@blamejs/pki 0.3.33 → 0.4.1

package/CHANGELOG.md

@@ -4,7 +4,38 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.3.33 — 2026-08-06
+## v0.4.1 — 2026-08-08
+
+pki.schema.c509 encodes and decodes the compact subjectDirectoryAttributes value form -- a C509 certificate's subject directory attributes ride their draft-20 registry integers (or unwrapped OIDs) with their directory-string values, interoperating with a conformant C509 implementation rather than only this decoder.
+
+### Added
+
+- pki.schema.c509 encodes and decodes the compact value form for the subjectDirectoryAttributes extension (draft-ietf-cose-cbor-encoded-cert-20 sec. 3.3): a flat array of (attribute type, attribute values) pairs where each type is a sec. 8.6 registry integer (the sign selecting the directory-string type) or an unwrapped OID, and each values slot is a non-empty array holding the attribute's SET of one or more values -- the string values for a registry-integer type, or the raw DER attribute values for an unwrapped-OID type. Both directions invert to the DER extnValue byte-for-byte, so a certificate carrying the extension is the specific compact shape a conformant C509 implementation reads rather than an opaque DER byte string. The encoder is guarded per attribute and per extension: an attribute whose value is not a directory string, or whose value SET mixes string types, uses the unwrapped-OID form for that attribute (keeping the rest of the extension compact); a value the compact form cannot represent falls the whole extension back to the unwrapped-OID byte-string form instead of encoding lossily; and a malformed compact value fails closed with a typed C509Error.
+- The OID registry gains the subjectDirectoryAttributes certificate-extension identifier (2.5.29.9), resolvable through pki.oid.byName / pki.oid.name.
+- The ASN.1 codec reads NumericString (pki.asn1.TAGS.NUMERIC_STRING), the X.520 syntax of the x121Address and internationalISDNNumber directory attributes. It is validated strictly like every other string type: a value outside the digits-and-space set the type permits is rejected as malformed rather than decoded.
+
+### Changed
+
+- A C509 certificate carrying subjectDirectoryAttributes now encodes to -- and decodes from -- its compact CBOR value shape rather than the unwrapped-OID byte-string form an earlier release emitted; both reconstruct the same DER, but the CBOR bytes differ, so re-encode any C509 produced by an earlier release.
+
+## v0.4.0 — 2026-08-06
+
+CRL issuance and verification, PKCS#12 build and open, attribute-certificate issuance, and the key-material lifecycle graduate to stable, and pki.schema.c509 adds the compact policyMappings and policyConstraints value forms -- a C509 certificate's policy mappings and policy constraints now ride their specific draft-20 CBOR shape and interoperate with a conformant C509 implementation rather than only this decoder.
+
+### Added
+
+- pki.schema.c509 encodes and decodes the compact value forms for the policyMappings and policyConstraints extensions (draft-ietf-cose-cbor-encoded-cert-20 sec. 3.3): a policy mapping's issuerDomainPolicy and subjectDomainPolicy each ride the sec. 8.9 registry-integer / unwrapped-OID policy space the certificatePolicies extension uses (a policy mapping to or from the special anyPolicy is preserved, matching what a certificate's own decoder accepts), and a policy constraints value rides the fixed two-element [requireExplicitPolicy, inhibitPolicyMapping] array, each field a non-negative skip count or absent. Both directions invert to the DER extnValue byte-for-byte, so a certificate carrying either extension is the specific compact shape a conformant C509 implementation reads rather than an opaque DER byte string. The encoder is guarded: a value the compact form cannot hold falls the whole extension back to the unwrapped-OID byte-string form instead of encoding lossily; a malformed compact value -- an empty or both-absent policy constraints, an odd-length or empty policy-mappings array, a policy mapping member that is not a two-policy pair, or an unregistered policy integer -- fails closed with a typed C509Error.
+
+### Changed
+
+- pki.crl.sign / verify / isRevoked (RFC 5280 sec. 5), pki.pkcs12.build / open / verifyMac (RFC 7292 / RFC 9579), pki.attrcert.sign (RFC 5755), and the key-material lifecycle pki.key.encrypt / decrypt / export / import / generate / publicFromPrivate (PKCS#8 / RFC 5958, RFC 8018) graduate from experimental to stable. Their governing standards are settled and each is proven against an independent implementation in the integration harness (OpenSSL), or for the attribute-certificate format through the toolkit's own conformance-vector round-trip plus coverage-guided fuzzing. They are now covered by the stability contract: a breaking change to any of them ships only after a prior deprecation cycle, never silently in a minor (the published LTS support window itself takes effect at v1.0).
+- A C509 certificate carrying policyMappings or policyConstraints now encodes to -- and decodes from -- its compact CBOR value shape rather than the unwrapped-OID byte-string form an earlier release emitted; both reconstruct the same DER, but the CBOR bytes differ, so re-encode any C509 produced by an earlier release.
+
+### Fixed
+
+- The C509 encoder now bounds the basicConstraints path length and the inhibitAnyPolicy and policyConstraints skip counts to the same non-negative 31-bit range the toolkit's own certificate decoders enforce. A native C509 carrying one of these counts past that range now fails closed with a typed C509Error rather than reconstructing a DER an X.509 decoder -- this toolkit's included -- would then reject.
+
+## v0.3.33 — 2026-08-05
 
 pki.schema.c509 encodes and decodes the compact certificatePolicies value form -- a C509 certificate's policy identifiers ride their draft-20 registry integers (or unwrapped OIDs) and their CPS-URI and UserNotice qualifiers ride the specific compact CBOR shape, interoperating with a conformant C509 implementation rather than only this decoder.
 

package/README.md

@@ -204,7 +204,7 @@ is callable today; nothing below is a stub.
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more), the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec, and certificate policies (registry-integer or OID policy identifiers with their CPS-URI and UserNotice qualifiers); a certificate outside the invertible set throws a typed `C509Error` |
+| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more), the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec, certificate policies (registry-integer or OID policy identifiers with their CPS-URI and UserNotice qualifiers), and policy mappings and policy constraints, and subject directory attributes; a certificate outside the invertible set throws a typed `C509Error` |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |

package/lib/asn1-der.js

@@ -66,6 +66,7 @@ var UNIVERSAL_TYPES = {
   UTF8_STRING:       { tag: 0x0c, form: "primitive" },
   SEQUENCE:          { tag: 0x10, form: "constructed" },
   SET:               { tag: 0x11, form: "constructed" },
+  NUMERIC_STRING:    { tag: 0x12, form: "primitive" },
   PRINTABLE_STRING:  { tag: 0x13, form: "primitive" },
   TELETEX_STRING:    { tag: 0x14, form: "primitive" },
   IA5_STRING:        { tag: 0x16, form: "primitive" },
@@ -95,7 +96,7 @@ var CONSTRUCTED_BIT   = 0x20;
 // constructed-capable set is DERIVED from the registry above and keyed by tag
 // for an O(1) decode-time form check. It is a WHITELIST: a universal tag
 // outside it -- a registered primitive type and an unregistered one
-// (NumericString, GeneralString, ObjectDescriptor, REAL, ...) alike -- has no
+// (GeneralString, ObjectDescriptor, REAL, ...) alike -- has no
 // DER constructed form, so the default is reject.
 var CONSTRUCTED_ONLY_UNIVERSAL_TAGS = Object.create(null);
 Object.keys(UNIVERSAL_TYPES).forEach(function (k) {
@@ -622,6 +623,15 @@ function _decodePrintable(buf) {
   return s;
 }
 
