@blamejs/pki 0.6.36 → 0.6.38

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.38 — 2026-09-05
+
+A trust anchor can name the namespace its root is trusted for, and pki.path.validate enforces it as the initial name-constraint state.
+
+### Added
+
+- A trust anchor passed to pki.path.validate or pki.path.build may carry nameConstraints: { permitted, excluded }, each an array of { tag, base } subtrees. They seed the RFC 5280 section 6.1.1(h)(i) initial permitted and excluded state, so a root a program trusts only for a namespace enforces that namespace even though its certificate states no nameConstraints extension. The anchor's subtrees intersect with an intermediate's own extension and with opts.initialPermittedSubtrees; excluded subtrees are a union.
+- The pki.path.validate verdict reports anchorConstraints.nameConstraintsApplied, so a stored verdict distinguishes an anchor that named a namespace from one that did not, alongside the distrustAfterApplied and purposeTrustApplied it already carries.
+
+### Fixed
+
+- pki.path.validate and pki.path.build copy a directoryName subtree base and snapshot an iPAddress one before validating, and read opts.initialPermittedSubtrees and opts.initialExcludedSubtrees once rather than again for each trust anchor or candidate path tried. A caller mutating its own subtree list, entry or base while the path is still verifying signatures no longer changes the namespace the validation enforces; the subtrees that bind are the ones read at entry.
+- A directoryName subtree base whose rdns is an accessor rather than a data property is refused. Its value was read once to check its shape and again to copy it, so an accessor could answer with a restrictive name the first time and an empty one the second, and an empty directoryName constraint matches every name.
+- A subtree list that is a Proxy, that is sparse, or whose entries are accessors is refused, on a trust anchor and on opts.initialPermittedSubtrees and opts.initialExcludedSubtrees alike. Such a list answers its own length and index reads, so it could hold a restrictive subtree while reporting none and leave the namespace unenforced. A directoryName subtree is built from property descriptors alone, so nothing the caller supplies runs while the namespace is read: an accessor, own or inherited, is refused rather than invoked. It is a relative-name sequence of attribute lists and nothing deeper, so an array nested past that, including one that refers to itself, is a typed refusal, as is a hole, an entry the array does not own, an attribute that is not an object, or one lacking its own type and value. Each of those refusals is a configuration error reported wherever the anchor sits among several, rather than a name mismatch a different anchor could mask.
+- A parsed certificate passed as a trust anchor is refused if it carries nameConstraints, the way one carrying purposes or distrustAfter already is. A certificate anchor cannot hold that metadata, so accepting it would have dropped the namespace and validated a leaf the anchor was meant to exclude.
+- An anchor whose nameConstraints names a field other than permitted or excluded is refused rather than read as unconstrained, and its subtrees are checked while the anchor is normalized, so a malformed one is refused wherever that anchor sits among several rather than only once it is reached.
+
+## v0.6.37 — 2026-09-05
+
+A natively signed C509 certificate is refused when it writes an extension in the generic OID form that the registry can carry as an identifier.
+
+### Fixed
+
+- pki.schema.c509.parse refuses a natively signed certificate (c509CertificateType 2) that writes an extension as an OID and a DER value when a C509 registry identifier carries the same extension value. Draft section 3.7 reserves the generic form for re-encoded certificates, where it stays accepted. An extension whose OID has no registry identifier, and one whose value the compact encodings cannot represent under that certificate type's rules, both keep the generic form.
+- pki.schema.c509.encode chooses an extension's form under the rules of the certificate type it is writing. It previously judged whether a value could be written compactly using the rules for a re-encoded certificate, so a natively signed certificate could be given a compact form its own decoder does not accept.
+- pki.schema.c509.encode resolves an extension named only by its OID to the matching registry identifier. It looked the identifier up by name alone, so an extension supplied without one was written in the generic OID form even where a compact encoding carried it.
+- pki.schema.c509 decides what belongs to the C509 registries by dotted OID rather than by the name pki.oid.register maps that OID to. Registering a different name for a built-in OID previously changed what the toolkit emitted for an unrelated certificate, and for commonName, a curve, ecPublicKey or an ECDSA signature algorithm it stopped a certificate converting to C509 at all.
+
 ## v0.6.36 — 2026-09-04
 
 A natively signed C509 certificate is refused when it spells an algorithm generically instead of using the registry entry that names the same value.

