@blamejs/pki 0.3.29 → 0.3.31

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.3.31 — 2026-08-03
+
+pki.schema.c509 encodes and decodes the compact per-extension value forms -- a C509 certificate's keyUsage, basicConstraints, extended key usage, key identifiers, and other scalar extensions now ride in their specific draft-20 CBOR shape and interoperate with a conformant C509 implementation, not only this decoder.
+
+### Added
+
+- pki.schema.c509 encodes and decodes the compact per-extension value forms defined by draft-ietf-cose-cbor-encoded-cert-20 sec. 3.3 for the common scalar extensions: subjectKeyIdentifier (the bare key id), keyUsage (a network-byte-order integer), basicConstraints (an integer -- -2 for cA=false, -1 for cA=true with no path length, N for the path length), authorityKeyIdentifier (the bare key id, keyId-only form), extendedKeyUsage (an array of registry integers or unwrapped OIDs, the array omitted for a single purpose), inhibitAnyPolicy (an integer), OCSP No Check (CBOR null), and TLS Feature (an array of integers). Each form inverts to the DER extnValue byte-for-byte in both directions, so a C509 certificate carrying these extensions is the specific compact shape a conformant C509 implementation expects (draft-20 sec. 3.7 requires the specific form where one is defined) rather than an opaque DER byte string. The encoder is guarded: it emits the compact form only when it decodes back to the exact DER value, so a non-canonical or unrepresentable extension value falls back to the unwrapped-OID byte-string form instead of encoding lossily; a malformed compact value fails closed with a typed C509Error. The extended-key-usage integer shorthands cover the full draft-20 sec. 8.12 registry -- the RFC 5280 purposes (serverAuth, clientAuth, codeSigning, emailProtection, timeStamping, ocspSigning, anyExtendedKeyUsage) plus the SSH (RFC 6187), Kerberos PKINIT (RFC 4556), CMC (RFC 6402), and Wi-SUN purposes; any purpose outside the registry encodes as an unwrapped OID.
+
+### Changed
+
+- pki.schema.c509's RDN-attribute (sec. 8.6) and extension (sec. 8.8) integer registries now match draft-ietf-cose-cbor-encoded-cert-20: authorityKeyIdentifier is extension integer 7, extendedKeyUsage 8, inhibitAnyPolicy 30, OCSP No Check 36, and TLS Feature 38; and the RDN attributes localityName, stateOrProvinceName, and streetAddress are integers 5, 6, and 7. A certificate carrying any of these attributes or extensions now encodes to -- and decodes from -- the draft-20 integers and compact value shapes, so it interoperates with a conformant C509 implementation; re-encode any C509 produced by an earlier release, whose integers and per-extension value shapes differ.
+
 ## v0.3.29 — 2026-08-02
 
 The pki.acme client rounds out its RFC 8555 / RFC 9773 surface -- pre-authorize an identifier with client.newAuthz, choose among alternate issuance chains in client.downloadCertificate, and schedule renewal from the CA's ARI window with client.renewalWindow.

package/README.md

@@ -204,7 +204,7 @@ is callable today; nothing below is a stub.
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands and the C509 compressions; a certificate outside the invertible set throws a typed `C509Error` |
+| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms (keyUsage, basicConstraints, extended key usage, subject/authority key identifier, and the other scalar extensions); a certificate outside the invertible set throws a typed `C509Error` |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |

package/lib/oid.js

@@ -81,6 +81,8 @@ var FAMILIES = {
   pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
     authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10,
     acmeIdentifier: 31,
+    // id-pe-tlsfeature (RFC 7633) -- the TLS Feature (formerly "must-staple") extension.
+    tlsFeature: 24,
     // id-pe-qcStatements (RFC 3739 sec. 3.2.6) -- the qualified-certificate-statements extension.
     qcStatements: 3 } },
 
@@ -138,9 +140,19 @@ var FAMILIES = {
   regInfo: { base: [1, 3, 6, 1, 5, 5, 7, 5, 2], of: { utf8Pairs: 1, certReq: 2 } },
 
