@blamejs/pki 0.3.31 → 0.3.32

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.3.32 — 2026-08-05
+
+pki.schema.c509 encodes and decodes the compact general-name extension values -- a C509 certificate's subjectAltName, issuer alternative name, name constraints, CRL distribution points, authority/subject information access, and the authority key identifier issuer form now ride their specific draft-20 CBOR shape and interoperate with a conformant C509 implementation, not only this decoder.
+
+### Added
+
+- pki.schema.c509 encodes and decodes the compact value forms for the general-name-bearing extensions defined by draft-ietf-cose-cbor-encoded-cert-20 sec. 3.3: subjectAltName and issuerAltName (a flat array of (general-name type, value) pairs, or the bare dNSName as CBOR text for a single host name), nameConstraints (the permitted and excluded GeneralSubtrees, with the RFC 9549 sec. 2.2 address-plus-prefix-length form for an iPAddress constraint), cRLDistributionPoints and freshestCRL (each distribution point's URI full name with optional reasons and CRL issuer, or a single bare URI as CBOR text), authorityInfoAccess and subjectInfoAccess (each access description as a sec. 8.11 registry integer or unwrapped OID plus its URI), and the authorityKeyIdentifier key-identifier / authority-cert-issuer / serial form. One shared GeneralNames codec drives them all, covering every general-name form the sec. 8.13 registry defines -- rfc822Name, dNSName, directoryName, URI, iPAddress, registeredID, and otherName including the hardware-module-name (RFC 4108), SMTP UTF-8 mailbox (RFC 9598), and MAC-address specials. Each form inverts to the DER extnValue byte-for-byte in both directions, so a certificate carrying these extensions is the specific compact shape a conformant C509 implementation reads rather than an opaque DER byte string. The encoder is guarded: it emits the compact form only when it decodes back to the exact DER value, so a general name outside the registry (an X.400 address, an EDI party name), a non-canonical value, or a value the compact form cannot hold falls the whole extension back to the unwrapped-OID byte-string form instead of encoding a partial or lossy value; a malformed compact value fails closed with a typed C509Error.
+- The OID registry gains the id-on other-name type identifiers (hardware module name, SMTP UTF-8 mailbox, MAC address), the id-ad access-description methods (time stamping, CA repository, RPKI manifest / signed object / notify), and subject information access, resolvable through pki.oid.byName / pki.oid.name.
+
+### Changed
+
+- A C509 certificate carrying a general-name-bearing extension (subjectAltName, issuerAltName, nameConstraints, cRLDistributionPoints, freshestCRL, authorityInfoAccess, subjectInfoAccess, or the authorityKeyIdentifier issuer form) now encodes to -- and decodes from -- its compact CBOR value shape rather than the unwrapped-OID byte-string form an earlier release emitted; both reconstruct the same DER, but the CBOR bytes differ, so re-encode any C509 produced by an earlier release. A native C509 that carried a subjectAltName as a raw byte string under its extension integer, which is not a value form the draft defines, is now rejected.
+
 ## v0.3.31 — 2026-08-03
 
 pki.schema.c509 encodes and decodes the compact per-extension value forms -- a C509 certificate's keyUsage, basicConstraints, extended key usage, key identifiers, and other scalar extensions now ride in their specific draft-20 CBOR shape and interoperate with a conformant C509 implementation, not only this decoder.

package/README.md

@@ -204,7 +204,7 @@ is callable today; nothing below is a stub.
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms (keyUsage, basicConstraints, extended key usage, subject/authority key identifier, and the other scalar extensions); a certificate outside the invertible set throws a typed `C509Error` |
+| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more) and the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec; a certificate outside the invertible set throws a typed `C509Error` |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |

package/lib/oid.js

@@ -81,6 +81,8 @@ var FAMILIES = {
   pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
     authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10,
     acmeIdentifier: 31,
+    // id-pe-subjectInfoAccess (RFC 5280 sec. 4.2.2.2) -- the SIA extension companion to the AIA.
+    subjectInfoAccess: 11,
     // id-pe-tlsfeature (RFC 7633) -- the TLS Feature (formerly "must-staple") extension.
     tlsFeature: 24,
     // id-pe-qcStatements (RFC 3739 sec. 3.2.6) -- the qualified-certificate-statements extension.
@@ -119,8 +121,18 @@ var FAMILIES = {
 
   // PKIX Access Descriptor methods (id-ad, RFC 5280 sec. 4.2.2.1/sec. 4.2.2.2). id-ad-ocsp
   // is the arc the OCSP responder OIDs hang under; id-ad-caIssuers names the AIA
-  // CA-issuers access method.
-  adAccess: { base: [1, 3, 6, 1, 5, 5, 7, 48], of: { ocsp: 1, caIssuers: 2 } },
+  // CA-issuers access method. The remaining id-ad methods (timeStamping RFC 3161, caRepository
+  // + rpkiManifest/signedObject/rpkiNotify RFC 6487/8182) complete the C509 Information Access
+  // registry (draft-ietf-cose-cbor-encoded-cert sec. 8.11); they carry the id-ad- prefix so the
+  // name->OID reverse stays unambiguous next to the id-kp "timeStamping" purpose (a distinct arc).
+  adAccess: { base: [1, 3, 6, 1, 5, 5, 7, 48], of: { ocsp: 1, caIssuers: 2,
+    "id-ad-timeStamping": 3, "id-ad-caRepository": 5, "id-ad-rpkiManifest": 10,
+    "id-ad-signedObject": 11, "id-ad-rpkiNotify": 13 } },
+
+  // id-on -- RFC 5280 sec. 4.2.1.6 otherName type-ids the C509 sec. 8.13 registry gives their own
+  // negative ints: id-on-hardwareModuleName (RFC 4108), id-on-SmtpUTF8Mailbox (RFC 9598),
+  // id-on-MACAddress (I-D.ietf-lamps-macaddress-on) on the id-pkix 8 arc.
+  pkixOn: { base: [1, 3, 6, 1, 5, 5, 7, 8], of: { hardwareModuleName: 4, smtpUtf8Mailbox: 9, macAddress: 12 } },
 