+// NumericString (X.680 sec. 41, Table 9) permits ONLY the digits and SPACE. It carries the X.520 syntax of
+// the x121Address and internationalISDNNumber directory attributes, so a value of this type must be readable
+// -- and strictly, since anything outside that alphabet is not a valid encoding of the type.
+function _decodeNumeric(buf) {
+  var s = buf.toString("latin1");
+  if (!NUMERIC_RE.test(s)) throw new Asn1Error("asn1/bad-numeric-string", "NumericString has characters outside the digits-and-space set");
+  return s;
+}
+
 // UTF8String must be well-formed UTF-8; a lenient decoder substitutes U+FFFD
 // for invalid sequences, silently mangling hostile input into valid text.
 function _decodeUtf8Strict(buf) {
@@ -637,6 +647,7 @@ function readString(node) {
   _expectPrimitive(node, "readString");
   switch (node.tagNumber) {
     case TAGS.UTF8_STRING:      return _decodeUtf8Strict(node.content);
+    case TAGS.NUMERIC_STRING:   return _decodeNumeric(node.content);
     case TAGS.PRINTABLE_STRING: return _decodePrintable(node.content);
     case TAGS.IA5_STRING:       return _decodeIa5(node.content);
     case TAGS.TELETEX_STRING:   return _decodeText(node.content, "latin1");
@@ -870,6 +881,7 @@ function encodeOidContent(dotted) {
 }
 
 var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
+var NUMERIC_RE = /^[0-9 ]*$/;
 
 function _fmtTwo(n) { return (n < 10 ? "0" : "") + n; }
 

package/lib/attrcert-sign.js

@@ -408,7 +408,7 @@ function _buildExtensions(extSpec, aaSpki) {
  * @primitive pki.attrcert.sign
  * @signature pki.attrcert.sign(spec, issuer, opts?) -> Promise<Buffer|string>
  * @since 0.3.2
- * @status experimental
+ * @status stable
  * @spec RFC 5755
  * @defends forged-attribute-certificate (CWE-347)
  * @related pki.schema.attrcert.parse, pki.x509.sign

package/lib/crl-sign.js

@@ -454,7 +454,7 @@ function _sign(spec, issuer, opts) {
  * @primitive pki.crl.sign
  * @signature pki.crl.sign(spec, issuer, opts?) -> Promise<Buffer|string>
  * @since 0.3.9
- * @status experimental
+ * @status stable
  * @spec RFC 5280 sec. 5, RFC 9882, RFC 9814
  * @defends crl-forgery (CWE-347)
  * @related pki.schema.crl.parse, pki.crl.verify, pki.path.crlChecker
@@ -510,7 +510,7 @@ function _resolveIssuerSpki(issuer) {
  * @primitive pki.crl.verify
  * @signature pki.crl.verify(crl, issuer) -> Promise<boolean>
  * @since 0.3.9
- * @status experimental
+ * @status stable
  * @spec RFC 5280 sec. 5.1.1.3, RFC 9814
  * @defends crl-signature-bypass (CWE-347)
  * @related pki.crl.sign, pki.path.crlChecker, pki.schema.crl.parse
@@ -549,7 +549,7 @@ function _serialHexOf(serial) {
  * @primitive pki.crl.isRevoked
  * @signature pki.crl.isRevoked(crl, serialNumber) -> entry | null
  * @since 0.3.9
- * @status experimental
+ * @status stable
  * @spec RFC 5280 sec. 5.1.2.6
  * @related pki.crl.verify, pki.schema.crl.parse
  *

package/lib/key.js

@@ -81,7 +81,7 @@ async function _toPrivateKeyDer(input) {
  * @primitive pki.key.encrypt
  * @signature pki.key.encrypt(privateKey, password, opts?) -> Promise<Buffer|string>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec RFC 5958 sec. 3, RFC 8018
  * @related pki.key.decrypt, pki.schema.pkcs8.parseEncrypted, pki.cms.encrypt
  *
@@ -132,7 +132,7 @@ async function encrypt(privateKey, password, opts) {
  * @primitive pki.key.decrypt
  * @signature pki.key.decrypt(encrypted, password, opts?) -> Promise<Buffer|string>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec RFC 5958 sec. 3, RFC 8018 sec. 6.2, RFC 8018 sec. 8
  * @defends pbes2-padding-oracle (CWE-208), pbkdf2-work-dos (CWE-400)
  * @related pki.key.encrypt, pki.schema.pkcs8.parse
@@ -187,7 +187,7 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
  * @primitive pki.key.export
  * @signature pki.key.export(key, opts?) -> Promise<Buffer|string>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec RFC 5958, RFC 5280 sec. 4.1.2.7, RFC 8410 sec. 3
  * @related pki.key.import, pki.key.publicFromPrivate, pki.schema.pkcs8.parse
  *
@@ -222,7 +222,7 @@ async function export_(key, opts) {
  * @primitive pki.key.import
  * @signature pki.key.import(input, opts?) -> Promise<CryptoKey>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec RFC 5958, RFC 5280 sec. 4.1.2.7, RFC 8018
  * @related pki.key.export, pki.key.decrypt
  *
@@ -265,7 +265,7 @@ async function import_(input, opts) {
  * @primitive pki.key.generate
  * @signature pki.key.generate(algorithm, opts?) -> Promise<{ privateKey, publicKey }>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec W3C WebCrypto, FIPS 203, FIPS 204
  * @related pki.key.export, pki.key.publicFromPrivate
  *
@@ -296,7 +296,7 @@ async function generate(algorithm, opts) {
  * @primitive pki.key.publicFromPrivate
  * @signature pki.key.publicFromPrivate(privateKey, opts?) -> Promise<Buffer|string>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec RFC 5280 sec. 4.1.2.7, RFC 8410 sec. 3
  * @related pki.key.export, pki.key.import
  *

package/lib/oid.js

@@ -60,6 +60,7 @@ var FAMILIES = {
 
   // RFC 5280 certificate extensions.
   certExtension: { base: [2, 5, 29], of: {
+    subjectDirectoryAttributes: 9,   // id-ce 9 (RFC 5280 sec. 4.2.1.8) -> 2.5.29.9
     subjectKeyIdentifier: 14, keyUsage: 15, subjectAltName: 17, issuerAltName: 18,
     basicConstraints: 19,
     // CRL + CRL-entry extensions (RFC 5280 sec. 5.2, sec. 5.3)

