@blamejs/pki 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.4.1 — 2026-08-08
+
+pki.schema.c509 encodes and decodes the compact subjectDirectoryAttributes value form -- a C509 certificate's subject directory attributes ride their draft-20 registry integers (or unwrapped OIDs) with their directory-string values, interoperating with a conformant C509 implementation rather than only this decoder.
+
+### Added
+
+- pki.schema.c509 encodes and decodes the compact value form for the subjectDirectoryAttributes extension (draft-ietf-cose-cbor-encoded-cert-20 sec. 3.3): a flat array of (attribute type, attribute values) pairs where each type is a sec. 8.6 registry integer (the sign selecting the directory-string type) or an unwrapped OID, and each values slot is a non-empty array holding the attribute's SET of one or more values -- the string values for a registry-integer type, or the raw DER attribute values for an unwrapped-OID type. Both directions invert to the DER extnValue byte-for-byte, so a certificate carrying the extension is the specific compact shape a conformant C509 implementation reads rather than an opaque DER byte string. The encoder is guarded per attribute and per extension: an attribute whose value is not a directory string, or whose value SET mixes string types, uses the unwrapped-OID form for that attribute (keeping the rest of the extension compact); a value the compact form cannot represent falls the whole extension back to the unwrapped-OID byte-string form instead of encoding lossily; and a malformed compact value fails closed with a typed C509Error.
+- The OID registry gains the subjectDirectoryAttributes certificate-extension identifier (2.5.29.9), resolvable through pki.oid.byName / pki.oid.name.
+- The ASN.1 codec reads NumericString (pki.asn1.TAGS.NUMERIC_STRING), the X.520 syntax of the x121Address and internationalISDNNumber directory attributes. It is validated strictly like every other string type: a value outside the digits-and-space set the type permits is rejected as malformed rather than decoded.
+
+### Changed
+
+- A C509 certificate carrying subjectDirectoryAttributes now encodes to -- and decodes from -- its compact CBOR value shape rather than the unwrapped-OID byte-string form an earlier release emitted; both reconstruct the same DER, but the CBOR bytes differ, so re-encode any C509 produced by an earlier release.
+
 ## v0.4.0 — 2026-08-06
 
 CRL issuance and verification, PKCS#12 build and open, attribute-certificate issuance, and the key-material lifecycle graduate to stable, and pki.schema.c509 adds the compact policyMappings and policyConstraints value forms -- a C509 certificate's policy mappings and policy constraints now ride their specific draft-20 CBOR shape and interoperate with a conformant C509 implementation rather than only this decoder.

package/README.md

@@ -204,7 +204,7 @@ is callable today; nothing below is a stub.
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more), the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec, certificate policies (registry-integer or OID policy identifiers with their CPS-URI and UserNotice qualifiers), and policy mappings and policy constraints; a certificate outside the invertible set throws a typed `C509Error` |
+| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more), the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec, certificate policies (registry-integer or OID policy identifiers with their CPS-URI and UserNotice qualifiers), and policy mappings and policy constraints, and subject directory attributes; a certificate outside the invertible set throws a typed `C509Error` |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |

package/lib/asn1-der.js

@@ -66,6 +66,7 @@ var UNIVERSAL_TYPES = {
   UTF8_STRING:       { tag: 0x0c, form: "primitive" },
   SEQUENCE:          { tag: 0x10, form: "constructed" },
   SET:               { tag: 0x11, form: "constructed" },
+  NUMERIC_STRING:    { tag: 0x12, form: "primitive" },
   PRINTABLE_STRING:  { tag: 0x13, form: "primitive" },
   TELETEX_STRING:    { tag: 0x14, form: "primitive" },
   IA5_STRING:        { tag: 0x16, form: "primitive" },
@@ -95,7 +96,7 @@ var CONSTRUCTED_BIT   = 0x20;
 // constructed-capable set is DERIVED from the registry above and keyed by tag
 // for an O(1) decode-time form check. It is a WHITELIST: a universal tag
 // outside it -- a registered primitive type and an unregistered one
-// (NumericString, GeneralString, ObjectDescriptor, REAL, ...) alike -- has no
+// (GeneralString, ObjectDescriptor, REAL, ...) alike -- has no
 // DER constructed form, so the default is reject.
 var CONSTRUCTED_ONLY_UNIVERSAL_TAGS = Object.create(null);
 Object.keys(UNIVERSAL_TYPES).forEach(function (k) {
@@ -622,6 +623,15 @@ function _decodePrintable(buf) {
   return s;
 }
 
