@blamejs/pki 0.8.56 → 0.8.57

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.57 — 2026-10-07
+
+Read the OCSP response a CMS message carries in its crls field, instead of accepting it unread.
+
+### Added
+
+- A `crls` entry in the `other [1]` arm is read as RFC 5652 sec. 10.2.1 `OtherRevocationInfoFormat` and carries `otherRevInfoFormat` (dotted), `otherRevInfoFormatName` (or `null` for a format no registry names) and `otherRevInfoBytes`, the raw ANY TLV exactly as it arrived. A CertificateList entry is unchanged. An operator can now tell an RFC 5940 OCSP entry from an SCVP one, and either from an unregistered format, which nothing in this build could do before.
+- For `id-ri-ocsp-response`, the embedded OCSP response is surfaced in `ocspResponse` as a parsed record, with the byte ranges a verifier hashes left raw. `pki.path.ocspChecker`, `pki.path.verifyOcspResponse`, `pki.ocsp.verify` and `pki.lint.ocsp` all accept it as it stands: harvest the entries with `crls.map(e => e.ocspResponse).filter(Boolean)` and hand them over. The same verbs take the record and the caller re-encodes nothing; a rebuilt copy of it is refused exactly as a rebuilt parse result is.
+- A carried response whose `responseType` names a body this build does not decode keeps its envelope and leaves the body alone: `ocspResponse.basicResponse` is `null` and `ocspResponse.responseBytes.response` holds the bytes as they arrived. RFC 6960 sec. 4.2.1 dispatches the response body on that OID and RFC 5940 sec. 3 asks for a successful status rather than a body a reader can decode, so the message parses and a caller who only needs its signature verified is not stopped by a response type nothing in the path consults. The verbs above are handed a record with no response body and determine nothing from it, so a certificate's status stays undetermined rather than reading as good. `pki.schema.ocsp.parseResponse` still refuses the same bytes with `ocsp/unsupported-response-type`: a client that asked a responder for an answer needs to be told it cannot be read.
+- The same reading applies to `originatorInfo.crls`, so EnvelopedData (RFC 5652 sec. 6.1), AuthenticatedData (sec. 9.1) and AuthEnvelopedData (RFC 5083 sec. 2.1) carry it too, not SignedData alone. RFC 5940 sec. 1 names all four.
+- `pki.oid` resolves the two id-ri formats a reader can act on: `id-ri-ocsp-response` (1.3.6.1.5.5.7.16.2) and `id-ri-scvp` (1.3.6.1.5.5.7.16.4).
+- `pki.lint.cms` reports a notice when a `crls` entry carries revocation information this build does not read, naming the format, the response type where there is one, and where the entry sat. An `id-ri-ocsp-response` entry whose response was read draws nothing; one whose `responseType` named a body this build does not decode draws the notice, because the revocation information it carries went unconsulted either way.
+
+### Changed
+
+- `pki.schema.cms.parse` reads these entries by default. An entry that was accepted unread before may now be refused if it is malformed under RFC 5652 sec. 10.2.1 or RFC 5940 sec. 3; an unrecognized format is still accepted and surfaced opaquely, because sec. 10.2.1's ANY DEFINED BY is an extension point and refusing an unknown format would refuse a future registered one. The reading is not optional, because an opt-in would leave the entry unread for every caller who does not know to ask for it.
+
+### Fixed
+
+- An `other [1]` crls entry is held to its stated shape. `OtherRevocationInfoFormat` is exactly an OBJECT IDENTIFIER and an ANY, so an empty arm, a one-element arm carrying a format and no revocation information, and an arm with a third element are each refused as `cms/bad-other-rev-info`. The one-element form is what OpenSSL both accepts and can emit, because its template marks the value optional.
+- An OCSP response carried in that arm must state a status. A `tryLater` or `malformed` response is a well-formed OCSPResponse that conveys no revocation information, so it is refused here as `cms/bad-ocsp-rev-info` (RFC 5940 sec. 3). `pki.schema.ocsp.parseResponse` still accepts one, because a client reading a live responder's answer needs to see it.
+- A BasicOCSPResponse where an OCSPResponse belongs is refused. Both are SEQUENCEs, so the confusion RFC 5126 sec. 6.3.4 invites by carrying `SEQUENCE OF BasicOCSPResponse` in a signed attribute passes any tag check and fails only on the first field, where a status is read and a ResponseData arrives.
+- An OCSP response placed in the CertificateList position is refused as `cms/misplaced-ocsp-response`. RFC 5940 sec. 2 states that such a response is carried in the `other` arm, and a universal SEQUENCE in `crls` was previously surfaced raw whatever it held.
+- A caller's decode caps reach the embedded response. The walk runs under the parse's own budget rather than starting a fresh one, so a tightened cap refuses the message with the caller's typed `cms/too-large` instead of letting the nested work run at defaults.
+- `pki.cms.parseCertsOnly`'s `maxCerts` bound no longer decides which messages it accepts. The bound caps the certificates and CRLs parsed and returned, but it was applied by shortening the lists before they were checked, so a cap leaving no room for the CRLs dropped a tagged entry silently: a capped reader accepted a message an uncapped reader refuses and handed back an empty CRL list where revocation information had been. The structural check now runs over every entry, and only the certificate and CRL parsing stays bounded, which is the work the bound exists for.
+- `pki.ocsp.verify` takes the record a `crls` entry surfaces, which it did not. Every verb that accepts a parse result re-reads it from the bytes it was parsed from, so that an edited copy cannot be verified in place of what was parsed; a record produced by walking a structure a message carries was not attributed to those bytes, so the re-reading produced an object that the next verb in the chain read as rebuilt and refused with `path/bad-input`. A record is now attributed the same way whether it was parsed from its own bytes or walked inside a message that carried it, and the refusal of a genuinely rebuilt record is unchanged.
+- The three readers that require a plain CertificateList still refuse a tagged entry now that a well-formed one parses: `pki.cms.parseCertsOnly` (`cms/bad-crl`), `pki.est.parseCertsOnly` (`est/bad-crl`) and a SCEP SUCCESS CertRep (`scep/bad-crl`). The SCEP refusal had no test before this change.
+
 ## v0.8.56 — 2026-10-06
 