   // OCSP (RFC 6960) on the id-pkix-ocsp arc (= id-ad-ocsp). id-pkix-ocsp-basic is
   // the ResponseBytes.responseType this build decodes; id-pkix-ocsp-nonce (sec. 4.4.1)

package/lib/schema-c509.js

@@ -19,6 +19,8 @@ var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var pkix = require("./schema-pkix");
+var schema = require("./schema-engine");
+var guard = require("./guard-all");
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var validator = require("./validator-all");
@@ -71,17 +73,24 @@ var ATTR_BY_INT = {
   10: _name("title"),
 };
 // sec. 8.8 extension types (abs(int) -> name; the sign selects criticality). The general-name-bearing
-// extensions (subjectAltName et al) carry an int extensionID only when their compact value is supported;
-// subjectAltName stays registered for the byte-string value form (the compact GeneralNames array awaits
-// the sec. 8.13 general-name codec and fails closed).
+// extensions (subjectAltName / issuerAltName / nameConstraints / cRLDistributionPoints / freshestCRL /
+// authorityInfoAccess / subjectInfoAccess) ride the shared sec. 8.13 GeneralNames value codec below; each
+// carries a specific CBOR value form and falls back to ~oid + byte-string only when a member is outside
+// the sec. 8.13 registry (an x400Address / ediPartyName general name, a non-URI access location, ...).
 var EXT_BY_INT = {
   1: _name("subjectKeyIdentifier"),
   2: _name("keyUsage"),
   3: _name("subjectAltName"),
   4: _name("basicConstraints"),
+  5: _name("cRLDistributionPoints"),
   7: _name("authorityKeyIdentifier"),
   8: _name("extKeyUsage"),
+  9: _name("authorityInfoAccess"),
+  25: _name("issuerAltName"),
+  26: _name("nameConstraints"),
+  29: _name("freshestCRL"),
   30: _name("inhibitAnyPolicy"),
+  31: _name("subjectInfoAccess"),
   36: _name("ocspNoCheck"),
   38: _name("tlsFeature"),
 };
@@ -90,6 +99,8 @@ var EXT_BY_INT = {
 var EXT_COMPACT = {
   subjectKeyIdentifier: 1, keyUsage: 1, basicConstraints: 1, authorityKeyIdentifier: 1,
   extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
+  subjectAltName: 1, issuerAltName: 1, nameConstraints: 1, cRLDistributionPoints: 1,
+  freshestCRL: 1, authorityInfoAccess: 1, subjectInfoAccess: 1,
 };
 // sec. 8.12 Extended Key Usages registry (C509 int -> registered id-kp purpose name). A KeyPurposeId
 // outside this set encodes as an unwrapped ~oid; a C509 int outside it fails closed on decode.
@@ -103,6 +114,33 @@ var EKU_BY_INT = {
 var EKU_TO_INT = {};   // dotted OID -> C509 int (the encode inverse; keyed on the resolved OID)
 Object.keys(EKU_BY_INT).forEach(function (k) { EKU_TO_INT[oid.byName(EKU_BY_INT[k])] = Number(k); });
 
+// The shared pkix namespace + GeneralName leaves the general-name value codec composes for the DER ->
+// CBOR direction (the CVE-2009-2408 IA5 control-byte guard, the otherName/directoryName shape, the
+// iPAddress length and RFC 9549 subtree-base length are all enforced there -- never re-validated by hand).
+var NS = pkix.makeNS("c509", C509Error, oid);
+var GN_LEAF = pkix.generalName(NS, { decodeValue: true });                       // SAN-form GeneralName leaf
+var GN_LEAF_SUBTREE = pkix.generalName(NS, { decodeValue: true, subtreeBase: true }); // name-constraints subtree base
+
+// sec. 8.13 C509 General Names registry: for the standard forms the C509 int == the RFC 5280 sec. 4.2.1.6
+// GeneralName CHOICE context tag (1 rfc822Name, 2 dNSName, 4 directoryName, 6 URI, 7 iPAddress, 8
+// registeredID); the _generalNameToDer / _generalNameFromDer switches carry that mapping directly.
+// x400Address [3] and ediPartyName [5] have no registry row -- a GeneralNames carrying either is not
+// compact-encodable (the enclosing extension falls back to ~oid + byte-string).
+// The id-on otherName specials get their own negative C509 ints (sec. 8.13 / sec. 3.3): int -> the id-on
+// type-id OID name; the derived inverse keys on the resolved OID so a decode selects the negative int.
+var ON_NAME_BY_INT = { "-1": _name("hardwareModuleName"), "-2": _name("smtpUtf8Mailbox"), "-3": _name("macAddress") };
+var ON_INT_BY_OID = {};
+Object.keys(ON_NAME_BY_INT).forEach(function (k) { ON_INT_BY_OID[oid.byName(ON_NAME_BY_INT[k])] = Number(k); });
+// sec. 8.11 C509 Information Access registry (int -> registered access-method OID name; the id-ad methods
+// keep the id-ad- prefix, see oid.js). A method OID outside the table encodes as ~oid; a C509 method int
+// outside it fails closed. IA_TO_INT is the derived encode inverse, keyed on the resolved OID.
+var IA_BY_INT = {
+  1: _name("ocsp"), 2: _name("caIssuers"), 3: _name("id-ad-timeStamping"), 5: _name("id-ad-caRepository"),
+  10: _name("id-ad-rpkiManifest"), 11: _name("id-ad-signedObject"), 13: _name("id-ad-rpkiNotify"),
+};
+var IA_TO_INT = {};
+Object.keys(IA_BY_INT).forEach(function (k) { IA_TO_INT[oid.byName(IA_BY_INT[k])] = Number(k); });
+
 // ---- field readers (the unwrapped ~biguint / ~time / ~oid contracts; draft-20 sec. 3.1) ----
 
 // ~biguint (sec. 3.1.2): a BARE byte string (major type 2), big-endian magnitude, the non-negative
@@ -193,6 +231,12 @@ function _name509(node, isSubject) {
   // attribute type with no value -- reject rather than silently drop the trailing element.
   if (kids.length % 2 !== 0) throw _err("c509/bad-name", "a C509 Name array must be attribute-type/value pairs (dangling attribute type)");
   for (var i = 0; i + 1 < kids.length; i += 2) {
+    // The attributeType slot must be a CBOR integer (major type 0/1). Guard the major type BEFORE the read
+    // so a non-integer type slot fails in this module's own domain (c509/bad-name), matching the value slot,
+    // rather than leaking cbor.read.int's cbor/unexpected-major fault onto the parse surface. Reached with
+    // attacker-controlled bytes via the sec. 8.13 directoryName general name (subjectAltName, authorityKey-
+    // Identifier issuer, cRLDistributionPoints cRLIssuer, nameConstraints subtree base) and the top-level Name.
+    if (kids[i].majorType !== 0 && kids[i].majorType !== 1) throw _err("c509/bad-name", "a C509 Name attribute type must be a CBOR integer");
     var ti = Number(cbor.read.int(kids[i]));
     var tname = ATTR_BY_INT[Math.abs(ti)];
     if (tname === undefined) throw _err("c509/bad-name", "attribute type integer " + ti + " has no C509 registry row");
@@ -235,6 +279,317 @@ function _ekuPurposeOid(node) {
   return _oidName(node, "c509/bad-extensions", "an extKeyUsage KeyPurposeId").oid;
 }
 
