@blamejs/pki 0.4.3 → 0.4.4

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.4.4 — 2026-08-08
+
+pki.schema.c509 encodes and decodes the RFC 3779 resource-delegation extensions -- a C509 certificate carrying IP address blocks or AS identifiers now parses at all, where before it was refused outright, and its addresses ride the compact form the specification defines.
+
+### Added
+
+- pki.schema.c509 encodes and decodes the RFC 3779 IPAddrBlocks and ASIdentifiers extensions in their compact value form, together with their RFC 8360 v2 twins, which the specification encodes identically. Previously these extensions had no registry entry, so a conformant C509 certificate carrying one was refused rather than falling back -- a C509 resource certificate could not be read at all. An address family carries its address-family identifier and optional sub-identifier, and its addresses as either the delta-coded integer form or the byte-string form; the prefix length rides the unused-bit count, so a prefix ending in zero bits survives exactly. Both directions reproduce the worked example published in the specification's own appendix, byte for byte.
+- Which address form applies is fixed by the specification, not chosen by the sender: the byte-string form applies to a whole address family as soon as any one of its addresses exceeds eight octets, and the integer form applies otherwise. The decoder enforces that, so a family that used the wrong form -- or mixed the two -- is refused instead of giving one certificate two valid encodings.
+- The compact form is used only for a certificate already in the canonical order RFC 3779 requires, at both levels. Within an address family the entries must be sorted, non-overlapping, and with any two contiguous entries already combined into one; the same three rules apply to AS identifiers. Across families, each address family may appear only once and they must ascend by their identifying octets, with a family carrying no sub-identifier preceding the one sharing its identifier. A certificate breaking any of these keeps its original bytes, because compacting it would give one resource set a second encoding when it already has a canonical one -- and because such a certificate is one an independent validator rejects, so re-encoding it would quietly turn a refused certificate into an accepted one. An address wider than its family allows, or one whose declared unused bits are not zero, is likewise refused. Every rule is enforced in both directions, so the two halves of the codec accept exactly the same certificates.
+
+### Fixed
+
+- A certificate whose version is not v3 is now refused with the reason, rather than reported as one this encoder could not reconstruct. Both C509 certificate types are defined over X.509 v3 and the encoding carries no version field, so a v1 or v2 certificate is outside the format; it previously fell through to the byte-exactness self-check, whose verdict reads as a defect in the encoder rather than a certificate the format does not cover. A v3 certificate whose extensions field is omitted was and remains fully supported -- the specification encodes that as an empty array.
+
 ## v0.4.3 — 2026-08-08
 
 pki.tls encodes and decodes RFC 8879 compressed certificate messages -- the largest payload a TLS handshake carries, and the one post-quantum chains grow by kilobytes -- with the two-sided decompression bound the specification requires. Alongside it, SHAKE128 and SHAKE256 join the digest surface, which brings the Ed448 composite signature arm into service.

package/README.md

@@ -205,7 +205,7 @@ is callable today; nothing below is a stub.
 | `pki.tls` | RFC 8879 TLS certificate compression — `decompressCertificate` / `compressCertificate` decode and build a `CompressedCertificate` (zlib / brotli / zstd, each offered only where the runtime decompresses it safely) with the two-sided bound RFC 8879 §5 requires (capped at the message's own declared length, then compared to it exactly), and `parseCertificateMessage` decodes the RFC 8446 §4.4.2 Certificate message to per-entry certificate DER |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more), the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec, certificate policies (registry-integer or OID policy identifiers with their CPS-URI and UserNotice qualifiers), and policy mappings and policy constraints, and subject directory attributes; a certificate outside the invertible set throws a typed `C509Error` |
+| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more), the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec, certificate policies (registry-integer or OID policy identifiers with their CPS-URI and UserNotice qualifiers), policy mappings and policy constraints, subject directory attributes, and the RFC 3779 resource-delegation extensions (IP address blocks and AS identifiers, plus their RFC 8360 v2 twins) whose addresses ride either the delta-coded integer form or the byte-string form the specification mandates once an address exceeds eight octets; a value the compact form cannot carry exactly falls back to the byte-string form with its bytes intact, and a certificate outside the invertible set throws a typed `C509Error` |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |

package/lib/oid.js

@@ -87,7 +87,11 @@ var FAMILIES = {
     // id-pe-tlsfeature (RFC 7633) -- the TLS Feature (formerly "must-staple") extension.
     tlsFeature: 24,
     // id-pe-qcStatements (RFC 3739 sec. 3.2.6) -- the qualified-certificate-statements extension.
-    qcStatements: 3 } },
+    qcStatements: 3,
+    // RFC 3779 -- the IP-address and AS-number delegation extensions that carry a resource
+    // certificate's authority (RPKI). Each has an RFC 8360 "v2" twin with identical syntax and
+    // stricter path-validation semantics, so both are registered here.