 Decide a name, an address, a revocation and a trust bit through operations and values no caller can replace.

package/README.md

@@ -249,7 +249,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.schema.csr` | PKCS#10 certification requests (RFC 2986): subject DN, public key, requested attributes, signature. `decodeExtensions` is what a CA reads to see what a request asked for, returning the rows of its one `extensionRequest` attribute; a request carrying more than one is refused, and `groups: true` reads each separately Fail-closed — `parse`, `pemDecode`, `pemEncode`, `decodeExtensions`, `decodeExtension` |
 | `pki.schema.trustanchor` | RFC 5914 trust anchor lists: a trust anchor as a structure rather than as a certificate, carrying the constraints a root program otherwise states out of band. `parse` reads a `TrustAnchorList` into `{ anchors }`, each naming which of the three `TrustAnchorChoice` arms it came from: a `certificate`, a bare `tbsCert` (an anchor has no signature to check), or a `taInfo`. A `taInfo` carries the public key, the key identifier, an optional title, and a `certPath` stating the name the anchor is known by plus the policies it may assert, the namespace it is trusted for, and how far below it a path may run. Every rule RFC 5914 states is enforced: an empty `taName`, a policy set carrying qualifiers, a negative path length, and a `requireExplicitPolicy` with no policy set are each refused, and where the anchor carries a certificate its subject, public key and `subjectKeyIdentifier` must match the anchor's own. The four extension types the RFC excludes from `exts` are reported and left out rather than refused, as it says to ignore them. `parseInfo` reads a bare `TrustAnchorInfo`. `pki.trust.parseTrustAnchorList` turns a list into anchors `pki.path.validate` consumes, and `pki.trustanchor.build` writes one Fail-closed — `parse`, `parseInfo`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | PKCS#8 private keys (RFC 5208 / 5958): algorithm, raw key bytes, attributes, optional public key. Encrypted keys are recognized but not decrypted. Fail-closed — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
-| `pki.schema.cms` | CMS (RFC 5652 / 5083 / 9629): SignedData (§5, signer infos plus raw signed-attribute bytes for external verification), EnvelopedData (§6, all five RecipientInfo kinds including RFC 5753 key agreement and RFC 9629 KEM recipients with ML-KEM validation), EncryptedData (§8), AuthenticatedData (§9, MAC surface plus raw `authAttrsBytes`), and AuthEnvelopedData (RFC 5083, with RFC 5084 AES-GCM/CCM parameter validation). §11 attribute placement is enforced, countersignatures validate recursively, certificates and CRLs are validated against the closed CHOICE sets and kept raw, and every result is tagged `contentTypeName` Fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.cms` | CMS (RFC 5652 / 5083 / 9629): SignedData (§5, signer infos plus raw signed-attribute bytes for external verification), EnvelopedData (§6, all five RecipientInfo kinds including RFC 5753 key agreement and RFC 9629 KEM recipients with ML-KEM validation), EncryptedData (§8), AuthenticatedData (§9, MAC surface plus raw `authAttrsBytes`), and AuthEnvelopedData (RFC 5083, with RFC 5084 AES-GCM/CCM parameter validation). §11 attribute placement is enforced, countersignatures validate recursively, certificates and CRLs are validated against the closed CHOICE sets and kept raw, a `crls` entry in the `other [1]` arm is read as RFC 5652 §10.2.1 `OtherRevocationInfoFormat` with an RFC 5940 OCSP response surfaced as a record the revocation verbs take directly, and every result is tagged `contentTypeName` Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | OCSP requests and responses (RFC 6960): per-certificate status (good, revoked, unknown), responder identity, raw tbs bytes for external verification, certificates kept raw. A response's nonce, and a single response's archive cutoff (§4.4.4) and CRL reference (§4.4.2), are decoded onto their extension entries by name; a malformed one is refused. Non-basic response types are recognized but not decoded. Fail-closed — `parseRequest`, `parseResponse`, `pemDecode`, `pemEncode` |
 | `pki.schema.tsp` | RFC 3161 timestamp requests, responses, and tokens: the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule. Fail-closed — `parse`, `parseRequest`, `parseResponse`, `parseTstInfo`, `parseToken`, `pemDecode`, `pemEncode` |
 | `pki.schema.attrcert` | Attribute certificates (RFC 5755): holder and issuer identities as validated GeneralNames, the validity window as real `Date`s, and the privilege attributes and extensions decoded to structured values (role, clearance, service and access identity, group, charging identity; audit identity, target and proxy information, no-rev-avail, AA controls), with the raw signed region for a verifier. Unknown types stay opaque, and the obsolete v1 form is recognized and deferred. `decodeExtensions` returns the same row shape the other formats return, reporting the criticality RFC 5755 fixes for each extension it profiles Fail-closed — `parse`, `pemDecode`, `pemEncode`, `decodeExtensions`, `decodeExtension` |