+// ---- the shared C509 GeneralNames value codec (draft-20 sec. 3.3 / sec. 8.13) ------------------
+// One int <-> DER-context-tag pair (_generalNameToDer / _generalNameFromDer) drives every general-name-
+// bearing extension (subjectAltName, nameConstraints, authorityKeyIdentifier, cRLDistributionPoints,
+// authorityInfoAccess, ...), so a tag/int mapping bug cannot diverge across them. The DER -> CBOR side
+// composes the shared pkix.generalName leaf; the CBOR -> DER side builds directly with asn1.build.*, the
+// exact inverse. Every encode stays behind the extension-level byte-exact round-trip guard
+// (_tryCompactExtValue), so a member the codec cannot invert byte-for-byte falls the WHOLE extension back
+// to the conformant ~oid + byte-string form (sec. 3.7) -- never a partial GeneralNames.
+
+// The unwrapped ~oid CBOR form (a bare byte string of the BER OID content octets; RFC 9090).
+function _oidCbor(dotted) { return cbor.build.byteString(asn1.encodeOidContent(dotted)); }
+// The CBOR simple value null (0xF6): the omitted permitted / excluded / reasons / cRLIssuer field.
+function _isCborNull(node) { return node.majorType === 7 && node.ai === 22; }
+
+// A CBOR text node -> the IA5String content octets of an IMPLICIT [n] GeneralName (rfc822Name/dNSName/URI).
+// IA5String is 7-bit ASCII, so a code point > 0x7f cannot be one; a control byte (C0/DEL) is an injection
+// vector (CVE-2009-2408) the shared name guard rejects -- matching the pkix.generalName decode side, so a
+// value it rejects also fails the reconstruction direction (no round-trip guard runs on decode).
+function _ia5Bytes(node, tag) {
+  if (node.majorType !== 3) throw _err("c509/bad-extensions", "a GeneralName [" + tag + "] value must be a CBOR text string (IA5String)");
+  var s = cbor.read.textString(node);
+  // An empty IA5 GeneralName is rejected by the shared pkix.generalName leaf (a non-empty rfc822Name /
+  // dNSName / URI), so reject it on the reconstruction side too rather than emit an empty [n] IA5String.
+  if (s.length === 0) throw _err("c509/bad-extensions", "a GeneralName [" + tag + "] IA5String must be non-empty");
+  for (var i = 0; i < s.length; i++) { if (s.charCodeAt(i) > 0x7f) throw _err("c509/bad-extensions", "a GeneralName [" + tag + "] IA5String has a non-ASCII code point"); }
+  var buf = Buffer.from(s, "latin1");
+  guard.name.assertPrintableIa5(buf, _err, "c509/bad-extensions", "GeneralName [" + tag + "]");
+  return buf;
+}
+
+// A named-bit-list value (bit i -> named bit i, MSB-first; the 9-bit keyUsage / ReasonFlags range) -> the
+// DER BIT STRING content { unusedBits, bytes }, or null when the value is outside the 9 defined bits.
+function _namedBitsToContent(value) {
+  if (!Number.isInteger(value) || value <= 0 || value > 0x1ff) return null;
+  var hi = 0; for (var t = value; t; t >>= 1) hi++; hi -= 1;   // highest set bit index
+  var buf = Buffer.alloc((hi >> 3) + 1);
+  for (var bit = 0; bit <= hi; bit++) { if (value & (1 << bit)) buf[bit >> 3] |= 0x80 >> (bit & 7); }
+  return { unusedBits: 7 - (hi & 7), bytes: buf };
+}
+// The inverse: a DER BIT STRING content -> the named-bit value (bit i -> 2^i), or null when out of range.
+function _namedBitsFromContent(bytes, unusedBits) {
+  var total = bytes.length * 8 - unusedBits, value = 0;
+  for (var bit = 0; bit < total && bit < 31; bit++) { if (bytes[bit >> 3] & (0x80 >> (bit & 7))) value |= (1 << bit); }
+  return value > 0 && value <= 0x1ff ? value : null;
+}
+
+// One C509 (int, value) general name -> one DER GeneralName TLV. `ipMode` (name-constraints subtree base)
+// only changes the iPAddress arm: SAN is a bare 4/16-octet address, a subtree base is the RFC 9549 form.
+function _generalNameToDer(intVal, valueNode, ipMode) {
+  if (intVal === 1 || intVal === 2 || intVal === 6) return b.contextPrimitive(intVal, _ia5Bytes(valueNode, intVal));   // IMPLICIT IA5String
+  if (intVal === 4) return b.explicit(4, _reconName(_name509(valueNode, true)));                                       // directoryName [4] EXPLICIT Name
+  if (intVal === 7) return b.contextPrimitive(7, ipMode ? _ncIpToDer(valueNode) : _sanIpBytes(valueNode));             // iPAddress [7] IMPLICIT OCTET STRING
+  if (intVal === 8) return b.contextPrimitive(8, asn1.encodeOidContent(_oidName(valueNode, "c509/bad-extensions", "a registeredID [8]").oid));  // registeredID [8] IMPLICIT OID
+  if (intVal === 0 || intVal === -1 || intVal === -2 || intVal === -3) return _otherNameToDer(valueNode, intVal);      // otherName [0]
+  throw _err("c509/bad-extensions", "GeneralName int " + intVal + " has no C509 sec. 8.13 registry row");
+}
+// The DER GeneralName leaf result { tagNumber, value, bytes } -> a [intCbor, valueCbor] pair, or null when
+// the name is not compact-representable (x400Address [3] / ediPartyName [5], a directoryName the compact
+// Name codec cannot hold, a non-canonical name-constraints IP mask).
+function _generalNameFromDer(gn, ipMode) {
+  var t = gn.tagNumber;
+  if (t === 1 || t === 2 || t === 6) return [cbor.build.int(BigInt(t)), cbor.build.textString(gn.value)];
+  if (t === 4) { var nm = _dirNameToCbor(gn.bytes); return nm == null ? null : [cbor.build.int(4n), nm]; }
+  if (t === 7) {
+    if (!ipMode) return [cbor.build.int(7n), cbor.build.byteString(gn.value)];
+    var ip = _ncIpFromDer(gn.value); return ip == null ? null : [cbor.build.int(7n), cbor.build.byteString(ip)];
+  }
+  if (t === 8) return [cbor.build.int(8n), _oidCbor(gn.value)];
+  if (t === 0) return _otherNameFromDer(gn.value);
+  return null;   // tags 3 / 5 (x400Address / ediPartyName) -- no sec. 8.13 registry row
+}
+
+// A flat CBOR array [int, value, int, value, ...] -> the list of DER GeneralName TLVs (the caller wraps
+// them: a universal SEQUENCE for SAN/IAN, an implicit [n] for AKI issuer / DP cRLIssuer). These are always
+// SAN-form (the RFC 9549 subtree-base iPAddress form is name-constraints-only and routes through
+// _subtreesToDer / _subtreesFromDer, which call the singular codec with ipMode directly).
+function _generalNamesToDer(node) {
+  if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a GeneralNames value must be a CBOR array");
+  var kids = node.children;
+  if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a GeneralNames array must be non-empty (int, value) pairs (sec. 3.3)");
+  var out = [];
+  for (var i = 0; i + 1 < kids.length; i += 2) out.push(_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralName type")), kids[i + 1], false));
+  return out;
+}
+// The inverse: a list of DER GeneralName nodes -> the flat CBOR items, or null if ANY member is not
+// compact-representable (the whole enclosing extension then falls back -- never a partial GeneralNames).
+function _generalNamesFromDer(gnNodes) {
+  var out = [];
+  for (var i = 0; i < gnNodes.length; i++) {
+    var pair = _generalNameFromDer(schema.walk(GN_LEAF, gnNodes[i], NS), false);
+    if (pair == null) return null;
+    out.push(pair[0]); out.push(pair[1]);
+  }
+  return out;
+}
+
+// otherName [0] IMPLICIT SEQUENCE { type-id OBJECT IDENTIFIER, value [0] EXPLICIT ANY } -- the context tag
+// REPLACES the SEQUENCE tag (RFC 5280 IMPLICIT tagging), so the [0] node holds type-id then value directly
+// (no inner universal SEQUENCE). The generic form (C509 int 0) carries [ ~oid(type-id), bytes(the [0]
+// EXPLICIT inner value's raw TLV) ]; the id-on specials (-1/-2/-3) carry the RFC 4108 / RFC 9598 /
+// lamps-macaddress value shapes and reconstruct the full OtherName.
+function _otherNameToDer(node, intVal) {
+  var typeId, inner;
+  if (intVal === 0) {
+    if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a generic otherName value must be a CBOR [ ~oid, bytes ] pair");
+    typeId = _oidName(node.children[0], "c509/bad-extensions", "an otherName type-id").oid;
+    if (node.children[1].majorType !== 2) throw _err("c509/bad-extensions", "an otherName value must be a CBOR byte string (the [0] EXPLICIT inner TLV)");
+    inner = node.children[1].content;
+    try { asn1.decode(inner); } catch (e) { throw _err("c509/bad-extensions", "an otherName value is not a single well-formed DER element", e); }
+  } else if (intVal === -1) {   // id-on-hardwareModuleName: [ ~oid(hwType), bytes(hwSerialNum) ] -> HardwareModuleName
+    if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "an id-on-hardwareModuleName value must be a CBOR [ ~oid, bytes ] pair");
+    if (node.children[1].majorType !== 2) throw _err("c509/bad-extensions", "a hardwareModuleName hwSerialNum must be a CBOR byte string");
+    typeId = oid.byName("hardwareModuleName");
+    inner = b.sequence([b.oid(_oidName(node.children[0], "c509/bad-extensions", "a hardwareModuleName hwType").oid), b.octetString(node.children[1].content)]);
+  } else if (intVal === -2) {   // id-on-SmtpUTF8Mailbox: text -> UTF8String (RFC 9598 SIZE (1..MAX))
+    if (node.majorType !== 3) throw _err("c509/bad-extensions", "an id-on-SmtpUTF8Mailbox value must be a CBOR text string");
+    var smtp = cbor.read.textString(node);
+    if (smtp.length === 0) throw _err("c509/bad-extensions", "an id-on-SmtpUTF8Mailbox value must be non-empty (RFC 9598 SIZE (1..MAX))");
+    typeId = oid.byName("smtpUtf8Mailbox");
+    inner = b.utf8(smtp);
+  } else {   // intVal === -3, id-on-MACAddress: bytes (6 = EUI-48, 8 = EUI-64) -> OCTET STRING
+    if (node.majorType !== 2) throw _err("c509/bad-extensions", "an id-on-MACAddress value must be a CBOR byte string");
+    if (node.content.length !== 6 && node.content.length !== 8) throw _err("c509/bad-extensions", "an id-on-MACAddress value must be 6 (EUI-48) or 8 (EUI-64) octets");
+    typeId = oid.byName("macAddress");
+    inner = b.octetString(node.content);
+  }
+  return b.contextConstructed(0, Buffer.concat([b.oid(typeId), b.explicit(0, inner)]));   // [0] IMPLICIT SEQUENCE
+}
+// The inverse: the pkix.generalName otherName value { typeId, valueBytes } -> a [intCbor, valueCbor] pair,
+// or null when an id-on special's inner value is not its RFC-defined shape (the extension then falls back).
+function _otherNameFromDer(v) {
+  var onInt = ON_INT_BY_OID[v.typeId];
+  if (onInt === undefined) return [cbor.build.int(0n), cbor.build.array([_oidCbor(v.typeId), cbor.build.byteString(v.valueBytes)])];
+  var inner;
+  try { inner = asn1.decode(v.valueBytes); } catch (_e) { return null; }
+  if (onInt === -1) {   // HardwareModuleName ::= SEQUENCE { hwType OID, hwSerialNum OCTET STRING } (RFC 4108)
+    if (inner.tagClass !== "universal" || inner.tagNumber !== asn1.TAGS.SEQUENCE || !inner.children || inner.children.length !== 2) return null;
+    var hwType, hwSerial;
+    try { hwType = asn1.read.oid(inner.children[0]); hwSerial = asn1.read.octetString(inner.children[1]); } catch (_e2) { return null; }
+    return [cbor.build.int(-1n), cbor.build.array([_oidCbor(hwType), cbor.build.byteString(hwSerial)])];
+  }
+  if (onInt === -2) {   // SmtpUTF8Mailbox ::= UTF8String (RFC 9598)
