@blamejs/pki 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.4.2 — 2026-08-08
+
+A NumericString attribute value no longer shares distinguished-name identity with a printable or UTF-8 value of the same characters -- the comparison that decides name chaining, revocation-issuer matching and name constraints. Alongside it, several C509 name-encoding conformance fixes and a move to Node 24.19.0.
+
+### Changed
+
+- The supported Node floor moves to 24.19.0, the current long-term-support release. Nothing is transpiled, so the supported version is the version the source runs on; the release is verified against that runtime.
+- pki.asn1.read.numericString reads a NumericString value, validated strictly to the digits and space the type permits. The shared string reader no longer accepts the type, so a caller that wants it asks for it by name.
+
+### Fixed
+
+- A NumericString attribute value no longer compares equal to a PrintableString or UTF8String attribute value carrying the same characters. RFC 5280 sec. 7.1 name comparison folds the directory-string types into one identity class, and NumericString is not one of them; because the previous release read it through the shared string reader, it entered that class and was treated as the same name by the comparison that decides certificate chaining, revocation-issuer matching and name-constraint evaluation. It now reads through its own reader and, as before, renders in the RFC 4514 hexadecimal form rather than as a plain string.
+- A natively signed C509 certificate is no longer accepted with, or built carrying, a negative attribute-type integer. The sign of that integer exists only to reproduce the string type of an original X.509 encoding, which a natively signed certificate does not have, so all of its integers are non-negative (draft-ietf-cose-cbor-encoded-cert-20 sec. 3.1.4); the toolkit previously read such a certificate and could also emit one that a conformant implementation must reject.
+- A country name or serial number attribute now keeps the string type its attribute integer's sign declares, and its restriction to the printable-string character subset is enforced on the characters instead. Both signs previously rebuilt the same certificate bytes, so two distinct compact encodings of one value produced one identical certificate under a single signature.
+- The rendered distinguished-name string now escapes its values (RFC 4514 sec. 2.4), so an attribute value containing a comma can no longer read as though the name held several attributes, and a control byte can no longer reach a log line unescaped.
+- An empty issuer name is now refused (RFC 5280 sec. 4.1.2.4 requires a non-empty issuer). It previously parsed and rebuilt a certificate that this toolkit's own certificate parser declines to load. An empty subject is still accepted; the profile pairs that with a subject alternative name, which this codec does not yet require.
+
+## v0.4.1 — 2026-08-07
+
+pki.schema.c509 encodes and decodes the compact subjectDirectoryAttributes value form -- a C509 certificate's subject directory attributes ride their draft-20 registry integers (or unwrapped OIDs) with their directory-string values, interoperating with a conformant C509 implementation rather than only this decoder.
+
+### Added
+
+- pki.schema.c509 encodes and decodes the compact value form for the subjectDirectoryAttributes extension (draft-ietf-cose-cbor-encoded-cert-20 sec. 3.3): a flat array of (attribute type, attribute values) pairs where each type is a sec. 8.6 registry integer (the sign selecting the directory-string type) or an unwrapped OID, and each values slot is a non-empty array holding the attribute's SET of one or more values -- the string values for a registry-integer type, or the raw DER attribute values for an unwrapped-OID type. Both directions invert to the DER extnValue byte-for-byte, so a certificate carrying the extension is the specific compact shape a conformant C509 implementation reads rather than an opaque DER byte string. The encoder is guarded per attribute and per extension: an attribute whose value is not a directory string, or whose value SET mixes string types, uses the unwrapped-OID form for that attribute (keeping the rest of the extension compact); a value the compact form cannot represent falls the whole extension back to the unwrapped-OID byte-string form instead of encoding lossily; and a malformed compact value fails closed with a typed C509Error.
+- The OID registry gains the subjectDirectoryAttributes certificate-extension identifier (2.5.29.9), resolvable through pki.oid.byName / pki.oid.name.
+- The ASN.1 codec reads NumericString (pki.asn1.TAGS.NUMERIC_STRING), the X.520 syntax of the x121Address and internationalISDNNumber directory attributes. It is validated strictly like every other string type: a value outside the digits-and-space set the type permits is rejected as malformed rather than decoded.
+
+### Changed
+
+- A C509 certificate carrying subjectDirectoryAttributes now encodes to -- and decodes from -- its compact CBOR value shape rather than the unwrapped-OID byte-string form an earlier release emitted; both reconstruct the same DER, but the CBOR bytes differ, so re-encode any C509 produced by an earlier release.
+
 ## v0.4.0 — 2026-08-06
 
 CRL issuance and verification, PKCS#12 build and open, attribute-certificate issuance, and the key-material lifecycle graduate to stable, and pki.schema.c509 adds the compact policyMappings and policyConstraints value forms -- a C509 certificate's policy mappings and policy constraints now ride their specific draft-20 CBOR shape and interoperate with a conformant C509 implementation rather than only this decoder.

package/README.md

@@ -63,7 +63,7 @@ Web Crypto API with its limits on streaming, opaque keys, and algorithm reach.
 npm i @blamejs/pki
 ```
 
-Requires Node.js 24.18+ (runs on the shipped runtime — no build step, no
+Requires Node.js 24.19+ (runs on the shipped runtime — no build step, no
 transpilation).
 
 ```js
@@ -204,7 +204,7 @@ is callable today; nothing below is a stub.
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more), the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec, certificate policies (registry-integer or OID policy identifiers with their CPS-URI and UserNotice qualifiers), and policy mappings and policy constraints; a certificate outside the invertible set throws a typed `C509Error` |
+| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more), the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec, certificate policies (registry-integer or OID policy identifiers with their CPS-URI and UserNotice qualifiers), and policy mappings and policy constraints, and subject directory attributes; a certificate outside the invertible set throws a typed `C509Error` |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |

package/lib/asn1-der.js

@@ -66,6 +66,7 @@ var UNIVERSAL_TYPES = {
   UTF8_STRING:       { tag: 0x0c, form: "primitive" },
   SEQUENCE:          { tag: 0x10, form: "constructed" },
   SET:               { tag: 0x11, form: "constructed" },
+  NUMERIC_STRING:    { tag: 0x12, form: "primitive" },
   PRINTABLE_STRING:  { tag: 0x13, form: "primitive" },
   TELETEX_STRING:    { tag: 0x14, form: "primitive" },
   IA5_STRING:        { tag: 0x16, form: "primitive" },
@@ -95,7 +96,7 @@ var CONSTRUCTED_BIT   = 0x20;
 // constructed-capable set is DERIVED from the registry above and keyed by tag
 // for an O(1) decode-time form check. It is a WHITELIST: a universal tag
 // outside it -- a registered primitive type and an unregistered one
-// (NumericString, GeneralString, ObjectDescriptor, REAL, ...) alike -- has no
+// (GeneralString, ObjectDescriptor, REAL, ...) alike -- has no
 // DER constructed form, so the default is reject.
 var CONSTRUCTED_ONLY_UNIVERSAL_TAGS = Object.create(null);
 Object.keys(UNIVERSAL_TYPES).forEach(function (k) {
@@ -622,6 +623,24 @@ function _decodePrintable(buf) {
   return s;
 }
 
