@blamejs/pki 0.6.18 → 0.6.20

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.20 — 2026-09-01
+
+A vulnerable build-time dependency is refreshed; it is not part of the published package.
+
+### Security
+
+- browserslist, a transitive development dependency of the fuzzing harness, is updated from 4.28.4 to 4.28.8, clearing GHSA-73wf-gq98-2v4g and GHSA-c83g-rgw3-j3cx (both High). browserslist is a build-time and test-time dependency and is not part of the published package.
+
+## v0.6.19 — 2026-09-01
+
+pki.scep.build issues the CA-side CertRep response, so the toolkit produces the SCEP certification-authority reply the client enrollment verbs consume.
+
+### Added
+
+- pki.scep.build({ messageType: "CertRep", pkiStatus, transactionId, recipientNonce, ... }) issues a SCEP CertRep response (RFC 8894 sec. 3.3.2). SUCCESS takes certificates (and/or crls, leaf identified by content since the CMS certificate SET is DER-ordered) plus the requester's recipient certificate and the CA signer; the issued certificates ride a certs-only SignedData inside a pkcsPKIEnvelope encrypted to the requester. FAILURE takes a failInfo (and optional failInfoText) and PENDING takes neither; both omit the pkcsPKIEnvelope and are signed detached. recipientNonce (echoing the request's senderNonce) and transactionId are required; a missing failInfo on a FAILURE, a SUCCESS without a certificate/CRL or recipient, an envelope field on a FAILURE or PENDING, or an unknown pkiStatus or failInfo is refused with a typed scep/bad-input.
+
+### Fixed
+
+- An enumerated option whose value collides with an inherited Object.prototype property name, such as a pkiStatus, contentEncryptionAlgorithm, macAlgorithm, digestAlgorithm, PKCS#8 cipher, or ACME resource kind of "toString" or "constructor", is now refused with the verb's own typed bad-input error across pki.scep.build, pki.cms.encrypt, pki.cms.authenticate, pki.key.encrypt, pki.acme.validate, and pki.acme.assertTransition. Such a value previously resolved to the inherited method and the call surfaced an unrelated error, and pki.acme.validate accepted the kind and returned without checking any field.
+- pki.scep.build now requires a primitive-string pkiStatus. A boxed String or an object that coerces to a status name is refused with scep/bad-input, instead of building a CertRep whose signed pkiStatus attribute claims SUCCESS while the pkcsPKIEnvelope that a SUCCESS response requires is absent.
+
 ## v0.6.18 — 2026-09-01
 
 pki.cms.encrypt and pki.cms.decrypt envelope to and open a composite ML-KEM recipient, extending the CMS KEMRecipientInfo arm to the hybrid post-quantum key-establishment algorithms.