+// NumericString (X.680 sec. 41, Table 9) permits ONLY the digits and SPACE. It carries the X.520 syntax of
+// the x121Address and internationalISDNNumber directory attributes, so a value of this type must be readable
+// -- and strictly, since anything outside that alphabet is not a valid encoding of the type.
+function _decodeNumeric(buf) {
+  var s = buf.toString("latin1");
+  if (!NUMERIC_RE.test(s)) throw new Asn1Error("asn1/bad-numeric-string", "NumericString has characters outside the digits-and-space set");
+  return s;
+}
+
 // UTF8String must be well-formed UTF-8; a lenient decoder substitutes U+FFFD
 // for invalid sequences, silently mangling hostile input into valid text.
 function _decodeUtf8Strict(buf) {
@@ -637,6 +647,7 @@ function readString(node) {
   _expectPrimitive(node, "readString");
   switch (node.tagNumber) {
     case TAGS.UTF8_STRING:      return _decodeUtf8Strict(node.content);
+    case TAGS.NUMERIC_STRING:   return _decodeNumeric(node.content);
     case TAGS.PRINTABLE_STRING: return _decodePrintable(node.content);
     case TAGS.IA5_STRING:       return _decodeIa5(node.content);
     case TAGS.TELETEX_STRING:   return _decodeText(node.content, "latin1");
@@ -870,6 +881,7 @@ function encodeOidContent(dotted) {
 }
 
 var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
+var NUMERIC_RE = /^[0-9 ]*$/;
 
 function _fmtTwo(n) { return (n < 10 ? "0" : "") + n; }
 

package/lib/oid.js

@@ -60,6 +60,7 @@ var FAMILIES = {
 
   // RFC 5280 certificate extensions.
   certExtension: { base: [2, 5, 29], of: {
+    subjectDirectoryAttributes: 9,   // id-ce 9 (RFC 5280 sec. 4.2.1.8) -> 2.5.29.9
     subjectKeyIdentifier: 14, keyUsage: 15, subjectAltName: 17, issuerAltName: 18,
     basicConstraints: 19,
     // CRL + CRL-entry extensions (RFC 5280 sec. 5.2, sec. 5.3)

package/lib/schema-c509.js

@@ -57,10 +57,12 @@ var PK_ALG_BY_INT = {
 // EC curve -> field size in bytes (the SEC1 coordinate width), for point-length validation.
 var EC_FIELD_BYTES = { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 };
 
-// sec. 8.6 RDN attribute types (abs(int) -> name; the sign selects the X.509 string type). emailAddress
-// (int 0) is an IA5String value not covered by the DirectoryString SpecialText codec below, so it is
-// declined; a DN carrying it encodes via the ~oid attribute form, not this alias table.
+// sec. 8.6 RDN attribute types (abs(int) -> name; the sign selects the X.509 string type: positive utf8String,
+// negative printableString). An attribute whose value is ALWAYS an IA5String is instead "unambiguously
+// represented using a non-negative int" (draft sec. 3.1.4) -- emailAddress is int 0, so its value reconstructs
+// as an IA5String and its sign carries no string-type meaning.
 var ATTR_BY_INT = {
+  0: _name("emailAddress"),
   1: _name("commonName"),
   2: _name("surname"),
   3: _name("serialNumber"),
@@ -87,6 +89,7 @@ var EXT_BY_INT = {
   7: _name("authorityKeyIdentifier"),
   8: _name("extKeyUsage"),
   9: _name("authorityInfoAccess"),
+  24: _name("subjectDirectoryAttributes"),
   25: _name("issuerAltName"),
   26: _name("nameConstraints"),
   27: _name("policyMappings"),
@@ -104,7 +107,7 @@ var EXT_COMPACT = {
   extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
   subjectAltName: 1, issuerAltName: 1, nameConstraints: 1, cRLDistributionPoints: 1,
   freshestCRL: 1, authorityInfoAccess: 1, subjectInfoAccess: 1, certificatePolicies: 1,
-  policyMappings: 1, policyConstraints: 1,
+  policyMappings: 1, policyConstraints: 1, subjectDirectoryAttributes: 1,
 };
 // sec. 8.12 Extended Key Usages registry (C509 int -> registered id-kp purpose name). A KeyPurposeId
 // outside this set encodes as an unwrapped ~oid; a C509 int outside it fails closed on decode.
@@ -240,14 +243,36 @@ function _specialText(node) {
 