package/lib/path-validate.js

@@ -553,19 +553,61 @@ function isSubtreeBaseValid(tag, base) {
 
 function checkedSubtreeSeeds(list, optName) {
   if (list === undefined || list === null) return [];
-  if (!intrinsic.isArray(list)) throw E("path/bad-input", "validate: opts." + optName + " must be an array of { tag, base } subtree entries");
-  return list.map(function (st) {
-    if (!st || typeof st !== "object" || !Number.isInteger(st.tag) || st.tag < 0 || st.tag > 8) {
-      throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
+  if (!intrinsic.isArray(list) || intrinsic.types.isProxy(list)) throw E("path/bad-input", "validate: opts." + optName + " must be a plain array of { tag, base } subtree entries");
+  for (var li = 0; li < list.length; li++) {
+    var ld = intrinsic.getOwnPropertyDescriptor(list, li);
+    if (ld === undefined) throw E("path/bad-input", "validate: opts." + optName + " must not be a sparse array; index " + li + " is a hole");
+    if (!intrinsic.hasOwn(ld, "value")) throw E("path/bad-input", "validate: opts." + optName + " entry " + li + " must be a data property, not an accessor");
+  }
+  /** @internal Built with a plain loop into a fresh array: Array.prototype.map consults the caller
+   * array's constructor and Symbol.species, which is more caller code running mid-copy. */
+  var seedsOut = [];
+  for (var si = 0; si < list.length; si++) {
+    intrinsic.push(seedsOut, (function (st) {
+    var shapeMsg = "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }";
+    if (!st || typeof st !== "object" || intrinsic.types.isProxy(st)) throw E("path/bad-input", shapeMsg);
+    /** @internal Read tag and base once each, from their own data properties: an accessor could
+     * answer with a restrictive value to a check and a permissive one to the copy. */
+    var tagD = intrinsic.getOwnPropertyDescriptor(st, "tag");
+    var baseD = intrinsic.getOwnPropertyDescriptor(st, "base");
+    if (tagD !== undefined && !intrinsic.hasOwn(tagD, "value")) throw E("path/bad-input", "validate: opts." + optName + " entry tag must be a data property, not an accessor");
+    if (baseD !== undefined && !intrinsic.hasOwn(baseD, "value")) throw E("path/bad-input", "validate: opts." + optName + " entry base must be a data property, not an accessor");
+    var tag = tagD === undefined ? undefined : tagD.value;
+    var base = baseD === undefined ? undefined : baseD.value;
+    if (!Number.isInteger(tag) || tag < 0 || tag > 8) throw E("path/bad-input", shapeMsg);
+    if (tag === 7 && guard.bytes.isByteSource(base)) {
+      base = guard.bytes.snapshotSource(base, PathError, "path/bad-input", "an iPAddress subtree base");
     }
-    var base = (st.tag === 7 && guard.bytes.isByteSource(st.base))
-      ? guard.bytes.snapshotSource(st.base, PathError, "path/bad-input", "an iPAddress subtree base")
-      : st.base;
-    if (!isSubtreeBaseValid(st.tag, base)) {
-      throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
+    if (tag === 4 && base !== null && typeof base === "object") {
+      var seedRdns = _capturedRdns(base, "validate: opts." + optName);
+      if (seedRdns !== undefined) {
+        var dnCopy = {};
+        intrinsic.defineProperty(dnCopy, "rdns", { value: seedRdns, enumerable: true, configurable: true, writable: true });
+        base = dnCopy;
+      }
     }
-    return { tag: st.tag, base: base };
-  });
+    if (!isSubtreeBaseValid(tag, base)) throw E("path/bad-input", shapeMsg);
+    return { tag: tag, base: base };
+    })(intrinsic.getOwnPropertyDescriptor(list, si).value));
+  }
+  return seedsOut;
+}
+
+/**
+ * @internal RFC 5280 sec. 6.1.1(h)(i): the anchor's own permitted/excluded subtrees, the way a root
+ * program restricts a root to a namespace its certificate does not state. Validated through the same
+ * entry-point checker the caller's seeds use, so a mis-shaped subtree is refused rather than dropped.
+ */
+function _anchorSubtreeSeeds(anchor) {
+  var nc = anchor.nameConstraints;
+  if (nc === undefined || nc === null) return { permitted: [], excluded: [] };
+  if (typeof nc !== "object" || intrinsic.isArray(nc)) {
+    throw E("path/bad-input", "validate: a trustAnchor nameConstraints must be a { permitted, excluded } object of { tag, base } subtree entries");
+  }
+  return {
+    permitted: checkedSubtreeSeeds(nc.permitted, "trustAnchors[].nameConstraints.permitted"),
+    excluded: checkedSubtreeSeeds(nc.excluded, "trustAnchors[].nameConstraints.excluded"),
+  };
 }
 
