@blamejs/pki 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -4,7 +4,24 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.4.1 — 2026-08-08
+## v0.4.2 — 2026-08-08
+
+A NumericString attribute value no longer shares distinguished-name identity with a printable or UTF-8 value of the same characters -- the comparison that decides name chaining, revocation-issuer matching and name constraints. Alongside it, several C509 name-encoding conformance fixes and a move to Node 24.19.0.
+
+### Changed
+
+- The supported Node floor moves to 24.19.0, the current long-term-support release. Nothing is transpiled, so the supported version is the version the source runs on; the release is verified against that runtime.
+- pki.asn1.read.numericString reads a NumericString value, validated strictly to the digits and space the type permits. The shared string reader no longer accepts the type, so a caller that wants it asks for it by name.
+
+### Fixed
+
+- A NumericString attribute value no longer compares equal to a PrintableString or UTF8String attribute value carrying the same characters. RFC 5280 sec. 7.1 name comparison folds the directory-string types into one identity class, and NumericString is not one of them; because the previous release read it through the shared string reader, it entered that class and was treated as the same name by the comparison that decides certificate chaining, revocation-issuer matching and name-constraint evaluation. It now reads through its own reader and, as before, renders in the RFC 4514 hexadecimal form rather than as a plain string.
+- A natively signed C509 certificate is no longer accepted with, or built carrying, a negative attribute-type integer. The sign of that integer exists only to reproduce the string type of an original X.509 encoding, which a natively signed certificate does not have, so all of its integers are non-negative (draft-ietf-cose-cbor-encoded-cert-20 sec. 3.1.4); the toolkit previously read such a certificate and could also emit one that a conformant implementation must reject.
+- A country name or serial number attribute now keeps the string type its attribute integer's sign declares, and its restriction to the printable-string character subset is enforced on the characters instead. Both signs previously rebuilt the same certificate bytes, so two distinct compact encodings of one value produced one identical certificate under a single signature.
+- The rendered distinguished-name string now escapes its values (RFC 4514 sec. 2.4), so an attribute value containing a comma can no longer read as though the name held several attributes, and a control byte can no longer reach a log line unescaped.
+- An empty issuer name is now refused (RFC 5280 sec. 4.1.2.4 requires a non-empty issuer). It previously parsed and rebuilt a certificate that this toolkit's own certificate parser declines to load. An empty subject is still accepted; the profile pairs that with a subject alternative name, which this codec does not yet require.
+
+## v0.4.1 — 2026-08-07
 
 pki.schema.c509 encodes and decodes the compact subjectDirectoryAttributes value form -- a C509 certificate's subject directory attributes ride their draft-20 registry integers (or unwrapped OIDs) with their directory-string values, interoperating with a conformant C509 implementation rather than only this decoder.
 

package/README.md

@@ -63,7 +63,7 @@ Web Crypto API with its limits on streaming, opaque keys, and algorithm reach.
 npm i @blamejs/pki
 ```
 
-Requires Node.js 24.18+ (runs on the shipped runtime — no build step, no
+Requires Node.js 24.19+ (runs on the shipped runtime — no build step, no
 transpilation).
 
 ```js

package/lib/asn1-der.js

@@ -623,11 +623,20 @@ function _decodePrintable(buf) {
   return s;
 }
 
-// NumericString (X.680 sec. 41, Table 9) permits ONLY the digits and SPACE. It carries the X.520 syntax of
-// the x121Address and internationalISDNNumber directory attributes, so a value of this type must be readable
-// -- and strictly, since anything outside that alphabet is not a valid encoding of the type.
-function _decodeNumeric(buf) {
-  var s = buf.toString("latin1");
+// NumericString (X.680 sec. 41, Table 9) permits ONLY the digits and SPACE. It carries the X.520 syntax of the
+// x121Address and internationalISDNNumber directory attributes.
+//
+// It is read through its OWN reader, deliberately NOT through readString. Every type readString returns a
+// plain string for enters the RFC 5280 sec. 7.1 name-comparison identity class, and
+// guard.name.dnEqual -- the single choke point for name chaining, revocation-issuer matching and name
+// constraints -- compares the strings it returns. Admitting NumericString there would make a NumericString
+// attribute value compare EQUAL to a PrintableString / UTF8String one with the same characters, silently
+// widening distinguished-name identity across the whole toolkit. A caller that genuinely wants this type asks
+// for it by name.
+function readNumericString(node) {
+  _expectUniversal(node, TAGS.NUMERIC_STRING, "readNumericString");
+  _expectPrimitive(node, "readNumericString");
+  var s = node.content.toString("latin1");
   if (!NUMERIC_RE.test(s)) throw new Asn1Error("asn1/bad-numeric-string", "NumericString has characters outside the digits-and-space set");
   return s;
 }
@@ -647,7 +656,6 @@ function readString(node) {
   _expectPrimitive(node, "readString");
   switch (node.tagNumber) {
     case TAGS.UTF8_STRING:      return _decodeUtf8Strict(node.content);
-    case TAGS.NUMERIC_STRING:   return _decodeNumeric(node.content);
     case TAGS.PRINTABLE_STRING: return _decodePrintable(node.content);
     case TAGS.IA5_STRING:       return _decodeIa5(node.content);
     case TAGS.TELETEX_STRING:   return _decodeText(node.content, "latin1");
@@ -1079,6 +1087,7 @@ module.exports = {
     booleanImplicit: readBooleanImplicit,
     oid:          readOid,
     string:       readString,
+    numericString: readNumericString,
     time:         readTime,
   },
 };