 // A single Name (sec. 3.1.4/sec. 3.1.6): the CBOR simple null (issuer only) | a bare SpecialText single
 // commonName | an array of RDNAttributes. Surfaces { dn, rdns, eui64? } shape-compatible with x509.
+// An rdn's (attribute type, sign) pair DECLARES an X.509 string type, so its text must be valid for that type --
+// a printableString sign over a non-PrintableString character, a non-ASCII emailAddress (IA5String-only), or a
+// value outside the type's SIZE. Assert it by running the SAME builder the reconstruction uses, so a Name this
+// parse accepts is always one it can rebuild, and a natively-signed certificate (which never reconstructs) is
+// held to the identical rule. Applied to BOTH Name forms -- the array form and the bare single-commonName form.
+// The builder's asn1/* fault is re-thrown in this module's domain rather than leaking onto the parse surface.
+function _assertAttrValue(rdn) {
+  try { _reconAttrValue(rdn); }
+  catch (e) {
+    if (e instanceof C509Error) throw e;
+    throw _err("c509/bad-name", "the " + rdn.type + " value is not valid for the string type its attribute integer declares", e);
+  }
+}
+
 function _name509(node, isSubject) {
   if (!isSubject && node.majorType === 7 && node.ai === 22) return null;   // issuer == subject (self-signed)
   // A bare SpecialText (not an array) is a single commonName attribute (attributeType == +1).
   if (node.majorType === 3 || node.majorType === 2 || node.majorType === 6) {
     var sv = _specialText(node);
-    if (sv.eui64) return { rdns: [{ type: "commonName", eui64: sv.eui64 }], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
+    // The bare form is a single commonName -- hold its value to the SAME rules the array form applies, so a
+    // natively-signed certificate (which never reconstructs) cannot carry a value the reconstruction would refuse.
+    if (sv.eui64) {
+      var euiRdn = { type: "commonName", eui64: sv.eui64 };
+      _assertAttrValue(euiRdn);
+      return { rdns: [euiRdn], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
+    }
     var val = sv.text !== undefined ? sv.text : sv.hex;
-    return { rdns: [{ type: "commonName", value: val }], dn: "CN=" + val };
+    var bareRdn = { type: "commonName", value: val };
+    _assertAttrValue(bareRdn);
+    return { rdns: [bareRdn], dn: "CN=" + val };
   }
   if (node.majorType !== 4) throw _err("c509/bad-name", "a C509 Name must be null, a SpecialText, or an array of RDN attributes");
   var rdns = [];
@@ -268,7 +293,13 @@ function _name509(node, isSubject) {
     if (tname === undefined) throw _err("c509/bad-name", "attribute type integer " + ti + " has no C509 registry row");
     var v = _specialText(kids[i + 1]);
     var vv = v.text !== undefined ? v.text : (v.hex !== undefined ? v.hex : _macToEui64String(v.eui64));
-    rdns.push({ type: tname, value: vv, printable: ti < 0 });
+    // The RENDERED text is what carries into the rdn -- deliberately NOT the raw eui64, because the EUI shortcut
+    // in _reconAttrValue is unconditional and would take precedence over the attribute's declared string type,
+    // rebuilding a tag-48 emailAddress or countryName as a UTF8String. Only the bare-SpecialText form above is
+    // always a commonName and may carry it; here the value is held to whatever type the attribute integer declares.
+    var rdn = { type: tname, value: vv, printable: ti < 0 };
+    _assertAttrValue(rdn);
+    rdns.push(rdn);
     parts.push(_shortName(tname) + "=" + vv);
   }
   return { rdns: rdns, dn: parts.join(",") };
@@ -420,8 +451,8 @@ function _otherNameToDer(node, intVal) {
     if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a generic otherName value must be a CBOR [ ~oid, bytes ] pair");
     typeId = _oidName(node.children[0], "c509/bad-extensions", "an otherName type-id").oid;
     if (node.children[1].majorType !== 2) throw _err("c509/bad-extensions", "an otherName value must be a CBOR byte string (the [0] EXPLICIT inner TLV)");
-    inner = node.children[1].content;
-    try { asn1.decode(inner); } catch (e) { throw _err("c509/bad-extensions", "an otherName value is not a single well-formed DER element", e); }
+    // The [0] EXPLICIT inner TLV is an ANY spliced verbatim -- strict-validate it, not just its framing.
+    inner = _requireStrictDerTlv(node.children[1].content, "c509/bad-extensions", "an otherName value");
   } else if (intVal === -1) {   // id-on-hardwareModuleName: [ ~oid(hwType), bytes(hwSerialNum) ] -> HardwareModuleName
     if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "an id-on-hardwareModuleName value must be a CBOR [ ~oid, bytes ] pair");
     if (node.children[1].majorType !== 2) throw _err("c509/bad-extensions", "a hardwareModuleName hwSerialNum must be a CBOR byte string");
@@ -802,6 +833,8 @@ function _extValueToDer(name, node) {
       if (pcFields.length === 0) throw _err("c509/bad-extensions", "policyConstraints must contain requireExplicitPolicy or inhibitPolicyMapping (RFC 5280 sec. 4.2.1.11)");
       return b.sequence(pcFields);   // positional slot -> tag makes [0] < [1] unique + ascending by construction
     }
+    case "subjectDirectoryAttributes":   // [ type, values, type, values, ... ] -> SEQUENCE OF Attribute (sec. 3.3)
+      return _sdaToDer(node);
     default:
       throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
   }
@@ -964,6 +997,8 @@ function _extValueFromDer(name, der) {
       }
       return cbor.build.array([repC, ipmC]);
     }
+    case "subjectDirectoryAttributes":                              // SEQUENCE OF Attribute -> [ type, values, ... ]
+      return _sdaFromDer(node);
     default:
       return null;
   }
@@ -972,6 +1007,219 @@ function _extValueFromDer(name, der) {
   }
 }
 