 function initialize(certs, params, seeds, anchor) {
@@ -574,7 +616,7 @@ function initialize(certs, params, seeds, anchor) {
     validPolicyTree: rootNode(),
     policyNodeCount: 1,
     maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
-    permittedGenerations: seeds.permitted.length ? [seeds.permitted] : [],
+    permittedGenerations: intrinsic.filter(seeds.permittedGenerations, function (g) { return g.length > 0; }),
     excludedSubtrees: seeds.excluded,
     explicitPolicy: params.initialExplicitPolicy ? 0 : n + 1,
     inhibitAnyPolicy: params.initialAnyPolicyInhibit ? 0 : n + 1,
@@ -867,10 +909,21 @@ function validateCriticalExtensionStructure(cert) {
  *
  * `anchorConstraints` reports what the anchor's own trust metadata decided:
  * the `checkedPurpose` it was judged under, and whether the `distrustAfter`
- * date and the `purposes` delegator map each applied. That metadata is keyed BY
- * key purpose, so an anchor carrying it while `opts.checkPurpose` is absent is a
- * configuration fault (`path/bad-input`). A silently inert constraint would let
- * a root distrusted years ago quietly validate a current leaf.
+ * date, the `purposes` delegator map and the `nameConstraints` namespace each
+ * applied. The purpose-keyed metadata is keyed BY key purpose, so an anchor
+ * carrying it while `opts.checkPurpose` is absent is a configuration fault
+ * (`path/bad-input`). A silently inert constraint would let a root distrusted
+ * years ago quietly validate a current leaf.
+ *
+ * An anchor may also carry `nameConstraints`, a `{ permitted, excluded }` pair
+ * of `{ tag, base }` subtrees naming the namespace that root is trusted for.
+ * A root program restricts a root this way when the restriction appears in no
+ * `nameConstraints` extension the root certificate carries. The subtrees become
+ * the RFC 5280 sec. 6.1.1(h)(i) initial permitted and excluded state, so an
+ * intermediate's own `nameConstraints` extension intersects with them and a leaf
+ * must satisfy both. They are a separate generation from
+ * `opts.initialPermittedSubtrees`, so those two intersect as well. A mis-shaped
+ * subtree is refused with `path/bad-input` rather than left inert.
  *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -938,17 +991,35 @@ async function validate(path, opts) {
   var certs = path.map(function (c, ci) { return coerceCert(c, "validate: path[" + ci + "]"); });
   var n = certs.length;
   if (n < 1) throw E("path/empty-path", "validate: the certification path is empty");
+  /** @internal Captured before any anchor is normalized: an anchor field may be an accessor, and
+   * that getter runs caller code which could otherwise clear these lists first. */
+  var callerPermitted = checkedSubtreeSeeds(opts.initialPermittedSubtrees, "initialPermittedSubtrees");
+  var callerExcluded = checkedSubtreeSeeds(opts.initialExcludedSubtrees, "initialExcludedSubtrees");
   var rawAnchors = opts.trustAnchors;
   var anchorList = intrinsic.isArray(rawAnchors) ? rawAnchors : [rawAnchors];
   if (rawAnchors == null || anchorList.length === 0) throw E("path/bad-input", "validate: trustAnchors is required (a single anchor or a non-empty array of anchors)");
+  /** @internal Read the caller's list once here, whatever its length, so neither branch below reads
+   * one of its indices twice. */
+  if (intrinsic.isArray(rawAnchors)) anchorList = _ownAnchorEntries(rawAnchors, "validate");
   if (anchorList.length > 1) {
+    var anchorEntries = anchorList;
+    var preNc = _precaptureAnchorNameConstraints(anchorEntries, "validate");
     var tuples = [];
-    for (var ti = 0; ti < anchorList.length; ti++) { tuples[ti] = toAnchor(anchorList[ti], "validate"); }
+    for (var ti = 0; ti < anchorEntries.length; ti++) {
+      tuples[ti] = toAnchor(anchorEntries[ti], "validate");
+      if (preNc[ti] !== undefined) intrinsic.defineProperty(tuples[ti], "nameConstraints", { value: preNc[ti], enumerable: true, configurable: true, writable: true });
+    }
+    /** @internal Each anchor is a separate attempt and the later ones run after an await, so the
+     * caller's own subtree lists are read once here rather than again per attempt. */
+    var permRawOnce = opts.initialPermittedSubtrees;
+    var exclRawOnce = opts.initialExcludedSubtrees;
     var singleOpts = function (a) {
       var keys = intrinsic.ownKeys(opts);
       var o = {};
       for (var ki = 0; ki < keys.length; ki++) { o[keys[ki]] = opts[keys[ki]]; }
       o.trustAnchors = a;
+      if (permRawOnce != null) o.initialPermittedSubtrees = callerPermitted;
+      if (exclRawOnce != null) o.initialExcludedSubtrees = callerExcluded;
       return o;
     };
     var lastMatched = null, anyMatched = false;
@@ -965,10 +1036,12 @@ async function validate(path, opts) {
   guard.time.assertValid(opts.time, E, "path/bad-input", "validate: opts.time (the always-on validity-window check date)");
   guard.limits.cap(opts.maxPolicyNodes, "validate: opts.maxPolicyNodes", undefined, { E: E, code: "path/bad-input", min: 1 });
   _assertUserInitialPolicySet(opts.userInitialPolicySet, "validate");
+  var anchorNc = _anchorSubtreeSeeds(anchor);
   var seeds = {
-    permitted: checkedSubtreeSeeds(opts.initialPermittedSubtrees, "initialPermittedSubtrees"),
-    excluded: checkedSubtreeSeeds(opts.initialExcludedSubtrees, "initialExcludedSubtrees"),
+    permittedGenerations: [callerPermitted, anchorNc.permitted],
+    excluded: intrinsic.concat(callerExcluded, anchorNc.excluded),
   };
+  var anchorNameConstraintsApplied = anchorNc.permitted.length > 0 || anchorNc.excluded.length > 0;
   var purposeOpts = resolvePurposeOpts(opts);
   var requiredEku = purposeOpts.requiredEku;
   var checkPurpose = purposeOpts.checkPurpose;
@@ -1158,6 +1231,7 @@ async function validate(path, opts) {
       checkedPurpose: checkPurpose || null,
       distrustAfterApplied: anchorDistrustApplied,
       purposeTrustApplied: anchorPurposeApplied,
+      nameConstraintsApplied: anchorNameConstraintsApplied,
     },
     path: certs,
     results: state.results,
@@ -1903,6 +1977,198 @@ function _captureOwnData(entry, key) {
   return (d && intrinsic.hasOwn(d, "value")) ? d.value : undefined;
 }
 