package/lib/schema-c509.js

@@ -257,22 +257,21 @@ function _assertAttrValue(rdn) {
   }
 }
 
-function _name509(node, isSubject) {
+function _name509(node, isSubject, isNative) {
   if (!isSubject && node.majorType === 7 && node.ai === 22) return null;   // issuer == subject (self-signed)
   // A bare SpecialText (not an array) is a single commonName attribute (attributeType == +1).
   if (node.majorType === 3 || node.majorType === 2 || node.majorType === 6) {
     var sv = _specialText(node);
     // The bare form is a single commonName -- hold its value to the SAME rules the array form applies, so a
     // natively-signed certificate (which never reconstructs) cannot carry a value the reconstruction would refuse.
-    if (sv.eui64) {
-      var euiRdn = { type: "commonName", eui64: sv.eui64 };
-      _assertAttrValue(euiRdn);
-      return { rdns: [euiRdn], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
-    }
+    // A tag-48 MAC renders to a fixed 17-character EUI-64 string that satisfies every value rule by
+    // construction, and _reconAttrValue short-circuits on eui64 before any of them -- so asserting here would
+    // be a no-op. The rules bind on the TEXT forms below.
+    if (sv.eui64) return { rdns: [{ type: "commonName", eui64: sv.eui64 }], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
     var val = sv.text !== undefined ? sv.text : sv.hex;
     var bareRdn = { type: "commonName", value: val };
     _assertAttrValue(bareRdn);
-    return { rdns: [bareRdn], dn: "CN=" + val };
+    return { rdns: [bareRdn], dn: "CN=" + guard.name.escapeDnValue(val) };
   }
   if (node.majorType !== 4) throw _err("c509/bad-name", "a C509 Name must be null, a SpecialText, or an array of RDN attributes");
   var rdns = [];
@@ -281,6 +280,10 @@ function _name509(node, isSubject) {
   // Each RDN attribute is an (attributeType, attributeValue) pair; an odd-length array is a dangling
   // attribute type with no value -- reject rather than silently drop the trailing element.
   if (kids.length % 2 !== 0) throw _err("c509/bad-name", "a C509 Name array must be attribute-type/value pairs (dangling attribute type)");
+  // RFC 5280 sec. 4.1.2.4 -- the issuer MUST be a non-empty distinguished name (only the SUBJECT may be empty,
+  // for the subjectAltName case). An empty issuer array would reconstruct a certificate this toolkit's OWN
+  // x509.parse refuses to load (x509/bad-issuer), so the codec must not produce one.
+  if (kids.length === 0 && !isSubject) throw _err("c509/bad-name", "the issuer Name must not be empty (RFC 5280 sec. 4.1.2.4)");
   for (var i = 0; i + 1 < kids.length; i += 2) {
     // The attributeType slot must be a CBOR integer (major type 0/1). Guard the major type BEFORE the read
     // so a non-integer type slot fails in this module's own domain (c509/bad-name), matching the value slot,
@@ -289,6 +292,11 @@ function _name509(node, isSubject) {
     // Identifier issuer, cRLDistributionPoints cRLIssuer, nameConstraints subtree base) and the top-level Name.
     if (kids[i].majorType !== 0 && kids[i].majorType !== 1) throw _err("c509/bad-name", "a C509 Name attribute type must be a CBOR integer");
     var ti = Number(cbor.read.int(kids[i]));
+    // draft sec. 3.1.4: "in natively signed C509 certificates all CBOR ints SHALL be non-negative." The sign
+    // exists ONLY to reproduce the string type of an original X.509 DER, which a native certificate does not
+    // have -- so a negative attributeType there is an encoding no conformant producer emits, and accepting it
+    // would let this parser read a natively-signed name a conformant peer must reject.
+    if (isNative && ti < 0) throw _err("c509/bad-name", "a natively signed C509 Name attribute type integer must be non-negative (draft sec. 3.1.4), got " + ti);
     var tname = ATTR_BY_INT[Math.abs(ti)];
     if (tname === undefined) throw _err("c509/bad-name", "attribute type integer " + ti + " has no C509 registry row");
     var v = _specialText(kids[i + 1]);
@@ -300,10 +308,14 @@ function _name509(node, isSubject) {
     var rdn = { type: tname, value: vv, printable: ti < 0 };
     _assertAttrValue(rdn);
     rdns.push(rdn);
-    parts.push(_shortName(tname) + "=" + vv);
+    parts.push(_shortName(tname) + "=" + guard.name.escapeDnValue(vv));
   }
   return { rdns: rdns, dn: parts.join(",") };
 }
+// The rendered dn is an RFC 4514 string, so every VALUE is escaped through the shared guard the rest of the
+// toolkit renders names with. Raw concatenation would let a single attribute whose value contains a comma
+// render identically to a genuine multi-RDN name (a spoofable identity string, and the ONLY name surface a
+// natively signed certificate has, since it never reconstructs DER), and would carry control bytes into logs.
 function _shortName(n) { return n === "commonName" ? "CN" : n === "countryName" ? "C" : n === "organizationName" ? "O" : n === "organizationalUnitName" ? "OU" : n === "localityName" ? "L" : n === "stateOrProvinceName" ? "ST" : n; }
 