package/lib/guard-parsed.js

@@ -157,18 +157,28 @@ function recordingParser(kind, parse, ErrorClass, code, label) {
 }
 
 // @enforced-by guard-shape-reinlined -- shares recordingParser's shape below: the PROVENANCE.set
+/** @internal `derive` records what it produces, so a re-derivation is the same kind of record the
+ *  first walk was. Verbs stack: a door answers a record by re-deriving it from the bytes it
+ *  recorded, and hands that to the next door, which is then the one deciding whether it is a parse
+ *  result. Deriving through the bare walk left the second door with an object carrying the kind's
+ *  fields and no provenance, which is the shape it refuses as rebuilt. */
 function recordingWalker(kind, walkNode, decodeBytes) {
-  return function (node, ctx) {
-    var out = walkNode(node, ctx);
-    if (out && typeof out === "object" && node && _isBytes(node.bytes)) {
+  function remember(out, source) {
+    if (out && typeof out === "object" && _isBytes(source)) {
       _weakSet(PROVENANCE, out, {
         kind: kind,
-        source: _bufferFrom(node.bytes),
+        source: _bufferFrom(source),
         shape: _shapeOf(out),
-        derive: function (src) { return walkNode(decodeBytes(src)); },
+        derive: derive,
       });
     }
     return out;
+  }
+  function derive(src) { return remember(walkNode(decodeBytes(src)), src); }
+  return function (node, ctx) {
+    var out = walkNode(node, ctx);
+    if (!out || typeof out !== "object" || !node) return out;
+    return remember(out, node.bytes);
   };
 }
 
@@ -208,9 +218,15 @@ function isRecordedAsProduced(obj) {
  */
 function sourceOf(obj) {
   if (!isRecordedAsProduced(obj)) return null;
-  return _bufferFrom(_weakGet(PROVENANCE, obj).source);
+  return _sourceCopy(_weakGet(PROVENANCE, obj).source);
 }
 
+/** @internal The recorded bytes are the one account of what was parsed, so what leaves this module
+ *  is a copy: a parse that keeps its argument would otherwise be holding them, and a write through
+ *  that reference changes what the NEXT re-derivation of the same record reads. A PEM source is a
+ *  string and cannot be written through. */
+function _sourceCopy(source) { return _isBytes(source) ? _bufferFrom(source) : source; }
+
 function _shapeOf(obj) {
   var shape = _create(null);
   var keys = _allNames(obj);
@@ -238,7 +254,7 @@ function _allNames(obj) {
 function fromTrustedSource(input, kind, claimFields, parse, E, code, why) {
   if (input && typeof input === "object" && !_isBytes(input)) {
     var rec = _recordOf(input, kind);
-    if (rec !== undefined) return (rec.derive || parse)(rec.source);
+    if (rec !== undefined) return (rec.derive || parse)(_sourceCopy(rec.source));
     for (var i = 0; i < claimFields.length; i++) {
       var claims;
       try { claims = input[claimFields[i]] !== undefined; }

package/lib/inspect.js

@@ -1063,7 +1063,7 @@ function _looksParsedOcspResp(o) {
   var st = o.responseStatus;
   if (!st || typeof st !== "object" || typeof st.code !== "number" || typeof st.name !== "string") return false;
   var br = o.basicResponse;
-  /** @internal A response with no basic response is a status-only answer the report handles, but one that
+  /** @internal A response with no basic response is an envelope-only answer the report handles, but one that
    *  HAS a basic response has to carry the answers the report walks: a responderID and a responses list whose
    *  entries name a CertID and a status. */
   if (br === null || br === undefined) return true;