   // PKIX extended key purposes (id-kp, RFC 5280 sec. 4.2.1.12). timeStamping is required
-  // -- critical and sole -- on an RFC 3161 TSA signing certificate (sec. 2.3).
+  // -- critical and sole -- on an RFC 3161 TSA signing certificate (sec. 2.3). The SSH
+  // (RFC 6187), CMC (RFC 6402), and Bundle Security (RFC 9174) purposes complete the C509
+  // Extended Key Usages registry (draft-ietf-cose-cbor-encoded-cert sec. 8.12).
   pkixKp: { base: [1, 3, 6, 1, 5, 5, 7, 3], of: {
-    serverAuth: 1, clientAuth: 2, codeSigning: 3, emailProtection: 4, timeStamping: 8, ocspSigning: 9 } },
+    serverAuth: 1, clientAuth: 2, codeSigning: 3, emailProtection: 4, timeStamping: 8, ocspSigning: 9,
+    secureShellClient: 21, secureShellServer: 22, cmcCA: 27, cmcRA: 28, cmcArchive: 29, cmKGA: 32, bundleSecurity: 35 } },
+
+  // Kerberos PKINIT extended key purposes (id-pkinit, RFC 4556 sec. 3.2.3 / 3.2.4): the client
+  // and KDC authentication EKUs (C509 Extended Key Usages registry integers 10 / 11).
+  pkinitKp: { base: [1, 3, 6, 1, 5, 2, 3], of: { pkinitClientAuth: 4, pkinitKdc: 5 } },
+
+  // Wi-SUN FAN device extended key purpose (C509 Extended Key Usages registry integer 20).
+  wisun: { base: [1, 3, 6, 1, 4, 1, 45605], of: { fanDevice: 1 } },
 
   // Google Certificate Transparency (RFC 6962) on the 1.3.6.1.4.1.11129.2.4 arc:
   // the SCT-list X.509 extension (sec. 3.3), the precertificate poison (sec. 3.1), the

package/lib/schema-c509.js

@@ -55,27 +55,53 @@ var PK_ALG_BY_INT = {
 // EC curve -> field size in bytes (the SEC1 coordinate width), for point-length validation.
 var EC_FIELD_BYTES = { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 };
 
-// sec. 8.6 attribute types (abs(int) -> name; the sign selects the X.509 string type).
+// sec. 8.6 RDN attribute types (abs(int) -> name; the sign selects the X.509 string type). emailAddress
+// (int 0) is an IA5String value not covered by the DirectoryString SpecialText codec below, so it is
+// declined; a DN carrying it encodes via the ~oid attribute form, not this alias table.
 var ATTR_BY_INT = {
   1: _name("commonName"),
   2: _name("surname"),
   3: _name("serialNumber"),
   4: _name("countryName"),
-  6: _name("localityName"),
-  7: _name("stateOrProvinceName"),
+  5: _name("localityName"),
+  6: _name("stateOrProvinceName"),
+  7: _name("streetAddress"),
   8: _name("organizationName"),
   9: _name("organizationalUnitName"),
   10: _name("title"),
 };
-// sec. 8.8 extension types (abs(int) -> name; the sign selects criticality).
+// sec. 8.8 extension types (abs(int) -> name; the sign selects criticality). The general-name-bearing
+// extensions (subjectAltName et al) carry an int extensionID only when their compact value is supported;
+// subjectAltName stays registered for the byte-string value form (the compact GeneralNames array awaits
+// the sec. 8.13 general-name codec and fails closed).
 var EXT_BY_INT = {
   1: _name("subjectKeyIdentifier"),
   2: _name("keyUsage"),
   3: _name("subjectAltName"),
   4: _name("basicConstraints"),
-  7: _name("keyUsage"),
-  10: _name("authorityKeyIdentifier"),
+  7: _name("authorityKeyIdentifier"),
+  8: _name("extKeyUsage"),
+  30: _name("inhibitAnyPolicy"),
+  36: _name("ocspNoCheck"),
+  38: _name("tlsFeature"),
 };
+// The extensions whose compact CBOR value form (sec. 3.3) is invertible to/from the DER extnValue.
+// A registered extension NOT in this set carries its value as the ~oid + byte-string form (sec. 3.7).
+var EXT_COMPACT = {
+  subjectKeyIdentifier: 1, keyUsage: 1, basicConstraints: 1, authorityKeyIdentifier: 1,
+  extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
+};
+// sec. 8.12 Extended Key Usages registry (C509 int -> registered id-kp purpose name). A KeyPurposeId
+// outside this set encodes as an unwrapped ~oid; a C509 int outside it fails closed on decode.
+var EKU_BY_INT = {
+  0: _name("anyExtendedKeyUsage"), 1: _name("serverAuth"), 2: _name("clientAuth"),
+  3: _name("codeSigning"), 4: _name("emailProtection"), 8: _name("timeStamping"), 9: _name("ocspSigning"),
+  10: _name("pkinitClientAuth"), 11: _name("pkinitKdc"), 12: _name("secureShellClient"), 13: _name("secureShellServer"),
+  14: _name("bundleSecurity"), 15: _name("cmcCA"), 16: _name("cmcRA"), 17: _name("cmcArchive"), 18: _name("cmKGA"),
+  20: _name("fanDevice"),
+};
+var EKU_TO_INT = {};   // dotted OID -> C509 int (the encode inverse; keyed on the resolved OID)
+Object.keys(EKU_BY_INT).forEach(function (k) { EKU_TO_INT[oid.byName(EKU_BY_INT[k])] = Number(k); });
 