+// ---- subjectDirectoryAttributes compact value codec (draft-20 sec. 3.3 / 8.6 / 8.8, RFC 5280 sec. 4.2.1.8) ----
+// SubjectDirectoryAttributes ::= SEQUENCE SIZE(1..MAX) OF Attribute ::= SEQUENCE { type, values SET OF value }.
+// The compact form is a flat CBOR array [ type1, values1, ... ] where each values slot is ITSELF a non-empty
+// CBOR array -- an Attribute's SET may hold more than one value, unlike a Name's single-value RDN. type is a
+// sec. 8.6 registry int (the sign selects the string type) with text values, or an unwrapped ~oid with raw DER
+// value bytes (an unregistered type stays compact via its own ~oid form, never dropping the whole extension).
+// The extension-level _tryCompactExtValue round-trip guard is the byte-exactness net.
+
+// A ~oid-form attributeValue must be exactly ONE non-empty, well-formed DER AttributeValue TLV. An empty byte
+// string would build a SET OF SIZE 0 (RFC 5280 sec. 4.2.1.8 requires at least one value); a byte string carrying
+// more than one TLV would fan one declared value into several SET members (draft-20 sec. 3.3: one `bytes` is one
+// AttributeValue). There is no downstream DER decoder to catch either (SDA ships c509-only), so the reconstruct
+// arm self-enforces the single-TLV shape rather than splice a degenerate or invalid Attribute.
+// ---- the shared strict-DER gate for a raw-spliced ANY value --------------------------------------
+// Several reconstruct sites splice CALLER/ATTACKER-supplied bytes into the rebuilt certificate verbatim (an
+// AlgorithmIdentifier's `parameters`, a generic otherName's `value [0] EXPLICIT ANY`, a subjectDirectoryAttributes
+// `~oid`-form AttributeValue). asn1.decode validates TLV FRAMING ONLY -- it rejects truncation, trailing bytes and
+// non-minimal lengths, and enforces the DER primitive/constructed rules, but it does NOT check per-type CONTENT:
+// it frames an empty INTEGER, the reserved end-of-contents tag 0, and an out-of-alphabet string quite happily.
+// Splicing those produces a certificate an independent decoder refuses to load, and one this toolkit's OWN readers
+// reject -- so every such site routes through the one gate below instead of a bare asn1.decode.
+
+// Every universal PRIMITIVE tag whose content this toolkit can strictly validate, mapped to its reader. A
+// universal primitive OUTSIDE this map has no strict content validator here, so it is REJECTED rather than
+// spliced unchecked. The documented residual: a value whose type this toolkit cannot yet strictly validate is
+// not compact-representable -- NumericString / VideotexString / GraphicString / GeneralString (no content reader),
+// and a fractional-seconds GeneralizedTime (the X.690 sec. 11.7 relaxation is deliberately scoped to the codec
+// and RFC 3161 timestamping, and must not creep into a third consumer). On the ENCODE path such a value simply
+// degrades to the byte-exact ~oid + byte-string form, losing nothing; on the DECODE path it is a fail-closed
+// verdict rather than a guess.
+var _ANY_VALUE_READERS = (function () {
+  var m = {}, R = asn1.read, T = asn1.TAGS;
+  m[T.BOOLEAN] = R.boolean; m[T.INTEGER] = R.integer; m[T.ENUMERATED] = R.enumerated;
+  m[T.BIT_STRING] = R.bitString; m[T.OCTET_STRING] = R.octetString; m[T.NULL] = R.nullValue;
+  m[T.OBJECT_IDENTIFIER] = R.oid; m[T.UTC_TIME] = R.time; m[T.GENERALIZED_TIME] = R.time;
+  [T.UTF8_STRING, T.PRINTABLE_STRING, T.NUMERIC_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING, T.BMP_STRING, T.UNIVERSAL_STRING].forEach(function (t) { m[t] = R.string; });
+  return m;
+})();
+
+// A universal SET's required member order depends on a type the ANY does not carry: X.690 sec. 11.6 orders a
+// SET OF by the members' full encodings, while a structured SET is ordered by TAG (X.680 sec. 8.6) -- and the two
+// differ whenever the constructed bit does (a SEQUENCE member, tag 16, sorts BEFORE a PrintableString, tag 19, by
+// tag but AFTER it by octets). A structured SET cannot repeat a tag, so a repeated tag proves SET OF and the
+// octet rule binds; with all-distinct tags either reading is possible, so accept a value that satisfies EITHER
+// (rejecting only what is non-canonical under BOTH readings -- sound in both directions, never a guess).
+var _TAG_CLASS_RANK = { universal: 0, application: 1, context: 2, private: 3 };
+function _setOrderOk(kids) {
+  var i, dup = false, seen = {};
+  for (i = 0; i < kids.length; i++) {
+    var key = kids[i].tagClass + ":" + kids[i].tagNumber;
+    if (seen[key]) { dup = true; break; }
+    seen[key] = true;
+  }
+  var octetAsc = true, tagAsc = true;
+  for (i = 1; i < kids.length; i++) {
+    if (Buffer.compare(kids[i - 1].bytes, kids[i].bytes) > 0) octetAsc = false;
+    // Tag order ranks by CLASS first (universal < application < context < private, X.680 sec. 8.6), then by tag
+    // number -- compare the class's NUMBER, never its name (the names do not sort in class order).
+    var pc = _TAG_CLASS_RANK[kids[i - 1].tagClass], cc = _TAG_CLASS_RANK[kids[i].tagClass];
+    if (pc !== cc ? pc > cc : kids[i - 1].tagNumber > kids[i].tagNumber) tagAsc = false;
+  }
+  return dup ? octetAsc : (octetAsc || tagAsc);
+}
+
+// Strict-validate a decoded DER element at ANY depth, in the caller's error domain. Rejects the reserved EOC tag
+// 0; runs a universal primitive through its strict content reader (or rejects a type with none); recurses into a
+// constructed element's children; and holds a universal SET to a canonical order. Only SEQUENCE and SET are
+// accepted as universal CONSTRUCTED types -- an EXTERNAL / EMBEDDED PDV / CHARACTER STRING has mandatory
+// components this gate cannot verify (the degenerate empty form is not a valid encoding of any of them), so it is
+// refused for the same reason an unvalidatable primitive is. A NON-universal element (a legitimately context- or
+// application-tagged ANY) passes on its framing, but its constructed children are still walked.
+function _strictDerElement(node, code, label) {