+// NumericString (X.680 sec. 41, Table 9) permits ONLY the digits and SPACE. It carries the X.520 syntax of the
+// x121Address and internationalISDNNumber directory attributes.
+//
+// It is read through its OWN reader, deliberately NOT through readString. Every type readString returns a
+// plain string for enters the RFC 5280 sec. 7.1 name-comparison identity class, and
+// guard.name.dnEqual -- the single choke point for name chaining, revocation-issuer matching and name
+// constraints -- compares the strings it returns. Admitting NumericString there would make a NumericString
+// attribute value compare EQUAL to a PrintableString / UTF8String one with the same characters, silently
+// widening distinguished-name identity across the whole toolkit. A caller that genuinely wants this type asks
+// for it by name.
+function readNumericString(node) {
+  _expectUniversal(node, TAGS.NUMERIC_STRING, "readNumericString");
+  _expectPrimitive(node, "readNumericString");
+  var s = node.content.toString("latin1");
+  if (!NUMERIC_RE.test(s)) throw new Asn1Error("asn1/bad-numeric-string", "NumericString has characters outside the digits-and-space set");
+  return s;
+}
+
 // UTF8String must be well-formed UTF-8; a lenient decoder substitutes U+FFFD
 // for invalid sequences, silently mangling hostile input into valid text.
 function _decodeUtf8Strict(buf) {
@@ -870,6 +889,7 @@ function encodeOidContent(dotted) {
 }
 
 var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
+var NUMERIC_RE = /^[0-9 ]*$/;
 
 function _fmtTwo(n) { return (n < 10 ? "0" : "") + n; }
 
@@ -1067,6 +1087,7 @@ module.exports = {
     booleanImplicit: readBooleanImplicit,
     oid:          readOid,
     string:       readString,
+    numericString: readNumericString,
     time:         readTime,
   },
 };

package/lib/oid.js

@@ -60,6 +60,7 @@ var FAMILIES = {
 
   // RFC 5280 certificate extensions.
   certExtension: { base: [2, 5, 29], of: {
+    subjectDirectoryAttributes: 9,   // id-ce 9 (RFC 5280 sec. 4.2.1.8) -> 2.5.29.9
     subjectKeyIdentifier: 14, keyUsage: 15, subjectAltName: 17, issuerAltName: 18,
     basicConstraints: 19,
     // CRL + CRL-entry extensions (RFC 5280 sec. 5.2, sec. 5.3)

package/lib/schema-c509.js

@@ -57,10 +57,12 @@ var PK_ALG_BY_INT = {
 // EC curve -> field size in bytes (the SEC1 coordinate width), for point-length validation.
 var EC_FIELD_BYTES = { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 };
 
-// sec. 8.6 RDN attribute types (abs(int) -> name; the sign selects the X.509 string type). emailAddress
-// (int 0) is an IA5String value not covered by the DirectoryString SpecialText codec below, so it is
-// declined; a DN carrying it encodes via the ~oid attribute form, not this alias table.
+// sec. 8.6 RDN attribute types (abs(int) -> name; the sign selects the X.509 string type: positive utf8String,
+// negative printableString). An attribute whose value is ALWAYS an IA5String is instead "unambiguously
+// represented using a non-negative int" (draft sec. 3.1.4) -- emailAddress is int 0, so its value reconstructs
+// as an IA5String and its sign carries no string-type meaning.
 var ATTR_BY_INT = {
+  0: _name("emailAddress"),
   1: _name("commonName"),
   2: _name("surname"),
   3: _name("serialNumber"),
@@ -87,6 +89,7 @@ var EXT_BY_INT = {
   7: _name("authorityKeyIdentifier"),
   8: _name("extKeyUsage"),
   9: _name("authorityInfoAccess"),
+  24: _name("subjectDirectoryAttributes"),
   25: _name("issuerAltName"),
   26: _name("nameConstraints"),
   27: _name("policyMappings"),
@@ -104,7 +107,7 @@ var EXT_COMPACT = {
   extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
   subjectAltName: 1, issuerAltName: 1, nameConstraints: 1, cRLDistributionPoints: 1,
   freshestCRL: 1, authorityInfoAccess: 1, subjectInfoAccess: 1, certificatePolicies: 1,
-  policyMappings: 1, policyConstraints: 1,
+  policyMappings: 1, policyConstraints: 1, subjectDirectoryAttributes: 1,
 };
 // sec. 8.12 Extended Key Usages registry (C509 int -> registered id-kp purpose name). A KeyPurposeId
 // outside this set encodes as an unwrapped ~oid; a C509 int outside it fails closed on decode.
@@ -240,14 +243,35 @@ function _specialText(node) {
 
 // A single Name (sec. 3.1.4/sec. 3.1.6): the CBOR simple null (issuer only) | a bare SpecialText single
 // commonName | an array of RDNAttributes. Surfaces { dn, rdns, eui64? } shape-compatible with x509.
-function _name509(node, isSubject) {
+// An rdn's (attribute type, sign) pair DECLARES an X.509 string type, so its text must be valid for that type --
+// a printableString sign over a non-PrintableString character, a non-ASCII emailAddress (IA5String-only), or a
+// value outside the type's SIZE. Assert it by running the SAME builder the reconstruction uses, so a Name this
+// parse accepts is always one it can rebuild, and a natively-signed certificate (which never reconstructs) is
+// held to the identical rule. Applied to BOTH Name forms -- the array form and the bare single-commonName form.
+// The builder's asn1/* fault is re-thrown in this module's domain rather than leaking onto the parse surface.
+function _assertAttrValue(rdn) {
+  try { _reconAttrValue(rdn); }
+  catch (e) {
+    if (e instanceof C509Error) throw e;
+    throw _err("c509/bad-name", "the " + rdn.type + " value is not valid for the string type its attribute integer declares", e);
+  }
+}
+
+function _name509(node, isSubject, isNative) {
   if (!isSubject && node.majorType === 7 && node.ai === 22) return null;   // issuer == subject (self-signed)
   // A bare SpecialText (not an array) is a single commonName attribute (attributeType == +1).
   if (node.majorType === 3 || node.majorType === 2 || node.majorType === 6) {
     var sv = _specialText(node);
+    // The bare form is a single commonName -- hold its value to the SAME rules the array form applies, so a
+    // natively-signed certificate (which never reconstructs) cannot carry a value the reconstruction would refuse.
+    // A tag-48 MAC renders to a fixed 17-character EUI-64 string that satisfies every value rule by
+    // construction, and _reconAttrValue short-circuits on eui64 before any of them -- so asserting here would
+    // be a no-op. The rules bind on the TEXT forms below.
     if (sv.eui64) return { rdns: [{ type: "commonName", eui64: sv.eui64 }], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
     var val = sv.text !== undefined ? sv.text : sv.hex;
-    return { rdns: [{ type: "commonName", value: val }], dn: "CN=" + val };
+    var bareRdn = { type: "commonName", value: val };
+    _assertAttrValue(bareRdn);
+    return { rdns: [bareRdn], dn: "CN=" + guard.name.escapeDnValue(val) };
   }
   if (node.majorType !== 4) throw _err("c509/bad-name", "a C509 Name must be null, a SpecialText, or an array of RDN attributes");
   var rdns = [];
@@ -256,6 +280,10 @@ function _name509(node, isSubject) {
   // Each RDN attribute is an (attributeType, attributeValue) pair; an odd-length array is a dangling
   // attribute type with no value -- reject rather than silently drop the trailing element.
   if (kids.length % 2 !== 0) throw _err("c509/bad-name", "a C509 Name array must be attribute-type/value pairs (dangling attribute type)");
+  // RFC 5280 sec. 4.1.2.4 -- the issuer MUST be a non-empty distinguished name (only the SUBJECT may be empty,
+  // for the subjectAltName case). An empty issuer array would reconstruct a certificate this toolkit's OWN
+  // x509.parse refuses to load (x509/bad-issuer), so the codec must not produce one.
+  if (kids.length === 0 && !isSubject) throw _err("c509/bad-name", "the issuer Name must not be empty (RFC 5280 sec. 4.1.2.4)");
   for (var i = 0; i + 1 < kids.length; i += 2) {
     // The attributeType slot must be a CBOR integer (major type 0/1). Guard the major type BEFORE the read
     // so a non-integer type slot fails in this module's own domain (c509/bad-name), matching the value slot,
@@ -264,15 +292,30 @@ function _name509(node, isSubject) {
     // Identifier issuer, cRLDistributionPoints cRLIssuer, nameConstraints subtree base) and the top-level Name.
     if (kids[i].majorType !== 0 && kids[i].majorType !== 1) throw _err("c509/bad-name", "a C509 Name attribute type must be a CBOR integer");
     var ti = Number(cbor.read.int(kids[i]));
+    // draft sec. 3.1.4: "in natively signed C509 certificates all CBOR ints SHALL be non-negative." The sign
+    // exists ONLY to reproduce the string type of an original X.509 DER, which a native certificate does not
+    // have -- so a negative attributeType there is an encoding no conformant producer emits, and accepting it
+    // would let this parser read a natively-signed name a conformant peer must reject.
+    if (isNative && ti < 0) throw _err("c509/bad-name", "a natively signed C509 Name attribute type integer must be non-negative (draft sec. 3.1.4), got " + ti);
     var tname = ATTR_BY_INT[Math.abs(ti)];
     if (tname === undefined) throw _err("c509/bad-name", "attribute type integer " + ti + " has no C509 registry row");
     var v = _specialText(kids[i + 1]);
     var vv = v.text !== undefined ? v.text : (v.hex !== undefined ? v.hex : _macToEui64String(v.eui64));
-    rdns.push({ type: tname, value: vv, printable: ti < 0 });
-    parts.push(_shortName(tname) + "=" + vv);
+    // The RENDERED text is what carries into the rdn -- deliberately NOT the raw eui64, because the EUI shortcut
+    // in _reconAttrValue is unconditional and would take precedence over the attribute's declared string type,
+    // rebuilding a tag-48 emailAddress or countryName as a UTF8String. Only the bare-SpecialText form above is
+    // always a commonName and may carry it; here the value is held to whatever type the attribute integer declares.
+    var rdn = { type: tname, value: vv, printable: ti < 0 };
+    _assertAttrValue(rdn);
+    rdns.push(rdn);
+    parts.push(_shortName(tname) + "=" + guard.name.escapeDnValue(vv));
   }
   return { rdns: rdns, dn: parts.join(",") };
 }
+// The rendered dn is an RFC 4514 string, so every VALUE is escaped through the shared guard the rest of the
+// toolkit renders names with. Raw concatenation would let a single attribute whose value contains a comma
+// render identically to a genuine multi-RDN name (a spoofable identity string, and the ONLY name surface a
+// natively signed certificate has, since it never reconstructs DER), and would carry control bytes into logs.
 function _shortName(n) { return n === "commonName" ? "CN" : n === "countryName" ? "C" : n === "organizationName" ? "O" : n === "organizationalUnitName" ? "OU" : n === "localityName" ? "L" : n === "stateOrProvinceName" ? "ST" : n; }
 
