@blamejs/pki 0.3.28 → 0.3.31

package/lib/http-retry-after.js

@@ -70,25 +70,34 @@ function httpDateMs(s, refMs) {
 // gates absence with its own code) is a delay-seconds integer -> retryAfterSeconds, or an HTTP-date ->
 // retryAfterDate (epoch ms) plus, when opts.now (epoch ms) is given, a bounded retryAfterSeconds. Either
 // form beyond the one-year ceiling, or a value that is neither, fails closed via opts.E(opts.code, ...).
-// Never slept on here -- the value is SURFACED for the caller to decide.
+// opts.cap (seconds) clamps a value above the cap to the cap instead of rejecting it; opts.lenient surfaces
+// an otherwise-rejected value as a null retryAfterSeconds -- both for a caller (e.g. an ARI poll cadence)
+// for whom the value is advisory and must not discard the response. Never slept on here -- the value is
+// SURFACED for the caller to decide.
 function parse(value, opts) {
   opts = opts || {};
   var raStr = String(value).trim();
   var out = { retryAfterSeconds: null, retryAfterDate: null };
   if (/^\d+$/.test(raStr)) {
     var n = parseInt(raStr, 10);
-    if (!Number.isSafeInteger(n) || n > MAX_RETRY_AFTER_SECONDS) throw _fail(opts, "the Retry-After delay is out of the supported range (0.." + MAX_RETRY_AFTER_SECONDS + " seconds)");
+    // opts.cap (seconds): a caller that will clamp anyway (e.g. an ARI poll cadence) wants a delay ABOVE its
+    // ceiling reduced to the ceiling, not rejected -- so a valid-but-huge value never discards the response.
+    if (typeof opts.cap === "number" && n > opts.cap) { out.retryAfterSeconds = opts.cap; return out; }
+    // opts.lenient: a caller for whom the value is purely advisory wants an UNPARSEABLE one surfaced as
+    // null (retryAfterSeconds stays null) rather than a hard reject that would discard the whole response.
+    if (!Number.isSafeInteger(n) || n > MAX_RETRY_AFTER_SECONDS) { if (opts.lenient) return out; throw _fail(opts, "the Retry-After delay is out of the supported range (0.." + MAX_RETRY_AFTER_SECONDS + " seconds)"); }
     out.retryAfterSeconds = n;
     return out;
   }
   var when = httpDateMs(raStr, opts.now);
-  if (isNaN(when)) throw _fail(opts, "a Retry-After must be delay-seconds or a valid HTTP-date (RFC 7231 sec. 7.1.1.1/7.1.3), got " + JSON.stringify(raStr));
+  if (isNaN(when)) { if (opts.lenient) return out; throw _fail(opts, "a Retry-After must be delay-seconds or a valid HTTP-date (RFC 7231 sec. 7.1.1.1/7.1.3), got " + JSON.stringify(raStr)); }
   out.retryAfterDate = when;
   if (typeof opts.now === "number" && isFinite(opts.now)) {
     // Round the remaining whole-second delay UP (a sub-second date must not retry before the requested
     // time), clamping a past date to 0.
     var d = Math.max(0, Math.ceil((when - opts.now) / constants.TIME.seconds(1)));
-    if (d > MAX_RETRY_AFTER_SECONDS) throw _fail(opts, "the Retry-After date is beyond the supported horizon (" + MAX_RETRY_AFTER_SECONDS + " seconds)");
+    if (typeof opts.cap === "number" && d > opts.cap) { out.retryAfterSeconds = opts.cap; return out; }
+    if (d > MAX_RETRY_AFTER_SECONDS) { if (opts.lenient) return out; throw _fail(opts, "the Retry-After date is beyond the supported horizon (" + MAX_RETRY_AFTER_SECONDS + " seconds)"); }
     out.retryAfterSeconds = d;
   }
   return out;

package/lib/oid.js

@@ -81,6 +81,8 @@ var FAMILIES = {
   pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
     authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10,
     acmeIdentifier: 31,
+    // id-pe-tlsfeature (RFC 7633) -- the TLS Feature (formerly "must-staple") extension.
+    tlsFeature: 24,
     // id-pe-qcStatements (RFC 3739 sec. 3.2.6) -- the qualified-certificate-statements extension.
     qcStatements: 3 } },
 
@@ -138,9 +140,19 @@ var FAMILIES = {
   regInfo: { base: [1, 3, 6, 1, 5, 5, 7, 5, 2], of: { utf8Pairs: 1, certReq: 2 } },
 