 // ---- field readers (the unwrapped ~biguint / ~time / ~oid contracts; draft-20 sec. 3.1) ----
 
@@ -94,7 +120,7 @@ function _biguint(node, code, label) {
 // MUST reject. Bound to the Date window; the CBOR simple null (permitted only for notAfter) -> null.
 function _time(node, allowNull, label) {
   if (allowNull && node.majorType === 7 && node.ai === 22) return null;   // CBOR simple null (0xF6)
-  if (!node || node.majorType !== 0) throw _err("c509/bad-validity", label + " must be an unwrapped CBOR epoch integer (~time)");
+  if (node.majorType !== 0) throw _err("c509/bad-validity", label + " must be an unwrapped CBOR epoch integer (~time)");
   var secs = node.argument;
   if (secs > MAX_EPOCH_SECONDS) throw _err("c509/bad-validity", label + " is outside the representable Date range");
   return new Date(C.TIME.seconds(Number(secs)));
@@ -179,6 +205,143 @@ function _name509(node, isSubject) {
 }
 function _shortName(n) { return n === "commonName" ? "CN" : n === "countryName" ? "C" : n === "organizationName" ? "O" : n === "organizationalUnitName" ? "OU" : n === "localityName" ? "L" : n === "stateOrProvinceName" ? "ST" : n; }
 
