@blamejs/pki 0.8.9 → 0.8.11

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.11 — 2026-09-23
+
+What a certificate, CRL, request or attribute certificate asserts in its extensions is read in one call.
+
+### Added
+
+- `pki.schema.x509.decodeExtensions(certOrBytes, opts?)` and `pki.schema.x509.decodeExtension(ext, opts?)` return a certificate's extensions as decoded records. Each row is `{ oid, name, critical, value, scope, index, containerIndex, state, decoded, code, profile }`. `state` is `"decoded"`, `"unrecognized"` for an identifier no decoder is registered for, or `"undecodable"` for a value that is not the structure its identifier names; `code` carries the typed error in that last arm. `value` is the raw extnValue octets in every arm, for a caller recomputing a hash or comparing an encoding. Read `state` rather than testing `decoded`, because a valid `ocspNoCheck` decodes to null.
+- The same pair on `pki.schema.crl`, `pki.schema.csr`, `pki.schema.attrcert` and `pki.schema.crmf`. The CRL table spans the CRL's own extensions and every revoked entry's in one array, each row naming its scope and, for an entry, its position in `containerIndex`. `pki.schema.crl.decodeExtension` takes a required `opts.scope` of `"crl"`, `"crl-entry"` or `"ocsp-single"`, since RFC 6960 section 4.4.5 carries a CRL entry extension into an OCSP SingleResponse and the same identifier means different things at those three scopes.
+- `pki.schema.csr.decodeExtensions` refuses a request carrying more than one `extensionRequest` attribute with `csr/ambiguous-extension-request`, because nothing states which of them a CA should honor. Pass `groups: true` to read each attribute separately, as `[{ attributeIndex, extensions }]`.
+- Both verbs report what they find and refuse nothing on the strength of it. An extension against the criticality its RFC fixes still decodes, and the deviation is reported on `profile` with the clause that fixes it. An unrecognized critical extension comes back as a row, whatever `opts.strict` says. RFC 5280 section 4.2's rule about one belongs to the relying party, and the two facts that rule needs, `critical` and `state`, are on the row.
+- The certificate extension table decodes the RFC 3779 address and AS number blocks (`ipAddrBlocks`, `autonomousSysIds`) and the RFC 8360 identifiers for the same syntax, plus the RFC 7633 TLS feature extension. `pki.inspect.certificate` renders all five. An AS number and a TLS feature are read as the `INTEGER` each type declares, so both come back as a `BigInt` and a value outside its registry's width is reported rather than refused.
+- The CRL extension table decodes the issuing distribution point and the delta CRL indicator, along with the authority key identifier, issuer alternative name, freshest CRL and authority information access that RFC 5280 section 5.2 profiles, and the certificate issuer at entry scope.
+
+### Changed
+
+- `pki.schema.crl.parse` puts the raw extnValue octets on every extension record as `valueBytes`, beside the `value` it already carried. The three extensions the CRL parse decodes in place, `cRLNumber`, `reasonCode` and `invalidityDate`, previously left a caller no way back to the bytes those values came from.
+- Every signer that validates a pre-encoded extension now validates a pre-encoded `ipAddrBlocks`, `autonomousSysIds` or `tlsFeature` too, and refuses one whose value is not the structure its identifier names. A certificate carrying such a value can still be read: the refusal is on the writing side.
+- `pki.attrcert.sign` and `pki.schema.attrcert.decodeExtensions` read the criticality RFC 5755 fixes from one table, so the signer's refusal names the section it refuses under where its message previously cited the RFC alone.
+
+## v0.8.10 — 2026-09-23
+
+A certificate's names are read the same way wherever the toolkit reads them.
+
+### Fixed
+
+- `pki.tsp.verify` reports `tsp/bad-eku` for an empty extendedKeyUsage. RFC 5280 section 4.2.1.12 has at least one KeyPurposeId, and an empty one decodes as a SEQUENCE, so a reader checking only the tag called it well-formed and reported it as naming the wrong purpose, `tsp/eku-not-exclusive`. Every other consumer of that extension already answered with the malformed-extension code.
+- The subjectAltName a timestamp token names its TSA through is read under the same rules every other consumer reads a name under, so a name this toolkit refuses elsewhere cannot be a source of TSA identity. The match itself is still a comparison of the encoded GeneralName bytes, which is what naming a TSA means: the name in the token and the name in the certificate have to be the same name.
+
+### Security
+
+- `pki.sigstore.verifyBundle` refuses a Fulcio certificate whose subjectAltName carries more than one name, whatever forms those names take. It counted only rfc822Name, dNSName, uniformResourceIdentifier and otherName, and dropped every other form before counting, so a certificate pairing a URI with an iPAddress or a directoryName was accepted as binding one identity. A caller identity policy matched the form the verifier reported and never saw the other, which is the outcome the one-identity rule exists to prevent. The rule now counts every name the extension carries. A certificate carrying a single name in a form with no identity string still reports `identity.san` as `null`, unchanged, so a policy gates on the null rather than on a name nothing read.
+
 ## v0.8.9 — 2026-09-23
 
 The 0.8.9 tarball is the one to install for everything 0.8.8 added.