+    ipAddrBlocks: 7, autonomousSysIds: 8, ipAddrBlocksV2: 28, autonomousSysIdsV2: 29 } },
 
   // RFC 3739 sec. 3.2.6.1 id-qcs -- the PKIX QCStatement statementIds carrying SemanticsInformation.
   pkixQcSyntax: { base: [1, 3, 6, 1, 5, 5, 7, 11], of: { qcsPkixQCSyntaxV1: 1, qcsPkixQCSyntaxV2: 2 } },

package/lib/schema-c509.js

@@ -97,6 +97,12 @@ var EXT_BY_INT = {
   29: _name("freshestCRL"),
   30: _name("inhibitAnyPolicy"),
   31: _name("subjectInfoAccess"),
+  // RFC 3779 resource-delegation extensions, and their RFC 8360 "v2" twins, which the draft
+  // encodes "exactly like" the originals -- same two codecs, four registry rows (sec. 8.8).
+  32: _name("ipAddrBlocks"),
+  33: _name("autonomousSysIds"),
+  34: _name("ipAddrBlocksV2"),
+  35: _name("autonomousSysIdsV2"),
   36: _name("ocspNoCheck"),
   38: _name("tlsFeature"),
 };
@@ -108,6 +114,7 @@ var EXT_COMPACT = {
   subjectAltName: 1, issuerAltName: 1, nameConstraints: 1, cRLDistributionPoints: 1,
   freshestCRL: 1, authorityInfoAccess: 1, subjectInfoAccess: 1, certificatePolicies: 1,
   policyMappings: 1, policyConstraints: 1, subjectDirectoryAttributes: 1,
+  ipAddrBlocks: 1, autonomousSysIds: 1, ipAddrBlocksV2: 1, autonomousSysIdsV2: 1,
 };
 // sec. 8.12 Extended Key Usages registry (C509 int -> registered id-kp purpose name). A KeyPurposeId
 // outside this set encodes as an unwrapped ~oid; a C509 int outside it fails closed on decode.
@@ -555,6 +562,332 @@ function _ncIpFromDer(buf) {
   return Buffer.concat([buf.subarray(0, addrLen), Buffer.from([prefixLen])]);
 }
 
+// ---- RFC 3779 IPAddrBlocks / ASIdentifiers (draft sec. 3.3, ext ints 32-35) -----------------
+//
+// An RFC 3779 IPAddress is a BIT STRING whose unused-bit count carries the prefix length, so the
+// draft maps it to the byte sequence `unusedBits || value`, which "preserves the exact information
+// contained in the ASN.1 BIT STRING" -- lossless even for a prefix ending in zero bits. Per
+// IPAddressFamily the draft then picks ONE of two forms and makes the choice a SHALL: if any of the
+// family's byte sequences exceeds 8 octets the whole family uses the bytes form, otherwise the int
+// form. Accepting the wrong one would give one DER two CBOR encodings, so decode enforces it.
+//
+// The int form is the big-endian integer of `(unusedBits + 1) || value` -- the +1 guarantees a
+// non-zero leading octet, which is what makes the minimal big-endian representation unambiguous --
+// and every IPAddress after the first is stored as the DIFFERENCE from its predecessor. The chain
+// runs flat over each address in order (a range contributes min then max) and RESETS at each
+// family, so a family always opens with an absolute value.
+//
+// These integers reach 2^64-1: an IPv6 /48 already exceeds 2^53, and the draft's own A.5 vector
+// lands there. Everything below is BigInt end to end and bounds through guard.range.uint64 (the
+// BigInt-preserving guard) -- never the uint31 counter bound, which would reject a valid prefix.
+
+// An asn1 node exposes tagClass + tagNumber (never a combined `.tag`), so a universal-type test
+// has to check both -- a context-tagged [16] must not read as a SEQUENCE.
+function _isUniversal(n, tagNumber) { return !!n && n.tagClass === "universal" && n.tagNumber === tagNumber; }
+
+// `unusedBits || value` -> the (unusedBits+1)||value integer. Returns null if the sequence cannot
+// be one (empty, or an unused-bit count DER would not accept).
+function _ipSeqToInt(seq) {
+  if (!seq.length || seq[0] > 7) return null;
+  // One-shot base-256 parse of (unusedBits+1)||value. A per-byte shift-accumulate is quadratic in
+  // the operand width, so the toolkit builds a BigInt from its hex in a single call instead.
+  var head = Buffer.from([seq[0] + 1]);
+  return BigInt("0x" + Buffer.concat([head, seq.subarray(1)]).toString("hex"));
+}
+// The inverse: the minimal big-endian octets of `n`, with the leading octet decremented back to the
+// unused-bit count. Returns null when `n` cannot be an encoded IPAddress -- a leading octet outside
+// 1..8 is not a DER unused-bit count, and past 8 octets the family was required to use the bytes form.
+function _ipIntToSeq(n) {
+  if (n < 1n) return null;
+  var out = [];
+  for (var v = n; v > 0n; v >>= 8n) out.unshift(Number(v & 0xffn));
+  if (out.length > 9 || out[0] < 1 || out[0] > 8) return null;
+  out[0] -= 1;
+  return Buffer.from(out);
+}
+// The address width in octets of an address family, from its AFI (RFC 3779 sec. 2.2.3.3). Only a
+// family whose width is known can have its canonical form checked, so an unrecognized AFI yields
+// null and the caller declines to compact rather than compacting something it cannot verify.