 // ---- compact per-extension value codec (draft-20 sec. 3.3) -------------------
@@ -392,9 +404,9 @@ function _namedBitsFromContent(bytes, unusedBits) {
 
 // One C509 (int, value) general name -> one DER GeneralName TLV. `ipMode` (name-constraints subtree base)
 // only changes the iPAddress arm: SAN is a bare 4/16-octet address, a subtree base is the RFC 9549 form.
-function _generalNameToDer(intVal, valueNode, ipMode) {
+function _generalNameToDer(intVal, valueNode, ipMode, isNative) {
   if (intVal === 1 || intVal === 2 || intVal === 6) return b.contextPrimitive(intVal, _ia5Bytes(valueNode, intVal));   // IMPLICIT IA5String
-  if (intVal === 4) return b.explicit(4, _reconName(_name509(valueNode, true)));                                       // directoryName [4] EXPLICIT Name
+  if (intVal === 4) return b.explicit(4, _reconName(_name509(valueNode, true, isNative)));                                       // directoryName [4] EXPLICIT Name
   if (intVal === 7) return b.contextPrimitive(7, ipMode ? _ncIpToDer(valueNode) : _sanIpBytes(valueNode));             // iPAddress [7] IMPLICIT OCTET STRING
   if (intVal === 8) return b.contextPrimitive(8, asn1.encodeOidContent(_oidName(valueNode, "c509/bad-extensions", "a registeredID [8]").oid));  // registeredID [8] IMPLICIT OID
   if (intVal === 0 || intVal === -1 || intVal === -2 || intVal === -3) return _otherNameToDer(valueNode, intVal);      // otherName [0]
@@ -420,12 +432,12 @@ function _generalNameFromDer(gn, ipMode) {
 // them: a universal SEQUENCE for SAN/IAN, an implicit [n] for AKI issuer / DP cRLIssuer). These are always
 // SAN-form (the RFC 9549 subtree-base iPAddress form is name-constraints-only and routes through
 // _subtreesToDer / _subtreesFromDer, which call the singular codec with ipMode directly).
-function _generalNamesToDer(node) {
+function _generalNamesToDer(node, isNative) {
   if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a GeneralNames value must be a CBOR array");
   var kids = node.children;
   if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a GeneralNames array must be non-empty (int, value) pairs (sec. 3.3)");
   var out = [];
-  for (var i = 0; i + 1 < kids.length; i += 2) out.push(_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralName type")), kids[i + 1], false));
+  for (var i = 0; i + 1 < kids.length; i += 2) out.push(_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralName type")), kids[i + 1], false, isNative));
   return out;
 }
 // The inverse: a list of DER GeneralName nodes -> the flat CBOR items, or null if ANY member is not
@@ -546,12 +558,12 @@ function _ncIpFromDer(buf) {
 // GeneralSubtrees = [ + GeneralName ] (the flat int/value array) <-> the concatenated GeneralSubtree
 // SEQUENCEs (RFC 5280 sec. 4.2.1.10: SEQUENCE { base, minimum [0] DEFAULT 0, maximum [1] OPTIONAL }); the
 // C509 profile omits minimum/maximum, so each GeneralSubtree is base-only.
-function _subtreesToDer(node) {
+function _subtreesToDer(node, isNative) {
   if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a GeneralSubtrees value must be a CBOR array");
   var kids = node.children;
   if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a GeneralSubtrees array must be non-empty (int, value) pairs");
   var out = [];
-  for (var i = 0; i + 1 < kids.length; i += 2) out.push(b.sequence([_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralSubtree base type")), kids[i + 1], true)]));
+  for (var i = 0; i + 1 < kids.length; i += 2) out.push(b.sequence([_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralSubtree base type")), kids[i + 1], true, isNative)]));
   return Buffer.concat(out);
 }
 function _subtreesFromDer(subtreeNodes) {
@@ -659,7 +671,7 @@ function _qualifierFromDer(pq) {
 // One CBOR DistributionPointName [ fullName, reasons, cRLIssuer ] -> one DER DistributionPoint SEQUENCE.
 // distributionPoint [0] is EXPLICIT (it wraps the DistributionPointName CHOICE); fullName [0], reasons [1],
 // cRLIssuer [2] are IMPLICIT (RFC 5280 sec. 4.2.1.13) -- mixing these is the classic byte-exactness trap.
-function _dpToDer(dpNode) {
+function _dpToDer(dpNode, isNative) {
   if (dpNode.majorType !== 4 || !dpNode.children || dpNode.children.length !== 3) throw _err("c509/bad-extensions", "a DistributionPoint must be a CBOR [ fullName, reasons, cRLIssuer ] array");
   var fullName = dpNode.children[0], reasons = dpNode.children[1], crlIssuer = dpNode.children[2];
   var uris;
@@ -670,7 +682,7 @@ function _dpToDer(dpNode) {
   } else throw _err("c509/bad-extensions", "a DistributionPoint fullName must be a URI text or an array of URIs");
   var fields = [b.explicit(0, b.contextConstructed(0, Buffer.concat(uris)))];   // distributionPoint [0] EXPLICIT { fullName [0] IMPLICIT GeneralNames }
   if (!_isCborNull(reasons)) fields.push(_reasonsBitsToDer(Number(_cborUint(reasons, "cRLDistributionPoints reasons"))));
-  if (!_isCborNull(crlIssuer)) fields.push(b.contextConstructed(2, b.explicit(4, _reconName(_name509(crlIssuer, true)))));   // cRLIssuer [2] { [4] directoryName }
+  if (!_isCborNull(crlIssuer)) fields.push(b.contextConstructed(2, b.explicit(4, _reconName(_name509(crlIssuer, true, isNative)))));   // cRLIssuer [2] { [4] directoryName }
   return b.sequence(fields);
 }
 // One DER DistributionPoint SEQUENCE -> the pieces for the CBOR DistributionPointName, or null when the DP
@@ -717,7 +729,7 @@ function _dpFromDer(dp) {
 
