirName = pkix.decodeNested(issuerName.names[0].bytes, ctx, "the issuerName directoryName").children[0];
     if (!dirName.children || dirName.children.length < 1) {
       throw ctx.E("attrcert/bad-issuer-name", "the issuerName directoryName must be a non-empty distinguished name (RFC 5755 sec. 4.2.3)");
     }
@@ -217,14 +217,14 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
     var attributes = acinfo.fields.attributes.value.result;
     attributes.forEach(function (a) {
       var dec = _ATTR_VALUE_DECODERS[a.type];
-      a.decoded = a.values.map(function (v) { return dec ? dec(v) : { opaque: true, bytes: v }; });
+      a.decoded = a.values.map(function (v) { return dec ? dec(v, ctx) : { opaque: true, bytes: v }; });
     });
 
     var extField = acinfo.fields.extensions;
     var extensions = (extField && extField.present) ? extField.value.result : [];
     extensions.forEach(function (x) {
       var dec = _AC_EXT_DECODERS[x.oid];
-      x.decoded = dec ? dec(x.value) : { opaque: true, bytes: x.value };
+      x.decoded = dec ? dec(x.value, ctx) : { opaque: true, bytes: x.value };
     });
 
     return {
@@ -398,12 +398,13 @@ function _oneGN(node, code) {
 
 // @internal
 function readGeneralName(der, code) {
+  // allow:bare-decode reached from the builder, not from a parse, so no parse context carries caps here.
   return _oneGN(asn1.decode(der), code || "attrcert/bad-input");
 }
 
 function _svceAuthInfo(authInfoAllowed, code) {
-  return function (buf) {
-    var kids = _seqChildren(buf, code, "SvceAuthInfo");
+  return function (buf, ctx) {
+    var kids = _seqChildren(buf, code, "SvceAuthInfo", ctx);
     if (kids.length < 2 || kids.length > 3) throw NS.E(code, "SvceAuthInfo must be a SEQUENCE { service, ident, authInfo? }");
     var service = _oneGN(kids[0], code);
     var ident = _oneGN(kids[1], code);
@@ -417,12 +418,12 @@ function _svceAuthInfo(authInfoAllowed, code) {
   };
 }
 
-function _ietfAttrSyntax(buf) {
+function _ietfAttrSyntax(buf, ctx) {
   var C = "attrcert/bad-ietf-attr";
-  var kids = _seqChildren(buf, C, "IetfAttrSyntax");
+  var kids = _seqChildren(buf, C, "IetfAttrSyntax", ctx);
   if (!kids.length || kids.length > 2) throw NS.E(C, "IetfAttrSyntax must be a SEQUENCE { policyAuthority [0]?, values }");
   var policyAuthority = null, i = 0;
-  if (_isCtx(kids[0], 0)) { policyAuthority = schema.walk(_GNS_0, kids[0], NS).result; i = 1; }
+  if (_isCtx(kids[0], 0)) { policyAuthority = schema.walk(_GNS_0, kids[0], schema.withResources(NS, ctx)).result; i = 1; }
   var valuesNode = kids[i];
   if (!valuesNode || !_isU(valuesNode, TAGS.SEQUENCE) || !valuesNode.children || !valuesNode.children.length) {
     throw NS.E(C, "IetfAttrSyntax values must be a non-empty SEQUENCE OF value");
@@ -438,12 +439,12 @@ function _ietfAttrSyntax(buf) {
   return { policyAuthority: policyAuthority, values: values, homogeneous: Object.keys(kinds).length === 1 };
 }
 
-function _role(buf) {
+function _role(buf, ctx) {
   var C = "attrcert/bad-role";
-  var kids = _seqChildren(buf, C, "RoleSyntax");
+  var kids = _seqChildren(buf, C, "RoleSyntax", ctx);
   if (!kids.length || kids.length > 2) throw NS.E(C, "RoleSyntax must be a SEQUENCE { roleAuthority [0]?, roleName [1] }");
   var roleAuthority = null, i = 0;
-  if (_isCtx(kids[0], 0)) { roleAuthority = schema.walk(_GNS_0, kids[0], NS).result; i = 1; }
+  if (_isCtx(kids[0], 0)) { roleAuthority = schema.walk(_GNS_0, kids[0], schema.withResources(NS, ctx)).result; i = 1; }
   var rn = kids[i];
   if (!_isCtx(rn, 1) || !rn.children || rn.children.length !== 1) throw NS.E(C, "RoleSyntax roleName must be an EXPLICIT [1] wrapping exactly one GeneralName");
   if (i + 1 !== kids.length) throw NS.E(C, "RoleSyntax has unexpected trailing fields");
@@ -473,9 +474,9 @@ function _securityCategory(node, C) {
   if (!_isCtx(valueNode, 1) || !valueNode.children || valueNode.children.length !== 1) throw NS.E(C, "SecurityCategory value must be an EXPLICIT [1] wrapping one element");
   return { type: type, valueBytes: Buffer.concat([valueNode.children[0].bytes]) };
 }
-function _clearance(buf) {
+function _clearance(buf, ctx) {
   var C = "attrcert/bad-clearance";
-  var kids = _seqChildren(buf, C, "Clearance");
+  var kids = _seqChildren(buf, C, "Clearance", ctx);
   if (!kids.length || kids.length > 3) throw NS.E(C, "Clearance must be a SEQUENCE { policyId, classList?, securityCategories? }");
   if (!_isU(kids[0], TAGS.OBJECT_IDENTIFIER)) throw NS.E(C, "Clearance policyId must be an OBJECT IDENTIFIER");
   var policyId; try { policyId = asn1.read.oid(kids[0]); } catch (e) { throw NS.E(C, "Clearance policyId must be an OBJECT IDENTIFIER", e); }
@@ -508,16 +509,16 @@ _ATTR_VALUE_DECODERS[_Oav("chargingIdentity")] = _ietfAttrSyntax;
 _ATTR_VALUE_DECODERS[_Oav("group")] = _ietfAttrSyntax;
 