package/README.md

@@ -222,7 +222,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.schema.cmp` | CMP messages (RFC 9810): the header (version, sender and recipient including the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` and `bodyBytes` slices an external verifier reconstructs the protected part from. The CMP-before-OCSP dispatch order is enforced Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csrattrs` | EST CSR Attributes (`CsrAttrs`, RFC 8951 §3.5 / RFC 9908) — the `AttrOrOID` items a server sends to shape an enrollment: bare OIDs, attributes with raw values, and decoded views of the RFC 9908 meaningful types (extension requests, EC and RSA key-type conventions, the certification-request-info template). Unknown types are surfaced raw; structure and the RFC 9908 semantic MUSTs are fail-closed — `parse` |
 | `pki.est` | Enrollment over Secure Transport (RFC 7030 / 8951 / 9908 / 7616). The client verbs `cacerts`, `simpleenroll`, `simplereenroll`, `serverkeygen`, `csrattrs`, and `fullcmc` drive the RFC 7030 flow over `pki.transport` (inject your own via `opts.transport`, or take the fail-closed default): HTTPS only, an explicit trust anchor required, same-origin redirects followed while a downgrade or loop is refused, a 202 Retry-After surfaced but never slept, HTTP Basic or Digest (RFC 7616, SHA-256 / SHA-512-256; MD5 and no-qop refused by default) answered only after the server is authenticated, and the issued certificate chosen by public-key match. `serverkeygen` requests a server-generated key, cleartext or an opaque CMS EnvelopedData, with encryption bound to the CSR's key-identifier attribute over a confidentiality-bearing cipher. `csrattrs` fetches the CA's RFC 9908 attributes policy. `fullcmc` (§4.3) carries a CMC Full PKI Request and reduces the CA's answer through `pki.cmc.verify` to one terminal outcome, refusing a response that fails to echo the transaction and nonce the request carried, or that covers a key the request never asked for; a certs-only reply to a bound request is refused rather than read as an issuance. Under the verbs sit the transport-agnostic codecs they compose: the RFC 8951 base64 transfer codec (which ignores Content-Transfer-Encoding), the `multipart/mixed` splitter, the certs-only and serverkeygen response validators over CMS, the enroll-attribute builders, and the HTTP response classifier — `transferDecode`/`transferEncode`, `parseCertsOnly`, `splitMultipartMixed`, `parseServerKeygenResponse`, `findIssuedCert`, `classifyResponse`, `paths`, and the builders |
-| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a request: a `PKCSReq` or `RenewalReq` wraps a PKCS#10 certification request, whose own proof-of-possession it verifies first; a `CertPoll` wraps an IssuerAndSubject naming the issuing CA and the request subject; and a `GetCert` or `GetCRL` wraps an IssuerAndSerialNumber naming a certificate by its issuer and a positive serial of at most 20 octets. It encrypts the messageData to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, `CertPoll`, `GetCert`, `GetCRL`, or `CertRep` back (a messageType outside the RFC 8894 registry is refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `getNextCACert(baseUrl, opts)`, `enroll(baseUrl, opts)`, `renew(baseUrl, opts)`, `getCert(baseUrl, opts)`, and `getCrl(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, `getNextCACert` fetches the CA's next (rollover) certificate and verifies the SignedData response against the current CA certificate (`caCertificate`) before returning it, refusing a response signed by any other key, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and poll a PENDING response with CertPoll requests until the CA answers or a bounded poll-count and total-wait budget is spent. `getCert` and `getCrl` retrieve an already-issued certificate or a CA CRL by issuer and serial number, authenticated the same way; RFC 8894 §2.6, §2.7, and §3.3.4 recommend these queries only where HTTP certificate-store access (RFC 4387), LDAP, or a CRL distribution point is unavailable, so prefer those where a CA offers them. Issuing a CertRep (the certification-authority side) is not yet built — `build`, `parse`, `parseCapabilities`, `getCACaps`, `getCACert`, `getNextCACert`, `enroll`, `renew`, `getCert`, `getCrl` |
+| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a request: a `PKCSReq` or `RenewalReq` wraps a PKCS#10 certification request, whose own proof-of-possession it verifies first; a `CertPoll` wraps an IssuerAndSubject naming the issuing CA and the request subject; and a `GetCert` or `GetCRL` wraps an IssuerAndSerialNumber naming a certificate by its issuer and a positive serial of at most 20 octets. It encrypts the messageData to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `build` also issues the CA-side `CertRep` response (§3.3.2): a SUCCESS envelopes a certs-only SignedData of the issued certificate (or the CRL for a GetCRL) to the requester and signs it under the CA key, while a FAILURE (carrying a `failInfo`) or a PENDING omits the pkcsPKIEnvelope and is signed detached, each echoing the request's senderNonce as `recipientNonce`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, `CertPoll`, `GetCert`, `GetCRL`, or `CertRep` back (a messageType outside the RFC 8894 registry is refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `getNextCACert(baseUrl, opts)`, `enroll(baseUrl, opts)`, `renew(baseUrl, opts)`, `getCert(baseUrl, opts)`, and `getCrl(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, `getNextCACert` fetches the CA's next (rollover) certificate and verifies the SignedData response against the current CA certificate (`caCertificate`) before returning it, refusing a response signed by any other key, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and poll a PENDING response with CertPoll requests until the CA answers or a bounded poll-count and total-wait budget is spent. `getCert` and `getCrl` retrieve an already-issued certificate or a CA CRL by issuer and serial number, authenticated the same way; RFC 8894 §2.6, §2.7, and §3.3.4 recommend these queries only where HTTP certificate-store access (RFC 4387), LDAP, or a CRL distribution point is unavailable, so prefer those where a CA offers them. GET-carried PKIOperation and HTTP proxy authentication are not yet built — `build`, `parse`, `parseCapabilities`, `getCACaps`, `getCACert`, `getNextCACert`, `enroll`, `renew`, `getCert`, `getCrl` |
 | `pki.transport` | The shared, fail-closed `node:https` transport the enrollment clients drive. `pki.transport.https(defaults)` returns a `transport(request) → { status, headers, body, tls }`, where `tls` carries the negotiated `protocol`, `cipher`, and raw `peerCertificate`. This is the toolkit's only socket choke point: an explicit trust anchor (or an opt-in to the system store) is required, `rejectUnauthorized` is always on, TLS is floored at 1.2, the response body is capped while it streams, and a stalled socket times out. The EST, ACME, and CMP clients reuse it verbatim. If you inject your own transport, return `tls` too: `pki.est.serverkeygen` asserts the negotiated cipher can protect the delivered private key, and a transport that reports no cipher is trusted rather than refused, so omitting the field silently skips that check — `https` |
 | `pki.jose` | Flattened JWS (RFC 7515) and JWK thumbprints (RFC 7638). `sign` and `verify` run a Flattened JWS against declarative profiles (ACME outer, EAB inner, keyChange inner) that carry the required and forbidden header rules as data. `base64url` is the strict RFC 4648 §5 codec, rejecting padding, non-alphabet characters, and non-canonical trailing bits. `parseJson` is a bounded reader that refuses duplicate members at any depth. `thumbprint` is the RFC 7638 / 8037 / 9964 canonical digest. The algorithm registry binds each `alg` to its key type (ES/RS/PS/EdDSA/ML-DSA), leaving no code path for `alg:none`, an RS256→HS256 key confusion, or an all-zero ECDSA signature; `assertPublicJwk` refuses a JWK carrying private material, so an exported private key is never published. `opts.key` names the key a message must be signed under and governs: where the profile also permits an embedded header `jwk`, the two must be the same key — compared as RFC 7638 thumbprints, so member order cannot make equal keys differ — and a disagreement is refused rather than resolved in the message's favor. `keySource` reports which key answered, since a signature checked against a key you named is a different claim from one checked against the key the message carried — `sign`, `verify`, `base64url`, `parseJson`, `thumbprint`, `assertPublicJwk` |
 | `pki.acme` | ACME (RFC 8555 / 8737 / 8738 / 9773). `client(directoryUrl, opts)` is a stateful client driving a live CA directory over `pki.transport`: `newAccount`, `newOrder`, `newAuthz`, `getOrder`, `getAuthorization`, `getChallenge`, `respondToChallenge`, `finalize`, `pollOrder`, `pollAuthorization`, and `downloadCertificate` walk the issuance flow, with `newAuthz` pre-authorizing a single identifier (§7.4.1) and `downloadCertificate` binding the issued certificate to the order — its key, its identifiers, or both; at least one is required by default and the result reports `boundToKey` / `boundToIdentifiers` — before choosing among alternate chains (`Link rel="alternate"`, §7.4.2, via a `selectChain` predicate bounded by `maxAlternates`). `revokeCert` (account-key or certificate-key signed), `keyChange`, `updateAccount` (change the account contacts, §7.3.2), `listOrders` (the account's orders list, following the §7.1.2.1 `Link rel="next"` pagination bounded by a page cap and confined to the orders origin), `deactivateAccount`, `deactivateAuthorization`, `renewalInfo` (ARI), and `renewalWindow` (the RFC 9773 §4.2/4.3 renewal decision) complete the lifecycle. Every URL is HTTPS only, an explicit trust anchor is required, each request carries a fresh single-use nonce with a bounded badNonce retry (and, when `opts.resignKeys` supplies caller-approved alternative account-key algorithms, a bounded RFC 8555 §6.2 badSignatureAlgorithm re-sign that the CA's advertised list can only filter, never widen, so it cannot force a weaker algorithm), reads are POST-as-GET, polling is bounded and sleeps on a Retry-After via an injectable sleeper capped by a poll count and a total-wait budget, and every response body is size-capped. The transport is injectable via `opts.transport`. Over the message layer it composes resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, the request builders (newAccount with External Account Binding, newOrder with `replaces`, finalize with a CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns and ip identifier validators, and the ARI certID with serial sign-padding preserved — `client`, `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |

package/lib/acme.js

@@ -223,7 +223,7 @@ var STATUS = {
   challenge:     ["pending", "processing", "valid", "invalid"],
 };
 
-var SPECS = {
+var SPECS = intrinsic.assign(intrinsic.create(null), {
   directory: [
     { name: "newNonce", type: "url", required: true },
     { name: "newAccount", type: "url", required: true },
@@ -275,7 +275,7 @@ var SPECS = {
   ordersList: [
     { name: "orders", type: "array", required: true, elemType: "url" },
   ],
-};
+});
 
 function _checkType(kind, field, value, obj) {
   switch (field.type) {
@@ -408,11 +408,11 @@ function _canonicalizeIpv6(value) {
 }
 
 
-var TRANSITIONS = {
+var TRANSITIONS = intrinsic.assign(intrinsic.create(null), {
   challenge:     { pending: ["processing", "valid", "invalid"], processing: ["processing", "valid", "invalid"] },
   authorization: { pending: ["valid", "invalid", "deactivated"], valid: ["expired", "deactivated", "revoked"] },
   order:         { pending: ["ready", "invalid"], ready: ["processing", "valid", "invalid"], processing: ["valid", "invalid"] },
-};
+});
 
 /**
  * @primitive  pki.acme.assertTransition
@@ -434,7 +434,7 @@ function assertTransition(kind, from, to) {
   var table = TRANSITIONS[kind];
   if (!table) throw E("acme/bad-input", "unknown resource kind " + JSON.stringify(kind));
   if (from === to) return;
-  var allowed = table[from];
+  var allowed = _hasOwn(table, from) ? table[from] : null;
   if (!allowed || allowed.indexOf(to) === -1) throw E("acme/bad-transition", "illegal " + kind + " transition " + JSON.stringify(from) + " -> " + JSON.stringify(to) + " (RFC 8555 sec. 7.1.6)");
 }
 
@@ -817,7 +817,7 @@ function newAccount(o) {
   });
 }
 
-var _HMAC_HASH = { HS256: "SHA-256", HS384: "SHA-384", HS512: "SHA-512" };
+var _HMAC_HASH = intrinsic.assign(intrinsic.create(null), { HS256: "SHA-256", HS384: "SHA-384", HS512: "SHA-512" });
 
 /**
  * @primitive  pki.acme.externalAccountBinding

package/lib/cms-encrypt.js

@@ -34,14 +34,14 @@ function _normCertDer(cert, what) {
   throw _err("cms/bad-input", (what || "a certificate") + " must be a DER Buffer, Uint8Array, or PEM string");
 }
 
-var CONTENT_ALGS = {
+var CONTENT_ALGS = intrinsic.assign(intrinsic.create(null), {
   "aes-128-gcm": { oid: "aes128-GCM", keyBits: 128, aead: true },
   "aes-192-gcm": { oid: "aes192-GCM", keyBits: 192, aead: true },
   "aes-256-gcm": { oid: "aes256-GCM", keyBits: 256, aead: true },
   "aes-128-cbc": { oid: "aes128-CBC", keyBits: 128, aead: false },
   "aes-192-cbc": { oid: "aes192-CBC", keyBits: 192, aead: false },
   "aes-256-cbc": { oid: "aes256-CBC", keyBits: 256, aead: false },
-};
+});
 
 function _wrapOidForKek(keyBytes) {
   if (keyBytes === 16) return "aes128-wrap";
@@ -83,7 +83,7 @@ function _assertKeyUsage(cert, bitName, arm) {
   if (ku && ku[bitName] !== true) throw _err("cms/bad-key-usage", "the " + arm + " recipient certificate's keyUsage does not assert " + bitName);
 }
 
-var OAEP_HASH = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
+var OAEP_HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 function _oaepParams(hashName) {
   var hAlg = _algId(hashName, "null");
   var mgf = b.sequence([b.oid(O("mgf1")), hAlg]);
@@ -282,7 +282,7 @@ function _pwriWrapIv(kek, cek, iv) {
   }
 }
 
-var PRF_HASH = { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" };
+var PRF_HASH = intrinsic.assign(intrinsic.create(null), { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" });
 function _prfHash(prf) { if (!PRF_HASH[prf]) throw _err("cms/bad-input", "unsupported pwri prf " + JSON.stringify(prf)); return PRF_HASH[prf]; }
 
 var _PWRI_KEYS = { password: 1, iterations: 1, prf: 1, salt: 1 };
@@ -557,13 +557,13 @@ function _tlvHeaderLen(der) {
 }
 