 // Decode a compact extension value (a decoded CBOR node) to the DER extnValue inner content. Fails closed
 // (c509/bad-extensions) on a CBOR shape the named extension does not define.
-function _extValueToDer(name, node) {
+function _extValueToDer(name, node, isNative) {
   switch (name) {
     case "subjectKeyIdentifier":   // KeyIdentifier = bytes -> OCTET STRING(keyid)
       if (node.majorType !== 2) throw _err("c509/bad-extensions", "a subjectKeyIdentifier value must be a CBOR byte string");
@@ -737,7 +749,7 @@ function _extValueToDer(name, node) {
         if (node.children[0].majorType !== 2) throw _err("c509/bad-extensions", "an authorityKeyIdentifier keyIdentifier must be a CBOR byte string");
         return b.sequence([
           b.contextPrimitive(0, node.children[0].content),                                           // keyIdentifier [0] IMPLICIT OCTET STRING
-          b.contextConstructed(1, Buffer.concat(_generalNamesToDer(node.children[1]))),       // authorityCertIssuer [1] IMPLICIT GeneralNames
+          b.contextConstructed(1, Buffer.concat(_generalNamesToDer(node.children[1], isNative))),       // authorityCertIssuer [1] IMPLICIT GeneralNames
           b.contextPrimitive(2, _serialIntContent(node.children[2])),                                // authorityCertSerialNumber [2] IMPLICIT INTEGER
         ]);
       }
@@ -764,12 +776,12 @@ function _extValueToDer(name, node) {
     case "subjectAltName":
     case "issuerAltName":          // SubjectAltName = GeneralNames / text (exactly one dNSName -> bare text)
       if (node.majorType === 3) return b.sequence([b.contextPrimitive(2, _ia5Bytes(node, 2))]);
-      return b.sequence(_generalNamesToDer(node));
+      return b.sequence(_generalNamesToDer(node, isNative));
     case "nameConstraints": {      // [ permittedSubtrees / null, excludedSubtrees / null ]
       if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a nameConstraints value must be a 2-element CBOR array [ permitted, excluded ] (sec. 3.3)");
       var ncFields = [];
-      if (!_isCborNull(node.children[0])) ncFields.push(b.contextConstructed(0, _subtreesToDer(node.children[0])));   // permittedSubtrees [0]
-      if (!_isCborNull(node.children[1])) ncFields.push(b.contextConstructed(1, _subtreesToDer(node.children[1])));   // excludedSubtrees [1]
+      if (!_isCborNull(node.children[0])) ncFields.push(b.contextConstructed(0, _subtreesToDer(node.children[0], isNative)));   // permittedSubtrees [0]
+      if (!_isCborNull(node.children[1])) ncFields.push(b.contextConstructed(1, _subtreesToDer(node.children[1], isNative)));   // excludedSubtrees [1]
       if (ncFields.length === 0) throw _err("c509/bad-extensions", "nameConstraints must contain permittedSubtrees or excludedSubtrees (RFC 5280 sec. 4.2.1.10)");
       return b.sequence(ncFields);
     }
@@ -786,7 +798,7 @@ function _extValueToDer(name, node) {
     case "freshestCRL":            // [ + DistributionPointName ] / text (one DP, one-URI fullName -> bare text)
       if (node.majorType === 3) return b.sequence([b.sequence([b.explicit(0, b.contextConstructed(0, b.contextPrimitive(6, _ia5Bytes(node, 6))))])]);