package/lib/lint.js

@@ -5087,6 +5087,51 @@ var RFC5652_CMS_RULES = [
       return (encap && encap.eContent) ? null : true;
     },
   },
+  {
+    id: "lint/rfc5652/other-revocation-format-not-read", severity: "notice", source: "rfc5652",
+    citation: "RFC 5940 4",
+    /** @internal The carriage is sec. 10.2.1's `other` arm, which is why the row sits in this
+     * profile; the document that registers the formats is the citation. RFC 5940 sec. 2 registers
+     * `id-ri-ocsp-response` for an OCSP response carried in the `crls` field and sec. 4 registers
+     * `id-ri-scvp` for an SCVP request-response pair. The parse reads the first and leaves the second
+     * as raw bytes, because acting on it needs an SCVP schema this build does not carry. An
+     * unregistered format is opaque for the same reason. Neither is a parse fault: sec. 10.2.1's ANY
+     * DEFINED BY is an extension point, so refusing an unknown format would refuse a future
+     * registered one. The finding tells an operator that revocation information present in the
+     * message was not read, which a reader counting on it needs to know. A notice: the message is
+     * conformant and the entry may be irrelevant to the certificates it travels with.
+     * An id-ri-ocsp-response entry whose OCSPResponse states a responseType this build does not
+     * decode (RFC 6960 sec. 4.2.1) is reported for the same reason: the format was recognized, the
+     * revocation information still was not read, and `responseType` in the context names why. */
+    message: "a crls entry carries revocation information this build does not read, so it was not consulted",
+    /** @internal Every content type that can carry a RevocationInfoChoice: SignedData's own `crls`
+     * and the `originatorInfo.crls` that EnvelopedData, AuthenticatedData and AuthEnvelopedData
+     * share. The buckets are read by presence rather than by content type, so one predicate admits
+     * each carrier and a type that carries neither draws nothing. */
+    appliesTo: function (cms) {
+      return Array.isArray(cms.crls) || !!(cms.originatorInfo && Array.isArray(cms.originatorInfo.crls));
+    },
+    check: function (cms) {
+      var out = [];
+      var buckets = [{ where: "crls", list: cms.crls },
+        { where: "originatorInfo.crls", list: cms.originatorInfo && cms.originatorInfo.crls }];
+      buckets.forEach(function (bucket) {
+        if (!Array.isArray(bucket.list)) return;
+        bucket.list.forEach(function (entry, index) {
+          if (!entry || entry.tagClass !== "context") return;
+          var resp = entry.ocspResponse;
+          if (resp && resp.basicResponse) return;
+          var rb = resp && resp.responseBytes;
+          out.push({ context: { placement: bucket.where, index: index,
+            otherRevInfoFormat: entry.otherRevInfoFormat,
+            otherRevInfoFormatName: entry.otherRevInfoFormatName,
+            responseType: (rb && rb.responseType) || null,
+            responseTypeName: (rb && rb.responseTypeName) || null } });
+        });
+      });
+      return out.length ? out : null;
+    },
+  },
 ];
 
 /** @internal RFC 8933 updates RFC 5652 rather than restating it, so its rows are their own profile:
@@ -7141,7 +7186,9 @@ function _ingestOcsp(input) {
  * already-parsed `pki.schema.ocsp.parseResponse` object. It returns the same `LintReport` shape
  * `pki.lint.certificate` returns, and it never throws on the data path: bytes that are not a
  * well-formed response produce a single `fatal` finding `lint/unparseable` carrying the strict
- * parser's own code. A non-successful response carries no BasicOCSPResponse and draws no row.
+ * parser's own code. A response with no BasicOCSPResponse to grade draws no row: a non-successful
+ * status carries none, and neither does a response carried in a CMS `crls` entry whose
+ * `responseType` this build does not decode.
  *
  * The `rfc6960` rows cover each SingleResponse's update times and their relation to producedAt,
  * an empty `certs` field, the extended revoked definition (criticality, value and placement) and
@@ -7203,8 +7250,9 @@ function ocsp(input, opts) {
     report = { findings: [ingested.fatal], ran: [],
       counts: Object.assign(Object.create(null), { fatal: 1, error: 0, warn: 0, notice: 0, pass: 0, na: 0, ne: 0 }) };
   } else if (!ingested.response.basicResponse) {
-    /** @internal A non-successful response carries no BasicOCSPResponse, so every row is not
-     * applicable to it: the profile grades responses, and an error status is not one. */
+    /** @internal Every row is not applicable to a response with no BasicOCSPResponse: the profile
+     * grades a response body, and neither an error status nor a responseType this build does not
+     * decode produces one. */
     report = { findings: [], ran: [],
       counts: Object.assign(Object.create(null), { fatal: 0, error: 0, warn: 0, notice: 0, pass: 0, na: rules_.length, ne: 0 }) };
   } else {

package/lib/ocsp.js

@@ -659,6 +659,13 @@ function buildErrorResponse(status) {
  * replayed would hand a soft-failing caller the very certificate the responder refused. A replayed
  * `revoked` is therefore reported as `revoked` with `nonceMatched: false`.
  *
+ * `response` is DER `Buffer` / `Uint8Array`, a PEM `OCSP RESPONSE` string, or an unmodified
+ * `pki.schema.ocsp.parseResponse` result, which includes the record a CMS `crls` entry surfaces in
+ * `ocspResponse`. From bytes, a `responseType` this build does not decode is the parse fault
+ * `ocsp/unsupported-response-type`. A record that carries such a response, which RFC 5940 sec. 3
+ * permits a message to carry, is taken and determines nothing: the verdict is `"unknown"` with no
+ * `signatureValid`, because the body stating the certificate's status was never read.
+ *
  * @opts
  *   cert            the target certificate (parsed, DER, or PEM) -- REQUIRED.
  *   issuer          its issuer certificate (parsed, DER, or PEM) -- REQUIRED.