   // PKIX extended key purposes (id-kp, RFC 5280 sec. 4.2.1.12). timeStamping is required
-  // -- critical and sole -- on an RFC 3161 TSA signing certificate (sec. 2.3).
+  // -- critical and sole -- on an RFC 3161 TSA signing certificate (sec. 2.3). The SSH
+  // (RFC 6187), CMC (RFC 6402), and Bundle Security (RFC 9174) purposes complete the C509
+  // Extended Key Usages registry (draft-ietf-cose-cbor-encoded-cert sec. 8.12).
   pkixKp: { base: [1, 3, 6, 1, 5, 5, 7, 3], of: {
-    serverAuth: 1, clientAuth: 2, codeSigning: 3, emailProtection: 4, timeStamping: 8, ocspSigning: 9 } },
+    serverAuth: 1, clientAuth: 2, codeSigning: 3, emailProtection: 4, timeStamping: 8, ocspSigning: 9,
+    secureShellClient: 21, secureShellServer: 22, cmcCA: 27, cmcRA: 28, cmcArchive: 29, cmKGA: 32, bundleSecurity: 35 } },
+
+  // Kerberos PKINIT extended key purposes (id-pkinit, RFC 4556 sec. 3.2.3 / 3.2.4): the client
+  // and KDC authentication EKUs (C509 Extended Key Usages registry integers 10 / 11).
+  pkinitKp: { base: [1, 3, 6, 1, 5, 2, 3], of: { pkinitClientAuth: 4, pkinitKdc: 5 } },
+
+  // Wi-SUN FAN device extended key purpose (C509 Extended Key Usages registry integer 20).
+  wisun: { base: [1, 3, 6, 1, 4, 1, 45605], of: { fanDevice: 1 } },
 
   // Google Certificate Transparency (RFC 6962) on the 1.3.6.1.4.1.11129.2.4 arc:
   // the SCT-list X.509 extension (sec. 3.3), the precertificate poison (sec. 3.1), the

package/lib/schema-c509.js

@@ -55,27 +55,53 @@ var PK_ALG_BY_INT = {
 // EC curve -> field size in bytes (the SEC1 coordinate width), for point-length validation.
 var EC_FIELD_BYTES = { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 };
 
-// sec. 8.6 attribute types (abs(int) -> name; the sign selects the X.509 string type).
+// sec. 8.6 RDN attribute types (abs(int) -> name; the sign selects the X.509 string type). emailAddress
+// (int 0) is an IA5String value not covered by the DirectoryString SpecialText codec below, so it is
+// declined; a DN carrying it encodes via the ~oid attribute form, not this alias table.
 var ATTR_BY_INT = {
   1: _name("commonName"),
   2: _name("surname"),
   3: _name("serialNumber"),
   4: _name("countryName"),
-  6: _name("localityName"),
-  7: _name("stateOrProvinceName"),
+  5: _name("localityName"),
+  6: _name("stateOrProvinceName"),
+  7: _name("streetAddress"),
   8: _name("organizationName"),
   9: _name("organizationalUnitName"),
   10: _name("title"),
 };
-// sec. 8.8 extension types (abs(int) -> name; the sign selects criticality).
+// sec. 8.8 extension types (abs(int) -> name; the sign selects criticality). The general-name-bearing
+// extensions (subjectAltName et al) carry an int extensionID only when their compact value is supported;
+// subjectAltName stays registered for the byte-string value form (the compact GeneralNames array awaits
+// the sec. 8.13 general-name codec and fails closed).
 var EXT_BY_INT = {
   1: _name("subjectKeyIdentifier"),
   2: _name("keyUsage"),
   3: _name("subjectAltName"),
   4: _name("basicConstraints"),
-  7: _name("keyUsage"),
-  10: _name("authorityKeyIdentifier"),
+  7: _name("authorityKeyIdentifier"),
+  8: _name("extKeyUsage"),
+  30: _name("inhibitAnyPolicy"),
+  36: _name("ocspNoCheck"),
+  38: _name("tlsFeature"),
 };
+// The extensions whose compact CBOR value form (sec. 3.3) is invertible to/from the DER extnValue.
+// A registered extension NOT in this set carries its value as the ~oid + byte-string form (sec. 3.7).
+var EXT_COMPACT = {
+  subjectKeyIdentifier: 1, keyUsage: 1, basicConstraints: 1, authorityKeyIdentifier: 1,
+  extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
+};
+// sec. 8.12 Extended Key Usages registry (C509 int -> registered id-kp purpose name). A KeyPurposeId
+// outside this set encodes as an unwrapped ~oid; a C509 int outside it fails closed on decode.
+var EKU_BY_INT = {
+  0: _name("anyExtendedKeyUsage"), 1: _name("serverAuth"), 2: _name("clientAuth"),
+  3: _name("codeSigning"), 4: _name("emailProtection"), 8: _name("timeStamping"), 9: _name("ocspSigning"),
+  10: _name("pkinitClientAuth"), 11: _name("pkinitKdc"), 12: _name("secureShellClient"), 13: _name("secureShellServer"),
+  14: _name("bundleSecurity"), 15: _name("cmcCA"), 16: _name("cmcRA"), 17: _name("cmcArchive"), 18: _name("cmKGA"),
+  20: _name("fanDevice"),
+};
+var EKU_TO_INT = {};   // dotted OID -> C509 int (the encode inverse; keyed on the resolved OID)
+Object.keys(EKU_BY_INT).forEach(function (k) { EKU_TO_INT[oid.byName(EKU_BY_INT[k])] = Number(k); });
 