+  if (node.tagClass === "universal" && node.tagNumber === 0) throw _err(code, label + " must not use the reserved end-of-contents encoding (tag 0)");
+  if (node.constructed) {
+    if (node.tagClass === "universal" && node.tagNumber !== asn1.TAGS.SEQUENCE && node.tagNumber !== asn1.TAGS.SET) {
+      throw _err(code, label + " of universal constructed type " + node.tagNumber + " has no strict DER structure validator here");
+    }
+    var kids = node.children;   // asn1.decode always sets a (possibly empty) children array on a constructed node
+    for (var i = 0; i < kids.length; i++) _strictDerElement(kids[i], code, label);
+    if (node.tagClass === "universal" && node.tagNumber === asn1.TAGS.SET && !_setOrderOk(kids)) {
+      throw _err(code, label + " has a SET whose members are in no canonical DER order (X.690 sec. 11.6 / X.680 sec. 8.6)");
+    }
+    return;
+  }
+  if (node.tagClass === "universal") {
+    // Validate-or-reject: a universal primitive with no strict content reader is NOT accepted on framing alone
+    // (asn1.decode frames a malformed NumericString "12 01 40" happily), so the map is exhaustive by refusal.
+    var reader = _ANY_VALUE_READERS[node.tagNumber];
+    if (!reader) throw _err(code, label + " of universal type " + node.tagNumber + " has no strict DER content validator here");
+    try { reader(node); } catch (e) { throw _err(code, label + " is not a valid DER element for its type", e); }
+  }
+}
+// Raw ANY bytes about to be spliced verbatim must be exactly ONE non-empty, well-formed AND strictly-valid DER
+// element: framing + no-trailing-data via asn1.decode, then content / structure / SET order via
+// _strictDerElement, both reported in the CALLER's error domain. Returns the bytes so a call site can wrap a
+// splice inline. Used by every reconstruct site that emits caller-supplied ANY bytes verbatim.
+function _requireStrictDerTlv(content, code, label) {
+  if (content.length === 0) throw _err(code, label + " must be a non-empty DER element");
+  var node;
+  try { node = asn1.decode(content); } catch (e) { throw _err(code, label + " must be exactly one well-formed DER element (no trailing data)", e); }
+  _strictDerElement(node, code, label);
+  return content;
+}
+
+// asn1.build.set SORTS its members, so handing it a non-canonically-ordered values list would SILENTLY rewrite
+// the declared order -- many distinct C509 encodings would reconstruct one and the same certificate. Require the
+// declared order to already BE canonical, so the compact form maps one-to-one onto the DER it rebuilds.
+function _derSetInDeclaredOrder(vals) {
+  for (var i = 1; i < vals.length; i++) {
+    if (Buffer.compare(vals[i - 1], vals[i]) > 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attributeValue list must be in DER ascending order (X.690 sec. 11.6)");
+  }
+  return b.set(vals);
+}
+
+// [ type1, values1, ... ] -> the DER SubjectDirectoryAttributes. A malformed native value fails closed
+// (c509/bad-extensions); on the encode path the same throw is a round-trip mismatch -> whole-ext ~oid fallback.
+function _sdaToDer(node) {
+  if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes value must be a CBOR array");
+  var kids = node.children;
+  if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes array must be non-empty (attributeType, attributeValue) pairs (sec. 3.3)");
+  var attrs = [];
+  for (var i = 0; i + 1 < kids.length; i += 2) {
+    var typeNode = kids[i], valuesNode = kids[i + 1];
+    if (valuesNode.majorType !== 4 || !valuesNode.children || valuesNode.children.length < 1) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attributeValue must be a non-empty CBOR array (SET OF, SIZE 1..MAX, RFC 5280 sec. 4.2.1.8)");
+    var vals = [];
+    if (typeNode.majorType === 0 || typeNode.majorType === 1) {          // int form: a sec. 8.6 registry alias, text values
+      var ti = Number(cbor.read.int(typeNode));
+      var tname = ATTR_BY_INT[Math.abs(ti)];
+      if (tname === undefined) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attribute type int " + ti + " has no C509 sec. 8.6 registry row");
+      // countryName / serialNumber are PrintableString-restricted -- their int MUST carry the negative
+      // (printableString) sign. A non-negative sign is ambiguous/nonconformant: fail closed rather than
+      // silently coerce the value to PrintableString (the ~oid form is the escape hatch for a genuine odd value).
+      if ((tname === "countryName" || tname === "serialNumber") && ti >= 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes " + tname + " must carry the negative (printableString) sign (it is PrintableString-restricted)");
+      for (var vi = 0; vi < valuesNode.children.length; vi++) {
+        var vn = valuesNode.children[vi];
+        if (vn.majorType !== 3) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes int-form attribute value must be a CBOR text string (a non-string value requires the ~oid form)");
+        // _reconAttrValue -> b.printable / b.utf8 throws only an Asn1Error for a value outside its string type's
+        // alphabet (a printableString sign over non-PrintableString characters); remap it to this module's
+        // domain so attacker-controlled native input fails closed as c509/bad-extensions, not a leaked asn1/*.
+        try { vals.push(_reconAttrValue({ type: tname, value: cbor.read.textString(vn), printable: ti < 0 })); }
+        catch (e) { throw _err("c509/bad-extensions", "a subjectDirectoryAttributes " + tname + " value is not valid for its string type", e); }
+      }
+      attrs.push(b.sequence([b.oid(oid.byName(tname)), _derSetInDeclaredOrder(vals)]));
+    } else if (typeNode.majorType === 2) {                              // ~oid form: raw AttributeValue TLVs
+      var dotted = _oidName(typeNode, "c509/bad-extensions", "a subjectDirectoryAttributes attribute type").oid;
+      for (var vj = 0; vj < valuesNode.children.length; vj++) {
+        var vb = valuesNode.children[vj];