+var _IP_WIDTH = { 1: 4, 2: 16 };
+
+// The lowest address an `unusedBits || value` sequence denotes, as `width` big-endian octets. DER
+// forces the unused bits to zero, so the value IS its own lowest address once zero-extended.
+function _ipLow(seq, width) {
+  var v = Buffer.alloc(width);
+  seq.subarray(1).copy(v);
+  return v;
+}
+// The highest address it denotes: the same prefix with every host bit set (RFC 3779 sec. 2.2.3.8 --
+// a range's max is likewise the prefix with its trailing bits taken as ones).
+function _ipHigh(seq, width) {
+  var v = _ipLow(seq, width);
+  var bits = (seq.length - 1) * 8 - seq[0];
+  for (var i = bits; i < width * 8; i++) v[i >> 3] |= 0x80 >> (i & 7);
+  return v;
+}
+// Big-endian octet-string compare, and "is `b` the immediate successor of `a`" -- the test that
+// distinguishes a legal gap from a contiguous pair the RFC requires be merged.
+function _ipOctCmp(a, b) {
+  for (var i = 0; i < a.length; i++) { if (a[i] !== b[i]) return a[i] - b[i]; }
+  return 0;
+}
+function _ipIsSuccessor(a, b) {
+  var carry = 1, inc = Buffer.from(a);
+  for (var i = inc.length - 1; i >= 0 && carry; i--) { var s = inc[i] + carry; inc[i] = s & 0xff; carry = s >> 8; }
+  if (carry) return false;                    // `a` was already the maximum address
+  return _ipOctCmp(inc, b) === 0;
+}
+
+// RFC 3779 sec. 2.2.3.7: "any range of addresses that can be encoded as a prefix MUST be encoded
+// using an IPAddress element", with the choice fixed by the spec's own pseudocode -- let N be the
+// count of matching leading bits of the low and high addresses; if every remaining bit of the low
+// is zero AND every remaining bit of the high is one, the span IS the N-bit prefix and the range
+// form is forbidden. Two encodings of one address span would otherwise both be legal.
+function _ipRangeIsPrefix(lo, hi) {
+  var bits = lo.length * 8, n = 0;
+  while (n < bits) {
+    var byteAt = n >> 3, mask = 0x80 >> (n & 7);
+    if ((lo[byteAt] & mask) !== (hi[byteAt] & mask)) break;
+    n++;
+  }
+  for (var i = n; i < bits; i++) {
+    var bt = i >> 3, mk = 0x80 >> (i & 7);
+    if ((lo[bt] & mk) !== 0) return false;        // a low-address host bit is set
+    if ((hi[bt] & mk) === 0) return false;        // a high-address host bit is clear
+  }
+  return true;
+}
+
+// RFC 3779 sec. 2.2.3.3 orders the families themselves: "There MUST be only one IPAddressFamily
+// SEQUENCE per unique combination of AFI and SAFI. Each SEQUENCE MUST be ordered by ascending
+// addressFamily values (treating the octets as unsigned quantities). An addressFamily without a
+// SAFI MUST precede one that contains an SAFI." A plain unsigned octet-string compare gives all
+// three at once, because a two-octet family is a PREFIX of the three-octet one sharing its AFI and
+// a prefix sorts first. Returns < 0, 0 or > 0; 0 means the same AFI/SAFI appeared twice.
+function _famOctCmp(a, b) {
+  var n = Math.min(a.length, b.length);
+  for (var i = 0; i < n; i++) { if (a[i] !== b[i]) return a[i] - b[i]; }
+  return a.length - b.length;
+}
+
+// Is `unusedBits || value` a sequence DER would accept as a BIT STRING? The declared unused low
+// bits MUST be zero (RFC 3779 sec. 2.2.3.8 restates the DER rule), and a value with no octets can
+// only declare zero unused bits. Checked HERE rather than left to the BIT STRING builder, because
+// the builder's fault is an asn1/* error surfacing out of a CBOR-layer decode -- a caller handed a
+// malformed compact value should see this module's own verdict, not the ASN.1 layer's.
+function _ipSeqBitsClear(seq) {
+  var unused = seq[0], value = seq.subarray(1);
+  if (!value.length) return unused === 0;
+  if (unused === 0) return true;
+  return (value[value.length - 1] & ((1 << unused) - 1)) === 0;
+}
+
+// RFC 3779 sec. 2.2.3.6 fixes the canonical form of an address list: entries sorted on
+// `<lowest address> | <prefix length>` (which is neither the DER byte order nor the compact integer
+// order -- the RFC warns about the first and the second sorts the same wrong way), no pair
+// overlapping, and any contiguous pair combined into one entry. All three bind together: a list
+// violating any of them is not the one canonical encoding of its address set, so this codec
+// declines to compact it and the extension keeps its original bytes.
+// Two comparisons carry all three rules. `cur.lo > prev.hi` is the no-overlap rule AND the sort
+// rule at once: entries are already known to have lo <= hi, so an entry that started at or before
+// its predecessor's low address would also start at or before its high one. A separate ascending
+// test would therefore be a branch nothing can reach.