 // ---- field readers (the unwrapped ~biguint / ~time / ~oid contracts; draft-20 sec. 3.1) ----
 
@@ -94,7 +120,7 @@ function _biguint(node, code, label) {
 // MUST reject. Bound to the Date window; the CBOR simple null (permitted only for notAfter) -> null.
 function _time(node, allowNull, label) {
   if (allowNull && node.majorType === 7 && node.ai === 22) return null;   // CBOR simple null (0xF6)
-  if (!node || node.majorType !== 0) throw _err("c509/bad-validity", label + " must be an unwrapped CBOR epoch integer (~time)");
+  if (node.majorType !== 0) throw _err("c509/bad-validity", label + " must be an unwrapped CBOR epoch integer (~time)");
   var secs = node.argument;
   if (secs > MAX_EPOCH_SECONDS) throw _err("c509/bad-validity", label + " is outside the representable Date range");
   return new Date(C.TIME.seconds(Number(secs)));
@@ -179,6 +205,143 @@ function _name509(node, isSubject) {
 }
 function _shortName(n) { return n === "commonName" ? "CN" : n === "countryName" ? "C" : n === "organizationName" ? "O" : n === "organizationalUnitName" ? "OU" : n === "localityName" ? "L" : n === "stateOrProvinceName" ? "ST" : n; }
 