+/**
+ * @internal Copy the anchor's subtree lists getter-free, so a caller mutating the entry afterwards
+ * cannot widen the namespace the validation already resolved.
+ */
+/**
+ * @internal Read a directoryName base's `rdns` once, from its own data property. Reading it twice,
+ * to test its shape and then to copy it, lets an accessor answer differently each time and hand the
+ * validation an empty DN, which matches every name.
+ */
+var _ATV_KEYS = ["type", "value", "name"];
+/**
+ * @internal Build the directoryName's own copy from property descriptors alone, so no caller code
+ * runs while the namespace is read: a getter, own or inherited, could clear another part of the
+ * namespace before it is captured. A directoryName is a relative-name sequence of attribute lists
+ * and nothing deeper, so exactly those levels are walked and a self-referencing array is refused
+ * rather than followed.
+ */
+function _copyDnRdns(rdns, who) {
+  _assertPlainDnRdns(rdns, who);
+  var out = [];
+  for (var i = 0; i < rdns.length; i++) {
+    var rd = intrinsic.getOwnPropertyDescriptor(rdns, i);
+    if (rd === undefined) throw E("path/bad-input", who + " index " + i + " is a hole or is inherited; every entry must be its own");
+    var rdn = rd.value;
+    if (!intrinsic.isArray(rdn)) throw E("path/bad-input", who + "[" + i + "] must be an array of attributes");
+    var rdnOut = [];
+    for (var j = 0; j < rdn.length; j++) {
+      var ad = intrinsic.getOwnPropertyDescriptor(rdn, j);
+      if (ad === undefined) throw E("path/bad-input", who + "[" + i + "] index " + j + " is a hole or is inherited; every entry must be its own");
+      var atv = ad.value;
+      if (atv === null || typeof atv !== "object") throw E("path/bad-input", who + "[" + i + "][" + j + "] must be an attribute object carrying a type and a value");
+      var atvOut = {};
+      for (var k = 0; k < _ATV_KEYS.length; k++) {
+        var fd = intrinsic.getOwnPropertyDescriptor(atv, _ATV_KEYS[k]);
+        if (fd === undefined) continue;
+        intrinsic.defineProperty(atvOut, _ATV_KEYS[k], { value: fd.value, enumerable: true, configurable: true, writable: true });
+      }
+      if (!intrinsic.hasOwn(atvOut, "type") || !intrinsic.hasOwn(atvOut, "value")) {
+        throw E("path/bad-input", who + "[" + i + "][" + j + "] must carry its type and value as own data properties");
+      }
+      intrinsic.push(rdnOut, atvOut);
+    }
+    intrinsic.push(out, rdnOut);
+  }
+  return out;
+}
+/**
+ * @internal The shape check the copy above relies on: a Proxy answers its own reads and an accessor
+ * runs caller code, so either one at any level of the directoryName is refused before it is copied.
+ */
+function _assertPlainDnRdns(rdns, who) {
+  if (intrinsic.types.isProxy(rdns)) throw E("path/bad-input", who + " must be a plain array, not a Proxy");
+  for (var i = 0; i < rdns.length; i++) {
+    var rd = intrinsic.getOwnPropertyDescriptor(rdns, i);
+    if (rd === undefined) continue;
+    if (!intrinsic.hasOwn(rd, "value")) throw E("path/bad-input", who + " entry " + i + " must be a data property, not an accessor");
+    var rdn = rd.value;
+    if (!intrinsic.isArray(rdn)) continue;
+    if (intrinsic.types.isProxy(rdn)) throw E("path/bad-input", who + "[" + i + "] must be a plain array, not a Proxy");
+    for (var j = 0; j < rdn.length; j++) {
+      var ad = intrinsic.getOwnPropertyDescriptor(rdn, j);
+      if (ad === undefined) continue;
+      if (!intrinsic.hasOwn(ad, "value")) throw E("path/bad-input", who + "[" + i + "] entry " + j + " must be a data property, not an accessor");
+      var atv = ad.value;
+      if (atv === null || typeof atv !== "object") continue;
+      if (intrinsic.types.isProxy(atv)) throw E("path/bad-input", who + "[" + i + "][" + j + "] must not be a Proxy");
+      if (intrinsic.isArray(atv)) throw E("path/bad-input", who + "[" + i + "][" + j + "] must be an attribute object, not an array");
+      for (var k = 0; k < _ATV_KEYS.length; k++) {
+        var fd = intrinsic.getOwnPropertyDescriptor(atv, _ATV_KEYS[k]);
+        if (fd !== undefined && !intrinsic.hasOwn(fd, "value")) {
+          throw E("path/bad-input", who + "[" + i + "][" + j + "]." + _ATV_KEYS[k] + " must be a data property, not an accessor");
+        }
+      }
+    }
+  }
+}
+function _capturedRdns(base, who) {
+  if (intrinsic.types.isProxy(base)) throw E("path/bad-input", who + ": a trustAnchor nameConstraints directoryName base must not be a Proxy");
+  /** @internal An inherited Proxy answers `in` through its has trap, which is caller code running
+   * inside what is meant to be a getter-free read. */
+  var baseProto = intrinsic.getPrototypeOf(base);
+  while (baseProto !== null) {
+    if (intrinsic.types.isProxy(baseProto)) throw E("path/bad-input", who + ": a trustAnchor nameConstraints directoryName base must not inherit from a Proxy");
+    baseProto = intrinsic.getPrototypeOf(baseProto);
+  }
+  var d = intrinsic.getOwnPropertyDescriptor(base, "rdns");
+  if (d === undefined) {
+    if ("rdns" in base) throw E("path/bad-input", who + ": a trustAnchor nameConstraints directoryName rdns must be an own data property, not inherited");
+    return undefined;
+  }
+  if (!intrinsic.hasOwn(d, "value")) throw E("path/bad-input", who + ": a trustAnchor nameConstraints directoryName rdns must be a data property, not an accessor");
+  if (!intrinsic.isArray(d.value)) return undefined;
+  return _copyDnRdns(d.value, who + ": a trustAnchor nameConstraints directoryName rdns");
+}
+var _NC_SUBTREE_KEYS = ["tag", "base"];
+var _NC_LIST_KEYS = ["permitted", "excluded"];
+function _copyAnchorSubtreeList(list, key, who) {
+  if (list === undefined || list === null) return undefined;
+  if (!intrinsic.isArray(list) || intrinsic.types.isProxy(list)) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " must be a plain array of { tag, base } subtree entries");
+  var copied = [];
+  var len = list.length;
+  for (var i = 0; i < len; i++) {
+    var entryD = intrinsic.getOwnPropertyDescriptor(list, i);
+    if (entryD === undefined) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " must not be a sparse array; index " + i + " is a hole");
+    if (!intrinsic.hasOwn(entryD, "value")) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " entry " + i + " must be a data property, not an accessor");
+    var st = entryD.value;
+    if (st === null || typeof st !== "object" || intrinsic.types.isProxy(st)) {
+      throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " entry must be a plain { tag, base } object");
+    }
+    var out = {};
+    for (var k = 0; k < _NC_SUBTREE_KEYS.length; k++) {
+      var field = _NC_SUBTREE_KEYS[k];
+      var fd = intrinsic.getOwnPropertyDescriptor(st, field);
+      if (fd === undefined) continue;
+      if (!intrinsic.hasOwn(fd, "value")) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " " + field + " must be a data property, not an accessor");
+      var fv = fd.value;
+      if (field === "base" && fv !== null && typeof fv === "object") {
+        var rdnsOwn = _capturedRdns(fv, who);
+        if (rdnsOwn !== undefined) {
+          var dnBase = {};
+          intrinsic.defineProperty(dnBase, "rdns", { value: rdnsOwn, enumerable: true, configurable: true, writable: true });