package/lib/pkcs12-build.js

@@ -403,7 +403,7 @@ function _normalizeSpec(spec, opts) {
  * @primitive pki.pkcs12.build
  * @signature pki.pkcs12.build(spec, opts?) -> Promise<Buffer|string>
  * @since 0.3.11
- * @status experimental
+ * @status stable
  * @spec RFC 7292, RFC 9579, RFC 8018
  * @related pki.schema.pkcs12.parse, pki.pkcs12.verifyMac
  *
@@ -468,7 +468,7 @@ async function build(spec, opts) {
  * @primitive pki.pkcs12.verifyMac
  * @signature pki.pkcs12.verifyMac(pfx, password, opts?) -> Promise<boolean>
  * @since 0.3.11
- * @status experimental
+ * @status stable
  * @spec RFC 7292 sec. 5.1, RFC 9579
  * @defends pkcs12-mac-forgery (CWE-347)
  * @related pki.pkcs12.build, pki.schema.pkcs12.parse
@@ -533,7 +533,7 @@ function _capWork(iterations, salt, opts, keyLength, hardCap) {
  * @primitive pki.pkcs12.open
  * @signature pki.pkcs12.open(pfx, password, opts?) -> Promise<OpenResult>
  * @since 0.3.12
- * @status experimental
+ * @status stable
  * @spec RFC 7292 sec. 5.1, RFC 9579, RFC 8018
  * @defends pkcs12-unauthenticated-decrypt (CWE-347), pbes2-padding-oracle (CWE-208)
  * @related pki.pkcs12.build, pki.pkcs12.verifyMac, pki.schema.pkcs12.parse

package/lib/schema-c509.js

@@ -57,10 +57,12 @@ var PK_ALG_BY_INT = {
 // EC curve -> field size in bytes (the SEC1 coordinate width), for point-length validation.
 var EC_FIELD_BYTES = { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 };
 
-// sec. 8.6 RDN attribute types (abs(int) -> name; the sign selects the X.509 string type). emailAddress
-// (int 0) is an IA5String value not covered by the DirectoryString SpecialText codec below, so it is
-// declined; a DN carrying it encodes via the ~oid attribute form, not this alias table.
+// sec. 8.6 RDN attribute types (abs(int) -> name; the sign selects the X.509 string type: positive utf8String,
+// negative printableString). An attribute whose value is ALWAYS an IA5String is instead "unambiguously
+// represented using a non-negative int" (draft sec. 3.1.4) -- emailAddress is int 0, so its value reconstructs
+// as an IA5String and its sign carries no string-type meaning.
 var ATTR_BY_INT = {
+  0: _name("emailAddress"),
   1: _name("commonName"),
   2: _name("surname"),
   3: _name("serialNumber"),
@@ -87,8 +89,11 @@ var EXT_BY_INT = {
   7: _name("authorityKeyIdentifier"),
   8: _name("extKeyUsage"),
   9: _name("authorityInfoAccess"),
+  24: _name("subjectDirectoryAttributes"),
   25: _name("issuerAltName"),
   26: _name("nameConstraints"),
+  27: _name("policyMappings"),
+  28: _name("policyConstraints"),
   29: _name("freshestCRL"),
   30: _name("inhibitAnyPolicy"),
   31: _name("subjectInfoAccess"),
@@ -102,6 +107,7 @@ var EXT_COMPACT = {
   extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
   subjectAltName: 1, issuerAltName: 1, nameConstraints: 1, cRLDistributionPoints: 1,
   freshestCRL: 1, authorityInfoAccess: 1, subjectInfoAccess: 1, certificatePolicies: 1,
+  policyMappings: 1, policyConstraints: 1, subjectDirectoryAttributes: 1,
 };
 // sec. 8.12 Extended Key Usages registry (C509 int -> registered id-kp purpose name). A KeyPurposeId
 // outside this set encodes as an unwrapped ~oid; a C509 int outside it fails closed on decode.
@@ -237,14 +243,36 @@ function _specialText(node) {
 