+function _ipRangesCanonical(bounds) {
+  for (var i = 1; i < bounds.length; i++) {
+    var prev = bounds[i - 1], cur = bounds[i];
+    if (_ipOctCmp(cur.lo, prev.hi) <= 0) return false;        // out of order, or overlapping
+    if (_ipIsSuccessor(prev.hi, cur.lo)) return false;        // contiguous: MUST have been merged
+  }
+  return true;
+}
+
+// One family's IntIPAddressChoice / IPAddressChoice -> the DER IPAddressOrRange SEQUENCE list.
+// The int form stores each address after the first as a DIFFERENCE from its predecessor, flat over
+// every address in order (a range contributes min then max); the chain resets at each family, which
+// is why `prev` starts null here rather than being threaded across families. The reconstructed
+// ABSOLUTE is what gets bounded -- the delta itself is an arbitrary CBOR int and bounding it would
+// miss a chain that walks out of range in steps.
+function _ipChoiceToDer(items, afi) {
+  var out = [], prev = null, sawBytes = false, sawInt = false, seqs = [];
+  // An address may not be wider than its family: RFC 3779 sec. 2.2.3.8 sizes an IPAddress by the
+  // family, so a 5-octet address under AFI 1 is not an IPv4 address at all. Without this, a native
+  // C509 would reconstruct into a DER carrying an over-wide address -- one the RFC forbids and an
+  // independent validator refuses -- from CBOR this codec had accepted. The mirror check lives on
+  // the encode side; both directions have to hold or the pair is not a bijection.
+  // Without the family's address width none of the RFC 3779 rules below can be evaluated: the
+  // width bound has nothing to compare against, and the low/high bounds that drive the order,
+  // overlap, adjacency and endpoint checks cannot be computed at all. Accepting such a family
+  // would therefore wave every one of those checks through -- so a family this codec cannot
+  // measure is refused outright, matching the encode side, which declines to compact it. An
+  // `inherit` family is unaffected: it carries no addresses and never reaches here.
+  var width = _IP_WIDTH[afi];
+  if (!width) throw _err("c509/bad-extensions", "address family " + afi + " has no known address width, so its addresses cannot be checked (RFC 3779 sec. 2.2.3.3)");
+  function widthOk(seq) { return seq.length - 1 <= width; }
+  function absolute(node) {
+    var seq;
+    if (node.majorType === 2) {                              // bytes form: the sequence verbatim
+      sawBytes = true;
+      if (node.content.length === 0) throw _err("c509/bad-extensions", "an IPAddress byte sequence must be non-empty");
+      if (node.content[0] > 7) throw _err("c509/bad-extensions", "an IPAddress unused-bit count must be 0..7 (DER)");
+      seq = node.content;
+    } else {
+      sawInt = true;
+      var d = _cborIntVal(node, "an IPAddress");
+      var abs = prev === null ? d : prev + d;
+      prev = abs;
+      // Bound the reconstructed absolute through the BigInt-preserving guard: this domain reaches
+      // 2^64-1, so narrowing to Number would corrupt the value being guarded.
+      guard.range.uint64(abs, _err, "c509/bad-extensions", "an IPAddress");
+      seq = _ipIntToSeq(abs);
+      if (!seq) throw _err("c509/bad-extensions", "an IPAddress integer does not encode a DER BIT STRING (sec. 3.3)");
+    }
+    if (!widthOk(seq)) {
+      throw _err("c509/bad-extensions", "an IPAddress is wider than address family " + afi + " permits (RFC 3779 sec. 2.2.3.8)");
+    }
+    if (!_ipSeqBitsClear(seq)) {
+      throw _err("c509/bad-extensions", "an IPAddress must leave its declared unused bits zero (RFC 3779 sec. 2.2.3.8)");
+    }
+    return seq;
+  }
+  var bounds = [];
+  for (var i = 0; i < items.length; i++) {
+    var it = items[i];
+    if (it.majorType === 4) {                                 // [min, max] -> an addressRange
+      if (!it.children || it.children.length !== 2) throw _err("c509/bad-extensions", "an IPAddress range must be exactly [min, max]");
+      var lo = absolute(it.children[0]), hi = absolute(it.children[1]);
+      seqs.push(lo); seqs.push(hi);
+      var rlo = _ipLow(lo, width), rhi = _ipHigh(hi, width);
+      {
+        // A span expressible as a prefix MUST use the prefix form (RFC 3779 sec. 2.2.3.7), or one
+        // address span would have two legal encodings.
+        if (_ipRangeIsPrefix(rlo, rhi)) throw _err("c509/bad-extensions", "an address range that is exactly a prefix must use the prefix form (RFC 3779 sec. 2.2.3.7)");
+        bounds.push({ lo: rlo, hi: rhi });
+      }
+      out.push(b.sequence([b.bitString(lo.subarray(1), lo[0]), b.bitString(hi.subarray(1), hi[0])]));
+    } else {                                                  // a single addressPrefix
+      var pfx = absolute(it);
+      seqs.push(pfx);
+      bounds.push({ lo: _ipLow(pfx, width), hi: _ipHigh(pfx, width) });
+      out.push(b.bitString(pfx.subarray(1), pfx[0]));
+    }
+  }
+  // The form choice is a SHALL, so the wrong one would give one DER two CBOR encodings. A family
+  // mixing the two arms is not a choice either admits; a bytes-form family whose every sequence
+  // fits 8 octets was required to use the int form.