+// ---- compact per-extension value codec (draft-20 sec. 3.3) -------------------
+// Each registered extension in EXT_COMPACT has a specific CBOR encoding of its value that is invertible
+// to/from the DER extnValue inner content (the bytes _reconExtensions wraps in an OCTET STRING). Native
+// C509 MUST use the specific form (sec. 3.7); the decode side reconstructs the DER, the encode side emits
+// the compact form only when it round-trips byte-for-byte (else the ~oid + byte-string fallback).
+
+// A CBOR unsigned integer node -> its BigInt value (major type 0 guarantees non-negative). Arbitrary
+// precision: a DER INTEGER holds any width, so no cap -- the round-trip guard verifies the reconstruction.
+function _cborUint(node, label) {
+  if (node.majorType !== 0) throw _err("c509/bad-extensions", "a " + label + " value must be a CBOR unsigned integer");
+  return cbor.read.int(node);
+}
+// A CBOR integer node (either sign) -> its BigInt value (basicConstraints uses -2/-1/pathLen).
+function _cborIntVal(node, label) {
+  if (node.majorType !== 0 && node.majorType !== 1) throw _err("c509/bad-extensions", "a " + label + " value must be a CBOR integer");
+  return cbor.read.int(node);
+}
+// A C509 KeyPurposeId (int registry alias OR unwrapped ~oid) -> the dotted extended-key-usage OID.
+function _ekuPurposeOid(node) {
+  if (node.majorType === 0 || node.majorType === 1) {
+    var i = Number(cbor.read.int(node));
+    var nm = EKU_BY_INT[i];
+    if (nm === undefined) throw _err("c509/bad-extensions", "an extKeyUsage int " + i + " has no C509 registry row");
+    return oid.byName(nm);
+  }
+  // A ~oid KeyPurposeId routes through _oidName, which validates the BER OID content and remaps an oid/*
+  // fault to c509/bad-extensions (fault preserved as .cause) -- a non-byte-string node fails closed there too.
+  return _oidName(node, "c509/bad-extensions", "an extKeyUsage KeyPurposeId").oid;
+}
+
+// Decode a compact extension value (a decoded CBOR node) to the DER extnValue inner content. Fails closed
+// (c509/bad-extensions) on a CBOR shape the named extension does not define.
+function _extValueToDer(name, node) {
+  switch (name) {
+    case "subjectKeyIdentifier":   // KeyIdentifier = bytes -> OCTET STRING(keyid)
+      if (node.majorType !== 2) throw _err("c509/bad-extensions", "a subjectKeyIdentifier value must be a CBOR byte string");
+      return b.octetString(node.content);
+    case "keyUsage":               // uint -> KeyUsage BIT STRING (a value past the 9 named bits fails closed)
+      return _reconKeyUsageBits(Number(_cborUint(node, "keyUsage")));
+    case "basicConstraints": {     // int -> SEQUENCE { cA?, pathLen? }
+      var iv = _cborIntVal(node, "basicConstraints");
+      if (iv === -2n) return b.sequence([]);                                  // cA false (omitted)
+      if (iv === -1n) return b.sequence([b.boolean(true)]);                   // cA true, no pathLen
+      if (iv >= 0n) return b.sequence([b.boolean(true), b.integer(iv)]);      // cA true, pathLen
+      throw _err("c509/bad-extensions", "a basicConstraints int " + iv + " is outside the -2/-1/pathLen range");
+    }
+    case "authorityKeyIdentifier": // keyId-only bytes -> SEQUENCE { [0] IMPLICIT keyIdentifier }
+      if (node.majorType !== 2) throw _err("c509/bad-extensions", "an authorityKeyIdentifier value must be a CBOR byte string (keyId-only form; the 3-tuple form is not supported)");
+      return b.sequence([b.contextPrimitive(0, node.content)]);
+    case "extKeyUsage": {          // [2* KeyPurposeId] / KeyPurposeId -> SEQUENCE OF OID (draft-20 sec. 3.3)
+      var items;
+      if (node.majorType === 4) {
+        items = node.children || [];
+        if (items.length < 2) throw _err("c509/bad-extensions", "an extKeyUsage array must hold 2 or more KeyPurposeIds; a single purpose omits the array (draft-20 sec. 3.3)");
+      } else {
+        items = [node];
+      }
+      return b.sequence(items.map(function (it) { return b.oid(_ekuPurposeOid(it)); }));
+    }
+    case "inhibitAnyPolicy":       // uint -> INTEGER SkipCerts
+      return b.integer(_cborUint(node, "inhibitAnyPolicy"));
+    case "ocspNoCheck":            // null -> NULL
+      if (node.majorType !== 7 || !(Buffer.isBuffer(node.bytes) && node.bytes.length === 1 && node.bytes[0] === 0xf6)) throw _err("c509/bad-extensions", "an ocspNoCheck value must be the CBOR simple value null");
+      return b.nullValue();
+    case "tlsFeature": {           // [uint ...] -> SEQUENCE OF INTEGER
+      if (node.majorType !== 4) throw _err("c509/bad-extensions", "a tlsFeature value must be a CBOR array");
+      return b.sequence((node.children || []).map(function (f) { return b.integer(_cborUint(f, "tlsFeature feature")); }));
+    }
+    default:
+      throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
+  }
+}
+
+// Encode a DER extnValue inner content to its compact CBOR value bytes, or null when the DER is not the
+// canonical form the compact encoding covers (the caller then emits the ~oid + byte-string fallback).
+function _extValueFromDer(name, der) {
+  var node;
+  // A malformed DER extnValue (an ill-formed OID/INTEGER child, a truncated SEQUENCE) is simply not
+  // compact-encodable; any decode/read fault surfaces as null so the caller emits the ~oid byte-string form.
+  // Wrong-type children throw from asn1.read.* / cbor.build.uint (a negative value) and surface as the null
+  // fallback; the encode-side round-trip guard is the final net, so only the structural dispatch is inline.
+  try {
+  node = asn1.decode(der);
+  switch (name) {
+    case "subjectKeyIdentifier":                                      // OCTET STRING(keyid) -> the bare key id
+      return cbor.build.byteString(asn1.read.octetString(node));
+    case "keyUsage": {                                               // BIT STRING -> uint
+      var bits = _keyUsageBitsFromDer(der);
+      return bits == null ? null : cbor.build.uint(BigInt(bits));
+    }
+    case "basicConstraints": {                                      // SEQUENCE { cA?, pathLen? } -> int
+      var kids = node.children || [];
+      if (kids.length === 0) return cbor.build.int(-2n);            // cA absent (a non-SEQUENCE falls back via the guard)
+      if (asn1.read.boolean(kids[0]) !== true) return null;        // explicit cA=false is non-canonical -> fall back
+      if (kids.length === 1) return cbor.build.int(-1n);
+      if (kids.length !== 2) return null;
+      return cbor.build.uint(asn1.read.integer(kids[1]));           // pathLen (>= 0; a negative INTEGER throws -> fall back)
+    }
+    case "authorityKeyIdentifier": {                               // SEQUENCE { [0] keyId } -> the bare key id
+      var akids = node.children || [];
+      if (akids.length !== 1 || akids[0].tagNumber !== 0) return null;   // 3-tuple / other forms fall back
+      return cbor.build.byteString(akids[0].content);
+    }
+    case "extKeyUsage": {                                          // SEQUENCE OF OID -> [int/~oid ...] / single
+      var purposes = node.children || [];
+      if (!purposes.length) return null;
+      var out = purposes.map(function (p) {
+        var dotted = asn1.read.oid(p), pint = EKU_TO_INT[dotted];
+        return pint !== undefined ? cbor.build.int(BigInt(pint)) : cbor.build.byteString(asn1.encodeOidContent(dotted));
+      });
+      return out.length === 1 ? out[0] : cbor.build.array(out);
+    }
+    case "inhibitAnyPolicy":                                       // INTEGER -> uint
+      return cbor.build.uint(asn1.read.integer(node));
+    case "ocspNoCheck":                                            // NULL -> null
+      asn1.read.nullValue(node);
+      return cbor.build.nullValue();
+    case "tlsFeature":                                             // SEQUENCE OF INTEGER -> [uint ...]
+      return cbor.build.array((node.children || []).map(function (f) { return cbor.build.uint(asn1.read.integer(f)); }));
+    default:
+      return null;
+  }
+  } catch (_e) {
+    return null;
+  }
+}
+
+// Encode-side guard: emit the compact value only when it decodes back to the EXACT DER extnValue, so a
+// non-canonical or unrepresentable value can never produce a lossy compact form (it falls back to ~oid).
+// _extValueToDer is the exact inverse of _extValueFromDer, so the round-trip decode does not throw here;
+// the guard is the byte comparison (a canonical-equivalent DER differs and falls back).
+function _tryCompactExtValue(name, der) {
+  var compact = _extValueFromDer(name, der);
+  if (compact == null) return null;
+  return _extValueToDer(name, cbor.decode(compact)).equals(der) ? compact : null;
+}
+
 // extensions (sec. 3.1.10/sec. 3.3/sec. 8.8): [ * Extension ] | a single keyUsage int-shortcut.
 function _extensions(node) {
   // The keyUsage int-shortcut (sec. 3.1.10): a bare int -> one keyUsage extension, criticality from the
@@ -201,9 +364,18 @@ function _extensions(node) {
       name = EXT_BY_INT[Math.abs(ei)];
       if (name === undefined) throw _err("c509/bad-extensions", "extension type integer " + ei + " has no C509 registry row");
       extOid = oid.byName(name); critical = ei < 0;
-      // An int extension value is a Defined CBOR item; v1 reconstructs only a byte-string value (a
-      // non-byte-string value surfaces as null and fails closed at the type-3 reconstruction).
-      valContent = valNode.content;
+      // A registered extension with a compact value form (sec. 3.3) decodes its specific CBOR value to the
+      // DER extnValue inner content. A registered extension WITHOUT one (subjectAltName, until the general-
+      // name value codec lands) can only reconstruct a byte-string value (the raw DER extnValue); a
+      // non-byte-string value there is an unsupported compact form and MUST fail closed -- a text/array value
+      // is NOT raw DER, and copying its bytes would reconstruct a structurally invalid extension.
+      if (EXT_COMPACT[name]) {
+        valContent = _extValueToDer(name, valNode);
+      } else if (valNode.majorType === 2) {
+        valContent = valNode.content;
+      } else {
+        throw _err("c509/bad-extensions", "extension " + name + " has no compact value codec; its int-form value must be a byte string (draft-20 sec. 3.3)");
+      }
     } else {
       var r = _oidName(idNode, "c509/bad-extensions", "an extension id");
       name = r.name; extOid = r.oid;
@@ -486,12 +658,16 @@ function matches(node) {
 // FLAGSHIP type-3 forward transform (parse(encode(der)).reconstructedDer == der, so the original signature
 // verifies); a c509.parse result -> re-emit its native array. Signing-free (mirrors ct.encodeSctList).
 