 // A single Name (sec. 3.1.4/sec. 3.1.6): the CBOR simple null (issuer only) | a bare SpecialText single
 // commonName | an array of RDNAttributes. Surfaces { dn, rdns, eui64? } shape-compatible with x509.
+// An rdn's (attribute type, sign) pair DECLARES an X.509 string type, so its text must be valid for that type --
+// a printableString sign over a non-PrintableString character, a non-ASCII emailAddress (IA5String-only), or a
+// value outside the type's SIZE. Assert it by running the SAME builder the reconstruction uses, so a Name this
+// parse accepts is always one it can rebuild, and a natively-signed certificate (which never reconstructs) is
+// held to the identical rule. Applied to BOTH Name forms -- the array form and the bare single-commonName form.
+// The builder's asn1/* fault is re-thrown in this module's domain rather than leaking onto the parse surface.
+function _assertAttrValue(rdn) {
+  try { _reconAttrValue(rdn); }
+  catch (e) {
+    if (e instanceof C509Error) throw e;
+    throw _err("c509/bad-name", "the " + rdn.type + " value is not valid for the string type its attribute integer declares", e);
+  }
+}
+
 function _name509(node, isSubject) {
   if (!isSubject && node.majorType === 7 && node.ai === 22) return null;   // issuer == subject (self-signed)
   // A bare SpecialText (not an array) is a single commonName attribute (attributeType == +1).
   if (node.majorType === 3 || node.majorType === 2 || node.majorType === 6) {
     var sv = _specialText(node);
-    if (sv.eui64) return { rdns: [{ type: "commonName", eui64: sv.eui64 }], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
+    // The bare form is a single commonName -- hold its value to the SAME rules the array form applies, so a
+    // natively-signed certificate (which never reconstructs) cannot carry a value the reconstruction would refuse.
+    if (sv.eui64) {
+      var euiRdn = { type: "commonName", eui64: sv.eui64 };
+      _assertAttrValue(euiRdn);
+      return { rdns: [euiRdn], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
+    }
     var val = sv.text !== undefined ? sv.text : sv.hex;
-    return { rdns: [{ type: "commonName", value: val }], dn: "CN=" + val };
+    var bareRdn = { type: "commonName", value: val };
+    _assertAttrValue(bareRdn);
+    return { rdns: [bareRdn], dn: "CN=" + val };
   }
   if (node.majorType !== 4) throw _err("c509/bad-name", "a C509 Name must be null, a SpecialText, or an array of RDN attributes");
   var rdns = [];
@@ -265,7 +293,13 @@ function _name509(node, isSubject) {
     if (tname === undefined) throw _err("c509/bad-name", "attribute type integer " + ti + " has no C509 registry row");
     var v = _specialText(kids[i + 1]);
     var vv = v.text !== undefined ? v.text : (v.hex !== undefined ? v.hex : _macToEui64String(v.eui64));
-    rdns.push({ type: tname, value: vv, printable: ti < 0 });
+    // The RENDERED text is what carries into the rdn -- deliberately NOT the raw eui64, because the EUI shortcut
+    // in _reconAttrValue is unconditional and would take precedence over the attribute's declared string type,
+    // rebuilding a tag-48 emailAddress or countryName as a UTF8String. Only the bare-SpecialText form above is
+    // always a commonName and may carry it; here the value is held to whatever type the attribute integer declares.
+    var rdn = { type: tname, value: vv, printable: ti < 0 };
+    _assertAttrValue(rdn);
+    rdns.push(rdn);
     parts.push(_shortName(tname) + "=" + vv);
   }
   return { rdns: rdns, dn: parts.join(",") };
@@ -289,6 +323,14 @@ function _cborIntVal(node, label) {
   if (node.majorType !== 0 && node.majorType !== 1) throw _err("c509/bad-extensions", "a " + label + " value must be a CBOR integer");
   return cbor.read.int(node);
 }
+// A non-negative reconstruct-side count (a policyConstraints / inhibitAnyPolicy SkipCerts, a basicConstraints
+// pathLenConstraint) narrowed to [0, 2^31-1] via the SAME guard.range.uint31 the toolkit's own DER decoders
+// (schema-pkix) bound these INTEGER (0..MAX) counts through. A native CBOR value past 2^31-1 fails closed here
+// rather than reconstructing a DER the toolkit's own decoder would then reject -- the reconstruct path must
+// produce nothing that decoder rejects. Returns a Number; b.integer narrows it to the minimal DER INTEGER.
+function _boundCount(value, label) {
+  return guard.range.uint31(value, _err, "c509/bad-extensions", label + " (0..2^31-1)");
+}
 // A C509 KeyPurposeId (int registry alias OR unwrapped ~oid) -> the dotted extended-key-usage OID.
 function _ekuPurposeOid(node) {
   if (node.majorType === 0 || node.majorType === 1) {
@@ -409,8 +451,8 @@ function _otherNameToDer(node, intVal) {
     if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a generic otherName value must be a CBOR [ ~oid, bytes ] pair");
     typeId = _oidName(node.children[0], "c509/bad-extensions", "an otherName type-id").oid;
     if (node.children[1].majorType !== 2) throw _err("c509/bad-extensions", "an otherName value must be a CBOR byte string (the [0] EXPLICIT inner TLV)");
-    inner = node.children[1].content;
-    try { asn1.decode(inner); } catch (e) { throw _err("c509/bad-extensions", "an otherName value is not a single well-formed DER element", e); }
+    // The [0] EXPLICIT inner TLV is an ANY spliced verbatim -- strict-validate it, not just its framing.
+    inner = _requireStrictDerTlv(node.children[1].content, "c509/bad-extensions", "an otherName value");
   } else if (intVal === -1) {   // id-on-hardwareModuleName: [ ~oid(hwType), bytes(hwSerialNum) ] -> HardwareModuleName
     if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "an id-on-hardwareModuleName value must be a CBOR [ ~oid, bytes ] pair");
     if (node.children[1].majorType !== 2) throw _err("c509/bad-extensions", "a hardwareModuleName hwSerialNum must be a CBOR byte string");
@@ -686,7 +728,7 @@ function _extValueToDer(name, node) {
       var iv = _cborIntVal(node, "basicConstraints");
       if (iv === -2n) return b.sequence([]);                                  // cA false (omitted)
       if (iv === -1n) return b.sequence([b.boolean(true)]);                   // cA true, no pathLen
-      if (iv >= 0n) return b.sequence([b.boolean(true), b.integer(iv)]);      // cA true, pathLen
+      if (iv >= 0n) return b.sequence([b.boolean(true), b.integer(_boundCount(iv, "a basicConstraints pathLenConstraint"))]);   // cA true, pathLen (0..2^31-1, as the DER decoder bounds it)
       throw _err("c509/bad-extensions", "a basicConstraints int " + iv + " is outside the -2/-1/pathLen range");
     }
     case "authorityKeyIdentifier":   // keyId-only bytes, or [ keyId, authorityCertIssuer, serial ] (sec. 3.3)
@@ -710,8 +752,8 @@ function _extValueToDer(name, node) {
       }
       return b.sequence(items.map(function (it) { return b.oid(_ekuPurposeOid(it)); }));
     }
-    case "inhibitAnyPolicy":       // uint -> INTEGER SkipCerts
-      return b.integer(_cborUint(node, "inhibitAnyPolicy"));
+    case "inhibitAnyPolicy":       // uint -> INTEGER SkipCerts (0..2^31-1, as the DER decoder bounds it)
+      return b.integer(_boundCount(_cborUint(node, "inhibitAnyPolicy"), "an inhibitAnyPolicy SkipCerts"));
     case "ocspNoCheck":            // null -> NULL
       if (node.majorType !== 7 || !(Buffer.isBuffer(node.bytes) && node.bytes.length === 1 && node.bytes[0] === 0xf6)) throw _err("c509/bad-extensions", "an ocspNoCheck value must be the CBOR simple value null");
       return b.nullValue();
@@ -770,6 +812,29 @@ function _extValueToDer(name, node) {
       }
       return b.sequence(polInfos);
     }
+    case "policyMappings": {        // [ idp, sdp, idp, sdp, ... ] -> SEQUENCE OF SEQUENCE { OID, OID } (sec. 3.3)
+      if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a policyMappings value must be a CBOR array");
+      var pmKids = node.children;
+      if (pmKids.length === 0 || pmKids.length % 2 !== 0) throw _err("c509/bad-extensions", "a policyMappings array must be non-empty (issuerDomainPolicy, subjectDomainPolicy) pairs (sec. 3.3)");
+      var maps = [];
+      // each member is a CertPolicyId -- the same sec. 8.9 int/~oid policy space as certificatePolicies (an int
+      // outside sec. 8.9 fails closed in _policyIdToDerOid). anyPolicy is accepted: RFC 5280 sec. 4.2.1.5's
+      // "MUST NOT map to/from anyPolicy" is a generation rule the toolkit's own DER decoder does not reject.
+      for (var mi = 0; mi + 1 < pmKids.length; mi += 2) maps.push(b.sequence([b.oid(_policyIdToDerOid(pmKids[mi])), b.oid(_policyIdToDerOid(pmKids[mi + 1]))]));
+      return b.sequence(maps);
+    }
+    case "policyConstraints": {      // [ requireExplicitPolicy: uint/null, inhibitPolicyMapping: uint/null ] -> SEQUENCE { [0]?, [1]? }
+      if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a policyConstraints value must be a 2-element CBOR array [ requireExplicitPolicy, inhibitPolicyMapping ] (sec. 3.3)");
+      var pcFields = [], repN = node.children[0], ipmN = node.children[1];
+      if (!_isCborNull(repN)) pcFields.push(b.implicit(0, b.integer(_boundCount(_cborUint(repN, "a policyConstraints requireExplicitPolicy"), "a policyConstraints requireExplicitPolicy"))));   // requireExplicitPolicy [0] IMPLICIT SkipCerts
+      if (!_isCborNull(ipmN)) pcFields.push(b.implicit(1, b.integer(_boundCount(_cborUint(ipmN, "a policyConstraints inhibitPolicyMapping"), "a policyConstraints inhibitPolicyMapping"))));   // inhibitPolicyMapping [1] IMPLICIT SkipCerts
+      // both-null is the empty-SEQUENCE case RFC 5280 sec. 4.2.1.11 forbids ("either ... MUST be present"); the
+      // toolkit's own DER decoder rejects the empty PolicyConstraints, so the reconstruct fails closed too.
+      if (pcFields.length === 0) throw _err("c509/bad-extensions", "policyConstraints must contain requireExplicitPolicy or inhibitPolicyMapping (RFC 5280 sec. 4.2.1.11)");
+      return b.sequence(pcFields);   // positional slot -> tag makes [0] < [1] unique + ascending by construction
+    }
+    case "subjectDirectoryAttributes":   // [ type, values, type, values, ... ] -> SEQUENCE OF Attribute (sec. 3.3)
+      return _sdaToDer(node);
     default:
       throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
   }
@@ -906,6 +971,34 @@ function _extValueFromDer(name, der) {
       }
       return cbor.build.array(cpOut);
     }
+    case "policyMappings": {                                        // SEQUENCE OF SEQUENCE { OID, OID } -> [ idp, sdp, ... ]
+      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
+      var pmOut = [];
+      for (var pm = 0; pm < node.children.length; pm++) {
+        var mp = node.children[pm];
+        if (mp.tagClass !== "universal" || mp.tagNumber !== asn1.TAGS.SEQUENCE || !mp.children || mp.children.length !== 2) return null;
+        pmOut.push(_policyIdFromDer(asn1.read.oid(mp.children[0])));
+        pmOut.push(_policyIdFromDer(asn1.read.oid(mp.children[1])));
+      }
+      return cbor.build.array(pmOut);
+    }
+    case "policyConstraints": {                                     // SEQUENCE { [0] rep?, [1] ipm? } -> [ rep/null, ipm/null ]
+      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1 || node.children.length > 2) return null;
+      var repC = cbor.build.nullValue(), ipmC = cbor.build.nullValue(), pcLast = -1;
+      for (var pci = 0; pci < node.children.length; pci++) {
+        var f = node.children[pci];
+        if (f.tagClass !== "context" || f.tagNumber <= pcLast) return null;   // DER: unique + ascending [0] < [1]
+        pcLast = f.tagNumber;
+        var sv = asn1.read.integerImplicit(f, f.tagNumber);
+        if (sv < 0n) return null;                                             // SkipCerts (0..MAX) -- a negative is non-compact
+        if (f.tagNumber === 0) repC = cbor.build.uint(sv);
+        else if (f.tagNumber === 1) ipmC = cbor.build.uint(sv);
+        else return null;
+      }
+      return cbor.build.array([repC, ipmC]);
+    }
+    case "subjectDirectoryAttributes":                              // SEQUENCE OF Attribute -> [ type, values, ... ]
+      return _sdaFromDer(node);
     default:
       return null;
   }
@@ -914,6 +1007,219 @@ function _extValueFromDer(name, der) {
   }
 }
 