+          fv = dnBase;
+        } else if (guard.bytes.isByteSource(fv)) {
+          fv = guard.bytes.snapshotSource(fv, PathError, "path/bad-input", who + ": a trustAnchor nameConstraints iPAddress subtree base");
+        }
+      }
+      intrinsic.defineProperty(out, field, { value: fv, enumerable: true, configurable: true, writable: true });
+    }
+    intrinsic.push(copied, out);
+  }
+  return copied;
+}
+/**
+ * @internal Anchors are normalized one at a time, and each may expose fields through getters that
+ * run caller code. Capture every anchor's namespace first, so an earlier anchor's getter cannot
+ * clear a later anchor's restriction before that anchor is reached.
+ */
+/**
+ * @internal Read a caller's anchor list once, from its own indices, into a fresh array. The list is
+ * walked twice, to capture namespaces and then to normalize, and an accessor index could answer
+ * differently each time.
+ */
+function _ownAnchorEntries(list, who) {
+  if (intrinsic.types.isProxy(list)) throw E("path/bad-input", who + ": trustAnchors must be a plain array, not a Proxy");
+  var out = [];
+  for (var i = 0; i < list.length; i++) {
+    var d = intrinsic.getOwnPropertyDescriptor(list, i);
+    if (d === undefined) throw E("path/bad-input", who + ": trustAnchors index " + i + " is a hole or is inherited; every entry must be its own");
+    if (!intrinsic.hasOwn(d, "value")) throw E("path/bad-input", who + ": trustAnchors entry " + i + " must be a data property, not an accessor");
+    intrinsic.push(out, d.value);
+  }
+  return out;
+}
+function _precaptureAnchorNameConstraints(list, who) {
+  var out = [];
+  for (var i = 0; i < list.length; i++) {
+    var entry = list[i];
+    var captured;
+    if (entry && typeof entry === "object" && !intrinsic.isBuffer(entry) && !guard.parsed.isRecorded(entry) && !intrinsic.types.isProxy(entry)) {
+      var raw = _captureConstraintMap(entry, "nameConstraints", E, "path/bad-input", who);
+      captured = raw == null ? undefined : _copyAnchorNameConstraints(raw, who);
+    }
+    intrinsic.push(out, captured);
+  }
+  return out;
+}
+function _copyAnchorNameConstraints(nc, who) {
+  if (nc === null || typeof nc !== "object" || intrinsic.isArray(nc)) {
+    throw E("path/bad-input", who + ": a trustAnchor nameConstraints must be a { permitted, excluded } object of { tag, base } subtree entries");
+  }
+  guard.identifier.assertPlainRecord(nc, E, "path/bad-input", who + ": a trustAnchor nameConstraints");
+  guard.identifier.assertKnownKeys(nc, { permitted: 1, excluded: 1 }, E, "path/bad-input",
+    who + ": a trustAnchor nameConstraints names its subtree lists `permitted` and `excluded`. The unknown key was: ");
+  var out = {};
+  for (var i = 0; i < _NC_LIST_KEYS.length; i++) {
+    var key = _NC_LIST_KEYS[i];
+    var d = intrinsic.getOwnPropertyDescriptor(nc, key);
+    if (d === undefined) {
+      if (key in nc) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " must be an own data property, not inherited");
+      continue;
+    }
+    if (!intrinsic.hasOwn(d, "value")) throw E("path/bad-input", who + ": a trustAnchor nameConstraints." + key + " must be a data property, not an accessor");
+    var copiedList = _copyAnchorSubtreeList(d.value, key, who);
+    if (copiedList === undefined) continue;
+    /** @internal Validated while the anchor is normalized, so a malformed subtree is refused
+     * wherever the anchor sits in the list rather than only once that anchor is reached. */
+    var checkedList = checkedSubtreeSeeds(copiedList, "trustAnchors[].nameConstraints." + key);
+    intrinsic.defineProperty(out, key, { value: checkedList, enumerable: true, configurable: true, writable: true });
+  }
+  return out;
+}
+
 function _copyAtv(atv) {
   var out = {};
   var t = atv.type;
@@ -1939,7 +2205,7 @@ function _copyRdnsDeep(rdns) {
 function toAnchor(entry, verb) {
   var who = verb || "build";
   var isTuple = false, alg = null, pubRaw, nameRaw = null, pk = null, purposesSnap, distrustSnap;
-  var subjectDerRaw, labelRaw, mozRaw;
+  var subjectDerRaw, labelRaw, mozRaw, ncSnap;
   if (intrinsic.types.isProxy(entry)) {
     throw E("path/bad-input", who + ": a trustAnchor must not be a Proxy");
   }
@@ -1956,6 +2222,8 @@ function toAnchor(entry, verb) {
       purposesSnap = _normalizeConstraintField(pRaw, E, "path/bad-input", who);
       var dRaw = _captureConstraintMap(entry, "distrustAfter", E, "path/bad-input", who);
       distrustSnap = _normalizeConstraintField(dRaw, E, "path/bad-input", who);
+      var ncRaw = _captureConstraintMap(entry, "nameConstraints", E, "path/bad-input", who);
+      ncSnap = ncRaw == null ? undefined : _copyAnchorNameConstraints(ncRaw, who);
       subjectDerRaw = _captureOwnData(entry, "subjectDer");
       labelRaw = _captureOwnData(entry, "label");
       mozRaw = _captureOwnData(entry, "mozillaCaPolicy");
@@ -2023,6 +2291,7 @@ function toAnchor(entry, verb) {
     intrinsic.defineProperty(flat, "name", { value: nameOut, enumerable: true, configurable: true, writable: true });
     if (purposesSnap !== undefined) intrinsic.defineProperty(flat, "purposes", { value: purposesSnap, enumerable: true, configurable: true, writable: true });
     if (distrustSnap !== undefined) intrinsic.defineProperty(flat, "distrustAfter", { value: distrustSnap, enumerable: true, configurable: true, writable: true });
+    if (ncSnap !== undefined) intrinsic.defineProperty(flat, "nameConstraints", { value: ncSnap, enumerable: true, configurable: true, writable: true });
     if (subjectDerRaw !== undefined) intrinsic.defineProperty(flat, "subjectDer", { value: subjectDerRaw, enumerable: true, configurable: true, writable: true });
     if (labelRaw !== undefined) intrinsic.defineProperty(flat, "label", { value: labelRaw, enumerable: true, configurable: true, writable: true });
     if (mozRaw !== undefined) intrinsic.defineProperty(flat, "mozillaCaPolicy", { value: mozRaw, enumerable: true, configurable: true, writable: true });
@@ -2031,8 +2300,8 @@ function toAnchor(entry, verb) {
     intrinsic.defineProperty(flat, "parameters", { value: spkiAlg.parameters, enumerable: true, configurable: true, writable: true });
     return flat;
   }
-  if (entry && typeof entry === "object" && (("purposes" in entry) || ("distrustAfter" in entry))) {
-    throw E("path/bad-input", who + ": a trustAnchor certificate must not carry purposes / distrustAfter -- put per-purpose constraints on a { name, publicKey, algorithm, purposes, distrustAfter } tuple (or a pki.trust anchor), not on a parsed certificate");
+  if (entry && typeof entry === "object" && (("purposes" in entry) || ("distrustAfter" in entry) || ("nameConstraints" in entry))) {
+    throw E("path/bad-input", who + ": a trustAnchor certificate must not carry purposes / distrustAfter / nameConstraints -- put anchor constraints on a { name, publicKey, algorithm, purposes, distrustAfter, nameConstraints } tuple (or a pki.trust anchor), not on a parsed certificate");
   }
   var cert;
   try { cert = coerceCert(entry); }
@@ -2349,7 +2618,20 @@ async function build(leaf, opts) {
   for (var pdk = 0; pdk < pool.length; pdk++) intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
 
