CSR Attributes
parse turns a DER Buffer into { items } -- CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID, where AttrOrOID ::= CHOICE { oid OBJECT IDENTIFIER, attribute Attribute } disambiguates on the universal tag. An empty SEQUENCE is a COMPLETE valid document ("no additional information desired"). Each item surfaces its kind ("oid" / "attribute"), the oid (dotted) and registry name; an attribute keeps its raw values and, for the three types RFC 9908 gives meaning, a decoded view: id-ExtensionReq -> extensions, the ecPublicKey / rsaEncryption key-type conventions -> curve / keySize, and id-aa-certificationRequestInfoTemplate -> a fully-decoded template.
Structure is strict-DER throughout, but UNKNOWN OIDs and attribute types are TOLERATED -- surfaced raw, never a parse fault ("the client MUST ignore any OID or attribute it does not recognize", RFC 8951 sec. 4.5.2). The RFC 9908 semantic MUSTs that ARE enforced fail closed with a typed csrattrs/* code: at most one id-ExtensionReq attribute, its values a SET of exactly one Extensions, template version v1(0), and a template's inner attributes carrying at most one id-aa-extensionReqTemplate and never both extension-request kinds. Template PRIORITY (a client that understands the template ignores the legacy elements, RFC 9908 sec. 4) is a pki.est builder rule, not a parse rejection -- parse surfaces everything.
There is NO pemDecode / pemEncode: no RFC 7468 label exists for CsrAttrs; the wire encoding is bare RFC 4648 base64 handled by the EST transfer codec (pki.est.transferDecode), not a PEM envelope.
pki.schema.csrattrs.parse
pki.schema.csrattrs.parse(der) -> { items }Parse a DER Buffer of EST CSR Attributes (CsrAttrs, RFC 8951 sec. 3.5) into { items }. Each item is { kind, oid, name } -- kind "oid" for a bare OID, "attribute" for an Attribute, which adds raw values plus, for the RFC 9908 meaningful types, extensions (id-ExtensionReq), curve / keySize (EC / RSA key-type conventions), or template (the request-info template). An empty SEQUENCE yields { items: [] } ("no additional information desired"). Unknown OIDs / attribute types are tolerated (surfaced raw); a malformed structure or an RFC 9908 semantic violation throws a typed CsrattrsError (csrattrs/*) and a leaf-level codec fault surfaces as asn1/*.
Example
var a = pki.schema.csrattrs.parse(der);
a.items[0].kind; // -> "oid" | "attribute"