+    if (inner.tagClass !== "universal" || inner.tagNumber !== asn1.TAGS.UTF8_STRING) return null;
+    var txt; try { txt = asn1.read.string(inner); } catch (_e3) { return null; }
+    return [cbor.build.int(-2n), cbor.build.textString(txt)];
+  }
+  if (inner.tagClass !== "universal" || inner.tagNumber !== asn1.TAGS.OCTET_STRING) return null;   // onInt === -3: MACAddress ::= OCTET STRING
+  var mac; try { mac = asn1.read.octetString(inner); } catch (_e4) { return null; }
+  // nosemgrep: pki-non-constant-time-secret-compare -- mac is a PUBLIC hardware MAC address (an EUI-48/64
+  // identifier, RFC 9542 / lamps-macaddress), not a MAC / HMAC / auth tag / secret; this is a length check.
+  if (mac.length !== 6 && mac.length !== 8) return null;
+  return [cbor.build.int(-3n), cbor.build.byteString(mac)];
+}
+
+// directoryName [4] EXPLICIT Name (a CHOICE, hence EXPLICIT) <-> the C509 compact Name. Reuses the file's
+// Name codecs; a Name the compact form cannot hold (a multi-value RDN, an attribute outside sec. 8.6)
+// returns null so the whole extension falls back to ~oid + byte-string.
+function _dirNameToCbor(gnBytes) {
+  var node = asn1.decode(gnBytes);   // the [4]-tagged EXPLICIT wrapper
+  if (!node.children || node.children.length !== 1) return null;
+  var name;
+  try { name = _c509NameFromDer(node.children[0].bytes); } catch (_e) { return null; }
+  try { return _encName(name, true); } catch (_e2) { return null; }
+}
+
+// iPAddress [7] (SAN form): a bare 4-octet (IPv4) or 16-octet (IPv6) address, CBOR bytes <-> DER content.
+function _sanIpBytes(node) {
+  if (node.majorType !== 2) throw _err("c509/bad-extensions", "an iPAddress value must be a CBOR byte string");
+  if (node.content.length !== 4 && node.content.length !== 16) throw _err("c509/bad-extensions", "an iPAddress must be 4 (IPv4) or 16 (IPv6) octets");
+  return node.content;
+}
+// iPAddress [7] (name-constraints subtree base): RFC 9549 sec. 2.2. CBOR is address || prefix-length (5 or
+// 17 octets, the last octet the prefix bit count); DER is address || mask (8 or 32 octets). CBOR -> DER
+// expands the prefix length to a contiguous mask.
+function _ncIpToDer(node) {
+  if (node.majorType !== 2) throw _err("c509/bad-extensions", "a name-constraints iPAddress value must be a CBOR byte string");
+  var buf = node.content, addrLen;
+  if (buf.length === 5) addrLen = 4; else if (buf.length === 17) addrLen = 16;
+  else throw _err("c509/bad-extensions", "a name-constraints iPAddress must be 5 (IPv4) or 17 (IPv6) octets (address + prefix length; RFC 9549 sec. 2.2)");
+  var prefixLen = buf[addrLen], maxBits = addrLen * 8;
+  if (prefixLen > maxBits) throw _err("c509/bad-extensions", "a name-constraints iPAddress prefix length " + prefixLen + " exceeds " + maxBits);
+  var mask = Buffer.alloc(addrLen);
+  for (var bit = 0; bit < prefixLen; bit++) mask[bit >> 3] |= 0x80 >> (bit & 7);
+  return Buffer.concat([buf.subarray(0, addrLen), mask]);
+}
+// DER -> CBOR: address || mask (8/32) -> address || prefix-length (5/17). The mask MUST be a canonical
+// contiguous prefix mask (N leading 1-bits then all 0-bits); a non-prefix mask (host bits set,
+// non-contiguous) is not representable in the prefix form -> null (the extension falls back, losing no bits).
+function _ncIpFromDer(buf) {
+  var addrLen = buf.length >> 1, mask = buf.subarray(addrLen), prefixLen = 0, seenZero = false;
+  for (var i = 0; i < mask.length; i++) {
+    for (var bit = 0; bit < 8; bit++) {
+      if (mask[i] & (0x80 >> bit)) { if (seenZero) return null; prefixLen++; }
+      else seenZero = true;
+    }
+  }
+  return Buffer.concat([buf.subarray(0, addrLen), Buffer.from([prefixLen])]);
+}
+
+// GeneralSubtrees = [ + GeneralName ] (the flat int/value array) <-> the concatenated GeneralSubtree
+// SEQUENCEs (RFC 5280 sec. 4.2.1.10: SEQUENCE { base, minimum [0] DEFAULT 0, maximum [1] OPTIONAL }); the
+// C509 profile omits minimum/maximum, so each GeneralSubtree is base-only.
+function _subtreesToDer(node) {
+  if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a GeneralSubtrees value must be a CBOR array");
+  var kids = node.children;
+  if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a GeneralSubtrees array must be non-empty (int, value) pairs");
+  var out = [];
+  for (var i = 0; i + 1 < kids.length; i += 2) out.push(b.sequence([_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralSubtree base type")), kids[i + 1], true)]));
+  return Buffer.concat(out);
+}
+function _subtreesFromDer(subtreeNodes) {
+  if (!subtreeNodes.length) return null;
+  var out = [];
+  for (var i = 0; i < subtreeNodes.length; i++) {
+    var st = subtreeNodes[i];
+    if (st.tagClass !== "universal" || st.tagNumber !== asn1.TAGS.SEQUENCE || !st.children || st.children.length !== 1) return null;   // base only (minimum/maximum omitted)
+    var pair = _generalNameFromDer(schema.walk(GN_LEAF_SUBTREE, st.children[0], NS), true);
+    if (pair == null) return null;
+    out.push(pair[0]); out.push(pair[1]);
+  }
+  return out;
+}
+
+// A CBOR accessMethod (int, sec. 8.11 registry, or ~oid) -> the dotted access-method OID.
+function _accessMethodOid(node) {
+  if (node.majorType === 0 || node.majorType === 1) {
+    var i = Number(cbor.read.int(node)), nm = IA_BY_INT[i];
+    if (nm === undefined) throw _err("c509/bad-extensions", "an accessMethod int " + i + " has no C509 sec. 8.11 registry row");
+    return oid.byName(nm);
+  }
+  return _oidName(node, "c509/bad-extensions", "an accessMethod").oid;
+}
+// A reasons uint (bit i -> named ReasonFlags bit i) -> the [1] IMPLICIT ReasonFlags BIT STRING TLV.
+function _reasonsBitsToDer(value) {
+  // ReasonFlags bit 0 is reserved "unused" (RFC 5280 sec. 4.2.1.13; the reason bits are 1..8), so a value
+  // that sets it is not a valid ReasonFlags even though the shared 9-bit range check would accept it. Bit 0
+  // is a legitimate keyUsage bit (digitalSignature), so this reason-specific reject lives here, not in the
+  // shared named-bit helper -- a malformed native C509 reasons value fails closed rather than reconstructing
+  // a semantically invalid X.509 ReasonFlags.
+  if ((value & 1) !== 0) throw _err("c509/bad-extensions", "a cRLDistributionPoints reasons value must not set the reserved unused ReasonFlags bit 0 (RFC 5280 sec. 4.2.1.13)");
+  var c = _namedBitsToContent(value);
+  if (c == null) throw _err("c509/bad-extensions", "a cRLDistributionPoints reasons value must be within the 9 defined ReasonFlags bits");
+  return b.contextPrimitive(1, Buffer.concat([Buffer.from([c.unusedBits]), c.bytes]));
+}
+// A CBOR ~biguint serial node -> the DER INTEGER content octets (minimal two's-complement of the
+// non-negative serial): the bare magnitude, prefixed with a 0x00 sign octet when its top bit is set.
+function _serialIntContent(node) {
+  var mag = _minBytes(_biguint(node, "c509/bad-extensions", "an authorityKeyIdentifier serial"));
+  if (mag.length === 0) return Buffer.from([0x00]);                                     // serial 0
+  return (mag[0] & 0x80) ? Buffer.concat([Buffer.from([0x00]), mag]) : mag;
+}
+
+// One CBOR DistributionPointName [ fullName, reasons, cRLIssuer ] -> one DER DistributionPoint SEQUENCE.
+// distributionPoint [0] is EXPLICIT (it wraps the DistributionPointName CHOICE); fullName [0], reasons [1],
+// cRLIssuer [2] are IMPLICIT (RFC 5280 sec. 4.2.1.13) -- mixing these is the classic byte-exactness trap.
+function _dpToDer(dpNode) {
+  if (dpNode.majorType !== 4 || !dpNode.children || dpNode.children.length !== 3) throw _err("c509/bad-extensions", "a DistributionPoint must be a CBOR [ fullName, reasons, cRLIssuer ] array");
+  var fullName = dpNode.children[0], reasons = dpNode.children[1], crlIssuer = dpNode.children[2];
+  var uris;
+  if (fullName.majorType === 3) uris = [b.contextPrimitive(6, _ia5Bytes(fullName, 6))];
+  else if (fullName.majorType === 4 && fullName.children) {
+    if (fullName.children.length < 2) throw _err("c509/bad-extensions", "a DistributionPoint fullName array must hold 2 or more URIs (a single URI is a bare text; sec. 3.3)");
+    uris = fullName.children.map(function (u) { return b.contextPrimitive(6, _ia5Bytes(u, 6)); });
+  } else throw _err("c509/bad-extensions", "a DistributionPoint fullName must be a URI text or an array of URIs");
+  var fields = [b.explicit(0, b.contextConstructed(0, Buffer.concat(uris)))];   // distributionPoint [0] EXPLICIT { fullName [0] IMPLICIT GeneralNames }
+  if (!_isCborNull(reasons)) fields.push(_reasonsBitsToDer(Number(_cborUint(reasons, "cRLDistributionPoints reasons"))));
+  if (!_isCborNull(crlIssuer)) fields.push(b.contextConstructed(2, b.explicit(4, _reconName(_name509(crlIssuer, true)))));   // cRLIssuer [2] { [4] directoryName }
+  return b.sequence(fields);
+}
+// One DER DistributionPoint SEQUENCE -> the pieces for the CBOR DistributionPointName, or null when the DP
+// is not compact-representable (no fullName, a non-URI fullName member, a nameRelativeToCRLIssuer, or a
+// cRLIssuer that is not a single directoryName). oneUri is set when fullName is exactly one URI, so the
+// whole-extension bare-text shortcut can fire.
+function _dpFromDer(dp) {
+  if (dp.tagClass !== "universal" || dp.tagNumber !== asn1.TAGS.SEQUENCE || !dp.children) return null;
+  var fullNameUris = null, reasonsVal = null, crlIssuerCbor = null, lastTag = -1;
+  for (var i = 0; i < dp.children.length; i++) {
+    var f = dp.children[i];
+    if (f.tagClass !== "context" || f.tagNumber <= lastTag) return null;   // DER: unique + ascending
+    lastTag = f.tagNumber;
+    if (f.tagNumber === 0) {
+      if (!f.children || f.children.length !== 1) return null;
+      var dpn = f.children[0];
+      if (dpn.tagClass !== "context" || dpn.tagNumber !== 0 || !dpn.children || !dpn.children.length) return null;   // fullName [0] only
+      fullNameUris = [];
+      for (var j = 0; j < dpn.children.length; j++) {
+        var mm = dpn.children[j];
+        if (mm.tagClass !== "context" || mm.tagNumber !== 6) return null;   // non-URI fullName member
+        fullNameUris.push(schema.walk(GN_LEAF, mm, NS).value);
+      }
+    } else if (f.tagNumber === 1) {
+      var bs;
+      try { bs = asn1.read.bitStringImplicit(f, 1); } catch (_e) { return null; }
+      reasonsVal = _namedBitsFromContent(bs.bytes, bs.unusedBits);
+      if (reasonsVal == null) return null;
+    } else if (f.tagNumber === 2) {
+      if (!f.children || f.children.length !== 1) return null;
+      var ci = f.children[0];
+      if (ci.tagClass !== "context" || ci.tagNumber !== 4 || !ci.children || ci.children.length !== 1) return null;   // one directoryName
+      try { crlIssuerCbor = _encName(_c509NameFromDer(ci.children[0].bytes), true); } catch (_e2) { return null; }
+    } else return null;
+  }
+  if (fullNameUris == null) return null;   // C509 requires the fullName distributionPoint
+  var oneUri = fullNameUris.length === 1 ? fullNameUris[0] : null;