   if (!intrinsic.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
-  var anchors = opts.trustAnchors.map(function (a) { return toAnchor(a, "build"); });
+  /** @internal Captured before any anchor is normalized: an anchor field may be an accessor whose
+   * getter runs caller code, and every candidate is validated in its own pass after an await. */
+  var buildPermRaw = opts.initialPermittedSubtrees;
+  var buildExclRaw = opts.initialExcludedSubtrees;
+  var buildPermSeeds = checkedSubtreeSeeds(buildPermRaw, "initialPermittedSubtrees");
+  var buildExclSeeds = checkedSubtreeSeeds(buildExclRaw, "initialExcludedSubtrees");
+  var buildEntries = _ownAnchorEntries(opts.trustAnchors, "build");
+  var buildPreNc = _precaptureAnchorNameConstraints(buildEntries, "build");
+  var anchors = [];
+  for (var bai = 0; bai < buildEntries.length; bai++) {
+    var bAnchor = toAnchor(buildEntries[bai], "build");
+    if (buildPreNc[bai] !== undefined) intrinsic.defineProperty(bAnchor, "nameConstraints", { value: buildPreNc[bai], enumerable: true, configurable: true, writable: true });
+    intrinsic.push(anchors, bAnchor);
+  }
 
   guard.time.assertValid(opts.time, E, "path/bad-input", "build: opts.time (the validity-window check date, forwarded to validate)");
   var effectiveMaxCerts = guard.limits.cap(opts.maxPathCerts, "build: opts.maxPathCerts", constants.LIMITS.PATH_MAX_CERTS, { E: E, code: "path/bad-input", min: 1 });
@@ -2396,6 +2678,8 @@ async function build(leaf, opts) {
     if (intrinsic.hasOwn(BUILD_ONLY_OPT, k)) return;
     if (k in opts) forwarded[k] = opts[k];
   });
+  if (buildPermRaw != null) forwarded.initialPermittedSubtrees = buildPermSeeds;
+  if (buildExclRaw != null) forwarded.initialExcludedSubtrees = buildExclSeeds;
   function validateOpts(anchor) {
     var vo = Object.create(null);
     Object.keys(forwarded).forEach(function (f) { vo[f] = forwarded[f]; });

package/lib/schema-c509.js

@@ -63,6 +63,11 @@ var PK_ALG_BY_INT = {
   3: { alg: _name("ecPublicKey"), curve: _name("secp521r1") },
 };
 var EC_FIELD_BYTES = Object.assign(Object.create(null), { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 });
+/** @internal Curve identity follows the dotted OID; pki.oid.register can rename one at any time. */
+var EC_CURVE_BY_OID = Object.create(null);
+Object.keys(EC_FIELD_BYTES).forEach(function (n) { EC_CURVE_BY_OID[oid.byName(n)] = n; });
+var SIG_ALG_BY_OID = Object.create(null);
+Object.keys(SIG_ALG_BY_INT).forEach(function (k) { SIG_ALG_BY_OID[oid.byName(SIG_ALG_BY_INT[k])] = SIG_ALG_BY_INT[k]; });
 
 var ATTR_BY_INT = {
   0: _name("emailAddress"),
@@ -1351,7 +1356,9 @@ function _sdaFromDer(node) {
     var setNode = attr.children[1];
     if (setNode.tagClass !== "universal" || setNode.tagNumber !== asn1.TAGS.SET || !setNode.children || setNode.children.length < 1) return null;
     var dotted = asn1.read.oid(attr.children[0]);
-    var nm = oid.name(dotted), tint = nm != null ? ATTR_TO_INT[nm] : undefined;
+    var canonAttr = ATTR_NAME_BY_OID[dotted];
+    var nm = canonAttr === undefined ? oid.name(dotted) : canonAttr;
+    var tint = canonAttr === undefined ? undefined : ATTR_TO_INT[canonAttr];
     var intForm = _sdaTryIntForm(tint, nm, setNode.children);
     if (intForm != null) {
       out.push(cbor.build.int(BigInt(intForm.sign < 0 ? -tint : tint)));
@@ -1364,12 +1371,24 @@ function _sdaFromDer(node) {
   return cbor.build.array(out);
 }
 