 
-var MAC_ALGS = {
+var MAC_ALGS = intrinsic.assign(intrinsic.create(null), {
   "hmac-sha256": { oid: "hmacWithSHA256", wc: "SHA-256", node: "sha256" },
   "hmac-sha384": { oid: "hmacWithSHA384", wc: "SHA-384", node: "sha384" },
   "hmac-sha512": { oid: "hmacWithSHA512", wc: "SHA-512", node: "sha512" },
-};
+});
 var MAC_KEY_OCTETS = 32;
-var SUPPORTED_DIGEST = { sha256: 1, sha384: 1, sha512: 1 };
+var SUPPORTED_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: 1, sha384: 1, sha512: 1 });
 
 async function authenticate(content, recipients, opts) {
   opts = opts || {};

package/lib/key.js

@@ -36,7 +36,7 @@ var PemError = frameworkError.PemError;
 function O(n) { return oid.byName(n); }
 function _err(code, msg, cause) { return new KeyError(code, msg, cause); }
 
-var CIPHER_NAME = { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" };
+var CIPHER_NAME = Object.assign(Object.create(null), { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" });
 
 var INFER_ALG = {};
 ["Ed25519", "Ed448", "X25519", "X448"].forEach(function (n) { INFER_ALG[O(n)] = { name: n }; });

package/lib/scep.js

@@ -16,8 +16,8 @@
  *   outer SignedData that signs it under a set of authenticated transaction
  *   attributes -- messageType, transactionID, pkiStatus, failInfo, and the
  *   sender/recipient nonces (RFC 8894 sec. 3). `pki.scep.build` assembles a
- *   request pkiMessage (PKCSReq, RenewalReq, CertPoll, GetCert, or GetCRL);
- *   `pki.scep.parse` verifies the
+ *   request pkiMessage (PKCSReq, RenewalReq, CertPoll, GetCert, or GetCRL) or a
+ *   CA-side CertRep response; `pki.scep.parse` verifies the
  *   outer signature, reads the transaction attributes BOUND to the verified
  *   signer, and (given the recipient key) decrypts the pkcsPKIEnvelope to the
  *   messageData.
@@ -29,10 +29,10 @@
  *   pki.transport separately.
  *
  * @card
- *   Build and read SCEP (RFC 8894) client messages: a PKCSReq, RenewalReq,
- *   CertPoll, GetCert, or GetCRL request wrapped in the signed-over-encrypted CMS
- *   layering, and any of those or a CertRep parsed back to its verified transaction
- *   attributes and decrypted messageData.
+ *   Build and read SCEP (RFC 8894) messages: a PKCSReq, RenewalReq, CertPoll,
+ *   GetCert, or GetCRL request, or a CA-side CertRep response, wrapped in the
+ *   signed-over-encrypted CMS layering, and any of them parsed back to its verified
+ *   transaction attributes and decrypted messageData.
  */
 
 var frameworkError = require("./framework-error");
@@ -63,14 +63,14 @@ function _err(code, msg, cause) { return new ScepError(code, msg, cause); }
 
 var _KU_NS = pkix.makeNS("scep", ScepError, oid);
 
-var MESSAGE_TYPE = { CertRep: "3", RenewalReq: "17", PKCSReq: "19", CertPoll: "20", GetCert: "21", GetCRL: "22" };
-var PKI_STATUS = { SUCCESS: "0", FAILURE: "2", PENDING: "3" };
-var FAIL_INFO = { badAlg: "0", badMessageCheck: "1", badRequest: "2", badTime: "3", badCertId: "4" };
+var MESSAGE_TYPE = Object.assign(Object.create(null), { CertRep: "3", RenewalReq: "17", PKCSReq: "19", CertPoll: "20", GetCert: "21", GetCRL: "22" });
+var PKI_STATUS = Object.assign(Object.create(null), { SUCCESS: "0", FAILURE: "2", PENDING: "3" });
+var FAIL_INFO = Object.assign(Object.create(null), { badAlg: "0", badMessageCheck: "1", badRequest: "2", badTime: "3", badCertId: "4" });
 
 function _invert(table) { var o = Object.create(null); for (var k in table) if (Object.prototype.hasOwnProperty.call(table, k)) o[table[k]] = k; return o; }
 var MESSAGE_TYPE_BY_CODE = _invert(MESSAGE_TYPE), PKI_STATUS_BY_CODE = _invert(PKI_STATUS), FAIL_INFO_BY_CODE = _invert(FAIL_INFO);
 