package/README.md

@@ -243,16 +243,16 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.webcrypto` | A W3C `SubtleCrypto` engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2 and SHA, plus post-quantum ML-DSA-44/65/87, SLH-DSA, and ML-KEM-512/768/1024 key generation with certificate and PKCS#8 import. The RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare seed or an internally inconsistent key is rejected with a typed error. `encapsulateBits` and `decapsulateBits` are the ML-KEM key-establishment pair the CMS `KEMRecipientInfo` arm rides on, with the FIPS 203 §7.3 ciphertext-length check enforced here so a direct caller inherits it. Cross-implementation use is undefined in the specification, so a `CryptoKey` from a different WebCrypto implementation is refused here with a typed fault naming its origin; the `pki.*` verbs adopt such a key instead, whether it came from the platform or from a separately installed copy of this toolkit |
 | `pki.tls` | RFC 8879 certificate compression and the RFC 8446 §4.4.2 Certificate message it carries (RFC 8446 is obsoleted by RFC 9846), which is the handshake's largest payload. `decompressCertificate` decodes a `CompressedCertificate` and returns the algorithm, the declared uncompressed length, the recovered message raw, and its per-entry certificate DER. Decompression carries the two-sided bound §5 requires: capped at the message's own declared length so a bomb is refused mid-stream, then compared to that declaration exactly, which catches the under-length direction a cap alone cannot see. An algorithm outside the RFC 8879 registry, one the runtime cannot decompress, or one the receiver never advertised is refused before any decompressor is handed the bytes; an empty compressed body is a framing violation (`tls/bad-framing`); and trailing bytes, after the message or after the compressed frame, are refused (`tls/trailing-data`), so one chain has exactly one encoding. `compressCertificate` is the inverse and round-trips its own output before returning. `parseCertificateMessage` decodes the RFC 8446 §4.4.2 message on its own, surfacing each entry's certificate DER ready for `pki.schema.x509.parse` alongside its raw extensions; a separate extension negotiates `certificate_type`, so it is declared, never guessed. All three registered algorithms (zlib, brotli, zstd) are implemented, each offered only where the running Node decompresses it safely — one whose decompressor answers a truncated frame with a short result instead of a fault is dropped at startup rather than advertised with a truncation it cannot detect. Structure only: no handshake is spoken and no certificate verified — `decompressCertificate`, `compressCertificate`, `parseCertificateMessage` |
 | `pki.schema` | The schema family. `parse` detects which PKI format a DER or PEM input encodes and routes it to the right parser; `all` enumerates the registered formats; `pem.decodeBundle` reads every object in a multi-object PEM file (a `fullchain.pem`, a `ca-certificates.crt`, a key beside its certificate), carrying each object's label, DER and offset into the text, with explanatory text around the blocks read as text and the file bounded in both the number of objects and the bytes they decode to; `pem.encodeBundle` writes that list back; `pki.schema.pkcs1` reads and writes the RFC 8017 `RSA PRIVATE KEY` and `RSA PUBLIC KEY` encodings, with every component relation the specification states checked; `pki.schema.sec1` reads and writes the RFC 5915 `EC PRIVATE KEY` encoding, holding the scalar to its curve's width and the parameters field to a named curve; the engine and per-format members are grouped here |
-| `pki.schema.x509` | Certificates (RFC 5280) parsed into structured, validated fields. Each extension is surfaced by name with its `extnValue` bytes; the shared extension decoders that read those bytes are what `pki.lint.certificate`, `pki.inspect` and `pki.path.validate` consume, and they cover the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification), the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), subject information access, subject directory attributes, and the RFC 6960 OCSP no-check responder marker. Unknown statements stay opaque, fail-closed Fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.x509` | Certificates (RFC 5280) parsed into structured, validated fields. Each extension is surfaced by name with its `extnValue` bytes; the shared extension decoders that read those bytes are what `pki.lint.certificate`, `pki.inspect` and `pki.path.validate` consume, and they cover the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification), the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), subject information access, subject directory attributes, and the RFC 6960 OCSP no-check responder marker. Unknown statements stay opaque, fail-closed. `decodeExtensions` is the read door onto that table: it returns one row per extension carrying the decoded value, the raw `extnValue` octets, and a `state` of `decoded`, `unrecognized` or `undecodable`, so a reader can tell an extension nothing decodes from one whose value does not read. The RFC 3779 address and AS number blocks, their RFC 8360 identifiers, and the RFC 7633 TLS feature extension decode here too Fail-closed — `parse`, `pemDecode`, `pemEncode`, `decodeExtensions`, `decodeExtension` |
 | `pki.schema.c509` | C509 certificates (draft-ietf-cose-cbor-encoded-cert), the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR. `encode` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte, so the original signature still verifies. A `parse` result re-emits its native array in canonical deterministic CBOR, with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms: the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, inhibitAnyPolicy, OCSP No Check, TLS Feature), the general-name-bearing extensions (subjectAltName, issuer alternative name, name constraints, CRL distribution points, freshest CRL, authority and subject information access, and the full authority key identifier) over one shared GeneralNames codec, certificate policies with their CPS-URI and UserNotice qualifiers, policy mappings and policy constraints, subject directory attributes, and the RFC 3779 resource-delegation extensions (IP address blocks and AS identifiers) with their RFC 8360 v2 twins, whose addresses ride either the delta-coded integer form or the byte-string form the specification mandates once an address exceeds eight octets. A value the compact form cannot carry exactly falls back to the byte-string form with its bytes intact; a certificate outside the invertible set throws a typed `C509Error`. Called explicitly, since it is CBOR rather than DER and so is not auto-routed |