 // ---- compact per-extension value codec (draft-20 sec. 3.3) -------------------
@@ -361,9 +404,9 @@ function _namedBitsFromContent(bytes, unusedBits) {
 
 // One C509 (int, value) general name -> one DER GeneralName TLV. `ipMode` (name-constraints subtree base)
 // only changes the iPAddress arm: SAN is a bare 4/16-octet address, a subtree base is the RFC 9549 form.
-function _generalNameToDer(intVal, valueNode, ipMode) {
+function _generalNameToDer(intVal, valueNode, ipMode, isNative) {
   if (intVal === 1 || intVal === 2 || intVal === 6) return b.contextPrimitive(intVal, _ia5Bytes(valueNode, intVal));   // IMPLICIT IA5String
-  if (intVal === 4) return b.explicit(4, _reconName(_name509(valueNode, true)));                                       // directoryName [4] EXPLICIT Name
+  if (intVal === 4) return b.explicit(4, _reconName(_name509(valueNode, true, isNative)));                                       // directoryName [4] EXPLICIT Name
   if (intVal === 7) return b.contextPrimitive(7, ipMode ? _ncIpToDer(valueNode) : _sanIpBytes(valueNode));             // iPAddress [7] IMPLICIT OCTET STRING
   if (intVal === 8) return b.contextPrimitive(8, asn1.encodeOidContent(_oidName(valueNode, "c509/bad-extensions", "a registeredID [8]").oid));  // registeredID [8] IMPLICIT OID
   if (intVal === 0 || intVal === -1 || intVal === -2 || intVal === -3) return _otherNameToDer(valueNode, intVal);      // otherName [0]
@@ -389,12 +432,12 @@ function _generalNameFromDer(gn, ipMode) {
 // them: a universal SEQUENCE for SAN/IAN, an implicit [n] for AKI issuer / DP cRLIssuer). These are always
 // SAN-form (the RFC 9549 subtree-base iPAddress form is name-constraints-only and routes through
 // _subtreesToDer / _subtreesFromDer, which call the singular codec with ipMode directly).
-function _generalNamesToDer(node) {
+function _generalNamesToDer(node, isNative) {
   if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a GeneralNames value must be a CBOR array");
   var kids = node.children;
   if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a GeneralNames array must be non-empty (int, value) pairs (sec. 3.3)");
   var out = [];
-  for (var i = 0; i + 1 < kids.length; i += 2) out.push(_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralName type")), kids[i + 1], false));
+  for (var i = 0; i + 1 < kids.length; i += 2) out.push(_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralName type")), kids[i + 1], false, isNative));
   return out;
 }
 // The inverse: a list of DER GeneralName nodes -> the flat CBOR items, or null if ANY member is not
@@ -420,8 +463,8 @@ function _otherNameToDer(node, intVal) {
     if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a generic otherName value must be a CBOR [ ~oid, bytes ] pair");
     typeId = _oidName(node.children[0], "c509/bad-extensions", "an otherName type-id").oid;
     if (node.children[1].majorType !== 2) throw _err("c509/bad-extensions", "an otherName value must be a CBOR byte string (the [0] EXPLICIT inner TLV)");
-    inner = node.children[1].content;
-    try { asn1.decode(inner); } catch (e) { throw _err("c509/bad-extensions", "an otherName value is not a single well-formed DER element", e); }
+    // The [0] EXPLICIT inner TLV is an ANY spliced verbatim -- strict-validate it, not just its framing.
+    inner = _requireStrictDerTlv(node.children[1].content, "c509/bad-extensions", "an otherName value");
   } else if (intVal === -1) {   // id-on-hardwareModuleName: [ ~oid(hwType), bytes(hwSerialNum) ] -> HardwareModuleName
     if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "an id-on-hardwareModuleName value must be a CBOR [ ~oid, bytes ] pair");
     if (node.children[1].majorType !== 2) throw _err("c509/bad-extensions", "a hardwareModuleName hwSerialNum must be a CBOR byte string");
@@ -515,12 +558,12 @@ function _ncIpFromDer(buf) {
 // GeneralSubtrees = [ + GeneralName ] (the flat int/value array) <-> the concatenated GeneralSubtree
 // SEQUENCEs (RFC 5280 sec. 4.2.1.10: SEQUENCE { base, minimum [0] DEFAULT 0, maximum [1] OPTIONAL }); the
 // C509 profile omits minimum/maximum, so each GeneralSubtree is base-only.
-function _subtreesToDer(node) {
+function _subtreesToDer(node, isNative) {
   if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a GeneralSubtrees value must be a CBOR array");
   var kids = node.children;
   if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a GeneralSubtrees array must be non-empty (int, value) pairs");
   var out = [];
-  for (var i = 0; i + 1 < kids.length; i += 2) out.push(b.sequence([_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralSubtree base type")), kids[i + 1], true)]));
+  for (var i = 0; i + 1 < kids.length; i += 2) out.push(b.sequence([_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralSubtree base type")), kids[i + 1], true, isNative)]));
   return Buffer.concat(out);
 }
 function _subtreesFromDer(subtreeNodes) {
@@ -628,7 +671,7 @@ function _qualifierFromDer(pq) {
 // One CBOR DistributionPointName [ fullName, reasons, cRLIssuer ] -> one DER DistributionPoint SEQUENCE.
 // distributionPoint [0] is EXPLICIT (it wraps the DistributionPointName CHOICE); fullName [0], reasons [1],
 // cRLIssuer [2] are IMPLICIT (RFC 5280 sec. 4.2.1.13) -- mixing these is the classic byte-exactness trap.
-function _dpToDer(dpNode) {
+function _dpToDer(dpNode, isNative) {
   if (dpNode.majorType !== 4 || !dpNode.children || dpNode.children.length !== 3) throw _err("c509/bad-extensions", "a DistributionPoint must be a CBOR [ fullName, reasons, cRLIssuer ] array");
   var fullName = dpNode.children[0], reasons = dpNode.children[1], crlIssuer = dpNode.children[2];
   var uris;
@@ -639,7 +682,7 @@ function _dpToDer(dpNode) {
   } else throw _err("c509/bad-extensions", "a DistributionPoint fullName must be a URI text or an array of URIs");
   var fields = [b.explicit(0, b.contextConstructed(0, Buffer.concat(uris)))];   // distributionPoint [0] EXPLICIT { fullName [0] IMPLICIT GeneralNames }
   if (!_isCborNull(reasons)) fields.push(_reasonsBitsToDer(Number(_cborUint(reasons, "cRLDistributionPoints reasons"))));
-  if (!_isCborNull(crlIssuer)) fields.push(b.contextConstructed(2, b.explicit(4, _reconName(_name509(crlIssuer, true)))));   // cRLIssuer [2] { [4] directoryName }
+  if (!_isCborNull(crlIssuer)) fields.push(b.contextConstructed(2, b.explicit(4, _reconName(_name509(crlIssuer, true, isNative)))));   // cRLIssuer [2] { [4] directoryName }
   return b.sequence(fields);
 }
 // One DER DistributionPoint SEQUENCE -> the pieces for the CBOR DistributionPointName, or null when the DP
@@ -686,7 +729,7 @@ function _dpFromDer(dp) {
 