+// ---- compact per-extension value codec (draft-20 sec. 3.3) -------------------
+// Each registered extension in EXT_COMPACT has a specific CBOR encoding of its value that is invertible
+// to/from the DER extnValue inner content (the bytes _reconExtensions wraps in an OCTET STRING). Native
+// C509 MUST use the specific form (sec. 3.7); the decode side reconstructs the DER, the encode side emits
+// the compact form only when it round-trips byte-for-byte (else the ~oid + byte-string fallback).
+
+// A CBOR unsigned integer node -> its BigInt value (major type 0 guarantees non-negative). Arbitrary
+// precision: a DER INTEGER holds any width, so no cap -- the round-trip guard verifies the reconstruction.
+function _cborUint(node, label) {
+  if (node.majorType !== 0) throw _err("c509/bad-extensions", "a " + label + " value must be a CBOR unsigned integer");
+  return cbor.read.int(node);
+}
+// A CBOR integer node (either sign) -> its BigInt value (basicConstraints uses -2/-1/pathLen).
+function _cborIntVal(node, label) {
+  if (node.majorType !== 0 && node.majorType !== 1) throw _err("c509/bad-extensions", "a " + label + " value must be a CBOR integer");
+  return cbor.read.int(node);
+}
+// A C509 KeyPurposeId (int registry alias OR unwrapped ~oid) -> the dotted extended-key-usage OID.
+function _ekuPurposeOid(node) {
+  if (node.majorType === 0 || node.majorType === 1) {
+    var i = Number(cbor.read.int(node));
+    var nm = EKU_BY_INT[i];
+    if (nm === undefined) throw _err("c509/bad-extensions", "an extKeyUsage int " + i + " has no C509 registry row");
+    return oid.byName(nm);
+  }
+  // A ~oid KeyPurposeId routes through _oidName, which validates the BER OID content and remaps an oid/*
+  // fault to c509/bad-extensions (fault preserved as .cause) -- a non-byte-string node fails closed there too.
+  return _oidName(node, "c509/bad-extensions", "an extKeyUsage KeyPurposeId").oid;
+}
+
+// Decode a compact extension value (a decoded CBOR node) to the DER extnValue inner content. Fails closed
+// (c509/bad-extensions) on a CBOR shape the named extension does not define.
+function _extValueToDer(name, node) {
+  switch (name) {
+    case "subjectKeyIdentifier":   // KeyIdentifier = bytes -> OCTET STRING(keyid)
+      if (node.majorType !== 2) throw _err("c509/bad-extensions", "a subjectKeyIdentifier value must be a CBOR byte string");
+      return b.octetString(node.content);
+    case "keyUsage":               // uint -> KeyUsage BIT STRING (a value past the 9 named bits fails closed)
+      return _reconKeyUsageBits(Number(_cborUint(node, "keyUsage")));
+    case "basicConstraints": {     // int -> SEQUENCE { cA?, pathLen? }
+      var iv = _cborIntVal(node, "basicConstraints");
+      if (iv === -2n) return b.sequence([]);                                  // cA false (omitted)
+      if (iv === -1n) return b.sequence([b.boolean(true)]);                   // cA true, no pathLen
+      if (iv >= 0n) return b.sequence([b.boolean(true), b.integer(iv)]);      // cA true, pathLen
+      throw _err("c509/bad-extensions", "a basicConstraints int " + iv + " is outside the -2/-1/pathLen range");
+    }
+    case "authorityKeyIdentifier": // keyId-only bytes -> SEQUENCE { [0] IMPLICIT keyIdentifier }
+      if (node.majorType !== 2) throw _err("c509/bad-extensions", "an authorityKeyIdentifier value must be a CBOR byte string (keyId-only form; the 3-tuple form is not supported)");
+      return b.sequence([b.contextPrimitive(0, node.content)]);
+    case "extKeyUsage": {          // [2* KeyPurposeId] / KeyPurposeId -> SEQUENCE OF OID (draft-20 sec. 3.3)
+      var items;
+      if (node.majorType === 4) {
+        items = node.children || [];
+        if (items.length < 2) throw _err("c509/bad-extensions", "an extKeyUsage array must hold 2 or more KeyPurposeIds; a single purpose omits the array (draft-20 sec. 3.3)");
+      } else {
+        items = [node];
+      }
+      return b.sequence(items.map(function (it) { return b.oid(_ekuPurposeOid(it)); }));
+    }
+    case "inhibitAnyPolicy":       // uint -> INTEGER SkipCerts
+      return b.integer(_cborUint(node, "inhibitAnyPolicy"));
+    case "ocspNoCheck":            // null -> NULL
+      if (node.majorType !== 7 || !(Buffer.isBuffer(node.bytes) && node.bytes.length === 1 && node.bytes[0] === 0xf6)) throw _err("c509/bad-extensions", "an ocspNoCheck value must be the CBOR simple value null");
+      return b.nullValue();
+    case "tlsFeature": {           // [uint ...] -> SEQUENCE OF INTEGER
+      if (node.majorType !== 4) throw _err("c509/bad-extensions", "a tlsFeature value must be a CBOR array");
+      return b.sequence((node.children || []).map(function (f) { return b.integer(_cborUint(f, "tlsFeature feature")); }));
+    }
+    default:
+      throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
+  }
+}
+
+// Encode a DER extnValue inner content to its compact CBOR value bytes, or null when the DER is not the
+// canonical form the compact encoding covers (the caller then emits the ~oid + byte-string fallback).
+function _extValueFromDer(name, der) {
+  var node;
+  // A malformed DER extnValue (an ill-formed OID/INTEGER child, a truncated SEQUENCE) is simply not
+  // compact-encodable; any decode/read fault surfaces as null so the caller emits the ~oid byte-string form.
+  // Wrong-type children throw from asn1.read.* / cbor.build.uint (a negative value) and surface as the null
+  // fallback; the encode-side round-trip guard is the final net, so only the structural dispatch is inline.
+  try {
+  node = asn1.decode(der);
+  switch (name) {
+    case "subjectKeyIdentifier":                                      // OCTET STRING(keyid) -> the bare key id
+      return cbor.build.byteString(asn1.read.octetString(node));
+    case "keyUsage": {                                               // BIT STRING -> uint
+      var bits = _keyUsageBitsFromDer(der);
+      return bits == null ? null : cbor.build.uint(BigInt(bits));
+    }
+    case "basicConstraints": {                                      // SEQUENCE { cA?, pathLen? } -> int
+      var kids = node.children || [];
+      if (kids.length === 0) return cbor.build.int(-2n);            // cA absent (a non-SEQUENCE falls back via the guard)
+      if (asn1.read.boolean(kids[0]) !== true) return null;        // explicit cA=false is non-canonical -> fall back
+      if (kids.length === 1) return cbor.build.int(-1n);
+      if (kids.length !== 2) return null;
+      return cbor.build.uint(asn1.read.integer(kids[1]));           // pathLen (>= 0; a negative INTEGER throws -> fall back)
+    }
+    case "authorityKeyIdentifier": {                               // SEQUENCE { [0] keyId } -> the bare key id
+      var akids = node.children || [];
+      if (akids.length !== 1 || akids[0].tagNumber !== 0) return null;   // 3-tuple / other forms fall back
+      return cbor.build.byteString(akids[0].content);
+    }
+    case "extKeyUsage": {                                          // SEQUENCE OF OID -> [int/~oid ...] / single
+      var purposes = node.children || [];
+      if (!purposes.length) return null;
+      var out = purposes.map(function (p) {
+        var dotted = asn1.read.oid(p), pint = EKU_TO_INT[dotted];
+        return pint !== undefined ? cbor.build.int(BigInt(pint)) : cbor.build.byteString(asn1.encodeOidContent(dotted));
+      });
+      return out.length === 1 ? out[0] : cbor.build.array(out);
+    }
+    case "inhibitAnyPolicy":                                       // INTEGER -> uint
+      return cbor.build.uint(asn1.read.integer(node));
+    case "ocspNoCheck":                                            // NULL -> null
+      asn1.read.nullValue(node);
+      return cbor.build.nullValue();
+    case "tlsFeature":                                             // SEQUENCE OF INTEGER -> [uint ...]
+      return cbor.build.array((node.children || []).map(function (f) { return cbor.build.uint(asn1.read.integer(f)); }));
+    default:
+      return null;
+  }
+  } catch (_e) {
+    return null;
+  }
+}
+
+// Encode-side guard: emit the compact value only when it decodes back to the EXACT DER extnValue, so a
+// non-canonical or unrepresentable value can never produce a lossy compact form (it falls back to ~oid).
+// _extValueToDer is the exact inverse of _extValueFromDer, so the round-trip decode does not throw here;
+// the guard is the byte comparison (a canonical-equivalent DER differs and falls back).
+function _tryCompactExtValue(name, der) {
+  var compact = _extValueFromDer(name, der);
+  if (compact == null) return null;
+  return _extValueToDer(name, cbor.decode(compact)).equals(der) ? compact : null;
+}
+
 // extensions (sec. 3.1.10/sec. 3.3/sec. 8.8): [ * Extension ] | a single keyUsage int-shortcut.
 function _extensions(node) {
   // The keyUsage int-shortcut (sec. 3.1.10): a bare int -> one keyUsage extension, criticality from the
@@ -201,9 +364,18 @@ function _extensions(node) {
       name = EXT_BY_INT[Math.abs(ei)];
       if (name === undefined) throw _err("c509/bad-extensions", "extension type integer " + ei + " has no C509 registry row");
       extOid = oid.byName(name); critical = ei < 0;
-      // An int extension value is a Defined CBOR item; v1 reconstructs only a byte-string value (a
-      // non-byte-string value surfaces as null and fails closed at the type-3 reconstruction).
-      valContent = valNode.content;
+      // A registered extension with a compact value form (sec. 3.3) decodes its specific CBOR value to the
+      // DER extnValue inner content. A registered extension WITHOUT one (subjectAltName, until the general-
+      // name value codec lands) can only reconstruct a byte-string value (the raw DER extnValue); a
+      // non-byte-string value there is an unsupported compact form and MUST fail closed -- a text/array value
+      // is NOT raw DER, and copying its bytes would reconstruct a structurally invalid extension.
+      if (EXT_COMPACT[name]) {
+        valContent = _extValueToDer(name, valNode);
+      } else if (valNode.majorType === 2) {
+        valContent = valNode.content;
+      } else {
+        throw _err("c509/bad-extensions", "extension " + name + " has no compact value codec; its int-form value must be a byte string (draft-20 sec. 3.3)");
+      }
     } else {
       var r = _oidName(idNode, "c509/bad-extensions", "an extension id");
       name = r.name; extOid = r.oid;
@@ -486,12 +658,16 @@ function matches(node) {
 // FLAGSHIP type-3 forward transform (parse(encode(der)).reconstructedDer == der, so the original signature
 // verifies); a c509.parse result -> re-emit its native array. Signing-free (mirrors ct.encodeSctList).
 