-var _PARSE_SUPPORTED = { PKCSReq: 1, RenewalReq: 1, CertRep: 1, CertPoll: 1, GetCert: 1, GetCRL: 1 };
+var _PARSE_SUPPORTED = Object.assign(Object.create(null), { PKCSReq: 1, RenewalReq: 1, CertRep: 1, CertPoll: 1, GetCert: 1, GetCRL: 1 });
 
 var ENVELOPE_CIPHER = "aes-128-cbc";
 
@@ -225,16 +225,26 @@ function _captureRecipientKey(rk) {
  * CA-issued certificate instead, which is why this is the caller's choice rather than an enforced
  * match. The proof-of-possession over the PKCS#10 itself is verified regardless.
  *
+ * A `CertRep` response is the CA (responder) side: it carries the transaction `pkiStatus`, echoes the
+ * request's senderNonce as `recipientNonce`, and is signed under the CA's `signer`. A SUCCESS response
+ * envelopes a certs-only SignedData of the issued `certificates` (or the `crls` of a GetCRL response) to
+ * the requester's `recipient` certificate; a FAILURE (which carries a `failInfo`) or a PENDING response
+ * omits the pkcsPKIEnvelope and is signed detached (RFC 8894 sec. 3.3.2).
+ *
  * @opts
- *   - `messageType` -- "PKCSReq" | "RenewalReq" | "CertPoll" | "GetCert" | "GetCRL".
+ *   - `messageType` -- "PKCSReq" | "RenewalReq" | "CertPoll" | "GetCert" | "GetCRL" | "CertRep".
  *   - `messageData` -- the PKCS#10 CertificationRequest DER, for a PKCSReq or RenewalReq.
  *   - `requestSubject` -- the request subject Name DER, for a CertPoll.
  *   - `certificate` -- for a GetCert or GetCRL, the certificate DER whose issuer and serial name the target (the convenience form).
  *   - `issuer` / `serialNumber` -- for a GetCert or GetCRL, the issuer Name DER and a positive serial (a BigInt, number, or hex string) naming the target directly. For a CertPoll, `issuer` alone names the issuing CA (defaulting to the recipient's subject) when the request is encrypted to a separate RA.
- *   - `recipient` -- the CA (or RA) certificate DER the messageData is encrypted to (an RSA key-transport certificate; a non-RSA recipient is refused, since the envelope uses RSAES-OAEP).
- *   - `signer` -- `{ cert, key }`, the outer SignedData signer (the client for a request).
- *   - `transactionId` -- a caller-unique PrintableString identifying the transaction.
+ *   - `recipient` -- the certificate DER the pkcsPKIEnvelope is encrypted to (an RSA key-transport certificate; a non-RSA recipient is refused, since the envelope uses RSAES-OAEP): the CA or RA certificate for a request, the requester's certificate for a SUCCESS CertRep.
+ *   - `signer` -- `{ cert, key }`, the outer SignedData signer (the client for a request, the CA for a CertRep).
+ *   - `transactionId` -- a caller-unique PrintableString identifying the transaction (echoes the request's on a CertRep).
  *   - `senderNonce` -- a 16-byte Buffer (generated when omitted).
+ *   - `pkiStatus` -- for a CertRep, "SUCCESS" | "FAILURE" | "PENDING".
+ *   - `recipientNonce` -- for a CertRep, the 16-byte value echoing the request's senderNonce (required).
+ *   - `certificates` / `crls` -- for a SUCCESS CertRep, arrays of the issued certificate DER (or CRL DER) the certs-only SignedData carries.
+ *   - `failInfo` / `failInfoText` -- for a FAILURE CertRep, the failInfo (badAlg / badMessageCheck / badRequest / badTime / badCertId) and an optional detail string.
  * @example
  *   // requires: csrDer -- the PKCS#10 CertificationRequest DER to enrol
  *   // requires: caCertDer -- the SCEP CA (or RA) certificate the request is encrypted to (keyEncipherment)
@@ -246,11 +256,15 @@ function _captureRecipientKey(rk) {
  */
 async function build(spec) {
   spec = guard.identifier.optionsObject(spec, _err, "scep/bad-input", "pki.scep.build spec");