+  var fnCbor = oneUri != null ? cbor.build.textString(oneUri) : cbor.build.array(fullNameUris.map(function (u) { return cbor.build.textString(u); }));
+  return {
+    triple: cbor.build.array([fnCbor, reasonsVal == null ? cbor.build.nullValue() : cbor.build.uint(BigInt(reasonsVal)), crlIssuerCbor == null ? cbor.build.nullValue() : crlIssuerCbor]),
+    oneUri: oneUri, noReasons: reasonsVal == null, noIssuer: crlIssuerCbor == null,
+  };
+}
+
 // Decode a compact extension value (a decoded CBOR node) to the DER extnValue inner content. Fails closed
 // (c509/bad-extensions) on a CBOR shape the named extension does not define.
 function _extValueToDer(name, node) {
@@ -251,9 +606,17 @@ function _extValueToDer(name, node) {
       if (iv >= 0n) return b.sequence([b.boolean(true), b.integer(iv)]);      // cA true, pathLen
       throw _err("c509/bad-extensions", "a basicConstraints int " + iv + " is outside the -2/-1/pathLen range");
     }
-    case "authorityKeyIdentifier": // keyId-only bytes -> SEQUENCE { [0] IMPLICIT keyIdentifier }
-      if (node.majorType !== 2) throw _err("c509/bad-extensions", "an authorityKeyIdentifier value must be a CBOR byte string (keyId-only form; the 3-tuple form is not supported)");
-      return b.sequence([b.contextPrimitive(0, node.content)]);
+    case "authorityKeyIdentifier":   // keyId-only bytes, or [ keyId, authorityCertIssuer, serial ] (sec. 3.3)
+      if (node.majorType === 2) return b.sequence([b.contextPrimitive(0, node.content)]);
+      if (node.majorType === 4 && node.children && node.children.length === 3) {
+        if (node.children[0].majorType !== 2) throw _err("c509/bad-extensions", "an authorityKeyIdentifier keyIdentifier must be a CBOR byte string");
+        return b.sequence([
+          b.contextPrimitive(0, node.children[0].content),                                           // keyIdentifier [0] IMPLICIT OCTET STRING
+          b.contextConstructed(1, Buffer.concat(_generalNamesToDer(node.children[1]))),       // authorityCertIssuer [1] IMPLICIT GeneralNames
+          b.contextPrimitive(2, _serialIntContent(node.children[2])),                                // authorityCertSerialNumber [2] IMPLICIT INTEGER
+        ]);
+      }
+      throw _err("c509/bad-extensions", "an authorityKeyIdentifier value must be a keyId byte string or the [ keyId, authorityCertIssuer, serial ] array (sec. 3.3)");
     case "extKeyUsage": {          // [2* KeyPurposeId] / KeyPurposeId -> SEQUENCE OF OID (draft-20 sec. 3.3)
       var items;
       if (node.majorType === 4) {
@@ -273,6 +636,32 @@ function _extValueToDer(name, node) {
       if (node.majorType !== 4) throw _err("c509/bad-extensions", "a tlsFeature value must be a CBOR array");
       return b.sequence((node.children || []).map(function (f) { return b.integer(_cborUint(f, "tlsFeature feature")); }));
     }
+    case "subjectAltName":
+    case "issuerAltName":          // SubjectAltName = GeneralNames / text (exactly one dNSName -> bare text)
+      if (node.majorType === 3) return b.sequence([b.contextPrimitive(2, _ia5Bytes(node, 2))]);
+      return b.sequence(_generalNamesToDer(node));
+    case "nameConstraints": {      // [ permittedSubtrees / null, excludedSubtrees / null ]
+      if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a nameConstraints value must be a 2-element CBOR array [ permitted, excluded ] (sec. 3.3)");
+      var ncFields = [];
+      if (!_isCborNull(node.children[0])) ncFields.push(b.contextConstructed(0, _subtreesToDer(node.children[0])));   // permittedSubtrees [0]
+      if (!_isCborNull(node.children[1])) ncFields.push(b.contextConstructed(1, _subtreesToDer(node.children[1])));   // excludedSubtrees [1]
+      if (ncFields.length === 0) throw _err("c509/bad-extensions", "nameConstraints must contain permittedSubtrees or excludedSubtrees (RFC 5280 sec. 4.2.1.10)");
+      return b.sequence(ncFields);
+    }
+    case "authorityInfoAccess":
+    case "subjectInfoAccess": {    // [ accessMethod, uri, ... ] -> SEQUENCE OF AccessDescription { OID, [6] URI }
+      if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "an " + name + " value must be a CBOR array");
+      var aiaKids = node.children;
+      if (aiaKids.length === 0 || aiaKids.length % 2 !== 0) throw _err("c509/bad-extensions", "an " + name + " array must be non-empty (accessMethod, uri) pairs (sec. 3.3)");
+      var descs = [];
+      for (var ai = 0; ai + 1 < aiaKids.length; ai += 2) descs.push(b.sequence([b.oid(_accessMethodOid(aiaKids[ai])), b.contextPrimitive(6, _ia5Bytes(aiaKids[ai + 1], 6))]));
+      return b.sequence(descs);
+    }
+    case "cRLDistributionPoints":
+    case "freshestCRL":            // [ + DistributionPointName ] / text (one DP, one-URI fullName -> bare text)
+      if (node.majorType === 3) return b.sequence([b.sequence([b.explicit(0, b.contextConstructed(0, b.contextPrimitive(6, _ia5Bytes(node, 6))))])]);
+      if (node.majorType !== 4 || !node.children || node.children.length < 1) throw _err("c509/bad-extensions", "a " + name + " value must be a CBOR array of DistributionPoints or a bare URI text (sec. 3.3)");
+      return b.sequence(node.children.map(function (dp) { return _dpToDer(dp); }));
     default:
       throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
   }
@@ -303,10 +692,22 @@ function _extValueFromDer(name, der) {
       if (kids.length !== 2) return null;
       return cbor.build.uint(asn1.read.integer(kids[1]));           // pathLen (>= 0; a negative INTEGER throws -> fall back)
     }
-    case "authorityKeyIdentifier": {                               // SEQUENCE { [0] keyId } -> the bare key id
+    case "authorityKeyIdentifier": {                               // SEQUENCE { [0] keyId } or the 3-tuple form
       var akids = node.children || [];
-      if (akids.length !== 1 || akids[0].tagNumber !== 0) return null;   // 3-tuple / other forms fall back
-      return cbor.build.byteString(akids[0].content);
+      if (akids.length === 1 && akids[0].tagClass === "context" && akids[0].tagNumber === 0) {
+        return cbor.build.byteString(asn1.read.octetStringImplicit(akids[0], 0));   // keyId-only
+      }
+      // the [ keyIdentifier [0], authorityCertIssuer [1], authorityCertSerialNumber [2] ] all-three form.
+      if (akids.length === 3 && akids[0].tagClass === "context" && akids[0].tagNumber === 0 &&
+          akids[1].tagClass === "context" && akids[1].tagNumber === 1 && akids[1].children &&
+          akids[2].tagClass === "context" && akids[2].tagNumber === 2) {
+        var akiIssuer = _generalNamesFromDer(akids[1].children);
+        if (akiIssuer == null) return null;
+        var akiSerial = asn1.read.integerImplicit(akids[2], 2);
+        if (akiSerial < 0n) return null;   // C509 authorityCertSerialNumber is a non-negative ~biguint
+        return cbor.build.array([cbor.build.byteString(asn1.read.octetStringImplicit(akids[0], 0)), cbor.build.array(akiIssuer), cbor.build.byteString(_minBytes(akiSerial))]);
+      }
+      return null;   // keyId+serial-without-issuer / issuer-only / other combinations fall back to ~oid
     }
     case "extKeyUsage": {                                          // SEQUENCE OF OID -> [int/~oid ...] / single
       var purposes = node.children || [];
@@ -324,6 +725,56 @@ function _extValueFromDer(name, der) {
       return cbor.build.nullValue();
     case "tlsFeature":                                             // SEQUENCE OF INTEGER -> [uint ...]
       return cbor.build.array((node.children || []).map(function (f) { return cbor.build.uint(asn1.read.integer(f)); }));
+    case "subjectAltName":
+    case "issuerAltName": {                                        // SEQUENCE OF GeneralName -> flat array / dNSName text
+      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
+      var sanMembers = node.children;
+      if (sanMembers.length === 1 && sanMembers[0].tagClass === "context" && sanMembers[0].tagNumber === 2) {
+        return cbor.build.textString(schema.walk(GN_LEAF, sanMembers[0], NS).value);   // exactly one dNSName -> bare text
+      }
+      var sanItems = _generalNamesFromDer(sanMembers);
+      return sanItems == null ? null : cbor.build.array(sanItems);
+    }
+    case "nameConstraints": {                                      // SEQUENCE { [0] permitted?, [1] excluded? } -> [perm, excl]
+      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
+      var permCbor = cbor.build.nullValue(), exclCbor = cbor.build.nullValue(), sawNc = false, ncLast = -1;
+      for (var nci = 0; nci < node.children.length; nci++) {
+        var ncf = node.children[nci];
+        if (ncf.tagClass !== "context" || ncf.tagNumber <= ncLast) return null;   // DER: unique + ascending
+        ncLast = ncf.tagNumber;
+        var subItems = _subtreesFromDer(ncf.children || []);
+        if (subItems == null) return null;
+        if (ncf.tagNumber === 0) { permCbor = cbor.build.array(subItems); sawNc = true; }
+        else if (ncf.tagNumber === 1) { exclCbor = cbor.build.array(subItems); sawNc = true; }
+        else return null;
+      }
+      return sawNc ? cbor.build.array([permCbor, exclCbor]) : null;
+    }
+    case "authorityInfoAccess":
+    case "subjectInfoAccess": {                                    // SEQUENCE OF AccessDescription -> [method, uri, ...]
+      var aiaDescs = node.children || [];
+      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || aiaDescs.length < 1) return null;
+      var aiaOut = [];
+      for (var adi = 0; adi < aiaDescs.length; adi++) {
+        var d = aiaDescs[adi];
+        if (d.tagClass !== "universal" || d.tagNumber !== asn1.TAGS.SEQUENCE || !d.children || d.children.length !== 2) return null;
+        var aiaLoc = d.children[1];
+        if (aiaLoc.tagClass !== "context" || aiaLoc.tagNumber !== 6) return null;   // the compact form is URI-only
+        var methodDotted = asn1.read.oid(d.children[0]), mint = IA_TO_INT[methodDotted];
+        aiaOut.push(mint !== undefined ? cbor.build.int(BigInt(mint)) : _oidCbor(methodDotted));
+        aiaOut.push(cbor.build.textString(schema.walk(GN_LEAF, aiaLoc, NS).value));
+      }
+      return cbor.build.array(aiaOut);
+    }
+    case "cRLDistributionPoints":
+    case "freshestCRL": {                                          // SEQUENCE OF DistributionPoint -> array / bare URI text
+      var dps = node.children || [];
+      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || dps.length < 1) return null;
+      var dpResults = [];
+      for (var dpi = 0; dpi < dps.length; dpi++) { var dpr = _dpFromDer(dps[dpi]); if (dpr == null) return null; dpResults.push(dpr); }
+      if (dpResults.length === 1 && dpResults[0].oneUri != null && dpResults[0].noReasons && dpResults[0].noIssuer) return cbor.build.textString(dpResults[0].oneUri);
+      return cbor.build.array(dpResults.map(function (r) { return r.triple; }));
+    }
     default:
       return null;
   }
@@ -334,12 +785,21 @@ function _extValueFromDer(name, der) {
 