package/lib/oid.js

@@ -432,6 +432,13 @@ var FAMILIES = Object.assign(Object.create(null), {
     scepMessageType: 2, scepPkiStatus: 3, scepFailInfo: 4,
     scepSenderNonce: 5, scepRecipientNonce: 6, scepTransactionId: 7 } },
   scep: { base: [1, 3, 6, 1, 5, 5, 7, 24], of: { scepFailInfoText: 1 } },
+  /** @internal id-ri, the RFC 5940 revocation-information arc. Only the two leaves a reader can act
+   *  on are registered: 2 names an OCSPResponse carried in a CMS `crls` field (RFC 5940 sec. 2) and
+   *  4 names an SCVP request-response pair (sec. 4). Leaves 1 and 3 are the SCVP sub-arcs RFC 5940
+   *  does not define a CMS carriage for. The hyphenated member names are the RFC's own; `ocspResponse`
+   *  is already bound to the OCSP nonce arc's `1.3.6.1.5.5.7.48.1.4` and is read by name from the
+   *  OCSP extension-placement table, so reusing it here would redirect that table as well. */
+  idRi: { base: [1, 3, 6, 1, 5, 5, 7, 16], of: { "id-ri-ocsp-response": 2, "id-ri-scvp": 4 } },
 });
 
 var _byOid = new Map();

package/lib/schema-cms.js

@@ -34,8 +34,13 @@
  *   (sec. 5.4); `authAttrsBytes` plays the same role for the sec. 9.2 MAC input and the
  *   RFC 5083 sec. 2.2 AAD. Embedded certificates and CRLs are surfaced as raw DER +
  *   their outer tag, validated against the closed CertificateChoices /
- *   RevocationInfoChoice tag sets, so an obsolete alternative never fails the
- *   parse but an out-of-set element does. DER-only, fail-closed.
+ *   RevocationInfoChoice tag sets, so an out-of-set element fails the parse. A
+ *   certificate alternative is surfaced raw whatever it holds; a `crls` entry in the
+ *   `other [1]` arm is read as RFC 5652 sec. 10.2.1 `OtherRevocationInfoFormat`,
+ *   which names its format and, for RFC 5940 `id-ri-ocsp-response`, carries the
+ *   embedded OCSP response as a record revocation checking takes directly. An
+ *   unrecognized format stays opaque; a malformed one fails the parse. DER-only,
+ *   fail-closed.
  *
  * @card
  *   Parse DER / PEM CMS (RFC 5652 / 5083 / 9629) into structured, validated fields:
@@ -49,6 +54,9 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var guard = require("./guard-all");
 var oid = require("./oid");
+/** @internal The OCSP response schema, for the RFC 5940 `crls` arm. `schema-ocsp` requires neither
+ *  this module nor anything that reaches it, so this is an ordinary top-of-file require. */
+var ocspSchema = require("./schema-ocsp");
 var frameworkError = require("./framework-error");
 var schemaX509 = require("./schema-x509");
 var schemaCrl = require("./schema-crl");
@@ -383,6 +391,78 @@ var CRL_CHOICE_TAGS = Object.assign(Object.create(null), {
   universal: Object.create(null),
   context: Object.assign(Object.create(null), { 1: true }),
 });
+
+/** @internal RFC 5652 sec. 10.2.1's `other` arm:
+ *
+ *    OtherRevocationInfoFormat ::= SEQUENCE { otherRevInfoFormat OBJECT IDENTIFIER, otherRevInfo ANY }
+ *
+ *  Exactly two components. OpenSSL's `crypto/cms/cms_asn1.c` makes `otherRevInfo` optional, so it both
+ *  accepts and can emit an entry carrying no revocation information at all; the ASN.1 above has no
+ *  OPTIONAL and the one-element form is refused here. */
+var OTHER_REV_INFO = schema.seq([
+  schema.field("otherRevInfoFormat", schema.oidLeaf()),
+  schema.field("otherRevInfo", schema.any()),
+], {
+  assert: "implicit", implicitTag: 1, arity: { exact: 2 },
+  code: "cms/bad-other-rev-info", what: "OtherRevocationInfoFormat",
+  build: function (m) {
+    return {
+      otherRevInfoFormat: m.fields.otherRevInfoFormat.value,
+      otherRevInfoNode: m.fields.otherRevInfo.value,
+    };
+  },
+});
+var OID_ID_RI_OCSP_RESPONSE = oid.byName("id-ri-ocsp-response");
+