       if (node.majorType !== 4 || !node.children || node.children.length < 1) throw _err("c509/bad-extensions", "a " + name + " value must be a CBOR array of DistributionPoints or a bare URI text (sec. 3.3)");
-      return b.sequence(node.children.map(function (dp) { return _dpToDer(dp); }));
+      return b.sequence(node.children.map(function (dp) { return _dpToDer(dp, isNative); }));
     case "certificatePolicies": {   // [ pid, [ *(qid, qtext) ], ... ] -> SEQUENCE OF PolicyInformation
       if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a certificatePolicies value must be a CBOR array");
       var cpKids = node.children;
@@ -834,7 +846,7 @@ function _extValueToDer(name, node) {
       return b.sequence(pcFields);   // positional slot -> tag makes [0] < [1] unique + ascending by construction
     }
     case "subjectDirectoryAttributes":   // [ type, values, type, values, ... ] -> SEQUENCE OF Attribute (sec. 3.3)
-      return _sdaToDer(node);
+      return _sdaToDer(node, isNative);
     default:
       throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
   }
@@ -1032,8 +1044,8 @@ function _extValueFromDer(name, der) {
 // Every universal PRIMITIVE tag whose content this toolkit can strictly validate, mapped to its reader. A
 // universal primitive OUTSIDE this map has no strict content validator here, so it is REJECTED rather than
 // spliced unchecked. The documented residual: a value whose type this toolkit cannot yet strictly validate is
-// not compact-representable -- NumericString / VideotexString / GraphicString / GeneralString (no content reader),
-// and a fractional-seconds GeneralizedTime (the X.690 sec. 11.7 relaxation is deliberately scoped to the codec
+// not compact-representable -- VideotexString / GraphicString / GeneralString / ObjectDescriptor / REAL (no
+// content reader in this toolkit), and a fractional-seconds GeneralizedTime (the X.690 sec. 11.7 relaxation is deliberately scoped to the codec
 // and RFC 3161 timestamping, and must not creep into a third consumer). On the ENCODE path such a value simply
 // degrades to the byte-exact ~oid + byte-string form, losing nothing; on the DECODE path it is a fail-closed
 // verdict rather than a guess.
@@ -1042,7 +1054,10 @@ var _ANY_VALUE_READERS = (function () {
   m[T.BOOLEAN] = R.boolean; m[T.INTEGER] = R.integer; m[T.ENUMERATED] = R.enumerated;
   m[T.BIT_STRING] = R.bitString; m[T.OCTET_STRING] = R.octetString; m[T.NULL] = R.nullValue;
   m[T.OBJECT_IDENTIFIER] = R.oid; m[T.UTC_TIME] = R.time; m[T.GENERALIZED_TIME] = R.time;
-  [T.UTF8_STRING, T.PRINTABLE_STRING, T.NUMERIC_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING, T.BMP_STRING, T.UNIVERSAL_STRING].forEach(function (t) { m[t] = R.string; });
+  // NumericString reads through its OWN reader: it is not a DirectoryString type, and routing it through
+  // read.string would fold it into the RFC 5280 sec. 7.1 name-comparison identity class (see asn1-der.js).
+  m[T.NUMERIC_STRING] = R.numericString;
+  [T.UTF8_STRING, T.PRINTABLE_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING, T.BMP_STRING, T.UNIVERSAL_STRING].forEach(function (t) { m[t] = R.string; });
   return m;
 })();
 