 // Decode a compact extension value (a decoded CBOR node) to the DER extnValue inner content. Fails closed
 // (c509/bad-extensions) on a CBOR shape the named extension does not define.
-function _extValueToDer(name, node) {
+function _extValueToDer(name, node, isNative) {
   switch (name) {
     case "subjectKeyIdentifier":   // KeyIdentifier = bytes -> OCTET STRING(keyid)
       if (node.majorType !== 2) throw _err("c509/bad-extensions", "a subjectKeyIdentifier value must be a CBOR byte string");
@@ -706,7 +749,7 @@ function _extValueToDer(name, node) {
         if (node.children[0].majorType !== 2) throw _err("c509/bad-extensions", "an authorityKeyIdentifier keyIdentifier must be a CBOR byte string");
         return b.sequence([
           b.contextPrimitive(0, node.children[0].content),                                           // keyIdentifier [0] IMPLICIT OCTET STRING
-          b.contextConstructed(1, Buffer.concat(_generalNamesToDer(node.children[1]))),       // authorityCertIssuer [1] IMPLICIT GeneralNames
+          b.contextConstructed(1, Buffer.concat(_generalNamesToDer(node.children[1], isNative))),       // authorityCertIssuer [1] IMPLICIT GeneralNames
           b.contextPrimitive(2, _serialIntContent(node.children[2])),                                // authorityCertSerialNumber [2] IMPLICIT INTEGER
         ]);
       }
@@ -733,12 +776,12 @@ function _extValueToDer(name, node) {
     case "subjectAltName":
     case "issuerAltName":          // SubjectAltName = GeneralNames / text (exactly one dNSName -> bare text)
       if (node.majorType === 3) return b.sequence([b.contextPrimitive(2, _ia5Bytes(node, 2))]);
-      return b.sequence(_generalNamesToDer(node));
+      return b.sequence(_generalNamesToDer(node, isNative));
     case "nameConstraints": {      // [ permittedSubtrees / null, excludedSubtrees / null ]
       if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a nameConstraints value must be a 2-element CBOR array [ permitted, excluded ] (sec. 3.3)");
       var ncFields = [];
-      if (!_isCborNull(node.children[0])) ncFields.push(b.contextConstructed(0, _subtreesToDer(node.children[0])));   // permittedSubtrees [0]
-      if (!_isCborNull(node.children[1])) ncFields.push(b.contextConstructed(1, _subtreesToDer(node.children[1])));   // excludedSubtrees [1]
+      if (!_isCborNull(node.children[0])) ncFields.push(b.contextConstructed(0, _subtreesToDer(node.children[0], isNative)));   // permittedSubtrees [0]
+      if (!_isCborNull(node.children[1])) ncFields.push(b.contextConstructed(1, _subtreesToDer(node.children[1], isNative)));   // excludedSubtrees [1]
       if (ncFields.length === 0) throw _err("c509/bad-extensions", "nameConstraints must contain permittedSubtrees or excludedSubtrees (RFC 5280 sec. 4.2.1.10)");
       return b.sequence(ncFields);
     }
@@ -755,7 +798,7 @@ function _extValueToDer(name, node) {
     case "freshestCRL":            // [ + DistributionPointName ] / text (one DP, one-URI fullName -> bare text)
       if (node.majorType === 3) return b.sequence([b.sequence([b.explicit(0, b.contextConstructed(0, b.contextPrimitive(6, _ia5Bytes(node, 6))))])]);
       if (node.majorType !== 4 || !node.children || node.children.length < 1) throw _err("c509/bad-extensions", "a " + name + " value must be a CBOR array of DistributionPoints or a bare URI text (sec. 3.3)");
-      return b.sequence(node.children.map(function (dp) { return _dpToDer(dp); }));
+      return b.sequence(node.children.map(function (dp) { return _dpToDer(dp, isNative); }));
     case "certificatePolicies": {   // [ pid, [ *(qid, qtext) ], ... ] -> SEQUENCE OF PolicyInformation
       if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a certificatePolicies value must be a CBOR array");
       var cpKids = node.children;
@@ -802,6 +845,8 @@ function _extValueToDer(name, node) {
       if (pcFields.length === 0) throw _err("c509/bad-extensions", "policyConstraints must contain requireExplicitPolicy or inhibitPolicyMapping (RFC 5280 sec. 4.2.1.11)");
       return b.sequence(pcFields);   // positional slot -> tag makes [0] < [1] unique + ascending by construction
     }
+    case "subjectDirectoryAttributes":   // [ type, values, type, values, ... ] -> SEQUENCE OF Attribute (sec. 3.3)
+      return _sdaToDer(node, isNative);
     default:
       throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
   }
@@ -964,6 +1009,8 @@ function _extValueFromDer(name, der) {
       }
       return cbor.build.array([repC, ipmC]);
     }
+    case "subjectDirectoryAttributes":                              // SEQUENCE OF Attribute -> [ type, values, ... ]
+      return _sdaFromDer(node);
     default:
       return null;
   }
@@ -972,6 +1019,225 @@ function _extValueFromDer(name, der) {
   }
 }
 