-| `pki.schema.crl` | X.509 CRLs (RFC 5280 §5): revoked serials with real-`Date` revocation times, named and partly decoded extensions Fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.csr` | PKCS#10 certification requests (RFC 2986): subject DN, public key, requested attributes, signature Fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.crl` | X.509 CRLs (RFC 5280 §5): revoked serials with real-`Date` revocation times, named and partly decoded extensions, each record carrying the raw `extnValue` octets as `valueBytes`. `decodeExtensions` returns the CRL's own extensions and every revoked entry's in one array, each row naming the scope it was read at, and covers the whole §5.2 and §5.3 profile including the issuing distribution point and the delta CRL indicator. `decodeExtension` takes the scope explicitly, since RFC 6960 §4.4.5 carries a CRL entry extension into an OCSP response Fail-closed — `parse`, `pemDecode`, `pemEncode`, `decodeExtensions`, `decodeExtension` |
+| `pki.schema.csr` | PKCS#10 certification requests (RFC 2986): subject DN, public key, requested attributes, signature. `decodeExtensions` is what a CA reads to see what a request asked for, returning the rows of its one `extensionRequest` attribute; a request carrying more than one is refused, and `groups: true` reads each separately Fail-closed — `parse`, `pemDecode`, `pemEncode`, `decodeExtensions`, `decodeExtension` |
 | `pki.schema.pkcs8` | PKCS#8 private keys (RFC 5208 / 5958): algorithm, raw key bytes, attributes, optional public key. Encrypted keys are recognized but not decrypted. Fail-closed — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
 | `pki.schema.cms` | CMS (RFC 5652 / 5083 / 9629): SignedData (§5, signer infos plus raw signed-attribute bytes for external verification), EnvelopedData (§6, all five RecipientInfo kinds including RFC 5753 key agreement and RFC 9629 KEM recipients with ML-KEM validation), EncryptedData (§8), AuthenticatedData (§9, MAC surface plus raw `authAttrsBytes`), and AuthEnvelopedData (RFC 5083, with RFC 5084 AES-GCM/CCM parameter validation). §11 attribute placement is enforced, countersignatures validate recursively, certificates and CRLs are validated against the closed CHOICE sets and kept raw, and every result is tagged `contentTypeName` Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | OCSP requests and responses (RFC 6960): per-certificate status (good, revoked, unknown), responder identity, raw tbs bytes for external verification, certificates kept raw. A response's nonce, and a single response's archive cutoff (§4.4.4) and CRL reference (§4.4.2), are decoded onto their extension entries by name; a malformed one is refused. Non-basic response types are recognized but not decoded. Fail-closed — `parseRequest`, `parseResponse`, `pemDecode`, `pemEncode` |
 | `pki.schema.tsp` | RFC 3161 timestamp requests, responses, and tokens: the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule. Fail-closed — `parse`, `parseRequest`, `parseResponse`, `parseTstInfo`, `parseToken`, `pemDecode`, `pemEncode` |
-| `pki.schema.attrcert` | Attribute certificates (RFC 5755): holder and issuer identities as validated GeneralNames, the validity window as real `Date`s, and the privilege attributes and extensions decoded to structured values (role, clearance, service and access identity, group, charging identity; audit identity, target and proxy information, no-rev-avail, AA controls), with the raw signed region for a verifier. Unknown types stay opaque, and the obsolete v1 form is recognized and deferred Fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.crmf` | Certificate request messages (RFC 4211) — the CMP and EST enrollment body. The requested-certificate template (subject, public key, validity, extensions), proof of possession, and registration controls, with the raw `CertRequest` region surfaced for the caller to hash. Names are dual-accepted, IMPLICIT and EXPLICIT. This toolkit ships no proof-of-possession verifier yet, so confirming that a requester holds the key it asks to have certified remains the CA's own step Fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.attrcert` | Attribute certificates (RFC 5755): holder and issuer identities as validated GeneralNames, the validity window as real `Date`s, and the privilege attributes and extensions decoded to structured values (role, clearance, service and access identity, group, charging identity; audit identity, target and proxy information, no-rev-avail, AA controls), with the raw signed region for a verifier. Unknown types stay opaque, and the obsolete v1 form is recognized and deferred. `decodeExtensions` returns the same row shape the other formats return, reporting the criticality RFC 5755 fixes for each extension it profiles Fail-closed — `parse`, `pemDecode`, `pemEncode`, `decodeExtensions`, `decodeExtension` |
+| `pki.schema.crmf` | Certificate request messages (RFC 4211) — the CMP and EST enrollment body. The requested-certificate template (subject, public key, validity, extensions), proof of possession, and registration controls, with the raw `CertRequest` region surfaced for the caller to hash. Names are dual-accepted, IMPLICIT and EXPLICIT. This toolkit ships no proof-of-possession verifier yet, so confirming that a requester holds the key it asks to have certified remains the CA's own step. `decodeExtensions` reads the extensions every message's template asks for, each row naming its message Fail-closed — `parse`, `pemDecode`, `pemEncode`, `decodeExtensions`, `decodeExtension` |
 | `pki.schema.pkcs12` | PKCS#12 (PFX) stores (RFC 7292) from DER, BER, or PEM: key bags via the PKCS#8 parser, shrouded keys with the algorithm surfaced and the ciphertext opaque, cert / CRL / secret bags raw and byte-exact, encrypted and enveloped safes structurally via CMS, `friendlyName` and `localKeyId` decoded, and the exact MAC byte range (`macedBytes`) plus RFC 9579 PBMAC1 recognition for external verification. BER is accepted exactly where §4.1 requires it Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.cmp` | CMP messages (RFC 9810): the header (version, sender and recipient including the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` and `bodyBytes` slices an external verifier reconstructs the protected part from. The CMP-before-OCSP dispatch order is enforced Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csrattrs` | EST CSR Attributes (`CsrAttrs`, RFC 8951 §3.5 / RFC 9908) — the `AttrOrOID` items a server sends to shape an enrollment: bare OIDs, attributes with raw values, and decoded views of the RFC 9908 meaningful types (extension requests, EC and RSA key-type conventions, the certification-request-info template). Unknown types are surfaced raw; structure and the RFC 9908 semantic MUSTs are fail-closed — `parse` |