+        if (vb.majorType !== 2) throw _err("c509/bad-extensions", "a ~oid-form subjectDirectoryAttributes value must be a CBOR byte string (a raw DER AttributeValue)");
+        vals.push(b.raw(_requireStrictDerTlv(vb.content, "c509/bad-extensions", "a ~oid-form subjectDirectoryAttributes AttributeValue")));
+      }
+      attrs.push(b.sequence([b.oid(dotted), _derSetInDeclaredOrder(vals)]));
+    } else {
+      throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attribute type must be a CBOR integer (sec. 8.6) or a ~oid");
+    }
+  }
+  return b.sequence(attrs);
+}
+
+// One DER Attribute's SET members -> the int-form { sign, values:[CBOR text] }, or null when the int form is
+// not confidently byte-exact (an unregistered type, a non-utf8/printable value, or a SET mixing utf8String and
+// printableString -- one sign cannot express it). A null routes that ONE attribute to the always-byte-exact
+// ~oid + raw-bytes form (a still-compact sec. 3.3 SDA form); the extension round-trip guard is the ultimate net.
+function _sdaTryIntForm(tint, name, valueNodes) {
+  if (tint === undefined) return null;
+  var i;
+  // An IA5String-only attribute (emailAddress) rides its non-negative int with IA5String values -- its type,
+  // not a sign, fixes the string type, so it is matched separately from the utf8/printable sign convention.
+  if (name === "emailAddress") {
+    var mails = [];
+    for (i = 0; i < valueNodes.length; i++) {
+      if (valueNodes[i].tagClass !== "universal" || valueNodes[i].tagNumber !== asn1.TAGS.IA5_STRING) return null;
+      mails.push(cbor.build.textString(asn1.read.string(valueNodes[i])));
+    }
+    return { sign: 1, values: mails };
+  }
+  var sign = 0, out = [];   // sign: -1 printableString, +1 utf8String
+  for (i = 0; i < valueNodes.length; i++) {
+    var vn = valueNodes[i], s;
+    if (vn.tagClass === "universal" && vn.tagNumber === asn1.TAGS.UTF8_STRING) s = 1;
+    else if (vn.tagClass === "universal" && vn.tagNumber === asn1.TAGS.PRINTABLE_STRING) s = -1;
+    else return null;                                  // any other value tag -> the ~oid form preserves it exactly
+    if (sign === 0) sign = s;
+    else if (sign !== s) return null;                  // a mixed utf8/printable SET -- the headline trap
+    out.push(cbor.build.textString(asn1.read.string(vn)));
+  }
+  return { sign: sign, values: out };
+}
+
+// The DER SubjectDirectoryAttributes -> the flat compact CBOR array, or null (whole-ext ~oid fallback). Per
+// attribute: the int form when the type is sec. 8.6-registered AND every value is a single-signed utf8/
+// printable string, else the ~oid + raw-bytes form (always byte-exact).
+function _sdaFromDer(node) {
+  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
+  var out = [];
+  for (var ai = 0; ai < node.children.length; ai++) {
+    var attr = node.children[ai];
+    if (attr.tagClass !== "universal" || attr.tagNumber !== asn1.TAGS.SEQUENCE || !attr.children || attr.children.length !== 2) return null;
+    var setNode = attr.children[1];
+    if (setNode.tagClass !== "universal" || setNode.tagNumber !== asn1.TAGS.SET || !setNode.children || setNode.children.length < 1) return null;   // SET OF, non-empty
+    var dotted = asn1.read.oid(attr.children[0]);
+    var nm = oid.name(dotted), tint = nm != null ? ATTR_TO_INT[nm] : undefined;
+    var intForm = _sdaTryIntForm(tint, nm, setNode.children);
+    if (intForm != null) {
+      out.push(cbor.build.int(BigInt(intForm.sign < 0 ? -tint : tint)));
+      out.push(cbor.build.array(intForm.values));
+    } else {
+      out.push(_oidCbor(dotted));
+      out.push(cbor.build.array(setNode.children.map(function (v) { return cbor.build.byteString(v.bytes); })));
+    }
+  }
+  return cbor.build.array(out);
+}
+
 // Encode-side guard: emit the compact value only when it decodes back to the EXACT DER extnValue, so a
 // non-canonical or unrepresentable value can never produce a lossy compact form (it falls back to ~oid).
 // A value _extValueFromDer produced but _extValueToDer cannot reconstruct -- an empty GeneralNames the DER
@@ -1063,9 +1311,20 @@ function _macToEui64String(buf) {
 // One RDN attribute value -> its DER string. The C509 sign convention: a positive attribute int ->
 // utf8String, a negative -> printableString; countryName / serialNumber are PrintableString-restricted.
 function _reconAttrValue(rdn) {
-  if (rdn.eui64) return b.utf8(_macToEui64String(rdn.eui64));
-  if (rdn.type === "countryName" || rdn.type === "serialNumber") return b.printable(String(rdn.value));
-  return rdn.printable ? b.printable(String(rdn.value)) : b.utf8(String(rdn.value));
+  if (rdn.eui64) return b.utf8(_macToEui64String(rdn.eui64));   // the bare-form commonName MAC (a fixed 17 chars)
+  var s = String(rdn.value);
+  // The attribute's registered ASN.1 type carries a SIZE constraint as well as an alphabet, and a value outside
+  // it is not a valid encoding of that type: every DirectoryString-valued attribute is SIZE (1..MAX) and
+  // emailAddress is IA5String SIZE (1..MAX) (RFC 5280 App. A.1), so an empty value is never valid; countryName
+  // "SHALL have length 2" (draft sec. 3.1.4, X.520 SIZE (2)). Enforced HERE, the single place the value is built
+  // for its declared type, so the decode, reconstruct and subject-directory-attributes paths cannot disagree.
+  if (s.length === 0) throw _err("c509/bad-name", "a " + rdn.type + " value must be non-empty (SIZE (1..MAX))");
+  if (rdn.type === "countryName" && s.length !== 2) throw _err("c509/bad-name", "a countryName value must have length 2 (draft sec. 3.1.4)");
+  // emailAddress is an IA5String-only attribute (draft sec. 3.1.4): its type, not the int's sign, fixes the
+  // string type, so it reconstructs as an IA5String whichever way the non-negative int was written.
+  if (rdn.type === "emailAddress") return b.ia5(s);
+  if (rdn.type === "countryName" || rdn.type === "serialNumber") return b.printable(s);
+  return rdn.printable ? b.printable(s) : b.utf8(s);
 }
 