+// ---- subjectDirectoryAttributes compact value codec (draft-20 sec. 3.3 / 8.6 / 8.8, RFC 5280 sec. 4.2.1.8) ----
+// SubjectDirectoryAttributes ::= SEQUENCE SIZE(1..MAX) OF Attribute ::= SEQUENCE { type, values SET OF value }.
+// The compact form is a flat CBOR array [ type1, values1, ... ] where each values slot is ITSELF a non-empty
+// CBOR array -- an Attribute's SET may hold more than one value, unlike a Name's single-value RDN. type is a
+// sec. 8.6 registry int (the sign selects the string type) with text values, or an unwrapped ~oid with raw DER
+// value bytes (an unregistered type stays compact via its own ~oid form, never dropping the whole extension).
+// The extension-level _tryCompactExtValue round-trip guard is the byte-exactness net.
+
+// A ~oid-form attributeValue must be exactly ONE non-empty, well-formed DER AttributeValue TLV. An empty byte
+// string would build a SET OF SIZE 0 (RFC 5280 sec. 4.2.1.8 requires at least one value); a byte string carrying
+// more than one TLV would fan one declared value into several SET members (draft-20 sec. 3.3: one `bytes` is one
+// AttributeValue). There is no downstream DER decoder to catch either (SDA ships c509-only), so the reconstruct
+// arm self-enforces the single-TLV shape rather than splice a degenerate or invalid Attribute.
+// ---- the shared strict-DER gate for a raw-spliced ANY value --------------------------------------
+// Several reconstruct sites splice CALLER/ATTACKER-supplied bytes into the rebuilt certificate verbatim (an
+// AlgorithmIdentifier's `parameters`, a generic otherName's `value [0] EXPLICIT ANY`, a subjectDirectoryAttributes
+// `~oid`-form AttributeValue). asn1.decode validates TLV FRAMING ONLY -- it rejects truncation, trailing bytes and
+// non-minimal lengths, and enforces the DER primitive/constructed rules, but it does NOT check per-type CONTENT:
+// it frames an empty INTEGER, the reserved end-of-contents tag 0, and an out-of-alphabet string quite happily.
+// Splicing those produces a certificate an independent decoder refuses to load, and one this toolkit's OWN readers
+// reject -- so every such site routes through the one gate below instead of a bare asn1.decode.
+
+// Every universal PRIMITIVE tag whose content this toolkit can strictly validate, mapped to its reader. A
+// universal primitive OUTSIDE this map has no strict content validator here, so it is REJECTED rather than
+// spliced unchecked. The documented residual: a value whose type this toolkit cannot yet strictly validate is
+// not compact-representable -- NumericString / VideotexString / GraphicString / GeneralString (no content reader),
+// and a fractional-seconds GeneralizedTime (the X.690 sec. 11.7 relaxation is deliberately scoped to the codec
+// and RFC 3161 timestamping, and must not creep into a third consumer). On the ENCODE path such a value simply
+// degrades to the byte-exact ~oid + byte-string form, losing nothing; on the DECODE path it is a fail-closed
+// verdict rather than a guess.
+var _ANY_VALUE_READERS = (function () {
+  var m = {}, R = asn1.read, T = asn1.TAGS;
+  m[T.BOOLEAN] = R.boolean; m[T.INTEGER] = R.integer; m[T.ENUMERATED] = R.enumerated;
+  m[T.BIT_STRING] = R.bitString; m[T.OCTET_STRING] = R.octetString; m[T.NULL] = R.nullValue;
+  m[T.OBJECT_IDENTIFIER] = R.oid; m[T.UTC_TIME] = R.time; m[T.GENERALIZED_TIME] = R.time;
+  [T.UTF8_STRING, T.PRINTABLE_STRING, T.NUMERIC_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING, T.BMP_STRING, T.UNIVERSAL_STRING].forEach(function (t) { m[t] = R.string; });
+  return m;
+})();
+
+// A universal SET's required member order depends on a type the ANY does not carry: X.690 sec. 11.6 orders a
+// SET OF by the members' full encodings, while a structured SET is ordered by TAG (X.680 sec. 8.6) -- and the two
+// differ whenever the constructed bit does (a SEQUENCE member, tag 16, sorts BEFORE a PrintableString, tag 19, by
+// tag but AFTER it by octets). A structured SET cannot repeat a tag, so a repeated tag proves SET OF and the
+// octet rule binds; with all-distinct tags either reading is possible, so accept a value that satisfies EITHER
+// (rejecting only what is non-canonical under BOTH readings -- sound in both directions, never a guess).
+var _TAG_CLASS_RANK = { universal: 0, application: 1, context: 2, private: 3 };
+function _setOrderOk(kids) {
+  var i, dup = false, seen = {};
+  for (i = 0; i < kids.length; i++) {
+    var key = kids[i].tagClass + ":" + kids[i].tagNumber;
+    if (seen[key]) { dup = true; break; }
+    seen[key] = true;
+  }
+  var octetAsc = true, tagAsc = true;
+  for (i = 1; i < kids.length; i++) {
+    if (Buffer.compare(kids[i - 1].bytes, kids[i].bytes) > 0) octetAsc = false;
+    // Tag order ranks by CLASS first (universal < application < context < private, X.680 sec. 8.6), then by tag
+    // number -- compare the class's NUMBER, never its name (the names do not sort in class order).
+    var pc = _TAG_CLASS_RANK[kids[i - 1].tagClass], cc = _TAG_CLASS_RANK[kids[i].tagClass];
+    if (pc !== cc ? pc > cc : kids[i - 1].tagNumber > kids[i].tagNumber) tagAsc = false;
+  }
+  return dup ? octetAsc : (octetAsc || tagAsc);
+}
+
+// Strict-validate a decoded DER element at ANY depth, in the caller's error domain. Rejects the reserved EOC tag
+// 0; runs a universal primitive through its strict content reader (or rejects a type with none); recurses into a
+// constructed element's children; and holds a universal SET to a canonical order. Only SEQUENCE and SET are
+// accepted as universal CONSTRUCTED types -- an EXTERNAL / EMBEDDED PDV / CHARACTER STRING has mandatory
+// components this gate cannot verify (the degenerate empty form is not a valid encoding of any of them), so it is
+// refused for the same reason an unvalidatable primitive is. A NON-universal element (a legitimately context- or
+// application-tagged ANY) passes on its framing, but its constructed children are still walked.
+function _strictDerElement(node, code, label) {
+  if (node.tagClass === "universal" && node.tagNumber === 0) throw _err(code, label + " must not use the reserved end-of-contents encoding (tag 0)");
+  if (node.constructed) {
+    if (node.tagClass === "universal" && node.tagNumber !== asn1.TAGS.SEQUENCE && node.tagNumber !== asn1.TAGS.SET) {
+      throw _err(code, label + " of universal constructed type " + node.tagNumber + " has no strict DER structure validator here");
+    }
+    var kids = node.children;   // asn1.decode always sets a (possibly empty) children array on a constructed node
+    for (var i = 0; i < kids.length; i++) _strictDerElement(kids[i], code, label);
+    if (node.tagClass === "universal" && node.tagNumber === asn1.TAGS.SET && !_setOrderOk(kids)) {
+      throw _err(code, label + " has a SET whose members are in no canonical DER order (X.690 sec. 11.6 / X.680 sec. 8.6)");
+    }
+    return;
+  }
+  if (node.tagClass === "universal") {
+    // Validate-or-reject: a universal primitive with no strict content reader is NOT accepted on framing alone
+    // (asn1.decode frames a malformed NumericString "12 01 40" happily), so the map is exhaustive by refusal.
+    var reader = _ANY_VALUE_READERS[node.tagNumber];
+    if (!reader) throw _err(code, label + " of universal type " + node.tagNumber + " has no strict DER content validator here");
+    try { reader(node); } catch (e) { throw _err(code, label + " is not a valid DER element for its type", e); }
+  }
+}
+// Raw ANY bytes about to be spliced verbatim must be exactly ONE non-empty, well-formed AND strictly-valid DER
+// element: framing + no-trailing-data via asn1.decode, then content / structure / SET order via
+// _strictDerElement, both reported in the CALLER's error domain. Returns the bytes so a call site can wrap a
+// splice inline. Used by every reconstruct site that emits caller-supplied ANY bytes verbatim.
+function _requireStrictDerTlv(content, code, label) {
+  if (content.length === 0) throw _err(code, label + " must be a non-empty DER element");
+  var node;
+  try { node = asn1.decode(content); } catch (e) { throw _err(code, label + " must be exactly one well-formed DER element (no trailing data)", e); }
+  _strictDerElement(node, code, label);
+  return content;
+}
+
+// asn1.build.set SORTS its members, so handing it a non-canonically-ordered values list would SILENTLY rewrite
+// the declared order -- many distinct C509 encodings would reconstruct one and the same certificate. Require the
+// declared order to already BE canonical, so the compact form maps one-to-one onto the DER it rebuilds.
+function _derSetInDeclaredOrder(vals) {
+  for (var i = 1; i < vals.length; i++) {
+    if (Buffer.compare(vals[i - 1], vals[i]) > 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attributeValue list must be in DER ascending order (X.690 sec. 11.6)");
+  }
+  return b.set(vals);
+}
+
+// [ type1, values1, ... ] -> the DER SubjectDirectoryAttributes. A malformed native value fails closed