+// ---- subjectDirectoryAttributes compact value codec (draft-20 sec. 3.3 / 8.6 / 8.8, RFC 5280 sec. 4.2.1.8) ----
+// SubjectDirectoryAttributes ::= SEQUENCE SIZE(1..MAX) OF Attribute ::= SEQUENCE { type, values SET OF value }.
+// The compact form is a flat CBOR array [ type1, values1, ... ] where each values slot is ITSELF a non-empty
+// CBOR array -- an Attribute's SET may hold more than one value, unlike a Name's single-value RDN. type is a
+// sec. 8.6 registry int (the sign selects the string type) with text values, or an unwrapped ~oid with raw DER
+// value bytes (an unregistered type stays compact via its own ~oid form, never dropping the whole extension).
+// The extension-level _tryCompactExtValue round-trip guard is the byte-exactness net.
+
+// A ~oid-form attributeValue must be exactly ONE non-empty, well-formed DER AttributeValue TLV. An empty byte
+// string would build a SET OF SIZE 0 (RFC 5280 sec. 4.2.1.8 requires at least one value); a byte string carrying
+// more than one TLV would fan one declared value into several SET members (draft-20 sec. 3.3: one `bytes` is one
+// AttributeValue). There is no downstream DER decoder to catch either (SDA ships c509-only), so the reconstruct
+// arm self-enforces the single-TLV shape rather than splice a degenerate or invalid Attribute.
+// ---- the shared strict-DER gate for a raw-spliced ANY value --------------------------------------
+// Several reconstruct sites splice CALLER/ATTACKER-supplied bytes into the rebuilt certificate verbatim (an
+// AlgorithmIdentifier's `parameters`, a generic otherName's `value [0] EXPLICIT ANY`, a subjectDirectoryAttributes
+// `~oid`-form AttributeValue). asn1.decode validates TLV FRAMING ONLY -- it rejects truncation, trailing bytes and
+// non-minimal lengths, and enforces the DER primitive/constructed rules, but it does NOT check per-type CONTENT:
+// it frames an empty INTEGER, the reserved end-of-contents tag 0, and an out-of-alphabet string quite happily.
+// Splicing those produces a certificate an independent decoder refuses to load, and one this toolkit's OWN readers
+// reject -- so every such site routes through the one gate below instead of a bare asn1.decode.
+
+// Every universal PRIMITIVE tag whose content this toolkit can strictly validate, mapped to its reader. A
+// universal primitive OUTSIDE this map has no strict content validator here, so it is REJECTED rather than
+// spliced unchecked. The documented residual: a value whose type this toolkit cannot yet strictly validate is
+// not compact-representable -- VideotexString / GraphicString / GeneralString / ObjectDescriptor / REAL (no
+// content reader in this toolkit), and a fractional-seconds GeneralizedTime (the X.690 sec. 11.7 relaxation is deliberately scoped to the codec
+// and RFC 3161 timestamping, and must not creep into a third consumer). On the ENCODE path such a value simply
+// degrades to the byte-exact ~oid + byte-string form, losing nothing; on the DECODE path it is a fail-closed
+// verdict rather than a guess.
+var _ANY_VALUE_READERS = (function () {
+  var m = {}, R = asn1.read, T = asn1.TAGS;
+  m[T.BOOLEAN] = R.boolean; m[T.INTEGER] = R.integer; m[T.ENUMERATED] = R.enumerated;
+  m[T.BIT_STRING] = R.bitString; m[T.OCTET_STRING] = R.octetString; m[T.NULL] = R.nullValue;
+  m[T.OBJECT_IDENTIFIER] = R.oid; m[T.UTC_TIME] = R.time; m[T.GENERALIZED_TIME] = R.time;
+  // NumericString reads through its OWN reader: it is not a DirectoryString type, and routing it through
+  // read.string would fold it into the RFC 5280 sec. 7.1 name-comparison identity class (see asn1-der.js).
+  m[T.NUMERIC_STRING] = R.numericString;
+  [T.UTF8_STRING, T.PRINTABLE_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING, T.BMP_STRING, T.UNIVERSAL_STRING].forEach(function (t) { m[t] = R.string; });
+  return m;
+})();
+
+// A universal SET's required member order depends on a type the ANY does not carry: X.690 sec. 11.6 orders a
+// SET OF by the members' full encodings, while a structured SET is ordered by TAG (X.680 sec. 8.6) -- and the two
+// differ whenever the constructed bit does (a SEQUENCE member, tag 16, sorts BEFORE a PrintableString, tag 19, by
+// tag but AFTER it by octets). A structured SET cannot repeat a tag, so a repeated tag proves SET OF and the
+// octet rule binds; with all-distinct tags either reading is possible, so accept a value that satisfies EITHER
+// (rejecting only what is non-canonical under BOTH readings -- sound in both directions, never a guess).
+var _TAG_CLASS_RANK = { universal: 0, application: 1, context: 2, private: 3 };
+function _setOrderOk(kids) {
+  var i, dup = false, seen = {};
+  for (i = 0; i < kids.length; i++) {
+    var key = kids[i].tagClass + ":" + kids[i].tagNumber;
+    if (seen[key]) { dup = true; break; }
+    seen[key] = true;
+  }
+  var octetAsc = true, tagAsc = true;
+  for (i = 1; i < kids.length; i++) {
+    if (Buffer.compare(kids[i - 1].bytes, kids[i].bytes) > 0) octetAsc = false;
+    // Tag order ranks by CLASS first (universal < application < context < private, X.680 sec. 8.6), then by tag
+    // number -- compare the class's NUMBER, never its name (the names do not sort in class order).
+    var pc = _TAG_CLASS_RANK[kids[i - 1].tagClass], cc = _TAG_CLASS_RANK[kids[i].tagClass];
+    if (pc !== cc ? pc > cc : kids[i - 1].tagNumber > kids[i].tagNumber) tagAsc = false;
+  }
+  return dup ? octetAsc : (octetAsc || tagAsc);
+}
+
+// Strict-validate a decoded DER element at ANY depth, in the caller's error domain. Rejects the reserved EOC tag
+// 0; runs a universal primitive through its strict content reader (or rejects a type with none); recurses into a
+// constructed element's children; and holds a universal SET to a canonical order. Only SEQUENCE and SET are
+// accepted as universal CONSTRUCTED types -- an EXTERNAL / EMBEDDED PDV / CHARACTER STRING has mandatory
+// components this gate cannot verify (the degenerate empty form is not a valid encoding of any of them), so it is
+// refused for the same reason an unvalidatable primitive is. A NON-universal element (a legitimately context- or
+// application-tagged ANY) passes on its framing, but its constructed children are still walked.
+function _strictDerElement(node, code, label) {
+  if (node.tagClass === "universal" && node.tagNumber === 0) throw _err(code, label + " must not use the reserved end-of-contents encoding (tag 0)");
+  if (node.constructed) {
+    if (node.tagClass === "universal" && node.tagNumber !== asn1.TAGS.SEQUENCE && node.tagNumber !== asn1.TAGS.SET) {
+      throw _err(code, label + " of universal constructed type " + node.tagNumber + " has no strict DER structure validator here");
+    }
+    var kids = node.children;   // asn1.decode always sets a (possibly empty) children array on a constructed node
+    for (var i = 0; i < kids.length; i++) _strictDerElement(kids[i], code, label);
+    if (node.tagClass === "universal" && node.tagNumber === asn1.TAGS.SET && !_setOrderOk(kids)) {
+      throw _err(code, label + " has a SET whose members are in no canonical DER order (X.690 sec. 11.6 / X.680 sec. 8.6)");
+    }
+    return;
+  }
+  if (node.tagClass === "universal") {
+    // Validate-or-reject: a universal primitive with no strict content reader is NOT accepted on framing alone
+    // (asn1.decode frames a malformed NumericString "12 01 40" happily), so the map is exhaustive by refusal.
+    var reader = _ANY_VALUE_READERS[node.tagNumber];
+    if (!reader) throw _err(code, label + " of universal type " + node.tagNumber + " has no strict DER content validator here");
+    try { reader(node); } catch (e) { throw _err(code, label + " is not a valid DER element for its type", e); }
+  }
+}
+// Raw ANY bytes about to be spliced verbatim must be exactly ONE non-empty, well-formed AND strictly-valid DER
+// element: framing + no-trailing-data via asn1.decode, then content / structure / SET order via
+// _strictDerElement, both reported in the CALLER's error domain. Returns the bytes so a call site can wrap a
+// splice inline. Used by every reconstruct site that emits caller-supplied ANY bytes verbatim.
+function _requireStrictDerTlv(content, code, label) {
+  if (content.length === 0) throw _err(code, label + " must be a non-empty DER element");
+  var node;
+  try { node = asn1.decode(content); } catch (e) { throw _err(code, label + " must be exactly one well-formed DER element (no trailing data)", e); }
+  _strictDerElement(node, code, label);
+  return content;
+}
+
+// asn1.build.set SORTS its members, so handing it a non-canonically-ordered values list would SILENTLY rewrite
+// the declared order -- many distinct C509 encodings would reconstruct one and the same certificate. Require the
+// declared order to already BE canonical, so the compact form maps one-to-one onto the DER it rebuilds.
+function _derSetInDeclaredOrder(vals) {
+  for (var i = 1; i < vals.length; i++) {
+    if (Buffer.compare(vals[i - 1], vals[i]) > 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attributeValue list must be in DER ascending order (X.690 sec. 11.6)");
+  }
+  return b.set(vals);
+}
+
+// [ type1, values1, ... ] -> the DER SubjectDirectoryAttributes. A malformed native value fails closed
+// (c509/bad-extensions); on the encode path the same throw is a round-trip mismatch -> whole-ext ~oid fallback.
+function _sdaToDer(node, isNative) {
+  if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes value must be a CBOR array");
+  var kids = node.children;
+  if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes array must be non-empty (attributeType, attributeValue) pairs (sec. 3.3)");
+  var attrs = [];
+  for (var i = 0; i + 1 < kids.length; i += 2) {
+    var typeNode = kids[i], valuesNode = kids[i + 1];
+    if (valuesNode.majorType !== 4 || !valuesNode.children || valuesNode.children.length < 1) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attributeValue must be a non-empty CBOR array (SET OF, SIZE 1..MAX, RFC 5280 sec. 4.2.1.8)");
+    var vals = [];
+    if (typeNode.majorType === 0 || typeNode.majorType === 1) {          // int form: a sec. 8.6 registry alias, text values
+      var ti = Number(cbor.read.int(typeNode));
+      // draft sec. 3.1.4 applies to EVERY int in a natively signed certificate, not just the top-level Name's.
+      if (isNative && ti < 0) throw _err("c509/bad-extensions", "a natively signed C509 subjectDirectoryAttributes attribute type integer must be non-negative (draft sec. 3.1.4), got " + ti);
+      var tname = ATTR_BY_INT[Math.abs(ti)];
+      if (tname === undefined) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attribute type int " + ti + " has no C509 sec. 8.6 registry row");
+      // countryName / serialNumber carry a CHARACTER restriction (draft sec. 3.1.4 "SHALL contain only
+      // characters from the 74-character ASCII subset permitted by PrintableString"), NOT a sign override --
+      // _reconAttrValue asserts the charset and honours the declared string type. Requiring the negative sign
+      // here would also make these attributes unrepresentable in a NATIVE certificate, whose ints SHALL all be
+      // non-negative (same sec.), so the rule is the charset, not the sign.
+      for (var vi = 0; vi < valuesNode.children.length; vi++) {
+        var vn = valuesNode.children[vi];
+        if (vn.majorType !== 3) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes int-form attribute value must be a CBOR text string (a non-string value requires the ~oid form)");
+        // _reconAttrValue -> b.printable / b.utf8 throws only an Asn1Error for a value outside its string type's
+        // alphabet (a printableString sign over non-PrintableString characters); remap it to this module's
+        // domain so attacker-controlled native input fails closed as c509/bad-extensions, not a leaked asn1/*.
+        try { vals.push(_reconAttrValue({ type: tname, value: cbor.read.textString(vn), printable: ti < 0 })); }
+        catch (e) { throw _err("c509/bad-extensions", "a subjectDirectoryAttributes " + tname + " value is not valid for its string type", e); }
+      }
+      attrs.push(b.sequence([b.oid(oid.byName(tname)), _derSetInDeclaredOrder(vals)]));
+    } else if (typeNode.majorType === 2) {                              // ~oid form: raw AttributeValue TLVs
+      var dotted = _oidName(typeNode, "c509/bad-extensions", "a subjectDirectoryAttributes attribute type").oid;
+      for (var vj = 0; vj < valuesNode.children.length; vj++) {
+        var vb = valuesNode.children[vj];
+        if (vb.majorType !== 2) throw _err("c509/bad-extensions", "a ~oid-form subjectDirectoryAttributes value must be a CBOR byte string (a raw DER AttributeValue)");
+        vals.push(b.raw(_requireStrictDerTlv(vb.content, "c509/bad-extensions", "a ~oid-form subjectDirectoryAttributes AttributeValue")));
+      }
+      attrs.push(b.sequence([b.oid(dotted), _derSetInDeclaredOrder(vals)]));
+    } else {
+      throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attribute type must be a CBOR integer (sec. 8.6) or a ~oid");
+    }
+  }
+  return b.sequence(attrs);
+}
+
+// One DER Attribute's SET members -> the int-form { sign, values:[CBOR text] }, or null when the int form is
+// not confidently byte-exact (an unregistered type, a non-utf8/printable value, or a SET mixing utf8String and
+// printableString -- one sign cannot express it). A null routes that ONE attribute to the always-byte-exact
+// ~oid + raw-bytes form (a still-compact sec. 3.3 SDA form); the extension round-trip guard is the ultimate net.
+function _sdaTryIntForm(tint, name, valueNodes) {
+  if (tint === undefined) return null;
+  var i;
+  // An IA5String-only attribute (emailAddress) rides its non-negative int with IA5String values -- its type,
+  // not a sign, fixes the string type, so it is matched separately from the utf8/printable sign convention.
+  if (name === "emailAddress") {
+    var mails = [];
+    for (i = 0; i < valueNodes.length; i++) {
+      if (valueNodes[i].tagClass !== "universal" || valueNodes[i].tagNumber !== asn1.TAGS.IA5_STRING) return null;
+      mails.push(cbor.build.textString(asn1.read.string(valueNodes[i])));
+    }
+    return { sign: 1, values: mails };
+  }
+  var sign = 0, out = [];   // sign: -1 printableString, +1 utf8String
+  for (i = 0; i < valueNodes.length; i++) {
+    var vn = valueNodes[i], s;
+    if (vn.tagClass === "universal" && vn.tagNumber === asn1.TAGS.UTF8_STRING) s = 1;
+    else if (vn.tagClass === "universal" && vn.tagNumber === asn1.TAGS.PRINTABLE_STRING) s = -1;
+    else return null;                                  // any other value tag -> the ~oid form preserves it exactly
+    if (sign === 0) sign = s;
+    else if (sign !== s) return null;                  // a mixed utf8/printable SET -- the headline trap
+    out.push(cbor.build.textString(asn1.read.string(vn)));
+  }
+  return { sign: sign, values: out };
+}
+
+// The DER SubjectDirectoryAttributes -> the flat compact CBOR array, or null (whole-ext ~oid fallback). Per
+// attribute: the int form when the type is sec. 8.6-registered AND every value is a single-signed utf8/
+// printable string, else the ~oid + raw-bytes form (always byte-exact).
+function _sdaFromDer(node) {
+  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
+  var out = [];
+  for (var ai = 0; ai < node.children.length; ai++) {
+    var attr = node.children[ai];
+    if (attr.tagClass !== "universal" || attr.tagNumber !== asn1.TAGS.SEQUENCE || !attr.children || attr.children.length !== 2) return null;
+    var setNode = attr.children[1];
+    if (setNode.tagClass !== "universal" || setNode.tagNumber !== asn1.TAGS.SET || !setNode.children || setNode.children.length < 1) return null;   // SET OF, non-empty
+    var dotted = asn1.read.oid(attr.children[0]);
+    var nm = oid.name(dotted), tint = nm != null ? ATTR_TO_INT[nm] : undefined;
+    var intForm = _sdaTryIntForm(tint, nm, setNode.children);
+    if (intForm != null) {
+      out.push(cbor.build.int(BigInt(intForm.sign < 0 ? -tint : tint)));
+      out.push(cbor.build.array(intForm.values));
+    } else {
+      out.push(_oidCbor(dotted));
+      out.push(cbor.build.array(setNode.children.map(function (v) { return cbor.build.byteString(v.bytes); })));
+    }
+  }
+  return cbor.build.array(out);
+}
+
 // Encode-side guard: emit the compact value only when it decodes back to the EXACT DER extnValue, so a
 // non-canonical or unrepresentable value can never produce a lossy compact form (it falls back to ~oid).
 // A value _extValueFromDer produced but _extValueToDer cannot reconstruct -- an empty GeneralNames the DER
@@ -992,7 +1258,7 @@ function _tryCompactExtValue(name, der) {
 }
 