package/lib/acme.js

@@ -578,7 +578,11 @@ var OID_AKI = oid.byName("authorityKeyIdentifier");
 var OID_CN = oid.byName("commonName");
 var _extNs = pkix.makeNS("acme", AcmeError, oid);
 var _extDecoders = pkix.certExtensionDecoders(_extNs);
-var _extCtx = intrinsic.assign(intrinsic.create(null), { E: function (c, m, cause) { return new AcmeError(c, m, cause); }, oid: oid });
+/** @internal The decoders take the value and nothing else: the error class and the OID registry
+ * they raise and resolve through come from the namespace the table was built with, above. Passing
+ * a second argument here suggested a per-call context that the table has no parameter for and
+ * silently dropped; where a decode genuinely needs resources, the way to supply them is to build
+ * the table with `schema.withResources`, as `schema-attrcert.js` does. */
 
 /**
  * @primitive  pki.acme.tlsAlpn01Extension
@@ -657,7 +661,7 @@ async function verifyTlsAlpn01(certDer, token, accountJwk, identifier) {
   if (!auth.equals(expected)) throw E("acme/bad-tlsalpn", "the acmeIdentifier digest does not match the key authorization");
   var sanExt = exts.filter(function (e) { return e.oid === OID_SAN; })[0];
   if (!sanExt) throw E("acme/bad-tlsalpn", "the validation certificate is missing the SubjectAltName");
-  var san = _extDecoders.byOid[OID_SAN](sanExt.value, _extCtx);
+  var san = _extDecoders.byOid[OID_SAN](sanExt.value);
   if (!san.names || san.names.length !== 1) throw E("acme/bad-tlsalpn", "the SubjectAltName must carry EXACTLY ONE entry (RFC 8737 sec. 3)");
   var entry = san.names[0];
   if (!_isObject(identifier) || !_isString(identifier.type)) throw E("acme/bad-input", "an identifier { type, value } is required");
@@ -914,7 +918,7 @@ function _csrIdentifierSet(parsedCsr) {
     if (a.type !== oid.byName("extensionRequest") || !_isArrayI(a.extensions)) return;
     _forEach(a.extensions, function (e) {
       if (e.oid !== OID_SAN) return;
-      var dec = _extDecoders.byOid[OID_SAN](e.value, _extCtx);
+      var dec = _extDecoders.byOid[OID_SAN](e.value);
       _forEach(dec.names || [], function (n) { _addSanName(set, n, "the finalize CSR"); });
     });
   });
@@ -981,7 +985,7 @@ function _certIdentifierSet(parsedCert) {
   var set = intrinsic.create(null);
   _forEach(parsedCert.extensions || [], function (e) {
     if (e.oid !== OID_SAN) return;
-    var dec = _extDecoders.byOid[OID_SAN](e.value, _extCtx);
+    var dec = _extDecoders.byOid[OID_SAN](e.value);
     _forEach(dec.names || [], function (n) { _addSanName(set, n, "the downloaded certificate"); });
   });
   if (_objectKeys(set).length === 0) {
@@ -1249,7 +1253,7 @@ function ariCertId(certDer) {
   var cert = x509.parse(certDer);
   var akiExt = (cert.extensions || []).filter(function (e) { return e.oid === OID_AKI; })[0];
   if (!akiExt) throw E("acme/bad-certid", "the certificate has no authorityKeyIdentifier extension (RFC 9773 sec. 4.1)");
-  var aki = _extDecoders.byOid[OID_AKI](akiExt.value, _extCtx);
+  var aki = _extDecoders.byOid[OID_AKI](akiExt.value);
   if (!aki || !Buffer.isBuffer(aki.keyIdentifier)) throw E("acme/bad-certid", "the authorityKeyIdentifier has no keyIdentifier field (RFC 9773 sec. 4.1)");
   var serialBytes = Buffer.from(cert.serialNumberHex, "hex");
   return jose.base64url.encode(aki.keyIdentifier) + "." + jose.base64url.encode(serialBytes);