 // Encode-side guard: emit the compact value only when it decodes back to the EXACT DER extnValue, so a
 // non-canonical or unrepresentable value can never produce a lossy compact form (it falls back to ~oid).
-// _extValueToDer is the exact inverse of _extValueFromDer, so the round-trip decode does not throw here;
-// the guard is the byte comparison (a canonical-equivalent DER differs and falls back).
+// A value _extValueFromDer produced but _extValueToDer cannot reconstruct -- an empty GeneralNames the DER
+// builder rejects (an AKI authorityCertIssuer [1] with no members), or any future codec asymmetry -- is
+// NOT compact-representable: the round-trip reconstruction throwing is treated identically to a byte
+// mismatch, so encode() falls back to the ~oid form rather than raising on a certificate x509.parse
+// accepts. The final encode() self-verify still gates byte-exactness end to end.
 function _tryCompactExtValue(name, der) {
   var compact = _extValueFromDer(name, der);
   if (compact == null) return null;
-  return _extValueToDer(name, cbor.decode(compact)).equals(der) ? compact : null;
+  var recon;
+  try {
+    recon = _extValueToDer(name, cbor.decode(compact));
+  } catch (_e) {
+    return null;
+  }
+  return recon.equals(der) ? compact : null;
 }
 
 // extensions (sec. 3.1.10/sec. 3.3/sec. 8.8): [ * Extension ] | a single keyUsage int-shortcut.
@@ -469,18 +929,13 @@ function _reconSpki(spkAlg, keyBytes, rsaKey) {
 }
 