 // A Name -> the DER RDNSequence (SEQUENCE OF SET OF SEQUENCE{ type, value }); one attribute per RDN.
@@ -1149,13 +1408,11 @@ function _reconExtensions(exts) {
 function _reconAlgId(alg) {
   var fields = [b.oid(alg.oid)];
   if (alg.parameters && alg.parameters.length) {
-    // AlgorithmIdentifier.parameters is ANY -- exactly one well-formed DER element. Validate the supplied
-    // bytes decode as a single element (the strict decoder rejects trailing bytes / malformed encodings)
-    // before re-emitting them, so a malformed or multi-element parameter blob fails closed rather than
-    // producing an invalid reconstructed AlgorithmIdentifier.
-    try { asn1.decode(alg.parameters); }
-    catch (e) { throw _err("c509/non-invertible", "algorithm parameters are not a single well-formed DER element", e); }
-    fields.push(b.raw(alg.parameters));
+    // AlgorithmIdentifier.parameters is ANY, spliced verbatim -- so it gets the SAME strict gate as every other
+    // raw-ANY splice, not just a framing check. Framing alone admits an empty INTEGER / reserved tag 0 / a
+    // non-minimal INTEGER, each of which reconstructs an AlgorithmIdentifier that an independent X.509 decoder
+    // refuses to load and that this toolkit's own readers reject.
+    fields.push(b.raw(_requireStrictDerTlv(alg.parameters, "c509/non-invertible", "algorithm parameters")));
   }
   return b.sequence(fields);
 }
@@ -1226,6 +1483,9 @@ function parse(input) {
   var f = root.children;
   if (f.length !== 11) throw _err("c509/bad-tbs", "a C509 certificate must be an array of exactly 11 elements, got " + f.length);
 