-// The registry INVERSE tables -- the canonical int per name (the lossy forward map is resolved to ONE
-// choice: EXT_BY_INT maps both 2 and 7 to keyUsage, so keyUsage encodes to the canonical draft int 2).
+// The registry INVERSE tables (name -> canonical int). The RDN-attribute and extension inverses are
+// DERIVED from the *_BY_INT decode tables so the two directions cannot drift apart (a hand-kept inverse
+// once carried a stale pre-draft-20 numbering); the extension inverse keeps only the compact-encodable
+// rows, so a registered extension without a value codec (subjectAltName) routes to the ~oid form.
 var SIG_ALG_TO_INT = { ecdsaWithSHA256: 0, ecdsaWithSHA384: 1, ecdsaWithSHA512: 2 };
 var PK_ALG_TO_INT = { rsaEncryption: 0, "ecPublicKey|prime256v1": 1, "ecPublicKey|secp384r1": 2, "ecPublicKey|secp521r1": 3 };
-var ATTR_TO_INT = { commonName: 1, surname: 2, serialNumber: 3, countryName: 4, localityName: 6, stateOrProvinceName: 7, organizationName: 8, organizationalUnitName: 9, title: 10 };
-var EXT_TO_INT = { subjectKeyIdentifier: 1, keyUsage: 2, subjectAltName: 3, basicConstraints: 4, authorityKeyIdentifier: 10 };
+var ATTR_TO_INT = {};
+Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_TO_INT[ATTR_BY_INT[k]] = Number(k); });
+var EXT_TO_INT = {};
+Object.keys(EXT_BY_INT).forEach(function (k) { if (EXT_COMPACT[EXT_BY_INT[k]]) EXT_TO_INT[EXT_BY_INT[k]] = Number(k); });
 