 // The keyUsage int value -> the DER KeyUsage BIT STRING (RFC 5280 sec. 4.2.1.3): bit i of the value ->
-// BIT STRING named bit i (bit 0 = digitalSignature = the MSB of the first content octet).
+// BIT STRING named bit i (bit 0 = digitalSignature = the MSB of the first content octet). Composes the
+// shared named-bit content builder (also used by the cRLDistributionPoints reasons transform); a
+// non-positive, non-integer, or > 0x1FF value is not a valid KeyUsage and fails closed.
 function _reconKeyUsageBits(value) {
-  // The keyUsage value indexes the 9 named bits of RFC 5280 sec. 4.2.1.3 (digitalSignature..decipherOnly);
-  // a non-positive, non-integer, or > 0x1FF value is not a valid KeyUsage and would also corrupt the
-  // 32-bit bitwise re-encoding below (a value past 2^31 wraps). Fail closed before the bit walk.
-  if (!Number.isInteger(value) || value <= 0 || value > 0x1ff) throw _err("c509/non-invertible", "a keyUsage value must be a positive integer within the 9 defined bits");
-  var hi = 0; for (var t = value; t; t >>= 1) hi++;   // number of significant bits
-  hi -= 1;                                             // highest set bit index
-  var nbytes = (hi >> 3) + 1;
-  var buf = Buffer.alloc(nbytes);
-  for (var bit = 0; bit <= hi; bit++) { if (value & (1 << bit)) buf[bit >> 3] |= 0x80 >> (bit & 7); }
-  return b.bitString(buf, 7 - (hi & 7));
+  var c = _namedBitsToContent(value);
+  if (c == null) throw _err("c509/non-invertible", "a keyUsage value must be a positive integer within the 9 defined bits");
+  return b.bitString(c.bytes, c.unusedBits);
 }
 