-  guard.identifier.assertKnownKeys(spec, _BUILD_KEYS, _err, "scep/bad-input", "pki.scep.build has an unknown option: ");
   var mtCode = MESSAGE_TYPE[spec.messageType];
   if (mtCode == null) throw _err("scep/bad-message-type", "unknown messageType " + JSON.stringify(spec.messageType) + " (RFC 8894 sec. 3.2.1.2)");
+  if (spec.messageType === "CertRep") {
+    guard.identifier.assertKnownKeys(spec, _CERTREP_KEYS, _err, "scep/bad-input", "pki.scep.build (CertRep) has an unknown option: ");
+    return await _buildCertRep(spec);
+  }
+  guard.identifier.assertKnownKeys(spec, _REQUEST_KEYS, _err, "scep/bad-input", "pki.scep.build has an unknown option: ");
   if (spec.messageType !== "PKCSReq" && spec.messageType !== "RenewalReq" && spec.messageType !== "CertPoll" && spec.messageType !== "GetCert" && spec.messageType !== "GetCRL") {
-    throw _err("scep/bad-message-type", "pki.scep.build issues a request (PKCSReq / RenewalReq / CertPoll / GetCert / GetCRL); " + spec.messageType + " is not built in this release");
+    throw _err("scep/bad-message-type", "pki.scep.build issues a request (PKCSReq / RenewalReq / CertPoll / GetCert / GetCRL) or a CertRep response; " + spec.messageType + " is not built in this release");
   }
   if (spec.signer == null || typeof spec.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
   var senderNonce = _nonce(spec.senderNonce, "senderNonce");
@@ -293,7 +307,69 @@ async function build(spec) {
     throw e;
   }
 }
-var _BUILD_KEYS = { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, certificate: 1, serialNumber: 1, signer: 1, transactionId: 1, senderNonce: 1 };
+var _REQUEST_KEYS = { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, certificate: 1, serialNumber: 1, signer: 1, transactionId: 1, senderNonce: 1 };
+var _CERTREP_KEYS = { messageType: 1, signer: 1, transactionId: 1, senderNonce: 1, pkiStatus: 1, recipientNonce: 1, certificates: 1, crls: 1, recipient: 1, failInfo: 1, failInfoText: 1 };
+
+async function _buildCertRep(spec) {
+  if (spec.signer == null || typeof spec.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
+  if (typeof spec.pkiStatus !== "string") throw _err("scep/bad-input", "a CertRep pkiStatus must be SUCCESS, FAILURE, or PENDING (RFC 8894 sec. 3.2.1.3), got " + JSON.stringify(spec.pkiStatus));
+  var statusCode = PKI_STATUS[spec.pkiStatus];
+  if (statusCode == null) throw _err("scep/bad-input", "a CertRep pkiStatus must be SUCCESS, FAILURE, or PENDING (RFC 8894 sec. 3.2.1.3), got " + JSON.stringify(spec.pkiStatus));
+  var txnId = _transactionId(spec.transactionId);
+  if (spec.recipientNonce == null) throw _err("scep/bad-input", "a CertRep must echo the request's senderNonce as recipientNonce (RFC 8894 sec. 3.2.1.5)");
+  var recipientNonce = _nonce(spec.recipientNonce, "recipientNonce");
+  var senderNonce = _nonce(spec.senderNonce, "senderNonce");
+  var signerCert = guard.bytes.snapshotSource(spec.signer.cert, ScepError, "scep/bad-input", "signer.cert");
+  var signerKey = spec.signer.key;
+  _assertSigningKeyUsage(signerCert, "signer certificate");
+  var attrs = [
+    _attr("scepMessageType", b.printable(MESSAGE_TYPE.CertRep)),
+    _attr("scepTransactionId", b.printable(txnId)),
+    _attr("scepSenderNonce", b.octetString(senderNonce)),
+    _attr("scepPkiStatus", b.printable(statusCode)),
+    _attr("scepRecipientNonce", b.octetString(recipientNonce)),
+  ];
+  if (spec.pkiStatus !== "FAILURE" && (spec.failInfo != null || spec.failInfoText != null)) {
+    throw _err("scep/bad-input", "failInfo and failInfoText are only valid on a FAILURE CertRep (RFC 8894 sec. 3.2.1.4)");
+  }
+  var content = null;
+  if (spec.pkiStatus === "SUCCESS") {