 
-function _acAuditIdentity(buf) {
+function _acAuditIdentity(buf, ctx) {
   var C = "attrcert/bad-audit-identity";
-  var n = _decodeTop(buf, C, "AuditIdentity");
+  var n = _decodeTop(buf, C, "AuditIdentity", ctx);
   if (!_isU(n, TAGS.OCTET_STRING)) throw NS.E(C, "AuditIdentity must be an OCTET STRING");
   return Buffer.concat([asn1.read.octetString(n)]);
 }
 
-function _noRevAvail(buf) {
+function _noRevAvail(buf, ctx) {
   var C = "attrcert/bad-no-rev-avail";
-  var n = _decodeTop(buf, C, "NoRevAvail");
+  var n = _decodeTop(buf, C, "NoRevAvail", ctx);
   try { asn1.read.nullValue(n); } catch (e) { throw NS.E(C, "NoRevAvail must be a DER NULL (RFC 5755 sec. 4.3.6)", e); }
   return { noRevAvail: true };
 }
@@ -546,13 +547,13 @@ function _acDecodeTargets(node, C, allowTargetCert) {
   if (!_isU(node, TAGS.SEQUENCE) || !node.children || !node.children.length) throw NS.E(C, "Targets must be a non-empty SEQUENCE OF Target");
   return node.children.map(function (t) { return _acTarget(t, C, allowTargetCert); });
 }
-function _seqOfTargets(buf, C, allowTargetCert) {
-  var kids = _seqChildren(buf, C, "SEQUENCE OF Targets");
+function _seqOfTargets(buf, C, allowTargetCert, ctx) {
+  var kids = _seqChildren(buf, C, "SEQUENCE OF Targets", ctx);
   if (!kids.length) throw NS.E(C, "a SEQUENCE OF Targets must be non-empty");
   return kids.map(function (targetsNode) { return _acDecodeTargets(targetsNode, C, allowTargetCert); });
 }
-function _targetInformation(buf) { return _seqOfTargets(buf, "attrcert/bad-targets", true); }
-function _acProxying(buf) { return _seqOfTargets(buf, "attrcert/bad-proxy-info", false); }
+function _targetInformation(buf, ctx) { return _seqOfTargets(buf, "attrcert/bad-targets", true, ctx); }
+function _acProxying(buf, ctx) { return _seqOfTargets(buf, "attrcert/bad-proxy-info", false, ctx); }
 
 function _acAttrSpec(node, C) {
   if (!node.children) throw NS.E(C, "an AttrSpec must be a SEQUENCE OF OBJECT IDENTIFIER");
@@ -561,9 +562,9 @@ function _acAttrSpec(node, C) {
     try { return asn1.read.oid(o); } catch (e) { throw NS.E(C, "an AttrSpec element must be an OBJECT IDENTIFIER", e); }
   });
 }
-function _aaControls(buf) {
+function _aaControls(buf, ctx) {
   var C = "attrcert/bad-aa-controls";
-  var kids = _seqChildren(buf, C, "AAControls");
+  var kids = _seqChildren(buf, C, "AAControls", ctx);
   if (kids.length > 4) throw NS.E(C, "AAControls has too many fields");
   var out = { pathLenConstraint: null, permittedAttrs: null, excludedAttrs: null, permitUnSpecified: true }, i = 0;
   if (kids[i] && _isU(kids[i], TAGS.INTEGER)) { out.pathLenConstraint = guard.range.uint31(_readInt(kids[i], C, "pathLenConstraint"), NS.E, C, "AAControls pathLenConstraint"); i++; }
@@ -588,9 +589,18 @@ _AC_EXT_DECODERS[_Oav("acProxying")] = _acProxying;
  *  through the certificate decoders, so a relying party running the sec. 6 "pointer in AC" scheme
  *  reads the distribution point and the OCSP location off the parse rather than off raw bytes. */
 var _CERT_EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
-_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = _CERT_EXT_DECODERS[_Oav("authorityKeyIdentifier")];
-_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = _CERT_EXT_DECODERS[_Oav("authorityInfoAccess")];
-_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = _CERT_EXT_DECODERS[_Oav("cRLDistributionPoints")];
+/** @internal The certificate decoders close over the namespace they were built with, so a parse
+ *  that named caps gets its own table and every decode below these three reads the caller's
+ *  figure. A caller outside a parse passes no context and reuses the module's table. */
+function _certExtDecoder(name) {
+  var key = _Oav(name);
+  return function (buf, ctx) {
+    return (ctx ? pkix.certExtensionDecoders(schema.withResources(NS, ctx)).byOid : _CERT_EXT_DECODERS)[key](buf);
+  };
+}
+_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = _certExtDecoder("authorityKeyIdentifier");
+_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = _certExtDecoder("authorityInfoAccess");
+_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = _certExtDecoder("cRLDistributionPoints");
 
 // @internal
 function validateAttributeValue(type, valueDer) {