+  if (sawBytes && sawInt) throw _err("c509/bad-extensions", "an IPAddressFamily must use one address form throughout (sec. 3.3)");
+  if (sawBytes && !seqs.some(function (s) { return s.length > 8; })) {
+    throw _err("c509/bad-extensions", "an IPAddressFamily whose addresses all fit 8 octets must use the integer form (sec. 3.3)");
+  }
+  // The SAME RFC 3779 sec. 2.2.3.6 canonical form the encode side requires, enforced here too.
+  // draft sec. 3.3 says "The limitations specified in [RFC3779] apply here as well", so a compact
+  // list that is unsorted, overlapping, or unmerged is malformed C509 -- and reconstructing it
+  // would emit a certificate an independent validator refuses, from CBOR this codec had accepted.
+  // Both directions must hold or the pair is not a bijection.
+  for (var r = 0; r < bounds.length; r++) {
+    if (_ipOctCmp(bounds[r].lo, bounds[r].hi) > 0) throw _err("c509/bad-extensions", "an IPAddress range must not end below its start (RFC 3779 sec. 2.2.3.9)");
+  }
+  if (!_ipRangesCanonical(bounds)) {
+    throw _err("c509/bad-extensions", "an IPAddressFamily must be sorted, non-overlapping and maximally merged (RFC 3779 sec. 2.2.3.6)");
+  }
+  return out;
+}
+
+// DER IPAddressChoice (a SEQUENCE of BIT STRING / SEQUENCE-of-two-BIT-STRING) -> the compact CBOR
+// array. The form is chosen per family and is a SHALL: the bytes form applies to the WHOLE family
+// as soon as any one sequence exceeds 8 octets, otherwise every member takes the delta-coded int
+// form. Returns null on any shape the compact form cannot carry exactly.
+function _ipChoiceFromDer(ch, afi) {
+  if (!_isUniversal(ch, asn1.TAGS.SEQUENCE) || !ch.children || ch.children.length === 0) return null;
+  // Collect each address as its `unusedBits || value` sequence, keeping the range grouping.
+  var groups = [], flat = [];
+  for (var i = 0; i < ch.children.length; i++) {
+    var el = ch.children[i], pair;
+    if (_isUniversal(el, asn1.TAGS.BIT_STRING)) {
+      var bs = asn1.read.bitString(el);
+      pair = [Buffer.concat([Buffer.from([bs.unusedBits]), bs.bytes])];
+    } else if (_isUniversal(el, asn1.TAGS.SEQUENCE) && el.children && el.children.length === 2 &&
+               _isUniversal(el.children[0], asn1.TAGS.BIT_STRING) && _isUniversal(el.children[1], asn1.TAGS.BIT_STRING)) {
+      var lo = asn1.read.bitString(el.children[0]), hi = asn1.read.bitString(el.children[1]);
+      pair = [Buffer.concat([Buffer.from([lo.unusedBits]), lo.bytes]),
+              Buffer.concat([Buffer.from([hi.unusedBits]), hi.bytes])];
+    } else return null;
+    groups.push(pair);
+    for (var k = 0; k < pair.length; k++) flat.push(pair[k]);
+  }
+  // The list must be in RFC 3779 sec. 2.2.3.6 canonical form -- sorted, non-overlapping, and with
+  // every contiguous pair already merged. A list that is not is not the one canonical encoding of
+  // its address set, so it is NOT re-encoded into a conforming one: this returns null and the
+  // extension rides the byte-string form, keeping its exact bytes and leaving the defect visible to
+  // a validator. Checking overlap and adjacency needs the family's address width, so a family whose
+  // AFI this codec does not know declines too, rather than compacting what it cannot verify.
+  // Defense-in-depth, and deliberately explicit: without the width the bound arithmetic below would
+  // fault and the caller's catch would produce the same fallback, so this line changes no observable
+  // verdict and no vector can isolate it. It stays because a fallback that depends on an exception
+  // being raised somewhere downstream is one refactor away from becoming an accepted value.
+  var width = _IP_WIDTH[afi];
+  if (!width) return null;
+  var bounds = [];
+  for (var g = 0; g < groups.length; g++) {
+    var bg = groups[g];
+    if (bg[0].length - 1 > width || bg[bg.length - 1].length - 1 > width) return null;   // longer than the family's addresses
+    var blo = _ipLow(bg[0], width), bhi = _ipHigh(bg[bg.length - 1], width);
+    // The mirror of the decode-side rule: a range that is exactly a prefix had to be written as one.
+    // No vector can isolate this line today, because the encode path's round-trip self-verify
+    // re-parses what it produced and the decode rule rejects it there, yielding the same fallback.
+    // It stays explicit because that makes encode's correctness depend on decode continuing to
+    // throw -- soften the decode rule and this path would silently start compacting again.
+    if (bg.length === 2 && _ipRangeIsPrefix(blo, bhi)) return null;
+    bounds.push({ lo: blo, hi: bhi });
+  }
+  // A range's own endpoints must ascend too, which a single-entry list has no chance to violate.