@@ -1123,7 +1138,7 @@ function _derSetInDeclaredOrder(vals) {
 
 // [ type1, values1, ... ] -> the DER SubjectDirectoryAttributes. A malformed native value fails closed
 // (c509/bad-extensions); on the encode path the same throw is a round-trip mismatch -> whole-ext ~oid fallback.
-function _sdaToDer(node) {
+function _sdaToDer(node, isNative) {
   if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes value must be a CBOR array");
   var kids = node.children;
   if (kids.length === 0 || kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes array must be non-empty (attributeType, attributeValue) pairs (sec. 3.3)");
@@ -1134,12 +1149,15 @@ function _sdaToDer(node) {
     var vals = [];
     if (typeNode.majorType === 0 || typeNode.majorType === 1) {          // int form: a sec. 8.6 registry alias, text values
       var ti = Number(cbor.read.int(typeNode));
+      // draft sec. 3.1.4 applies to EVERY int in a natively signed certificate, not just the top-level Name's.
+      if (isNative && ti < 0) throw _err("c509/bad-extensions", "a natively signed C509 subjectDirectoryAttributes attribute type integer must be non-negative (draft sec. 3.1.4), got " + ti);
       var tname = ATTR_BY_INT[Math.abs(ti)];
       if (tname === undefined) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attribute type int " + ti + " has no C509 sec. 8.6 registry row");
-      // countryName / serialNumber are PrintableString-restricted -- their int MUST carry the negative
-      // (printableString) sign. A non-negative sign is ambiguous/nonconformant: fail closed rather than
-      // silently coerce the value to PrintableString (the ~oid form is the escape hatch for a genuine odd value).
-      if ((tname === "countryName" || tname === "serialNumber") && ti >= 0) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes " + tname + " must carry the negative (printableString) sign (it is PrintableString-restricted)");
+      // countryName / serialNumber carry a CHARACTER restriction (draft sec. 3.1.4 "SHALL contain only
+      // characters from the 74-character ASCII subset permitted by PrintableString"), NOT a sign override --
+      // _reconAttrValue asserts the charset and honours the declared string type. Requiring the negative sign
+      // here would also make these attributes unrepresentable in a NATIVE certificate, whose ints SHALL all be
+      // non-negative (same sec.), so the rule is the charset, not the sign.
       for (var vi = 0; vi < valuesNode.children.length; vi++) {
         var vn = valuesNode.children[vi];
         if (vn.majorType !== 3) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes int-form attribute value must be a CBOR text string (a non-string value requires the ~oid form)");
@@ -1240,7 +1258,7 @@ function _tryCompactExtValue(name, der) {
 }
 