-// The registry INVERSE tables -- the canonical int per name (the lossy forward map is resolved to ONE
-// choice: EXT_BY_INT maps both 2 and 7 to keyUsage, so keyUsage encodes to the canonical draft int 2).
+// The registry INVERSE tables (name -> canonical int). The RDN-attribute and extension inverses are
+// DERIVED from the *_BY_INT decode tables so the two directions cannot drift apart (a hand-kept inverse
+// once carried a stale pre-draft-20 numbering); the extension inverse keeps only the compact-encodable
+// rows, so a registered extension without a value codec (subjectAltName) routes to the ~oid form.
 var SIG_ALG_TO_INT = { ecdsaWithSHA256: 0, ecdsaWithSHA384: 1, ecdsaWithSHA512: 2 };
 var PK_ALG_TO_INT = { rsaEncryption: 0, "ecPublicKey|prime256v1": 1, "ecPublicKey|secp384r1": 2, "ecPublicKey|secp521r1": 3 };
-var ATTR_TO_INT = { commonName: 1, surname: 2, serialNumber: 3, countryName: 4, localityName: 6, stateOrProvinceName: 7, organizationName: 8, organizationalUnitName: 9, title: 10 };
-var EXT_TO_INT = { subjectKeyIdentifier: 1, keyUsage: 2, subjectAltName: 3, basicConstraints: 4, authorityKeyIdentifier: 10 };
+var ATTR_TO_INT = {};
+Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_TO_INT[ATTR_BY_INT[k]] = Number(k); });
+var EXT_TO_INT = {};
+Object.keys(EXT_BY_INT).forEach(function (k) { if (EXT_COMPACT[EXT_BY_INT[k]]) EXT_TO_INT[EXT_BY_INT[k]] = Number(k); });
 