 // extensions (sec. 3.1.10/sec. 3.3/sec. 8.8): [ * Extension ] | a single keyUsage int-shortcut.
-function _extensions(node) {
+function _extensions(node, isNative) {
   // The keyUsage int-shortcut (sec. 3.1.10): a bare int -> one keyUsage extension, criticality from the
   // sign, value = abs(int) (Appendix A.1.1: the single int 1 -> non-critical keyUsage digitalSignature).
   if (node.majorType === 0 || node.majorType === 1) {
@@ -1019,7 +1285,7 @@ function _extensions(node) {
       // non-byte-string value there is an unsupported compact form and MUST fail closed -- a text/array value
       // is NOT raw DER, and copying its bytes would reconstruct a structurally invalid extension.
       if (EXT_COMPACT[name]) {
-        valContent = _extValueToDer(name, valNode);
+        valContent = _extValueToDer(name, valNode, isNative);
       } else if (valNode.majorType === 2) {
         valContent = valNode.content;
       } else {
@@ -1063,9 +1329,27 @@ function _macToEui64String(buf) {
 // One RDN attribute value -> its DER string. The C509 sign convention: a positive attribute int ->
 // utf8String, a negative -> printableString; countryName / serialNumber are PrintableString-restricted.
 function _reconAttrValue(rdn) {
-  if (rdn.eui64) return b.utf8(_macToEui64String(rdn.eui64));
-  if (rdn.type === "countryName" || rdn.type === "serialNumber") return b.printable(String(rdn.value));
-  return rdn.printable ? b.printable(String(rdn.value)) : b.utf8(String(rdn.value));
+  if (rdn.eui64) return b.utf8(_macToEui64String(rdn.eui64));   // the bare-form commonName MAC (a fixed 17 chars)
+  var s = String(rdn.value);
+  // The attribute's registered ASN.1 type carries a SIZE constraint as well as an alphabet, and a value outside
+  // it is not a valid encoding of that type: every DirectoryString-valued attribute is SIZE (1..MAX) and
+  // emailAddress is IA5String SIZE (1..MAX) (RFC 5280 App. A.1), so an empty value is never valid; countryName
+  // "SHALL have length 2" (draft sec. 3.1.4, X.520 SIZE (2)). Enforced HERE, the single place the value is built
+  // for its declared type, so the decode, reconstruct and subject-directory-attributes paths cannot disagree.
+  if (s.length === 0) throw _err("c509/bad-name", "a " + rdn.type + " value must be non-empty (SIZE (1..MAX))");
+  if (rdn.type === "countryName" && s.length !== 2) throw _err("c509/bad-name", "a countryName value must have length 2 (draft sec. 3.1.4)");
+  // emailAddress is an IA5String-only attribute (draft sec. 3.1.4): its type, not the int's sign, fixes the
+  // string type, so it reconstructs as an IA5String whichever way the non-negative int was written.
+  if (rdn.type === "emailAddress") return b.ia5(s);
+  // serialNumber / countryName carry a CHARACTER restriction, not a string-type override: draft sec. 3.1.4
+  // "SHALL contain only characters from the 74-character ASCII subset permitted by PrintableString". Enforce
+  // that on the CHARACTERS and still honour the sign for the string type -- coercing them to PrintableString
+  // regardless of sign would make the +N and -N encodings of one value reconstruct IDENTICAL DER, so a single
+  // X.509 signature would cover two distinct C509 encodings (a malleability window in the type-3 transform).
+  // b.printable IS the PrintableString charset authority -- run it for the assert even when the sign selects
+  // utf8String, so the restriction binds on the characters without overriding the declared string type.
+  if (!rdn.printable && (rdn.type === "countryName" || rdn.type === "serialNumber")) b.printable(s);
+  return rdn.printable ? b.printable(s) : b.utf8(s);
 }
 