package/lib/attrcert-sign.js

@@ -69,18 +69,17 @@ var ATTR_OID_NAME = intrinsic.assign(intrinsic.create(null), {
   role: "role", clearance: "clearance", group: "group", chargingIdentity: "chargingIdentity",
   accessIdentity: "accessIdentity", authenticationInfo: "authenticationInfo",
 });
-var EXT_META = intrinsic.assign(intrinsic.create(null), {
-  auditIdentity:          { name: "acAuditIdentity",       critical: true },
-  targetInformation:      { name: "targetInformation",     critical: true },
-  noRevAvail:             { name: "noRevAvail",            critical: false },
-  aaControls:             { name: "aaControls",            critical: true },
-  acProxying:             { name: "acProxying",            critical: true },
-  authorityKeyIdentifier: { name: "authorityKeyIdentifier", critical: false },
-  cRLDistributionPoints:  { name: "cRLDistributionPoints", critical: false },
-  authorityInfoAccess:    { name: "authorityInfoAccess",   critical: false },
-});
-var REQUIRED_CRITICALITY = intrinsic.create(null);
-Object.keys(EXT_META).forEach(function (k) { REQUIRED_CRITICALITY[O(EXT_META[k].name)] = EXT_META[k].critical; });
+/** @internal The criticality each extension must carry is the schema module's table, so the shape
+ *  this signer refuses to write and the deviation the extension door reports are one row set. What
+ *  stays here is the friendly option name each extension is written under. */
+var REQUIRED_CRITICALITY = attrcert.extensionCriticality(oid);
+var EXT_META = intrinsic.create(null);
+intrinsic.forEach([
+  ["auditIdentity", "acAuditIdentity"], ["targetInformation", "targetInformation"],
+  ["noRevAvail", "noRevAvail"], ["aaControls", "aaControls"], ["acProxying", "acProxying"],
+  ["authorityKeyIdentifier", "authorityKeyIdentifier"], ["cRLDistributionPoints", "cRLDistributionPoints"],
+  ["authorityInfoAccess", "authorityInfoAccess"],
+], function (r) { EXT_META[r[0]] = { name: r[1], critical: REQUIRED_CRITICALITY[O(r[1])].critical }; });
 var OID_AKI = O("authorityKeyIdentifier"), OID_OCSP = O("ocsp");
 
 /** @internal RFC 5755 sets rules on the issuer that its parser reads past and its verifier does
@@ -442,9 +441,9 @@ function _buildExtensions(extSpec, ctx) {
       var extnId = asn1.read.oid(n.children[0]);
       if (seenA[extnId]) throw _err("attrcert/bad-input", "duplicate extension " + extnId + " (RFC 5755 sec. 4.2.9)");
       seenA[extnId] = true;
-      var required = REQUIRED_CRITICALITY[extnId];
-      if (required != null && (n.children.length === 3) !== required) {
-        throw _err("attrcert/bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension must be marked " + (required ? "critical" : "non-critical") + " (RFC 5755)");
+      var fixed = intrinsic.hasOwn(REQUIRED_CRITICALITY, extnId) ? REQUIRED_CRITICALITY[extnId] : null;
+      if (fixed !== null && (n.children.length === 3) !== fixed.critical) {
+        throw _err("attrcert/bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension must be marked " + (fixed.critical ? "critical" : "non-critical") + " (" + fixed.citation + ")");
       }
       var extnValue = asn1.read.octetString(n.children[n.children.length - 1]);
       var decoded;

package/lib/constants.js

@@ -244,6 +244,11 @@ var NAMES = Object.assign(Object.create(null), {
     "8": "removeFromCRL", "9": "privilegeWithdrawn", "10": "aACompromise",
   },
   OCSP_STATUS: { "0": "successful", "1": "malformedRequest", "2": "internalError", "3": "tryLater", "5": "sigRequired", "6": "unauthorized" },
+  /** @internal The TLS ExtensionType values RFC 7633 sec. 4 names for the TLS feature extension. A
+   *  value outside this table is printed as its number. */
+  TLS_FEATURE: { "5": "status_request", "17": "status_request_v2" },
+  /** @internal The IANA Address Family Numbers RFC 3779 sec. 2.2.3.3 names. */
+  ADDRESS_FAMILY: { "1": "IPv4", "2": "IPv6" },
   OBJECT_DIGEST_TYPE: { "0": "publicKey", "1": "publicKeyCert", "2": "otherObjectTypes" },
   ALGORITHM: {
     rsaEncryption: "rsaEncryption", rsassaPss: "rsassaPss", rsaesOaep: "rsaesOaep", ecPublicKey: "id-ecPublicKey",

package/lib/guard-parsed.js

@@ -60,7 +60,7 @@ function _isExtensionEntry(e) {
 
 function _isCrlExtensionEntry(e) {
   return !!e && typeof e.oid === "string" && _isOptName(e.name) &&
-    typeof e.critical === "boolean" && e.value !== undefined;
+    typeof e.critical === "boolean" && e.value !== undefined && _isBuffer(e.valueBytes);
 }
 