+/** @internal The crls element mapper, which unlike `rawChoiceElement` needs the walk's own ctx: the
+ *  `other` arm's interior is decoded under the caller's caps and budget rather than at defaults.
+ *
+ *  The universal arm is surfaced raw as before, with one new refusal: RFC 5940 sec. 2 states that an
+ *  OCSP response is carried in the `other` arm, so a response placed where a CertificateList belongs
+ *  is a smuggle. It is detected POSITIVELY, by the OCSP module's own response detector, because the
+ *  CRL detector answers false for shapes that are not full CertificateLists and "not a CRL" would
+ *  therefore refuse more than sec. 2 forbids. */
+/** @internal The mapper bound to one walk's ctx, so it fits the one-argument shape a list projection
+ *  passes. The ctx is the walk's own, not a fresh one: that is what carries the caller's caps and the
+ *  budget already being spent into the embedded response. */
+function _mapCrlsWith(ctx, code, what) {
+  var mapper = crlChoiceElement(code, what);
+  return function (item) { return mapper(item, ctx); };
+}
+function crlChoiceElement(code, what) {
+  return function (item, ctx) {
+    var n = item.node;
+    var byClass = CRL_CHOICE_TAGS[n.tagClass];
+    if (!n.constructed || !byClass || byClass[n.tagNumber] !== true) {
+      throw NS.E(code, what + " element tag is outside the closed CHOICE set (RFC 5652 sec. 10.2.1-sec. 10.2.2)");
+    }
+    var out = rawElement(item);
+    if (n.tagClass !== "context") {
+      if (ocspSchema.matchesResponse(n)) {
+        throw NS.E("cms/misplaced-ocsp-response", "an OCSP response is carried in the other [1] " +
+          "RevocationInfoChoice arm under id-ri-ocsp-response, not in the CertificateList arm (RFC 5940 sec. 2)");
+      }
+      return out;
+    }
+    var other = schema.walk(OTHER_REV_INFO, n, ctx).result;
+    out.otherRevInfoFormat = other.otherRevInfoFormat;
+    out.otherRevInfoFormatName = ctx.oid.name(other.otherRevInfoFormat) || null;
+    out.otherRevInfoBytes = other.otherRevInfoNode.bytes;
+    out.ocspResponse = null;
+    if (other.otherRevInfoFormat === OID_ID_RI_OCSP_RESPONSE) {
+      var resp = ocspSchema.walkOcspResponse(other.otherRevInfoNode, ctx);
+      /** @internal RFC 5940 sec. 3: the carried response states a status. A `tryLater` or `malformed`
+       *  OCSPResponse is a VALID OCSPResponse that conveys no revocation information, so it is refused
+       *  HERE rather than in the OCSP module, whose standalone door must keep accepting it. */
+      if (resp.responseStatus.code !== 0) {
+        throw NS.E("cms/bad-ocsp-rev-info", "an id-ri-ocsp-response revocation entry carries a " +
+          resp.responseStatus.name + " OCSP response, which states no revocation status (RFC 5940 sec. 3)");
+      }
+      out.ocspResponse = resp;
+    }
+    return out;
+  };
+}
 CERT_CHOICE_TAGS.universal[asn1.TAGS.SEQUENCE] = true;
 CRL_CHOICE_TAGS.universal[asn1.TAGS.SEQUENCE] = true;
 function rawChoiceElement(allowed, code, what) {
@@ -648,7 +728,8 @@ var SIGNED_DATA = schema.seq([
     var version = m.fields.version.value;
     var encapContentInfo = m.fields.encapContentInfo.value.result;
     var certificates = m.fields.certificates.present ? m.fields.certificates.value.items.map(rawChoiceElement(CERT_CHOICE_TAGS, "cms/bad-certificates", "certificates")) : [];
-    var crls = m.fields.crls.present ? m.fields.crls.value.items.map(rawChoiceElement(CRL_CHOICE_TAGS, "cms/bad-crls", "crls")) : [];
+    var crls = m.fields.crls.present
+      ? guard.list.copyMap(m.fields.crls.value.items, _mapCrlsWith(ctx, "cms/bad-crls", "crls")) : [];
     var signerInfos = m.fields.signerInfos.value.items.map(function (it) { return it.value.result; });
 