-function _tryCompactExtValue(name, der) {
+/**
+ * @internal Draft sec. 3.7 for extensions. The specific form was available when the registry names
+ * this extension AND the int form can carry this exact value: a compact-codec extension only when
+ * the codec represents it, and one without a codec always, since its int form carries the same
+ * bytes. An extension the codec cannot represent keeps the generic form on every certificate type.
+ */
+function _assertSpecificExtension(dotted, valContent, isNative) {
+  var canon = EXT_NAME_BY_OID[dotted];
+  if (!isNative || canon === undefined) return;
+  if (EXT_COMPACT[canon] && (!Buffer.isBuffer(valContent) || _tryCompactExtValue(canon, valContent, isNative) == null)) return;
+  throw _err("c509/non-specific-encoding", "extension " + canon + " has a C509 registry id that carries this value, and a natively signed certificate uses only the specific CBOR encoding (draft sec. 3.7)");
+}
+function _tryCompactExtValue(name, der, isNative) {
   var compact = _extValueFromDer(name, der);
   if (compact == null) return null;
   var recon;
   try {
-    recon = _extValueToDer(name, cbor.decode(compact));
+    recon = _extValueToDer(name, cbor.decode(compact), isNative);
   } catch (_e) {
     return null;
   }
@@ -1418,6 +1437,7 @@ function _extensions(node, isNative) {
         if (valNode.majorType !== 2) throw _err("c509/bad-extensions", "a non-critical ~oid extension value must be a byte string");
         valContent = valNode.content;
       }
+      _assertSpecificExtension(extOid, valContent, isNative);
     }
     out.push({ name: name, oid: extOid, critical: critical, value: valContent || null });
   }
@@ -1637,8 +1657,14 @@ function matches(node) {
 
 var ATTR_TO_INT = Object.create(null);
 Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_TO_INT[ATTR_BY_INT[k]] = Number(k); });
+/** @internal An attribute's C509 registry membership follows its dotted OID, not its display name. */
+var ATTR_NAME_BY_OID = Object.create(null);
+Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_NAME_BY_OID[oid.byName(ATTR_BY_INT[k])] = ATTR_BY_INT[k]; });
 var EXT_TO_INT = Object.create(null);
 Object.keys(EXT_BY_INT).forEach(function (k) { if (EXT_COMPACT[EXT_BY_INT[k]]) EXT_TO_INT[EXT_BY_INT[k]] = Number(k); });
+/** @internal An extension's C509 registry membership follows its dotted OID, not its display name. */
+var EXT_NAME_BY_OID = Object.create(null);
+Object.keys(EXT_BY_INT).forEach(function (k) { EXT_NAME_BY_OID[oid.byName(EXT_BY_INT[k])] = EXT_BY_INT[k]; });
 