+  // The type slot must be a CBOR integer -- guard the major type here so a text/array/byte-string field 0 fails
+  // in this module's domain rather than leaking cbor.read.int's cbor/unexpected-major fault to the caller.
+  if (f[0].majorType !== 0 && f[0].majorType !== 1) throw _err("c509/bad-certificate-type", "c509CertificateType must be a CBOR integer");
   var type = Number(cbor.read.int(f[0]));
   if (type !== 2 && type !== 3) throw _err("c509/bad-certificate-type", "c509CertificateType must be 2 (native) or 3 (re-encoded), got " + type);
 
@@ -1492,6 +1752,11 @@ function _c509NameFromDer(nameBytes) {
     if (attrName == null || ATTR_TO_INT[attrName] === undefined) throw _err("c509/non-invertible", "attribute type " + attrName + " has no C509 registry integer");
     var valNode = attr.children[1];
     var value = asn1.read.string(valNode);
+    // The IA5String type belongs ONLY to an IA5-only attribute (emailAddress, draft sec. 3.1.4), whose value
+    // reconstructs from its type rather than the int's sign. Refuse either mismatch here with a precise verdict
+    // instead of emitting an int form whose reconstruction would differ from the source bytes.
+    var isIa5 = valNode.tagClass === "universal" && valNode.tagNumber === asn1.TAGS.IA5_STRING;
+    if ((attrName === "emailAddress") !== isIa5) throw _err("c509/non-invertible", "attribute " + attrName + " carries a " + (isIa5 ? "IA5String" : "non-IA5String") + " value the C509 sec. 8.6 int form cannot represent");
     var eui = attrName === "commonName" ? _euiFromCn(value) : null;
     if (eui) rdns.push({ type: attrName, value: value, eui64: eui });                            // tag-48 MAC commonName
     else rdns.push({ type: attrName, value: value, printable: valNode.tagNumber === asn1.TAGS.PRINTABLE_STRING });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -68,6 +68,8 @@
     "coverage": "c8 --include=lib/** --include=index.js --reporter=text-summary --reporter=lcov node test/smoke.js",
     "check:swallows": "node scripts/check-swallow-coverage.js",
     "coverage:gated": "npm run coverage && npm run check:swallows",
+    "coverage:unified": "node scripts/coverage-unified.js",
+    "coverage:unified:gated": "npm run coverage:unified && npm run check:swallows",
     "prepack": "node scripts/check-pack-against-gitignore.js",
     "check:vendor-currency": "node scripts/check-vendor-currency.js"
   },

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:40b5fc50-7b82-41d2-9e80-f01b6be97878",
+  "serialNumber": "urn:uuid:62c970a5-3536-480a-8269-a0c5d85b82eb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-06T23:41:09.454Z",
+    "timestamp": "2026-08-08T02:38:25.668Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.4.0",
+      "bom-ref": "@blamejs/pki@0.4.1",
       "type": "application",
       "name": "pki",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.4.0",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.4.0",
+      "ref": "@blamejs/pki@0.4.1",
       "dependsOn": []
     }
   ]