     if (encapContentInfo.eContentType !== OID_DATA) {
@@ -909,10 +990,16 @@ var ORIGINATOR_INFO = schema.seq([
   schema.optional("crls", schema.implicitSetOf(1, schema.any(), { min: 1, code: "cms/bad-originator-crls", what: "crls" }), { tag: 1 }),
 ], {
   assert: "constructed", code: "cms/bad-originator-info", what: "OriginatorInfo",
-  build: function (m) {
+  /** @internal The build takes `ctx` because the crls mapper decodes the RFC 5940 arm under the
+   *  caller's own caps and budget. This one record is shared by EnvelopedData (RFC 5652 sec. 6.1),
+   *  AuthenticatedData (sec. 9.1) and AuthEnvelopedData (RFC 5083 sec. 2.1), so decoding only in
+   *  SignedData would leave three of the four content types RFC 5940 sec. 1 names undecoded. */
+  build: function (m, ctx) {
     return {
       certs: m.fields.certs.present ? m.fields.certs.value.items.map(rawChoiceElement(CERT_CHOICE_TAGS, "cms/bad-originator-certs", "OriginatorInfo certs")) : [],
-      crls: m.fields.crls.present ? m.fields.crls.value.items.map(rawChoiceElement(CRL_CHOICE_TAGS, "cms/bad-originator-crls", "OriginatorInfo crls")) : [],
+      crls: m.fields.crls.present
+        ? guard.list.copyMap(m.fields.crls.value.items,
+          _mapCrlsWith(ctx, "cms/bad-originator-crls", "OriginatorInfo crls")) : [],
     };
   },
 });
@@ -1184,7 +1271,14 @@ var CONTENT_INFO = schema.seq([
  * unauthAttrs }` (`aead` holds the validated AES-GCM/CCM nonce + ICV length, or
  * `null` for an unrecognized algorithm). A KEM recipient (RFC 9629) surfaces as
  * `{ type: "ori", oriType, oriValue, kemri }` with the parsed KEMRecipientInfo in
- * `kemri`. Every result additionally carries `contentType` (the dotted OID) and
+ * `kemri`. A `crls` entry is `{ bytes, tagClass, tagNumber }` for a CertificateList;
+ * an entry in the `other [1]` arm additionally carries `otherRevInfoFormat` (dotted),
+ * `otherRevInfoFormatName` (or `null`), `otherRevInfoBytes` (the raw ANY TLV) and,
+ * for RFC 5940 `id-ri-ocsp-response`, `ocspResponse` holding the embedded response
+ * as a record `pki.path.ocspChecker` and `pki.path.verifyOcspResponse` take
+ * directly. A response whose `responseType` is one this build does not decode keeps
+ * its envelope in `ocspResponse` with `basicResponse` null and the body in
+ * `responseBytes.response` as it arrived. `originatorInfo.crls` carries the same shapes. Every result additionally carries `contentType` (the dotted OID) and
  * `contentTypeName` (its registry name) naming which of the five shapes was
  * dispatched. The raw byte ranges an external verifier hashes (`eContent`,
  * `signature`, `signedAttrsBytes`, `authAttrsBytes`, `mac`) are surfaced
@@ -1337,16 +1431,27 @@ function parseCertsOnly(der, E, prefix, maxCerts, requireCert) {
   } else if (allCerts.length === 0 && allCrls.length === 0) {
     throw E(prefix + "/no-certificates", "a certs-only message must contain at least one certificate or CRL (RFC 8551 sec. 3.8)");
   }
+  /** @internal `maxCerts` caps the certificates and CRLs PARSED and RETURNED, which is a resource
+   *  bound. It may not decide which messages are accepted. The tag-class test reads a field off an
+   *  entry the parse already produced and costs nothing, so it runs over EVERY entry before the cap
+   *  is applied: taken after it, a cap leaving no room for the crls dropped a tagged entry silently,
+   *  so a capped reader accepted a message an uncapped reader refuses and handed back an empty crls
+   *  list where revocation information had been. Only the X.509 and CRL parsing below stays bounded,
+   *  which is the work the bound exists for. */
+  for (var ci = 0; ci < allCerts.length; ci++) {
+    if (allCerts[ci].tagClass !== "universal") throw E(prefix + "/bad-certificate-choice", "a certs-only response exchanges plain X.509 certificates; a tagged CertificateChoices alternative is not permitted (RFC 5272)");
+  }
+  for (var cj = 0; cj < allCrls.length; cj++) {
+    if (allCrls[cj].tagClass !== "universal") throw E(prefix + "/bad-crl", "a certs-only response CRL must be a plain X.509 CertificateList, not a tagged otherRevInfo alternative (RFC 5652 sec. 10.2.1)");
+  }
   var certs = (maxCerts != null && allCerts.length > maxCerts) ? allCerts.slice(0, maxCerts) : allCerts;
   for (var i = 0; i < certs.length; i++) {
-    if (certs[i].tagClass !== "universal") throw E(prefix + "/bad-certificate-choice", "a certs-only response exchanges plain X.509 certificates; a tagged CertificateChoices alternative is not permitted (RFC 5272)");
     try { schemaX509.parse(certs[i].bytes); }
     catch (e) { throw E(prefix + "/bad-certificate", "a certs-only response carried a non-certificate in its certificates field (RFC 5272 sec. 4.1)", e); }
   }
   var crlCap = maxCerts != null ? (maxCerts - certs.length) : null;
   var crls = (crlCap != null && allCrls.length > crlCap) ? allCrls.slice(0, crlCap) : allCrls;
   for (var j = 0; j < crls.length; j++) {
-    if (crls[j].tagClass !== "universal") throw E(prefix + "/bad-crl", "a certs-only response CRL must be a plain X.509 CertificateList, not a tagged otherRevInfo alternative (RFC 5652 sec. 10.2.1)");
     try { schemaCrl.parse(crls[j].bytes); }
     catch (e) { throw E(prefix + "/bad-crl", "a certs-only response carried a non-CRL in its crls field", e); }
   }