+// (c509/bad-extensions); on the encode path the same throw is a round-trip mismatch -> whole-ext ~oid fallback.
+function _sdaToDer(node) {
+  if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes value must be a CBOR array");
+  var kids = node.children;
+  if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes array must be non-empty (attributeType, attributeValue) pairs (sec. 3.3)");
+  var attrs = [];
+  for (var i = 0; i + 1 < kids.length; i += 2) {
+    var typeNode = kids[i], valuesNode = kids[i + 1];
+    if (valuesNode.majorType !== 4 || !valuesNode.children || valuesNode.children.length < 1) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attributeValue must be a non-empty CBOR array (SET OF, SIZE 1..MAX, RFC 5280 sec. 4.2.1.8)");
+    var vals = [];
+    if (typeNode.majorType === 0 || typeNode.majorType === 1) {          // int form: a sec. 8.6 registry alias, text values
+      var ti = Number(cbor.read.int(typeNode));
+      var tname = ATTR_BY_INT[Math.abs(ti)];
+      if (tname === undefined) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attribute type int " + ti + " has no C509 sec. 8.6 registry row");
+      // countryName / serialNumber are PrintableString-restricted -- their int MUST carry the negative
+      // (printableString) sign. A non-negative sign is ambiguous/nonconformant: fail closed rather than
+      // silently coerce the value to PrintableString (the ~oid form is the escape hatch for a genuine odd value).
+      if ((tname === "countryName" || tname === "serialNumber") && ti >= 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes " + tname + " must carry the negative (printableString) sign (it is PrintableString-restricted)");
+      for (var vi = 0; vi < valuesNode.children.length; vi++) {
+        var vn = valuesNode.children[vi];
+        if (vn.majorType !== 3) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes int-form attribute value must be a CBOR text string (a non-string value requires the ~oid form)");
+        // _reconAttrValue -> b.printable / b.utf8 throws only an Asn1Error for a value outside its string type's
+        // alphabet (a printableString sign over non-PrintableString characters); remap it to this module's
+        // domain so attacker-controlled native input fails closed as c509/bad-extensions, not a leaked asn1/*.
+        try { vals.push(_reconAttrValue({ type: tname, value: cbor.read.textString(vn), printable: ti < 0 })); }
+        catch (e) { throw _err("c509/bad-extensions", "a subjectDirectoryAttributes " + tname + " value is not valid for its string type", e); }
+      }
+      attrs.push(b.sequence([b.oid(oid.byName(tname)), _derSetInDeclaredOrder(vals)]));
+    } else if (typeNode.majorType === 2) {                              // ~oid form: raw AttributeValue TLVs
+      var dotted = _oidName(typeNode, "c509/bad-extensions", "a subjectDirectoryAttributes attribute type").oid;
+      for (var vj = 0; vj < valuesNode.children.length; vj++) {
+        var vb = valuesNode.children[vj];
+        if (vb.majorType !== 2) throw _err("c509/bad-extensions", "a ~oid-form subjectDirectoryAttributes value must be a CBOR byte string (a raw DER AttributeValue)");
+        vals.push(b.raw(_requireStrictDerTlv(vb.content, "c509/bad-extensions", "a ~oid-form subjectDirectoryAttributes AttributeValue")));
+      }
+      attrs.push(b.sequence([b.oid(dotted), _derSetInDeclaredOrder(vals)]));
+    } else {
+      throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attribute type must be a CBOR integer (sec. 8.6) or a ~oid");
+    }
+  }
+  return b.sequence(attrs);
+}
+
+// One DER Attribute's SET members -> the int-form { sign, values:[CBOR text] }, or null when the int form is
+// not confidently byte-exact (an unregistered type, a non-utf8/printable value, or a SET mixing utf8String and
+// printableString -- one sign cannot express it). A null routes that ONE attribute to the always-byte-exact
+// ~oid + raw-bytes form (a still-compact sec. 3.3 SDA form); the extension round-trip guard is the ultimate net.
+function _sdaTryIntForm(tint, name, valueNodes) {
+  if (tint === undefined) return null;
+  var i;
+  // An IA5String-only attribute (emailAddress) rides its non-negative int with IA5String values -- its type,
+  // not a sign, fixes the string type, so it is matched separately from the utf8/printable sign convention.
+  if (name === "emailAddress") {
+    var mails = [];
+    for (i = 0; i < valueNodes.length; i++) {
+      if (valueNodes[i].tagClass !== "universal" || valueNodes[i].tagNumber !== asn1.TAGS.IA5_STRING) return null;
+      mails.push(cbor.build.textString(asn1.read.string(valueNodes[i])));
+    }
+    return { sign: 1, values: mails };
+  }
+  var sign = 0, out = [];   // sign: -1 printableString, +1 utf8String
+  for (i = 0; i < valueNodes.length; i++) {
+    var vn = valueNodes[i], s;
+    if (vn.tagClass === "universal" && vn.tagNumber === asn1.TAGS.UTF8_STRING) s = 1;
+    else if (vn.tagClass === "universal" && vn.tagNumber === asn1.TAGS.PRINTABLE_STRING) s = -1;
+    else return null;                                  // any other value tag -> the ~oid form preserves it exactly
+    if (sign === 0) sign = s;
+    else if (sign !== s) return null;                  // a mixed utf8/printable SET -- the headline trap
+    out.push(cbor.build.textString(asn1.read.string(vn)));
+  }
+  return { sign: sign, values: out };
+}
+
+// The DER SubjectDirectoryAttributes -> the flat compact CBOR array, or null (whole-ext ~oid fallback). Per
+// attribute: the int form when the type is sec. 8.6-registered AND every value is a single-signed utf8/
+// printable string, else the ~oid + raw-bytes form (always byte-exact).
+function _sdaFromDer(node) {
+  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
+  var out = [];
+  for (var ai = 0; ai < node.children.length; ai++) {
+    var attr = node.children[ai];
+    if (attr.tagClass !== "universal" || attr.tagNumber !== asn1.TAGS.SEQUENCE || !attr.children || attr.children.length !== 2) return null;
+    var setNode = attr.children[1];
+    if (setNode.tagClass !== "universal" || setNode.tagNumber !== asn1.TAGS.SET || !setNode.children || setNode.children.length < 1) return null;   // SET OF, non-empty
+    var dotted = asn1.read.oid(attr.children[0]);
+    var nm = oid.name(dotted), tint = nm != null ? ATTR_TO_INT[nm] : undefined;
+    var intForm = _sdaTryIntForm(tint, nm, setNode.children);
+    if (intForm != null) {
+      out.push(cbor.build.int(BigInt(intForm.sign < 0 ? -tint : tint)));
+      out.push(cbor.build.array(intForm.values));
+    } else {
+      out.push(_oidCbor(dotted));
+      out.push(cbor.build.array(setNode.children.map(function (v) { return cbor.build.byteString(v.bytes); })));
+    }
+  }
+  return cbor.build.array(out);
+}
+
 // Encode-side guard: emit the compact value only when it decodes back to the EXACT DER extnValue, so a
 // non-canonical or unrepresentable value can never produce a lossy compact form (it falls back to ~oid).
 // A value _extValueFromDer produced but _extValueToDer cannot reconstruct -- an empty GeneralNames the DER
@@ -1005,9 +1311,20 @@ function _macToEui64String(buf) {
 // One RDN attribute value -> its DER string. The C509 sign convention: a positive attribute int ->
 // utf8String, a negative -> printableString; countryName / serialNumber are PrintableString-restricted.
 function _reconAttrValue(rdn) {
-  if (rdn.eui64) return b.utf8(_macToEui64String(rdn.eui64));
-  if (rdn.type === "countryName" || rdn.type === "serialNumber") return b.printable(String(rdn.value));
-  return rdn.printable ? b.printable(String(rdn.value)) : b.utf8(String(rdn.value));
+  if (rdn.eui64) return b.utf8(_macToEui64String(rdn.eui64));   // the bare-form commonName MAC (a fixed 17 chars)
+  var s = String(rdn.value);
+  // The attribute's registered ASN.1 type carries a SIZE constraint as well as an alphabet, and a value outside
+  // it is not a valid encoding of that type: every DirectoryString-valued attribute is SIZE (1..MAX) and
+  // emailAddress is IA5String SIZE (1..MAX) (RFC 5280 App. A.1), so an empty value is never valid; countryName
+  // "SHALL have length 2" (draft sec. 3.1.4, X.520 SIZE (2)). Enforced HERE, the single place the value is built
+  // for its declared type, so the decode, reconstruct and subject-directory-attributes paths cannot disagree.
+  if (s.length === 0) throw _err("c509/bad-name", "a " + rdn.type + " value must be non-empty (SIZE (1..MAX))");
+  if (rdn.type === "countryName" && s.length !== 2) throw _err("c509/bad-name", "a countryName value must have length 2 (draft sec. 3.1.4)");
+  // emailAddress is an IA5String-only attribute (draft sec. 3.1.4): its type, not the int's sign, fixes the
+  // string type, so it reconstructs as an IA5String whichever way the non-negative int was written.
+  if (rdn.type === "emailAddress") return b.ia5(s);
+  if (rdn.type === "countryName" || rdn.type === "serialNumber") return b.printable(s);
+  return rdn.printable ? b.printable(s) : b.utf8(s);
 }
 