+  for (var r = 0; r < bounds.length; r++) {
+    if (_ipOctCmp(bounds[r].lo, bounds[r].hi) > 0) return null;
+  }
+  if (!_ipRangesCanonical(bounds)) return null;
+  var useBytes = flat.some(function (s) { return s.length > 8; });
+  var out = [];
+  if (useBytes) {
+    groups.forEach(function (p) {
+      out.push(p.length === 1 ? cbor.build.byteString(p[0])
+        : cbor.build.array([cbor.build.byteString(p[0]), cbor.build.byteString(p[1])]));
+    });
+    return cbor.build.array(out);
+  }
+  var prev = null;
+  function delta(seq) {
+    var n = _ipSeqToInt(seq);
+    if (n === null) return null;
+    var d = prev === null ? n : n - prev;
+    prev = n;
+    return cbor.build.int(d);
+  }
+  for (var gi = 0; gi < groups.length; gi++) {
+    var grp = groups[gi];
+    if (grp.length === 1) {
+      var one = delta(grp[0]);
+      if (!one) return null;
+      out.push(one);
+    } else {
+      var dlo = delta(grp[0]);
+      var dhi = dlo ? delta(grp[1]) : null;
+      if (!dlo || !dhi) return null;
+      out.push(cbor.build.array([dlo, dhi]));
+    }
+  }
+  return cbor.build.array(out);
+}
+
+// One ASId in the delta chain -> its absolute value, bounded to the RFC 3779 32-bit ASId domain.
+// Safe to narrow here (2^32-1 < 2^53), unlike the IP domain.
+function _asDelta(node, prev) {
+  var d = _cborIntVal(node, "an ASIdentifier");
+  var abs = prev === null ? d : prev + d;
+  // Bound only -- the narrowed Number the guard returns is deliberately discarded, because the
+  // chain's next step adds a BigInt delta to this value and mixing the two throws.
+  guard.range.int(abs, 0n, 4294967295n, _err, "c509/bad-extensions", "an ASIdentifier");
+  return abs;
+}
+
 // GeneralSubtrees = [ + GeneralName ] (the flat int/value array) <-> the concatenated GeneralSubtree
 // SEQUENCEs (RFC 5280 sec. 4.2.1.10: SEQUENCE { base, minimum [0] DEFAULT 0, maximum [1] OPTIONAL }); the
 // C509 profile omits minimum/maximum, so each GeneralSubtree is base-only.
@@ -799,6 +1132,82 @@ function _extValueToDer(name, node, isNative) {
       if (node.majorType === 3) return b.sequence([b.sequence([b.explicit(0, b.contextConstructed(0, b.contextPrimitive(6, _ia5Bytes(node, 6))))])]);
       if (node.majorType !== 4 || !node.children || node.children.length < 1) throw _err("c509/bad-extensions", "a " + name + " value must be a CBOR array of DistributionPoints or a bare URI text (sec. 3.3)");
       return b.sequence(node.children.map(function (dp) { return _dpToDer(dp, isNative); }));
+    // IPAddrBlocks (and its RFC 8360 v2 twin): a FLAT array of (AFI, SAFI, choice) triples --
+    // IPAddressFamily is a parenthesized CDDL group, so it splices rather than nesting.
+    case "ipAddrBlocks":
+    case "ipAddrBlocksV2": {
+      if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "an IPAddrBlocks value must be a CBOR array");
+      var ipKids = node.children;
+      if (ipKids.length === 0 || ipKids.length % 3 !== 0) throw _err("c509/bad-extensions", "an IPAddrBlocks array must be non-empty (AFI, SAFI, addresses) triples (sec. 3.3)");
+      var families = [], prevFam = null;
+      for (var fi = 0; fi + 2 < ipKids.length; fi += 3) {
+        var afi = _cborUint(ipKids[fi], "an IPAddrBlocks AFI");
+        if (afi > 0xffffn) throw _err("c509/bad-extensions", "an IPAddrBlocks AFI must fit two octets (RFC 3779 sec. 2.2.3.3)");
+        var safiNode = ipKids[fi + 1], famBytes = [Number(afi >> 8n) & 0xff, Number(afi & 0xffn)];
+        if (!_isCborNull(safiNode)) {
+          var safi = _cborUint(safiNode, "an IPAddrBlocks SAFI");
+          if (safi > 0xffn) throw _err("c509/bad-extensions", "an IPAddrBlocks SAFI must fit one octet (RFC 3779 sec. 2.2.3.3)");
+          famBytes.push(Number(safi));
+        }
+        // The families themselves are ordered and unique (RFC 3779 sec. 2.2.3.3), the same way the
+        // addresses inside one are. Without this a value could name AFI 2 before AFI 1, or repeat a
+        // family, and reconstruct a certificate an independent validator refuses.
+        var famOct = Buffer.from(famBytes);
+        if (prevFam !== null && _famOctCmp(prevFam, famOct) >= 0) {
+          throw _err("c509/bad-extensions", "IPAddrBlocks address families must be unique and in ascending addressFamily order (RFC 3779 sec. 2.2.3.3)");
+        }
+        prevFam = famOct;
+        var choice = ipKids[fi + 2], famFields = [b.octetString(famOct)];
+        if (_isCborNull(choice)) {                          // null -> inherit
+          famFields.push(b.nullValue());
+        } else {
+          if (choice.majorType !== 4 || !choice.children || choice.children.length === 0) {
+            throw _err("c509/bad-extensions", "an IPAddrBlocks address choice must be null (inherit) or a non-empty CBOR array");
+          }
+          famFields.push(b.sequence(_ipChoiceToDer(choice.children, Number(afi))));
+        }
+        families.push(b.sequence(famFields));
+      }
+      return b.sequence(families);
+    }
+    // ASIdentifiers (and its v2 twin): null = inherit, else a flat array of uint / [min,max].