package/lib/schema-ocsp.js

@@ -40,6 +40,7 @@ var oid = require("./oid");
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var intrinsic = require("./guard-intrinsic");
+var guard = require("./guard-all");
 var _hasOwn = intrinsic.hasOwn;
 var _String = intrinsic.String;
 
@@ -319,18 +320,24 @@ var RESPONSE_BYTES = schema.seq([
   schema.field("response", schema.octetString()),
 ], {
   assert: "sequence", arity: { exact: 2 }, code: "ocsp/bad-response-bytes", what: "ResponseBytes",
+  /** @internal RFC 6960 sec. 4.2.1 dispatches the body on `responseType`, so a type this build does
+   *  not read leaves `basicResponse` null and the body in `response` exactly as it arrived. The
+   *  envelope is the part every reader shares, and which bodies this build decodes is its own support
+   *  limit rather than a shape rule: `parseResponse` refuses an unread body at its door, where the
+   *  caller asked for a response to read, and a response carried inside another structure stays
+   *  readable as far as its envelope goes. A body that claims id-pkix-ocsp-basic is still decoded,
+   *  and still refused when it is not one. */
   build: function (m, ctx) {
     var responseType = m.fields.responseType.value;
     var raw = m.fields.response.value;
-    if (responseType !== OID_OCSP_BASIC) {
-      throw NS.E("ocsp/unsupported-response-type", (ctx.oid.name(responseType) || responseType) + " is not id-pkix-ocsp-basic (RFC 6960 sec. 4.2.1)");
-    }
     return {
       responseType: responseType,
       responseTypeName: ctx.oid.name(responseType) || null,
       response: raw,
-      basicResponse: schema.embeddedDer(BASIC_OCSP_RESPONSE, raw, ctx,
-        { code: "ocsp/bad-der", what: "BasicOCSPResponse" }).result,
+      basicResponse: responseType === OID_OCSP_BASIC
+        ? schema.embeddedDer(BASIC_OCSP_RESPONSE, raw, ctx,
+          { code: "ocsp/bad-der", what: "BasicOCSPResponse" }).result
+        : null,
     };
   },
 });
@@ -506,7 +513,19 @@ var parseRequest = pkix.makeParser({ pemLabel: "OCSP REQUEST", PemError: PemErro
  *     above it, or an option outside this set, is refused. A parse that exceeds one is
  *     refused with the `/too-large` code of this format.
  */
-var parseResponse = pkix.makeRecordingParser({ pemLabel: "OCSP RESPONSE", PemError: PemError, ErrorClass: OcspError, prefix: "ocsp", what: "OCSP response", topSchema: OCSP_RESPONSE, ns: NS }, "ocspResponse");
+var _parseResponseRecorded = pkix.makeRecordingParser({ pemLabel: "OCSP RESPONSE", PemError: PemError, ErrorClass: OcspError, prefix: "ocsp", what: "OCSP response", topSchema: OCSP_RESPONSE, ns: NS }, "ocspResponse");
+/** @internal The decision is made on `responseType`, the field RFC 6960 sec. 4.2.1 dispatches on,
+ *  rather than on the absent `basicResponse` that follows from it. A non-successful response carries
+ *  no responseBytes at all and keeps reaching the caller, which is the status a live responder
+ *  returns. */
+function parseResponse(input, caps) {
+  var out = _parseResponseRecorded(input, caps);
+  var rb = out.responseBytes;
+  if (rb && rb.responseType !== OID_OCSP_BASIC) {
+    throw NS.E("ocsp/unsupported-response-type", (rb.responseTypeName || rb.responseType) + " is not id-pkix-ocsp-basic (RFC 6960 sec. 4.2.1)");
+  }
+  return out;
+}
 
 /**
  * @primitive  pki.schema.ocsp.pemDecode
@@ -580,9 +599,25 @@ function matchesRequest(root) {
   return true;
 }
 
+/** @internal Walk an ALREADY-DECODED OCSPResponse node under the caller's own parse resources, for a
+ *  carrier that embeds one: RFC 5940 sec. 2 puts an OCSPResponse in a CMS `crls` field, and the CMS
+ *  parse reaches it with a node it has already decoded and a budget it is already spending.
+ *  `parseResponse(bytes)` cannot serve that: it re-decodes from scratch and starts a fresh budget, so
+ *  a caller's tightened caps would not reach the embedded walk. `withResources` carries the caps and
+ *  the budget while keeping this module's own error class, so a malformed embedded response still
+ *  reports an `ocsp/*` code. The record is a recording one, so `guard.parsed.fromTrustedSource`
+ *  accepts it wherever a parsed response is taken and a rebuilt copy is still refused. The re-decode
+ *  this walker performs on raw DER is STRICT, unlike the CMS one: an OCSPResponse has no
+ *  BER-tolerant door. */
+var walkOcspResponse = guard.parsed.recordingWalker("ocspResponse", function (node, ctx) {
+  return schema.walk(OCSP_RESPONSE, node, schema.withResources(NS, ctx)).result;
+  // allow:bare-decode the re-decode a recording walker performs on raw DER a caller hands it, outside any parse.
+}, function (der) { return asn1.decode(der); });
+
 module.exports = {
   parseRequest: parseRequest,
   parseResponse: parseResponse,
+  walkOcspResponse: walkOcspResponse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matchesRequest: matchesRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.56",
+  "version": "0.8.57",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:921f4ed0-ec38-4c9d-b490-d6223c040e96",
+  "serialNumber": "urn:uuid:114b9f0f-7681-4cab-8c6a-fcdbf8fd64af",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-06T23:49:00.685Z",
+    "timestamp": "2026-10-07T02:26:14.514Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.56",
+      "bom-ref": "@blamejs/pki@0.8.57",
       "type": "application",
       "name": "pki",
-      "version": "0.8.56",
+      "version": "0.8.57",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.56",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.57",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.56",
+      "ref": "@blamejs/pki@0.8.57",
       "dependsOn": []
     }
   ]