 // A Name -> the DER RDNSequence (SEQUENCE OF SET OF SEQUENCE{ type, value }); one attribute per RDN.
@@ -1091,13 +1408,11 @@ function _reconExtensions(exts) {
 function _reconAlgId(alg) {
   var fields = [b.oid(alg.oid)];
   if (alg.parameters && alg.parameters.length) {
-    // AlgorithmIdentifier.parameters is ANY -- exactly one well-formed DER element. Validate the supplied
-    // bytes decode as a single element (the strict decoder rejects trailing bytes / malformed encodings)
-    // before re-emitting them, so a malformed or multi-element parameter blob fails closed rather than
-    // producing an invalid reconstructed AlgorithmIdentifier.
-    try { asn1.decode(alg.parameters); }
-    catch (e) { throw _err("c509/non-invertible", "algorithm parameters are not a single well-formed DER element", e); }
-    fields.push(b.raw(alg.parameters));
+    // AlgorithmIdentifier.parameters is ANY, spliced verbatim -- so it gets the SAME strict gate as every other
+    // raw-ANY splice, not just a framing check. Framing alone admits an empty INTEGER / reserved tag 0 / a
+    // non-minimal INTEGER, each of which reconstructs an AlgorithmIdentifier that an independent X.509 decoder
+    // refuses to load and that this toolkit's own readers reject.
+    fields.push(b.raw(_requireStrictDerTlv(alg.parameters, "c509/non-invertible", "algorithm parameters")));
   }
   return b.sequence(fields);
 }
@@ -1168,6 +1483,9 @@ function parse(input) {
   var f = root.children;
   if (f.length !== 11) throw _err("c509/bad-tbs", "a C509 certificate must be an array of exactly 11 elements, got " + f.length);
 