 // @enforced-by guard-shape-reinlined -- shares the `accept` shape below: any door

package/lib/inspect.js

@@ -134,6 +134,31 @@ function _keyBlock(spki, pad) {
 }
 
 
+var TLS_FEATURE_NAMES = NAMES.TLS_FEATURE;
+var AFI_NAMES = NAMES.ADDRESS_FAMILY;
+var ipUtils = require("./ip-utils");
+/** @internal An RFC 3779 IPAddress is a BIT STRING carrying only the leading bits of the address.
+ *  What the bits it does not carry stand for depends on where the address sits: RFC 3779 sec. 2.1.2
+ *  makes them zero in a range's `min` and ONE in its `max`, so a max written out zero-filled names
+ *  a different address from the one the range ends at. `fillOnes` selects the rule, and it applies
+ *  to the unused bits inside the last present octet as well as to the octets left off entirely. */
+var AFI_OCTETS = Object.assign(Object.create(null), { 1: 4, 2: 16 });
+function _ipAddressText(afi, addr, fillOnes) {
+  var width = AFI_OCTETS[afi];
+  if (!width || addr.bytes.length > width) return addr.bytes.toString("hex");
+  var padded = Buffer.alloc(width, fillOnes ? 0xff : 0x00);
+  addr.bytes.copy(padded, 0, 0, addr.bytes.length);
+  if (addr.unusedBits > 0 && addr.bytes.length > 0) {
+    var last = addr.bytes.length - 1;
+    var keep = (0xff << addr.unusedBits) & 0xff;
+    padded[last] = fillOnes ? (padded[last] | (~keep & 0xff)) : (padded[last] & keep);
+  }
+  return ipUtils.textFromOctets(padded) || padded.toString("hex");
+}
+/** @internal A prefix names a block, so it is written as its address and its length in bits. A
+ *  range endpoint names one address and carries no length. */
+function _ipPrefix(afi, addr) { return _ipAddressText(afi, addr, false) + "/" + addr.prefixLength; }
+
 var EXT_LABEL = NAMES.EXTENSION;
 var KU_LABEL = NAMES.KEY_USAGE;
 var EKU_LABEL = NAMES.EXT_KEY_USAGE;
@@ -388,8 +413,42 @@ var EXT_RENDERERS = Object.assign(Object.create(null), {
     }
     return akiLines.length ? akiLines.join("\n") : inner + "keyid:(none)";
   },
+  /** @internal RFC 7633 sec. 6 carries TLS ExtensionType values, so each is named from the registry
+   *  where the toolkit knows it and printed as its number where it does not. */
+  tlsFeature: function (decoded, inner) {
+    return (decoded.features || []).map(function (f) {
+      var text = String(f);
+      var name = TLS_FEATURE_NAMES[text];
+      return inner + (name ? name + " (" + text + ")" : text);
+    }).join("\n") || inner + "(none)";
+  },
+  ipAddrBlocks: function (decoded, inner) {
+    return (decoded.families || []).map(function (f) {
+      var head = inner + (AFI_NAMES[f.afi] || "AFI " + f.afi) + (f.safi === null ? "" : " SAFI " + f.safi) + ":";
+      if (f.inherit) return head + " inherit";
+      var rows = (f.addressesOrRanges || []).map(function (r) {
+        if (r.kind === "addressPrefix") return inner + "    " + _ipPrefix(f.afi, r.addressPrefix);
+        return inner + "    " + _ipAddressText(f.afi, r.min, false) + " to " + _ipAddressText(f.afi, r.max, true);
+      });
+      return head + (rows.length ? "\n" + rows.join("\n") : " (none)");
+    }).join("\n") || inner + "(none)";
+  },
+  autonomousSysIds: function (decoded, inner) {
+    var lines = [];
+    [["asnum", decoded.asnum], ["rdi", decoded.rdi]].forEach(function (pair) {
+      if (pair[1] === null) return;
+      if (pair[1].inherit) { lines.push(inner + pair[0] + ": inherit"); return; }
+      lines.push(inner + pair[0] + ":");
+      (pair[1].asIdsOrRanges || []).forEach(function (r) {
+        lines.push(inner + "    " + (r.kind === "id" ? String(r.id) : String(r.min) + " to " + String(r.max)));
+      });
+    });
+    return lines.length ? lines.join("\n") : inner + "(none)";
+  },
 });
 EXT_RENDERERS.msApplicationPolicies = EXT_RENDERERS.certificatePolicies;
+EXT_RENDERERS.ipAddrBlocksV2 = EXT_RENDERERS.ipAddrBlocks;
+EXT_RENDERERS.autonomousSysIdsV2 = EXT_RENDERERS.autonomousSysIds;
 
 
 function _renderExtValue(ext, decoded, inner) {

package/lib/lint.js

@@ -1416,10 +1416,10 @@ var OID_REASON_CODE = oid.byName("reasonCode");
  * references itself and refuses a malformed one, so an entry for any of those would be dead. */
 var OCSP_SINGLE_VALUE_READER = Object.create(null);
 OCSP_SINGLE_VALUE_READER[OID_REASON_CODE] = function (bytes) {
-  crlSchema.decodeExtension({ oid: OID_REASON_CODE, name: "reasonCode", critical: false, value: bytes });
+  crlSchema.decodeExt({ oid: OID_REASON_CODE, name: "reasonCode", critical: false, value: bytes });
 };
 OCSP_SINGLE_VALUE_READER[oid.byName("invalidityDate")] = function (bytes) {
-  crlSchema.decodeExtension({ oid: oid.byName("invalidityDate"), name: "invalidityDate", critical: false, value: bytes });
+  crlSchema.decodeExt({ oid: oid.byName("invalidityDate"), name: "invalidityDate", critical: false, value: bytes });
 };
 OCSP_SINGLE_VALUE_READER[oid.byName("certificateIssuer")] = CRL_ENTRY_VALUE_READER[oid.byName("certificateIssuer")];
 var OCSP_RESPONSE_VALUE_READER = Object.create(null);
@@ -1444,7 +1444,7 @@ function _singleReasonCode(sr) {
   var e = _extIn(_ocspSingleExts(sr), OID_REASON_CODE);
   if (!e || !Buffer.isBuffer(e.value)) return null;
   // allow:swallow-unverified a value the CRL reader refuses carries no reason; the value-syntax row reports it
-  try { return crlSchema.decodeExtension(e).value; }
+  try { return crlSchema.decodeExt(e).value; }
   catch (_e) { return null; }
 }
 /** @internal RFC 6960 sec. 2.2 gives a "revoked" answer for a non-issued certificate a fixed shape:

package/lib/schema-all.js

@@ -345,10 +345,13 @@ function _detectOrNull(der, label) {
 
 module.exports = {
   engine: engine,
-  x509: { parse: x509.parse, pemDecode: x509.pemDecode, pemEncode: x509.pemEncode },
+  x509: { parse: x509.parse, pemDecode: x509.pemDecode, pemEncode: x509.pemEncode,
+    decodeExtensions: x509.decodeExtensions, decodeExtension: x509.decodeExtension },
   c509: { parse: c509.parse, encode: c509.encode },
-  crl:  { parse: crl.parse,  pemDecode: crl.pemDecode, pemEncode: crl.pemEncode },
-  csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
+  crl:  { parse: crl.parse,  pemDecode: crl.pemDecode, pemEncode: crl.pemEncode,
+    decodeExtensions: crl.decodeExtensions, decodeExtension: crl.decodeExtension },
+  csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode,
+    decodeExtensions: csr.decodeExtensions, decodeExtension: csr.decodeExtension },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },
   pkcs1: {
     parse: pkcs1.parse, parsePublic: pkcs1.parsePublic,
@@ -361,10 +364,12 @@ module.exports = {
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode, pemEncode: ocsp.pemEncode },
   tsp: { parse: tsp.parse, parseResponse: tsp.parseResponse, parseRequest: tsp.parseRequest, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode, pemEncode: tsp.pemEncode },
-  crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode, pemEncode: crmf.pemEncode },
+  crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode, pemEncode: crmf.pemEncode,
+    decodeExtensions: crmf.decodeExtensions, decodeExtension: crmf.decodeExtension },
   cmp: { parse: cmp.parse, pemDecode: cmp.pemDecode, pemEncode: cmp.pemEncode },
   csrattrs: { parse: csrattrs.parse },
-  attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode, pemEncode: attrcert.pemEncode },
+  attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode, pemEncode: attrcert.pemEncode,
+    decodeExtensions: attrcert.decodeExtensions, decodeExtension: attrcert.decodeExtension },
   smime: { parseSigningCertificate: smime.parseSigningCertificate, parseSigningCertificateV2: smime.parseSigningCertificateV2, parseSmimeCapabilities: smime.parseSmimeCapabilities, decodeAttribute: smime.decodeAttribute },
   cmc: { parse: cmc.parse, parsePkiData: cmc.parsePkiData, parsePkiResponse: cmc.parsePkiResponse },
   pem: {

package/lib/schema-attrcert.js

@@ -590,19 +590,9 @@ _AC_EXT_DECODERS[_Oav("acProxying")] = _acProxying;
 /** @internal The three RFC 5280 extensions RFC 5755 sec. 4.3.3 to 4.3.5 profile for an AC are read
  *  through the certificate decoders, so a relying party running the sec. 6 "pointer in AC" scheme
  *  reads the distribution point and the OCSP location off the parse rather than off raw bytes. */
-var _CERT_EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
-/** @internal The certificate decoders close over the namespace they were built with, so a parse
- *  that named caps gets its own table and every decode below these three reads the caller's
- *  figure. A caller outside a parse passes no context and reuses the module's table. */
-function _certExtDecoder(name) {
-  var key = _Oav(name);
-  return function (buf, ctx) {
-    return (ctx ? pkix.certExtensionDecoders(schema.withResources(NS, ctx)).byOid : _CERT_EXT_DECODERS)[key](buf);
-  };
-}
-_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = _certExtDecoder("authorityKeyIdentifier");
-_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = _certExtDecoder("authorityInfoAccess");
-_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = _certExtDecoder("cRLDistributionPoints");
+_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = pkix.scopedCertDecoder(NS, "authorityKeyIdentifier");
+_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = pkix.scopedCertDecoder(NS, "authorityInfoAccess");
+_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = pkix.scopedCertDecoder(NS, "cRLDistributionPoints");
 
 // @internal
 function validateAttributeValue(type, valueDer) {
@@ -614,6 +604,108 @@ function validateExtensionValue(extnOid, extnValueDer) {
   return dec ? dec(extnValueDer) : null;
 }
 