 // extensions -> the [3] EXPLICIT SEQUENCE OF Extension DER.
@@ -855,6 +1310,7 @@ function _c509NameFromDer(nameBytes) {
   return { rdns: rdns };
 }
 // A keyUsage extnValue (a DER KeyUsage BIT STRING) -> the C509 integer whose bit i is the named bit i.
+// Composes the shared named-bit reader (also used by the cRLDistributionPoints reasons transform).
 function _keyUsageBitsFromDer(extnValue) {
   var bs;
   try {
@@ -862,9 +1318,7 @@ function _keyUsageBitsFromDer(extnValue) {
   } catch (_e) {
     return null;   // a malformed keyUsage BIT STRING cannot take the int shortcut -> encode it as a raw extension
   }
-  var total = bs.bytes.length * 8 - bs.unusedBits, value = 0;
-  for (var bit = 0; bit < total && bit < 31; bit++) { if (bs.bytes[bit >> 3] & (0x80 >> (bit & 7))) value |= (1 << bit); }
-  return value > 0 && value <= 0x1ff ? value : null;
+  return _namedBitsFromContent(bs.bytes, bs.unusedBits);
 }
 var _NO_EXPIRY = Date.UTC(9999, 11, 31, 23, 59, 59);
 // The C509 (OID/node) curve names <-> the WebCrypto namedCurve the P1363 converter expects, and the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.31",
+  "version": "0.3.32",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1d3e8266-55f8-442b-877c-abe084a62726",
+  "serialNumber": "urn:uuid:0d0e1498-d791-4209-890f-c1d837673a21",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-03T23:07:28.101Z",
+    "timestamp": "2026-08-05T23:30:49.498Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.31",
+      "bom-ref": "@blamejs/pki@0.3.32",
       "type": "application",
       "name": "pki",
-      "version": "0.3.31",
+      "version": "0.3.32",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.31",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.32",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.31",
+      "ref": "@blamejs/pki@0.3.32",
       "dependsOn": []
     }
   ]