 // extensions (sec. 3.1.10/sec. 3.3/sec. 8.8): [ * Extension ] | a single keyUsage int-shortcut.
-function _extensions(node) {
+function _extensions(node, isNative) {
   // The keyUsage int-shortcut (sec. 3.1.10): a bare int -> one keyUsage extension, criticality from the
   // sign, value = abs(int) (Appendix A.1.1: the single int 1 -> non-critical keyUsage digitalSignature).
   if (node.majorType === 0 || node.majorType === 1) {
@@ -1267,7 +1285,7 @@ function _extensions(node) {
       // non-byte-string value there is an unsupported compact form and MUST fail closed -- a text/array value
       // is NOT raw DER, and copying its bytes would reconstruct a structurally invalid extension.
       if (EXT_COMPACT[name]) {
-        valContent = _extValueToDer(name, valNode);
+        valContent = _extValueToDer(name, valNode, isNative);
       } else if (valNode.majorType === 2) {
         valContent = valNode.content;
       } else {
@@ -1323,7 +1341,14 @@ function _reconAttrValue(rdn) {
   // emailAddress is an IA5String-only attribute (draft sec. 3.1.4): its type, not the int's sign, fixes the
   // string type, so it reconstructs as an IA5String whichever way the non-negative int was written.
   if (rdn.type === "emailAddress") return b.ia5(s);
-  if (rdn.type === "countryName" || rdn.type === "serialNumber") return b.printable(s);
+  // serialNumber / countryName carry a CHARACTER restriction, not a string-type override: draft sec. 3.1.4
+  // "SHALL contain only characters from the 74-character ASCII subset permitted by PrintableString". Enforce
+  // that on the CHARACTERS and still honour the sign for the string type -- coercing them to PrintableString
+  // regardless of sign would make the +N and -N encodings of one value reconstruct IDENTICAL DER, so a single
+  // X.509 signature would cover two distinct C509 encodings (a malleability window in the type-3 transform).
+  // b.printable IS the PrintableString charset authority -- run it for the assert even when the sign selects
+  // utf8String, so the restriction binds on the characters without overriding the declared string type.
+  if (!rdn.printable && (rdn.type === "countryName" || rdn.type === "serialNumber")) b.printable(s);
   return rdn.printable ? b.printable(s) : b.utf8(s);
 }
 
@@ -1494,10 +1519,16 @@ function parse(input) {
   var sHex = serialBytes.content.toString("hex");
 
   var sigAlg = _algorithm(f[2], SIG_ALG_BY_INT, "c509/unknown-algorithm", "issuerSignatureAlgorithm");
-  var issuer = _name509(f[3], false);
+  var issuer = _name509(f[3], false, type === 2);
   var notBefore = _time(f[4], false, "validityNotBefore");
   var notAfter = _time(f[5], true, "validityNotAfter");
-  var subject = _name509(f[6], true);
+  var subject = _name509(f[6], true, type === 2);
+  // A CBOR-null issuer means issuer == subject (self-signed), so the EFFECTIVE issuer is the subject -- and it
+  // must still satisfy RFC 5280 sec. 4.1.2.4. Checking only the array form would let the null form rebuild the
+  // very empty issuer the array form is refused for.
+  if (issuer === null && (!subject || !subject.rdns || subject.rdns.length === 0)) {
+    throw _err("c509/bad-name", "a self-signed C509 (issuer == subject) requires a non-empty subject, since it is also the issuer (RFC 5280 sec. 4.1.2.4)");
+  }
   var spkAlg = _algorithm(f[7], PK_ALG_BY_INT, "c509/unknown-algorithm", "subjectPublicKeyAlgorithm");
   var subjectPublicKey = null, rsaKey = null;
   if (spkAlg.name === "rsaEncryption") {
@@ -1511,7 +1542,7 @@ function parse(input) {
     if (f[8].majorType !== 2) throw _err("c509/bad-spki", "subjectPublicKey must be a CBOR byte string");
     subjectPublicKey = f[8].content;
   }
-  var extensions = _extensions(f[9]);
+  var extensions = _extensions(f[9], type === 2);
   if (f[10].majorType !== 2) throw _err("c509/bad-signature", "issuerSignatureValue must be a CBOR byte string");
   var signatureValue = f[10].content;
 
@@ -1751,7 +1782,12 @@ function _c509NameFromDer(nameBytes) {
     var attrName = oid.name(asn1.read.oid(attr.children[0]));
     if (attrName == null || ATTR_TO_INT[attrName] === undefined) throw _err("c509/non-invertible", "attribute type " + attrName + " has no C509 registry integer");
     var valNode = attr.children[1];
-    var value = asn1.read.string(valNode);
+    // A value whose string type this codec cannot represent (NumericString and the other non-DirectoryString
+    // types read.string declines) is NOT compact-representable -- report that in THIS module's domain rather
+    // than leaking the codec's own asn1/* fault out of encode(), which is what every sibling shape does.
+    var value;
+    try { value = asn1.read.string(valNode); }
+    catch (e) { throw _err("c509/non-invertible", "attribute " + attrName + " carries a value whose string type the C509 sec. 8.6 int form cannot represent", e); }
     // The IA5String type belongs ONLY to an IA5-only attribute (emailAddress, draft sec. 3.1.4), whose value
     // reconstructs from its type rather than the int's sign. Refuse either mismatch here with a precise verdict
     // instead of emitting an int form whose reconstruction would differ from the source bytes.