+/** @internal The criticality RFC 5755 fixes for each extension it profiles for an attribute
+ *  certificate. The AC signer refuses to write an extension against this table and the extension
+ *  door reports one that arrived against it, from this one row set. */
+var AC_FIXED_CRITICALITY_ROWS = [
+  ["acAuditIdentity", true, "RFC 5755 sec. 4.3.1"], ["targetInformation", true, "RFC 5755 sec. 4.3.2"],
+  ["authorityKeyIdentifier", false, "RFC 5755 sec. 4.3.3"], ["authorityInfoAccess", false, "RFC 5755 sec. 4.3.4"],
+  ["cRLDistributionPoints", false, "RFC 5755 sec. 4.3.5"], ["noRevAvail", false, "RFC 5755 sec. 4.3.6"],
+  ["acProxying", true, "RFC 5755 sec. 7.3"], ["aaControls", true, "RFC 5755 sec. 7.4"],
+];
+function extensionCriticality(oidRegistry) {
+  var table = intrinsic.create(null);
+  intrinsic.forEach(AC_FIXED_CRITICALITY_ROWS, function (r) {
+    table[oidRegistry.byName(r[0])] = { critical: r[1], citation: r[2] };
+  });
+  return table;
+}
+
+/** @internal The attribute-certificate scope. The table is this module's own, passed to the shared
+ *  door rather than reached for from it, because a registry in `schema-pkix.js` that required this
+ *  module would invert the dependency. */
+var AC_SCOPES = intrinsic.assign(intrinsic.create(null), {
+  "attribute-certificate": {
+    /** @internal Every decoder in this table takes the walk context and threads it into its own
+     *  decode, so the one table serves every call and the caller's caps still reach the value. */
+    decoders: function () { return _AC_EXT_DECODERS; },
+    criticality: extensionCriticality(oid),
+  },
+});
+
+var DOOR = pkix.extensionDoor({
+  ns: NS, ErrorClass: AttrCertError, key: "attrcert", kind: "attributeCertificate",
+  what: "the attribute certificate", parse: parse, scopes: AC_SCOPES,
+  defaultScope: "attribute-certificate",
+  segments: function (ac) { return [{ list: ac.extensions || [], scope: "attribute-certificate" }]; },
+});
+
+/**
+ * @primitive  pki.schema.attrcert.decodeExtensions
+ * @signature  pki.schema.attrcert.decodeExtensions(acOrBytes, opts?) -> rows
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 5755 sec. 4.2.9, RFC 5755 sec. 4.3
+ * @related    pki.schema.attrcert.parse, pki.schema.x509.decodeExtensions
+ *
+ * Read an attribute certificate's extensions as decoded records. The argument is the object `parse`
+ * returned or the bytes `parse` takes.
+ *
+ * Each row is `{ oid, name, critical, value, scope, index, containerIndex, state, decoded, code,
+ * profile }`, with `scope` `"attribute-certificate"` and `containerIndex` `null`. `state` is the
+ * discriminator, and `profile` reports the criticality RFC 5755 fixes for the extension.
+ *
+ * RFC 5755 sec. 5 item 7 has a verifier reject an AC carrying a critical extension it does not
+ * recognize. That is the caller's rule to apply, and the two facts it needs, `critical` and
+ * `state`, are on the row.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value. It does not turn an unrecognized OID into a throw.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var aaCert = await pki.x509.sign({ subject: "Example AA", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "CN=Holder" }] },
+ *     attributes: { role: { roleName: "https://example.test/role/admin" } }, serialNumber: 1n,
+ *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
+ *     extensions: { noRevAvail: true } }, { cert: aaCert, key: key });
+ *   var rows = pki.schema.attrcert.decodeExtensions(acDer);
+ *   rows.filter(function (r) { return r.critical && r.state === "unrecognized"; }).length;  // -> 0
+ */
+var decodeExtensions = DOOR.decodeExtensions;
+
+/**
+ * @primitive  pki.schema.attrcert.decodeExtension
+ * @signature  pki.schema.attrcert.decodeExtension(ext, opts?) -> row
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 5755 sec. 4.3
+ * @related    pki.schema.attrcert.decodeExtensions
+ *
+ * Read one attribute-certificate extension record as a decoded row, at scope
+ * `"attribute-certificate"`. The argument is `{ oid, name, critical, value }`.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var aaCert = await pki.x509.sign({ subject: "Example AA", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var acDer = await pki.attrcert.sign({ holder: { entityName: [{ directoryName: "CN=Holder" }] },
+ *     attributes: { role: { roleName: "https://example.test/role/admin" } }, serialNumber: 1n,
+ *     notBeforeTime: new Date("2026-01-01T00:00:00Z"), notAfterTime: new Date("2027-01-01T00:00:00Z"),
+ *     extensions: { noRevAvail: true } }, { cert: aaCert, key: key });
+ *   var ac = pki.schema.attrcert.parse(acDer);
+ *   pki.schema.attrcert.decodeExtension(ac.extensions[0]).profile.citation;  // -> "RFC 5755 sec. 4.3.6"
+ */
+var decodeExtension = DOOR.decodeExtension;
+
 module.exports = {
   parse: parse,
   parseV1: parseV1,
@@ -621,6 +713,9 @@ module.exports = {
   pemEncode: pemEncode,
   matches: matches,
   matchesV1: matchesV1,
+  decodeExtensions: decodeExtensions,
+  decodeExtension: decodeExtension,
+  extensionCriticality: extensionCriticality,
   readGeneralName: readGeneralName,
   validateAttributeValue: validateAttributeValue,
   validateExtensionValue: validateExtensionValue,