 // A non-negative BigInt -> its minimal big-endian ~biguint bytes (the leading 0x00 sign octet omitted).
 function _minBytes(n) {
@@ -548,13 +724,15 @@ function _encExtensions(exts) {
   var items = [];
   exts.forEach(function (ext) {
     var ei = EXT_TO_INT[ext.name];
-    if (ei !== undefined) {
+    // A registered extension with a compact value form emits int extID + the specific CBOR value, but
+    // only when that value inverts to the EXACT DER extnValue (the round-trip guard); otherwise it falls
+    // through to the conformant ~oid + byte-string form (sec. 3.7) -- never a lossy compact encoding.
+    var compact = (ei !== undefined && Buffer.isBuffer(ext.value)) ? _tryCompactExtValue(ext.name, ext.value) : null;
+    if (compact != null) {
       items.push(cbor.build.int(BigInt(ext.critical ? -ei : ei)));
-      // a registered-int extension carries its extnValue DER bytes as a bare byte string.
-      if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + ext.name + " has no byte-string value to encode");
-      items.push(cbor.build.byteString(ext.value));
+      items.push(compact);
     } else {
-      items.push(cbor.build.byteString(asn1.encodeOidContent(ext.oid)));   // ~oid extension id
+      items.push(cbor.build.byteString(asn1.encodeOidContent(ext.oid || oid.byName(ext.name))));   // ~oid extension id
       if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + (ext.oid || ext.name) + " has no byte-string value to encode");
       var bs = cbor.build.byteString(ext.value);
       items.push(ext.critical ? cbor.build.array([bs]) : bs);              // critical ~oid value wraps in a 1-element array

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.29",
+  "version": "0.3.31",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3a0c2231-58bb-4cd0-ae0c-88a58b06b1bf",
+  "serialNumber": "urn:uuid:1d3e8266-55f8-442b-877c-abe084a62726",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-02T13:10:19.880Z",
+    "timestamp": "2026-08-03T23:07:28.101Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.29",
+      "bom-ref": "@blamejs/pki@0.3.31",
       "type": "application",
       "name": "pki",
-      "version": "0.3.29",
+      "version": "0.3.31",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.29",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.31",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.29",
+      "ref": "@blamejs/pki@0.3.31",
       "dependsOn": []
     }
   ]