+    // Only the asnum field is representable -- a present rdi has no compact form (sec. 3.3), so a
+    // certificate carrying one rides the ~oid byte-string form and never reaches this arm.
+    case "autonomousSysIds":
+    case "autonomousSysIdsV2": {
+      if (_isCborNull(node)) return b.sequence([b.explicit(0, b.nullValue())]);   // asnum inherit
+      if (node.majorType !== 4 || !node.children || node.children.length === 0) {
+        throw _err("c509/bad-extensions", "an ASIdentifiers value must be null (inherit) or a non-empty CBOR array");
+      }
+      // The deltas are `uint` in the draft's CDDL precisely because RFC 3779 sec. 3.2.3.4 sorts AS
+      // ids by increasing value: a negative delta would walk the chain backwards. That section also
+      // forbids a pair overlapping and requires a contiguous series to be one range -- the same
+      // three rules the encode side applies, tracked here across members through `asPrevHigh`.
+      // A negative delta needs no separate test: on the first entry it drives the absolute below
+      // zero and the range guard refuses it, and on any later entry it lands at or below the
+      // previous high, which the canonical test already refuses. A separate uint check would be a
+      // branch nothing can reach.
+      var asKids = node.children, asDers = [], asPrev = null, asPrevHigh = null;
+      for (var asi2 = 0; asi2 < asKids.length; asi2++) {
+        var it = asKids[asi2];
+        if (it.majorType === 4) {                            // [min, max] -> ASRange
+          if (!it.children || it.children.length !== 2) throw _err("c509/bad-extensions", "an ASIdentifiers range must be exactly [min, max]");
+          var amin = _asDelta(it.children[0], asPrev), amax = _asDelta(it.children[1], amin);
+          if (amax <= amin) throw _err("c509/bad-extensions", "an ASIdentifiers range must be ascending (RFC 3779 sec. 3.2.3.6)");
+          if (asPrevHigh !== null && amin <= asPrevHigh + 1n) throw _err("c509/bad-extensions", "ASIdentifiers must be sorted, non-overlapping and maximally merged (RFC 3779 sec. 3.2.3.4)");
+          asDers.push(b.sequence([b.integer(amin), b.integer(amax)]));
+          asPrev = amax;
+          asPrevHigh = amax;
+        } else {                                             // uint -> ASId
+          var aid = _asDelta(it, asPrev);
+          if (asPrevHigh !== null && aid <= asPrevHigh + 1n) throw _err("c509/bad-extensions", "ASIdentifiers must be sorted, non-overlapping and maximally merged (RFC 3779 sec. 3.2.3.4)");
+          asDers.push(b.integer(aid));
+          asPrev = aid;
+          asPrevHigh = aid;
+        }
+      }
+      return b.sequence([b.explicit(0, b.sequence(asDers))]);
+    }
     case "certificatePolicies": {   // [ pid, [ *(qid, qtext) ], ... ] -> SEQUENCE OF PolicyInformation
       if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a certificatePolicies value must be a CBOR array");
       var cpKids = node.children;
@@ -960,6 +1369,73 @@ function _extValueFromDer(name, der) {
       if (dpResults.length === 1 && dpResults[0].oneUri != null && dpResults[0].noReasons && dpResults[0].noIssuer) return cbor.build.textString(dpResults[0].oneUri);
       return cbor.build.array(dpResults.map(function (r) { return r.triple; }));
     }
+    // IPAddrBlocks -> the flat (AFI, SAFI, choice) array. Any shape the compact form cannot
+    // represent exactly returns null, so the extension rides the ~oid byte-string form intact.
+    case "ipAddrBlocks":
+    case "ipAddrBlocksV2": {
+      if (!_isUniversal(node, asn1.TAGS.SEQUENCE) || !node.children || node.children.length === 0) return null;
+      var ipOut = [], prevFamOct = null;
+      for (var ifi = 0; ifi < node.children.length; ifi++) {
+        var fam = node.children[ifi];
+        if (!_isUniversal(fam, asn1.TAGS.SEQUENCE) || !fam.children || fam.children.length !== 2) return null;
+        var famOct = asn1.read.octetString(fam.children[0]);
+        if (famOct.length !== 2 && famOct.length !== 3) return null;   // OCTET STRING (SIZE (2..3))
+        // Families ordered and unique (RFC 3779 sec. 2.2.3.3) -- the mirror of the decode side.