 function _minBytes(n) {
   if (typeof n !== "bigint") throw _err("c509/bad-serial", "a ~biguint value must be a BigInt, got " + _describe(n));
@@ -1696,7 +1722,24 @@ function _encSpk(r) {
   if (!Buffer.isBuffer(r.subjectPublicKey)) throw _err("c509/bad-spki", "the subjectPublicKey bytes are missing");
   return cbor.build.byteString(r.subjectPublicKey);
 }
-function _encExtensions(exts) {
+/** @internal An extension names itself by name, by OID, or by both; the registry is keyed by name. */
+function _extIdentity(ext) {
+  var dotted = ext.oid || (typeof ext.name === "string" ? oid.byName(ext.name) : null);
+  var canon = dotted ? EXT_NAME_BY_OID[dotted] : undefined;
+  if (canon !== undefined) return { dotted: dotted, name: canon };
+  return { dotted: dotted, name: typeof ext.name === "string" ? ext.name : (dotted ? oid.name(dotted) : null) };
+}
+/**
+ * @internal The bits a lone keyUsage is written as. Derived from a DER value only when the compact
+ * form reproduces that value byte for byte, since the bare integer covers the nine defined bits and
+ * a wider BIT STRING would lose the rest.
+ */
+function _extKeyUsageBits(ext, isNative) {
+  if (typeof ext.keyUsageBits === "number") return ext.keyUsageBits;
+  if (!Buffer.isBuffer(ext.value) || _tryCompactExtValue("keyUsage", ext.value, isNative) == null) return null;
+  return _keyUsageBitsFromDer(ext.value);
+}
+function _encExtensions(exts, isNative) {
   _assertDense(exts, "c509/bad-input", "the extensions array");
   exts.forEach(function (ext) {
     if (!ext || typeof ext !== "object") throw _err("c509/bad-input", "each extension must be an object, got " + _describe(ext));
@@ -1709,18 +1752,20 @@ function _encExtensions(exts) {
       throw _err("c509/bad-extensions", "keyUsageBits must be a safe integer, got " + _describe(ext.keyUsageBits));
     }
   });
-  if (exts.length === 1 && exts[0].name === "keyUsage" && typeof exts[0].keyUsageBits === "number") {
-    return cbor.build.int(BigInt(exts[0].critical ? -exts[0].keyUsageBits : exts[0].keyUsageBits));
+  if (exts.length === 1 && _extIdentity(exts[0]).name === "keyUsage") {
+    var onlyBits = _extKeyUsageBits(exts[0], isNative);
+    if (typeof onlyBits === "number") return cbor.build.int(BigInt(exts[0].critical ? -onlyBits : onlyBits));
   }
   var items = [];
   exts.forEach(function (ext) {
-    var ei = EXT_TO_INT[ext.name];
-    var compact = (ei !== undefined && Buffer.isBuffer(ext.value)) ? _tryCompactExtValue(ext.name, ext.value) : null;
+    var ident = _extIdentity(ext);
+    var extDotted = ident.dotted, extName = ident.name;
+    var ei = extName == null ? undefined : EXT_TO_INT[extName];
+    var compact = (ei !== undefined && Buffer.isBuffer(ext.value)) ? _tryCompactExtValue(extName, ext.value, isNative) : null;
     if (compact != null) {
       items.push(cbor.build.int(BigInt(ext.critical ? -ei : ei)));
       items.push(compact);
     } else {
-      var extDotted = ext.oid || (typeof ext.name === "string" ? oid.byName(ext.name) : null);
       if (!extDotted) throw _err("c509/bad-input", "an extension must carry an OID or a name in the OID registry, got " + _describe(ext.name));
       items.push(cbor.build.byteString(asn1.encodeOidContent(extDotted)));
       if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + (ext.oid || ext.name) + " has no byte-string value to encode");
@@ -1764,7 +1809,7 @@ function _encodeC509Array(r) {
     _encName(r.subject, true),
     _encAlgorithm(r.subjectPublicKeyAlgorithm, PK_ALG_BY_INT),
     _encSpk(r),
-    _encExtensions(r.extensions),
+    _encExtensions(r.extensions, Number(r.certificateType) === 2),
     cbor.build.byteString(r.signatureValue),
   ]);
   parse(arr);
@@ -1828,7 +1873,9 @@ function _c509NameFromDer(nameBytes) {
   (node.children || []).forEach(function (rdnSet) {
     if (!rdnSet.children || rdnSet.children.length !== 1) throw _err("c509/non-invertible", "a C509 Name requires single-attribute RDNs");
     var attr = rdnSet.children[0];
-    var attrName = oid.name(asn1.read.oid(attr.children[0]));
+    var attrDotted = asn1.read.oid(attr.children[0]);
+    var attrCanon = ATTR_NAME_BY_OID[attrDotted];
+    var attrName = attrCanon === undefined ? oid.name(attrDotted) : attrCanon;
     if (attrName == null || ATTR_TO_INT[attrName] === undefined) throw _err("c509/non-invertible", "attribute type " + attrName + " has no C509 registry integer");
     var valNode = attr.children[1];
     var value;
@@ -1875,19 +1922,19 @@ function _minCurveForMag(mag) {
   for (var i = 0; i < CURVE_ORDER.length; i++) { if (mag <= WEBCRYPTO_FIELD_BYTES[CURVE_ORDER[i]]) return CURVE_ORDER[i]; }
   return null;
 }
-function _resolveIssuerSigCurve(c, opts) {
+function _resolveIssuerSigCurve(c, opts, sigAlgName) {
   var mag = _sigMagWidth(c.signatureValue.bytes), curve;
   if (opts && opts.issuerCurve != null) {
     curve = String(opts.issuerCurve);
     if (NODE_TO_WEBCRYPTO[curve]) curve = NODE_TO_WEBCRYPTO[curve];
     if (!WEBCRYPTO_FIELD_BYTES[curve]) throw _err("c509/bad-input", "opts.issuerCurve must be P-256 / P-384 / P-521 (or prime256v1 / secp384r1 / secp521r1); got " + opts.issuerCurve);
   } else {
-    curve = SIG_ALG_TO_CURVE[c.signatureAlgorithm.name];
-    if (!curve) throw _err("c509/non-invertible", "cannot resolve the issuer signing curve for signature algorithm " + c.signatureAlgorithm.name);
+    curve = SIG_ALG_TO_CURVE[sigAlgName];
+    if (!curve) throw _err("c509/non-invertible", "cannot resolve the issuer signing curve for signature algorithm " + sigAlgName);
     var minCurve = _minCurveForMag(mag);
     if (!minCurve) throw _err("c509/non-invertible", "the ECDSA signature r/s width " + mag + " exceeds every supported curve field");
-    if (WEBCRYPTO_FIELD_BYTES[curve] < mag) throw _err("c509/non-invertible", "the issuer signed with a non-standard digest/curve pairing (r/s width " + mag + " exceeds the " + curve + " field implied by " + c.signatureAlgorithm.name + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
-    if (WEBCRYPTO_FIELD_BYTES[curve] > WEBCRYPTO_FIELD_BYTES[minCurve]) throw _err("c509/non-invertible", "signature algorithm " + c.signatureAlgorithm.name + " does not uniquely determine the issuer curve (r/s width " + mag + " also fits " + minCurve + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
+    if (WEBCRYPTO_FIELD_BYTES[curve] < mag) throw _err("c509/non-invertible", "the issuer signed with a non-standard digest/curve pairing (r/s width " + mag + " exceeds the " + curve + " field implied by " + sigAlgName + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
+    if (WEBCRYPTO_FIELD_BYTES[curve] > WEBCRYPTO_FIELD_BYTES[minCurve]) throw _err("c509/non-invertible", "signature algorithm " + sigAlgName + " does not uniquely determine the issuer curve (r/s width " + mag + " also fits " + minCurve + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
   }
   if (mag > WEBCRYPTO_FIELD_BYTES[curve]) throw _err("c509/non-invertible", "the ECDSA signature r/s width " + mag + " does not fit the resolved " + curve + " field");
   return curve;
@@ -1902,13 +1949,16 @@ _derToType3 = function (input, opts) {
   var c;
   try { c = x509.parse(input); } catch (e) { throw _err("c509/bad-input", "the input is not a valid X.509 certificate", e); }
   if (c.version !== 3) throw _err("c509/non-invertible", "C509 covers X.509 v3 certificates; got v" + c.version);
-  if (String(c.signatureAlgorithm.name || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
-  if (c.subjectPublicKeyInfo.algorithm.name !== "ecPublicKey") throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
+  var sigCanon = SIG_ALG_BY_OID[c.signatureAlgorithm.oid];
+  var sigAlgName = sigCanon === undefined ? c.signatureAlgorithm.name : sigCanon;
+  if (String(sigAlgName || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (sigAlgName || "an unregistered algorithm"));
+  if (c.subjectPublicKeyInfo.algorithm.oid !== oid.byName("ecPublicKey")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
   var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
-  var curve = oid.name(curveOid);
+  var curveCanon = EC_CURVE_BY_OID[curveOid];
+  var curve = curveCanon === undefined ? oid.name(curveOid) : curveCanon;
   var coordLen = EC_FIELD_BYTES[curve];
   if (!coordLen) throw _err("c509/non-invertible", "unsupported EC subject curve " + (curve || curveOid));
-  var sigCurve = _resolveIssuerSigCurve(c, opts);
+  var sigCurve = _resolveIssuerSigCurve(c, opts, sigAlgName);
   var spkiNode = asn1.decode(c.subjectPublicKeyInfo.bytes);
   return {
     certificateType: 3,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.36",
+  "version": "0.6.38",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:8d50e6dd-1ddf-46f8-b8db-ed97195096c3",
+  "serialNumber": "urn:uuid:adf5e979-6804-475f-a0d0-8aef04be0317",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-05T01:58:33.232Z",
+    "timestamp": "2026-09-05T07:57:13.454Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.36",
+      "bom-ref": "@blamejs/pki@0.6.38",
       "type": "application",
       "name": "pki",
-      "version": "0.6.36",
+      "version": "0.6.38",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.36",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.38",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.36",
+      "ref": "@blamejs/pki@0.6.38",
       "dependsOn": []
     }
   ]