+  // The type slot must be a CBOR integer -- guard the major type here so a text/array/byte-string field 0 fails
+  // in this module's domain rather than leaking cbor.read.int's cbor/unexpected-major fault to the caller.
+  if (f[0].majorType !== 0 && f[0].majorType !== 1) throw _err("c509/bad-certificate-type", "c509CertificateType must be a CBOR integer");
   var type = Number(cbor.read.int(f[0]));
   if (type !== 2 && type !== 3) throw _err("c509/bad-certificate-type", "c509CertificateType must be 2 (native) or 3 (re-encoded), got " + type);
 
@@ -1434,6 +1752,11 @@ function _c509NameFromDer(nameBytes) {
     if (attrName == null || ATTR_TO_INT[attrName] === undefined) throw _err("c509/non-invertible", "attribute type " + attrName + " has no C509 registry integer");
     var valNode = attr.children[1];
     var value = asn1.read.string(valNode);
+    // The IA5String type belongs ONLY to an IA5-only attribute (emailAddress, draft sec. 3.1.4), whose value
+    // reconstructs from its type rather than the int's sign. Refuse either mismatch here with a precise verdict
+    // instead of emitting an int form whose reconstruction would differ from the source bytes.
+    var isIa5 = valNode.tagClass === "universal" && valNode.tagNumber === asn1.TAGS.IA5_STRING;
+    if ((attrName === "emailAddress") !== isIa5) throw _err("c509/non-invertible", "attribute " + attrName + " carries a " + (isIa5 ? "IA5String" : "non-IA5String") + " value the C509 sec. 8.6 int form cannot represent");
     var eui = attrName === "commonName" ? _euiFromCn(value) : null;
     if (eui) rdns.push({ type: attrName, value: value, eui64: eui });                            // tag-48 MAC commonName
     else rdns.push({ type: attrName, value: value, printable: valNode.tagNumber === asn1.TAGS.PRINTABLE_STRING });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.33",
+  "version": "0.4.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -68,6 +68,8 @@
     "coverage": "c8 --include=lib/** --include=index.js --reporter=text-summary --reporter=lcov node test/smoke.js",
     "check:swallows": "node scripts/check-swallow-coverage.js",
     "coverage:gated": "npm run coverage && npm run check:swallows",
+    "coverage:unified": "node scripts/coverage-unified.js",
+    "coverage:unified:gated": "npm run coverage:unified && npm run check:swallows",
     "prepack": "node scripts/check-pack-against-gitignore.js",
     "check:vendor-currency": "node scripts/check-vendor-currency.js"
   },

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:d39fe4d9-9f98-4126-8a96-8660ce1805e0",
+  "serialNumber": "urn:uuid:62c970a5-3536-480a-8269-a0c5d85b82eb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-06T04:08:23.299Z",
+    "timestamp": "2026-08-08T02:38:25.668Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.33",
+      "bom-ref": "@blamejs/pki@0.4.1",
       "type": "application",
       "name": "pki",
-      "version": "0.3.33",
+      "version": "0.4.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.33",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.33",
+      "ref": "@blamejs/pki@0.4.1",
       "dependsOn": []
     }
   ]