+        if (prevFamOct !== null && _famOctCmp(prevFamOct, famOct) >= 0) return null;
+        prevFamOct = famOct;
+        var afiVal = (famOct[0] << 8) | famOct[1];
+        ipOut.push(cbor.build.uint(BigInt(afiVal)));
+        ipOut.push(famOct.length === 3 ? cbor.build.uint(BigInt(famOct[2])) : cbor.build.nullValue());
+        var ch = fam.children[1];
+        if (_isUniversal(ch, asn1.TAGS.NULL)) { ipOut.push(cbor.build.nullValue()); continue; }   // inherit
+        var chOut = _ipChoiceFromDer(ch, afiVal);
+        if (!chOut) return null;
+        ipOut.push(chOut);
+      }
+      return cbor.build.array(ipOut);
+    }
+    // ASIdentifiers -> null (inherit) or the flat delta array. Only asnum is representable: a
+    // present rdi has no compact form (sec. 3.3), so such a certificate returns null here.
+    case "autonomousSysIds":
+    case "autonomousSysIdsV2": {
+      if (!_isUniversal(node, asn1.TAGS.SEQUENCE) || !node.children || node.children.length !== 1) return null;
+      var asnum = node.children[0];
+      if (asnum.tagClass !== "context" || asnum.tagNumber !== 0 || !asnum.children || asnum.children.length !== 1) return null;
+      var inner = asnum.children[0];
+      if (_isUniversal(inner, asn1.TAGS.NULL)) return cbor.build.nullValue();          // asnum inherit
+      if (!_isUniversal(inner, asn1.TAGS.SEQUENCE) || !inner.children || inner.children.length === 0) return null;
+      // RFC 3779 sec. 3.2.3.4 fixes the canonical form the same way sec. 2.2.3.6 does for addresses:
+      // sorted by increasing value, no pair overlapping, and any contiguous series already merged
+      // into one range. `asPrevHigh` carries the previous entry's upper bound so all three hold
+      // ACROSS members -- checking only within a range would let a descending or adjacent pair
+      // through. A list that is not canonical is left uncompacted with its bytes intact.
+      var asOut = [], asPrevOut = null, asPrevHigh = null;
+      for (var aoi = 0; aoi < inner.children.length; aoi++) {
+        var el = inner.children[aoi], elLo, elHi;
+        if (_isUniversal(el, asn1.TAGS.INTEGER)) {
+          elLo = asn1.read.integer(el);
+          elHi = elLo;
+          if (elLo < 0n || elLo > 4294967295n) return null;
+        } else if (_isUniversal(el, asn1.TAGS.SEQUENCE) && el.children && el.children.length === 2) {
+          elLo = asn1.read.integer(el.children[0]);
+          elHi = asn1.read.integer(el.children[1]);
+          if (elLo < 0n || elHi > 4294967295n || elHi <= elLo) return null;
+        } else return null;
+        if (asPrevHigh !== null && elLo <= asPrevHigh + 1n) return null;   // descending, overlapping, or contiguous
+        if (el.tagNumber === asn1.TAGS.INTEGER) {
+          asOut.push(cbor.build.int(asPrevOut === null ? elLo : elLo - asPrevOut));
+          asPrevOut = elLo;
+        } else {
+          asOut.push(cbor.build.array([
+            cbor.build.int(asPrevOut === null ? elLo : elLo - asPrevOut),
+            cbor.build.int(elHi - elLo),
+          ]));
+          asPrevOut = elHi;
+        }
+        asPrevHigh = elHi;
+      }
+      return cbor.build.array(asOut);
+    }
     case "certificatePolicies": {                                  // SEQUENCE OF PolicyInformation -> [ pid, [ *(qid, qtext) ], ... ]
       if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
       var cpOut = [];
@@ -1879,6 +2355,14 @@ function _compressEcPoint(point, coordLen) {
 _derToType3 = function (input, opts) {
   var c;
   try { c = x509.parse(input); } catch (e) { throw _err("c509/bad-input", "the input is not a valid X.509 certificate", e); }
+  // Both C509 certificate types are defined over X.509 v3 (draft-ietf-cose-cbor-encoded-cert
+  // sec. 1), and the encoding carries no version field -- reconstruction always emits v3. So a v1
+  // or v2 certificate is outside the format, not a codec limitation, and saying so here keeps it
+  // from falling through to the byte-compare below, whose "does not reconstruct byte-for-byte"
+  // reads as a defect in this encoder rather than a certificate the format does not cover.
+  // (A v3 certificate with the extensions field OMITTED is fully supported: sec. 3.1.10 encodes
+  // an omitted 'extensions' field as an empty CBOR array.)
+  if (c.version !== 3) throw _err("c509/non-invertible", "C509 covers X.509 v3 certificates; got v" + c.version);
   if (!/^ecdsa/i.test(c.signatureAlgorithm.name || "")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
   if (c.subjectPublicKeyInfo.algorithm.name !== "ecPublicKey") throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
   var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1c291ecb-db3e-4569-b3aa-70bb7803b9f3",
+  "serialNumber": "urn:uuid:1be17160-9a0e-4c1f-b171-d5234287a696",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-08T07:58:59.469Z",
+    "timestamp": "2026-08-08T17:10:39.565Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.4.3",
+      "bom-ref": "@blamejs/pki@0.4.4",
       "type": "application",
       "name": "pki",
-      "version": "0.4.3",
+      "version": "0.4.4",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.4.3",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.4",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.4.3",
+      "ref": "@blamejs/pki@0.4.4",
       "dependsOn": []
     }
   ]