+    var certs = spec.certificates != null ? spec.certificates : [];
+    var crls = spec.crls != null ? spec.crls : [];
+    if (!Array.isArray(certs) || !Array.isArray(crls)) throw _err("scep/bad-input", "a CertRep certificates and crls must be arrays of certificate / CRL DER");
+    if (certs.length === 0 && crls.length === 0) throw _err("scep/bad-input", "a SUCCESS CertRep must carry at least one certificate or CRL (RFC 8894 sec. 3.3.2.1)");
+    if (spec.recipient == null) throw _err("scep/bad-input", "a SUCCESS CertRep needs a recipient certificate to encrypt the pkcsPKIEnvelope to (RFC 8894 sec. 3.2.2)");
+    var recipient = guard.bytes.snapshotSource(spec.recipient, ScepError, "scep/bad-input", "recipient");
+    _assertRsaRecipient(recipient);
+    var certsOnlyDer;
+    try { certsOnlyDer = cmsSign.certsOnly(certs, { crls: crls }); }
+    catch (e) { throw _err("scep/bad-input", "a SUCCESS CertRep certificates / crls must be valid certificate / CRL DER (RFC 8894 sec. 3.4): " + e.message, e); }
+    try { content = await cmsEncrypt.encrypt(certsOnlyDer, [{ cert: recipient }], { contentEncryptionAlgorithm: ENVELOPE_CIPHER }); }
+    catch (e) {
+      if (e && e.isPkiError) throw _err("scep/bad-input", "the SUCCESS CertRep pkcsPKIEnvelope could not be built (the recipient must be a keyEncipherment certificate): " + e.message, e);
+      throw e;
+    }
+  } else {
+    if (spec.certificates != null || spec.crls != null || spec.recipient != null) {
+      throw _err("scep/bad-input", "a " + spec.pkiStatus + " CertRep must omit certificates, crls, and recipient: the pkcsPKIEnvelope is omitted (RFC 8894 sec. 3.3.2." + (spec.pkiStatus === "FAILURE" ? "2" : "3") + ")");
+    }
+    if (spec.pkiStatus === "FAILURE") {
+      var failCode = FAIL_INFO[spec.failInfo];
+      if (failCode == null) throw _err("scep/bad-input", "a FAILURE CertRep must carry a failInfo of badAlg / badMessageCheck / badRequest / badTime / badCertId (RFC 8894 sec. 3.2.1.4), got " + JSON.stringify(spec.failInfo));
+      attrs.push(_attr("scepFailInfo", b.printable(failCode)));
+      if (spec.failInfoText != null) attrs.push(_attr("scepFailInfoText", b.utf8(String(spec.failInfoText))));
+    }
+  }
+  var signOpts = { additionalSignedAttributes: attrs };
+  var signContent = content;
+  if (content == null) { signContent = Buffer.alloc(0); signOpts.detached = true; }
+  try {
+    return await cmsSign.sign(signContent, { cert: signerCert, key: signerKey }, signOpts);
+  } catch (e) {
+    if (e && e.isPkiError) throw _err("scep/bad-input", "the CertRep could not be signed: " + e.message, e);
+    throw e;
+  }
+}
 
 function _buildIssuerAndSubject(recipientCertDer, requestSubjectSource, issuerOverride) {
   var subject = guard.bytes.snapshotSource(requestSubjectSource, ScepError, "scep/bad-input", "requestSubject");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.18",
+  "version": "0.6.20",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:12f32901-e931-42b5-b817-2f304d987943",
+  "serialNumber": "urn:uuid:40b50089-a128-40ea-a5a2-b82960272544",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-01T15:21:55.160Z",
+    "timestamp": "2026-09-01T19:36:06.284Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.18",
+      "bom-ref": "@blamejs/pki@0.6.20",
       "type": "application",
       "name": "pki",
-      "version": "0.6.18",
+      "version": "0.6.20",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.18",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.20",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.18",
+      "ref": "@blamejs/pki@0.6.20",
       "dependsOn": []
     }
   ]