 // A Name -> the DER RDNSequence (SEQUENCE OF SET OF SEQUENCE{ type, value }); one attribute per RDN.
@@ -1149,13 +1433,11 @@ function _reconExtensions(exts) {
 function _reconAlgId(alg) {
   var fields = [b.oid(alg.oid)];
   if (alg.parameters && alg.parameters.length) {
-    // AlgorithmIdentifier.parameters is ANY -- exactly one well-formed DER element. Validate the supplied
-    // bytes decode as a single element (the strict decoder rejects trailing bytes / malformed encodings)
-    // before re-emitting them, so a malformed or multi-element parameter blob fails closed rather than
-    // producing an invalid reconstructed AlgorithmIdentifier.
-    try { asn1.decode(alg.parameters); }
-    catch (e) { throw _err("c509/non-invertible", "algorithm parameters are not a single well-formed DER element", e); }
-    fields.push(b.raw(alg.parameters));
+    // AlgorithmIdentifier.parameters is ANY, spliced verbatim -- so it gets the SAME strict gate as every other
+    // raw-ANY splice, not just a framing check. Framing alone admits an empty INTEGER / reserved tag 0 / a
+    // non-minimal INTEGER, each of which reconstructs an AlgorithmIdentifier that an independent X.509 decoder
+    // refuses to load and that this toolkit's own readers reject.
+    fields.push(b.raw(_requireStrictDerTlv(alg.parameters, "c509/non-invertible", "algorithm parameters")));
   }
   return b.sequence(fields);
 }
@@ -1226,6 +1508,9 @@ function parse(input) {
   var f = root.children;
   if (f.length !== 11) throw _err("c509/bad-tbs", "a C509 certificate must be an array of exactly 11 elements, got " + f.length);
 
+  // The type slot must be a CBOR integer -- guard the major type here so a text/array/byte-string field 0 fails
+  // in this module's domain rather than leaking cbor.read.int's cbor/unexpected-major fault to the caller.
+  if (f[0].majorType !== 0 && f[0].majorType !== 1) throw _err("c509/bad-certificate-type", "c509CertificateType must be a CBOR integer");
   var type = Number(cbor.read.int(f[0]));
   if (type !== 2 && type !== 3) throw _err("c509/bad-certificate-type", "c509CertificateType must be 2 (native) or 3 (re-encoded), got " + type);
 