 // A non-negative BigInt -> its minimal big-endian ~biguint bytes (the leading 0x00 sign octet omitted).
 function _minBytes(n) {
@@ -548,13 +724,15 @@ function _encExtensions(exts) {
   var items = [];
   exts.forEach(function (ext) {
     var ei = EXT_TO_INT[ext.name];
-    if (ei !== undefined) {
+    // A registered extension with a compact value form emits int extID + the specific CBOR value, but
+    // only when that value inverts to the EXACT DER extnValue (the round-trip guard); otherwise it falls
+    // through to the conformant ~oid + byte-string form (sec. 3.7) -- never a lossy compact encoding.
+    var compact = (ei !== undefined && Buffer.isBuffer(ext.value)) ? _tryCompactExtValue(ext.name, ext.value) : null;
+    if (compact != null) {
       items.push(cbor.build.int(BigInt(ext.critical ? -ei : ei)));
-      // a registered-int extension carries its extnValue DER bytes as a bare byte string.
-      if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + ext.name + " has no byte-string value to encode");
-      items.push(cbor.build.byteString(ext.value));
+      items.push(compact);
     } else {
-      items.push(cbor.build.byteString(asn1.encodeOidContent(ext.oid)));   // ~oid extension id
+      items.push(cbor.build.byteString(asn1.encodeOidContent(ext.oid || oid.byName(ext.name))));   // ~oid extension id
       if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + (ext.oid || ext.name) + " has no byte-string value to encode");
       var bs = cbor.build.byteString(ext.value);
       items.push(ext.critical ? cbor.build.array([bs]) : bs);              // critical ~oid value wraps in a 1-element array

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.28",
+  "version": "0.3.31",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ea40d20f-ad92-403e-8de1-cfd14bead6ba",
+  "serialNumber": "urn:uuid:1d3e8266-55f8-442b-877c-abe084a62726",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-01T18:47:21.356Z",
+    "timestamp": "2026-08-03T23:07:28.101Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.28",
+      "bom-ref": "@blamejs/pki@0.3.31",
       "type": "application",
       "name": "pki",
-      "version": "0.3.28",
+      "version": "0.3.31",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.28",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.31",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.28",
+      "ref": "@blamejs/pki@0.3.31",
       "dependsOn": []
     }
   ]