package/lib/schema-pkix.js

@@ -331,6 +331,15 @@ function attrValueToString(ns) {
       if (!e || (e.code !== "asn1/expected-string" && e.code !== "asn1/expected-primitive")) {
         throw ns.E(ns.prefix + "/bad-atv", "malformed string in attribute value: " + ((e && e.message) || String(e)));
       }
+      // NumericString is deliberately NOT read by asn1.read.string -- a value that returns a plain string joins
+      // the RFC 5280 sec. 7.1 name-comparison identity class, and NumericString is not a DirectoryString type.
+      // It does have its own strict reader though, so VALIDATE the content here (an out-of-alphabet value is
+      // malformed DER and must not be accepted merely because it falls to the opaque form) while still
+      // surfacing it in the type-distinct RFC 4514 hex form, which keeps it out of that identity class.
+      if (node.tagClass === "universal" && node.tagNumber === asn1.TAGS.NUMERIC_STRING) {
+        try { asn1.read.numericString(node); }
+        catch (e2) { throw ns.E(ns.prefix + "/bad-atv", "malformed NumericString in attribute value: " + ((e2 && e2.message) || String(e2))); }
+      }
       return "#" + node.bytes.toString("hex");
     }
     if (s.charAt(0) === "#" || s.charAt(0) === "\\") return "\\" + s;

package/lib/vendor/MANIFEST.json

@@ -1,4 +1,4 @@
 {
-  "_comment": "Vendored dependencies — none currently. @blamejs/pki's cryptography runs entirely on Node's built-in node:crypto: the classical algorithm set (RSA, ECDSA, EdDSA, ECDH, AES, HMAC, HKDF, PBKDF2, the SHA family) AND the FIPS 203/204/205 post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) via the platform OpenSSL 3.5 that the Node engine floor (>=24.18) ships. A built-in ships zero bytes and is OpenSSL-interoperable by construction, so no crypto bundle is vendored. A package is added here ONLY when a specific operation is confirmed missing from the engine floor; see lib/vendor/README.md for the policy.",
+  "_comment": "Vendored dependencies — none currently. @blamejs/pki's cryptography runs entirely on Node's built-in node:crypto: the classical algorithm set (RSA, ECDSA, EdDSA, ECDH, AES, HMAC, HKDF, PBKDF2, the SHA family) AND the FIPS 203/204/205 post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) via the platform OpenSSL 3.5 that the Node engine floor (>=24.19) ships. A built-in ships zero bytes and is OpenSSL-interoperable by construction, so no crypto bundle is vendored. A package is added here ONLY when a specific operation is confirmed missing from the engine floor; see lib/vendor/README.md for the policy.",
   "packages": {}
 }

package/lib/vendor/README.md

@@ -6,7 +6,7 @@ vendors **nothing** — this directory holds only the manifest.
 ## Native-first crypto
 
 The toolkit's cryptography runs entirely on Node's built-in `node:crypto`. The
-engine floor (Node `>=24.18`) links OpenSSL 3.5, which provides:
+engine floor (Node `>=24.19`) links OpenSSL 3.5, which provides:
 
 - the full classical set — RSA (PKCS#1 v1.5, PSS, OAEP), ECDSA, EdDSA
   (Ed25519/Ed448), ECDH (incl. X25519/X448), AES (GCM/CBC/CTR/KW), HMAC, HKDF,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -47,7 +47,7 @@
     "owns-its-stack"
   ],
   "engines": {
-    "node": ">=24.18.0"
+    "node": ">=24.19.0"
   },
   "files": [
     "index.js",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:62c970a5-3536-480a-8269-a0c5d85b82eb",
+  "serialNumber": "urn:uuid:484717d3-b574-44fc-ba53-e13d70ea5f85",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-08T02:38:25.668Z",
+    "timestamp": "2026-08-08T05:35:44.402Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -15,18 +15,18 @@
       {
         "vendor": "npm",
         "name": "cli",
-        "version": "11.16.0"
+        "version": "11.17.0"
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.4.1",
+      "bom-ref": "@blamejs/pki@0.4.2",
       "type": "application",
       "name": "pki",
-      "version": "0.4.1",
+      "version": "0.4.2",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.4.1",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.2",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.4.1",
+      "ref": "@blamejs/pki@0.4.2",
       "dependsOn": []
     }
   ]