@@ -1234,10 +1519,16 @@ function parse(input) {
   var sHex = serialBytes.content.toString("hex");
 
   var sigAlg = _algorithm(f[2], SIG_ALG_BY_INT, "c509/unknown-algorithm", "issuerSignatureAlgorithm");
-  var issuer = _name509(f[3], false);
+  var issuer = _name509(f[3], false, type === 2);
   var notBefore = _time(f[4], false, "validityNotBefore");
   var notAfter = _time(f[5], true, "validityNotAfter");
-  var subject = _name509(f[6], true);
+  var subject = _name509(f[6], true, type === 2);
+  // A CBOR-null issuer means issuer == subject (self-signed), so the EFFECTIVE issuer is the subject -- and it
+  // must still satisfy RFC 5280 sec. 4.1.2.4. Checking only the array form would let the null form rebuild the
+  // very empty issuer the array form is refused for.
+  if (issuer === null && (!subject || !subject.rdns || subject.rdns.length === 0)) {
+    throw _err("c509/bad-name", "a self-signed C509 (issuer == subject) requires a non-empty subject, since it is also the issuer (RFC 5280 sec. 4.1.2.4)");
+  }
   var spkAlg = _algorithm(f[7], PK_ALG_BY_INT, "c509/unknown-algorithm", "subjectPublicKeyAlgorithm");
   var subjectPublicKey = null, rsaKey = null;
   if (spkAlg.name === "rsaEncryption") {
@@ -1251,7 +1542,7 @@ function parse(input) {
     if (f[8].majorType !== 2) throw _err("c509/bad-spki", "subjectPublicKey must be a CBOR byte string");
     subjectPublicKey = f[8].content;
   }
-  var extensions = _extensions(f[9]);
+  var extensions = _extensions(f[9], type === 2);
   if (f[10].majorType !== 2) throw _err("c509/bad-signature", "issuerSignatureValue must be a CBOR byte string");
   var signatureValue = f[10].content;
 
@@ -1491,7 +1782,17 @@ function _c509NameFromDer(nameBytes) {
     var attrName = oid.name(asn1.read.oid(attr.children[0]));
     if (attrName == null || ATTR_TO_INT[attrName] === undefined) throw _err("c509/non-invertible", "attribute type " + attrName + " has no C509 registry integer");
     var valNode = attr.children[1];
-    var value = asn1.read.string(valNode);
+    // A value whose string type this codec cannot represent (NumericString and the other non-DirectoryString
+    // types read.string declines) is NOT compact-representable -- report that in THIS module's domain rather
+    // than leaking the codec's own asn1/* fault out of encode(), which is what every sibling shape does.
+    var value;
+    try { value = asn1.read.string(valNode); }
+    catch (e) { throw _err("c509/non-invertible", "attribute " + attrName + " carries a value whose string type the C509 sec. 8.6 int form cannot represent", e); }
+    // The IA5String type belongs ONLY to an IA5-only attribute (emailAddress, draft sec. 3.1.4), whose value
+    // reconstructs from its type rather than the int's sign. Refuse either mismatch here with a precise verdict
+    // instead of emitting an int form whose reconstruction would differ from the source bytes.
+    var isIa5 = valNode.tagClass === "universal" && valNode.tagNumber === asn1.TAGS.IA5_STRING;
+    if ((attrName === "emailAddress") !== isIa5) throw _err("c509/non-invertible", "attribute " + attrName + " carries a " + (isIa5 ? "IA5String" : "non-IA5String") + " value the C509 sec. 8.6 int form cannot represent");
     var eui = attrName === "commonName" ? _euiFromCn(value) : null;
     if (eui) rdns.push({ type: attrName, value: value, eui64: eui });                            // tag-48 MAC commonName
     else rdns.push({ type: attrName, value: value, printable: valNode.tagNumber === asn1.TAGS.PRINTABLE_STRING });

package/lib/schema-pkix.js

@@ -331,6 +331,15 @@ function attrValueToString(ns) {
       if (!e || (e.code !== "asn1/expected-string" && e.code !== "asn1/expected-primitive")) {
         throw ns.E(ns.prefix + "/bad-atv", "malformed string in attribute value: " + ((e && e.message) || String(e)));
       }
+      // NumericString is deliberately NOT read by asn1.read.string -- a value that returns a plain string joins
+      // the RFC 5280 sec. 7.1 name-comparison identity class, and NumericString is not a DirectoryString type.
+      // It does have its own strict reader though, so VALIDATE the content here (an out-of-alphabet value is
+      // malformed DER and must not be accepted merely because it falls to the opaque form) while still
+      // surfacing it in the type-distinct RFC 4514 hex form, which keeps it out of that identity class.
+      if (node.tagClass === "universal" && node.tagNumber === asn1.TAGS.NUMERIC_STRING) {
+        try { asn1.read.numericString(node); }
+        catch (e2) { throw ns.E(ns.prefix + "/bad-atv", "malformed NumericString in attribute value: " + ((e2 && e2.message) || String(e2))); }
+      }
       return "#" + node.bytes.toString("hex");
     }
     if (s.charAt(0) === "#" || s.charAt(0) === "\\") return "\\" + s;

package/lib/vendor/MANIFEST.json

@@ -1,4 +1,4 @@
 {
-  "_comment": "Vendored dependencies — none currently. @blamejs/pki's cryptography runs entirely on Node's built-in node:crypto: the classical algorithm set (RSA, ECDSA, EdDSA, ECDH, AES, HMAC, HKDF, PBKDF2, the SHA family) AND the FIPS 203/204/205 post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) via the platform OpenSSL 3.5 that the Node engine floor (>=24.18) ships. A built-in ships zero bytes and is OpenSSL-interoperable by construction, so no crypto bundle is vendored. A package is added here ONLY when a specific operation is confirmed missing from the engine floor; see lib/vendor/README.md for the policy.",
+  "_comment": "Vendored dependencies — none currently. @blamejs/pki's cryptography runs entirely on Node's built-in node:crypto: the classical algorithm set (RSA, ECDSA, EdDSA, ECDH, AES, HMAC, HKDF, PBKDF2, the SHA family) AND the FIPS 203/204/205 post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) via the platform OpenSSL 3.5 that the Node engine floor (>=24.19) ships. A built-in ships zero bytes and is OpenSSL-interoperable by construction, so no crypto bundle is vendored. A package is added here ONLY when a specific operation is confirmed missing from the engine floor; see lib/vendor/README.md for the policy.",
   "packages": {}
 }

package/lib/vendor/README.md

@@ -6,7 +6,7 @@ vendors **nothing** — this directory holds only the manifest.
 ## Native-first crypto
 
 The toolkit's cryptography runs entirely on Node's built-in `node:crypto`. The
-engine floor (Node `>=24.18`) links OpenSSL 3.5, which provides:
+engine floor (Node `>=24.19`) links OpenSSL 3.5, which provides:
 
 - the full classical set — RSA (PKCS#1 v1.5, PSS, OAEP), ECDSA, EdDSA
   (Ed25519/Ed448), ECDH (incl. X25519/X448), AES (GCM/CBC/CTR/KW), HMAC, HKDF,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -47,7 +47,7 @@
     "owns-its-stack"
   ],
   "engines": {
-    "node": ">=24.18.0"
+    "node": ">=24.19.0"
   },
   "files": [
     "index.js",
@@ -68,6 +68,8 @@
     "coverage": "c8 --include=lib/** --include=index.js --reporter=text-summary --reporter=lcov node test/smoke.js",
     "check:swallows": "node scripts/check-swallow-coverage.js",
     "coverage:gated": "npm run coverage && npm run check:swallows",
+    "coverage:unified": "node scripts/coverage-unified.js",
+    "coverage:unified:gated": "npm run coverage:unified && npm run check:swallows",
     "prepack": "node scripts/check-pack-against-gitignore.js",
     "check:vendor-currency": "node scripts/check-vendor-currency.js"
   },

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:40b5fc50-7b82-41d2-9e80-f01b6be97878",
+  "serialNumber": "urn:uuid:484717d3-b574-44fc-ba53-e13d70ea5f85",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-06T23:41:09.454Z",
+    "timestamp": "2026-08-08T05:35:44.402Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -15,18 +15,18 @@
       {
         "vendor": "npm",
         "name": "cli",
-        "version": "11.16.0"
+        "version": "11.17.0"
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.4.0",
+      "bom-ref": "@blamejs/pki@0.4.2",
       "type": "application",
       "name": "pki",
-      "version": "0.4.0",
+      "version": "0.4.2",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.4.0",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.2",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.4.0",
+      "ref": "@blamejs/pki@0.4.2",
       "dependsOn": []
     }
   ]