@blamejs/pki 0.6.18 → 0.6.21

package/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.21 — 2026-09-01
+
+WebCrypto and the signing and format builders refuse an algorithm, curve, digest, or profile name that collides with an inherited Object.prototype property name.
+
+### Fixed
+
+- pki.webcrypto (generateKey, sign, verify, encrypt, decrypt, deriveBits, deriveKey, wrapKey, unwrapKey, importKey, encapsulateBits, decapsulateBits) refuses an algorithm name or namedCurve that collides with an inherited Object.prototype property name, returning webcrypto/not-supported instead of a bare Node error. The digest, PBMAC1 PRF, CMP body, PKCS#12 MAC hash, PBES2 PRF, and lint-profile lookups behind pki.tsp.sign, pki.cmp.build, pki.pkcs12.build, pki.key.encrypt, pki.lint.certificate, and the RSA-PSS and C509 builders are hardened the same way, each returning the verb's typed error for such a name.
+
+## v0.6.20 — 2026-09-01
+
+A vulnerable build-time dependency is refreshed; it is not part of the published package.
+
+### Security
+
+- browserslist, a transitive development dependency of the fuzzing harness, is updated from 4.28.4 to 4.28.8, clearing GHSA-73wf-gq98-2v4g and GHSA-c83g-rgw3-j3cx (both High). browserslist is a build-time and test-time dependency and is not part of the published package.
+
+## v0.6.19 — 2026-09-01
+
+pki.scep.build issues the CA-side CertRep response, so the toolkit produces the SCEP certification-authority reply the client enrollment verbs consume.
+
+### Added
+
+- pki.scep.build({ messageType: "CertRep", pkiStatus, transactionId, recipientNonce, ... }) issues a SCEP CertRep response (RFC 8894 sec. 3.3.2). SUCCESS takes certificates (and/or crls, leaf identified by content since the CMS certificate SET is DER-ordered) plus the requester's recipient certificate and the CA signer; the issued certificates ride a certs-only SignedData inside a pkcsPKIEnvelope encrypted to the requester. FAILURE takes a failInfo (and optional failInfoText) and PENDING takes neither; both omit the pkcsPKIEnvelope and are signed detached. recipientNonce (echoing the request's senderNonce) and transactionId are required; a missing failInfo on a FAILURE, a SUCCESS without a certificate/CRL or recipient, an envelope field on a FAILURE or PENDING, or an unknown pkiStatus or failInfo is refused with a typed scep/bad-input.
+
+### Fixed
+
+- An enumerated option whose value collides with an inherited Object.prototype property name, such as a pkiStatus, contentEncryptionAlgorithm, macAlgorithm, digestAlgorithm, PKCS#8 cipher, or ACME resource kind of "toString" or "constructor", is now refused with the verb's own typed bad-input error across pki.scep.build, pki.cms.encrypt, pki.cms.authenticate, pki.key.encrypt, pki.acme.validate, and pki.acme.assertTransition. Such a value previously resolved to the inherited method and the call surfaced an unrelated error, and pki.acme.validate accepted the kind and returned without checking any field.
+- pki.scep.build now requires a primitive-string pkiStatus. A boxed String or an object that coerces to a status name is refused with scep/bad-input, instead of building a CertRep whose signed pkiStatus attribute claims SUCCESS while the pkcsPKIEnvelope that a SUCCESS response requires is absent.
+
 ## v0.6.18 — 2026-09-01
 
 pki.cms.encrypt and pki.cms.decrypt envelope to and open a composite ML-KEM recipient, extending the CMS KEMRecipientInfo arm to the hybrid post-quantum key-establishment algorithms.

package/README.md

@@ -222,7 +222,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.schema.cmp` | CMP messages (RFC 9810): the header (version, sender and recipient including the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` and `bodyBytes` slices an external verifier reconstructs the protected part from. The CMP-before-OCSP dispatch order is enforced Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csrattrs` | EST CSR Attributes (`CsrAttrs`, RFC 8951 §3.5 / RFC 9908) — the `AttrOrOID` items a server sends to shape an enrollment: bare OIDs, attributes with raw values, and decoded views of the RFC 9908 meaningful types (extension requests, EC and RSA key-type conventions, the certification-request-info template). Unknown types are surfaced raw; structure and the RFC 9908 semantic MUSTs are fail-closed — `parse` |
 | `pki.est` | Enrollment over Secure Transport (RFC 7030 / 8951 / 9908 / 7616). The client verbs `cacerts`, `simpleenroll`, `simplereenroll`, `serverkeygen`, `csrattrs`, and `fullcmc` drive the RFC 7030 flow over `pki.transport` (inject your own via `opts.transport`, or take the fail-closed default): HTTPS only, an explicit trust anchor required, same-origin redirects followed while a downgrade or loop is refused, a 202 Retry-After surfaced but never slept, HTTP Basic or Digest (RFC 7616, SHA-256 / SHA-512-256; MD5 and no-qop refused by default) answered only after the server is authenticated, and the issued certificate chosen by public-key match. `serverkeygen` requests a server-generated key, cleartext or an opaque CMS EnvelopedData, with encryption bound to the CSR's key-identifier attribute over a confidentiality-bearing cipher. `csrattrs` fetches the CA's RFC 9908 attributes policy. `fullcmc` (§4.3) carries a CMC Full PKI Request and reduces the CA's answer through `pki.cmc.verify` to one terminal outcome, refusing a response that fails to echo the transaction and nonce the request carried, or that covers a key the request never asked for; a certs-only reply to a bound request is refused rather than read as an issuance. Under the verbs sit the transport-agnostic codecs they compose: the RFC 8951 base64 transfer codec (which ignores Content-Transfer-Encoding), the `multipart/mixed` splitter, the certs-only and serverkeygen response validators over CMS, the enroll-attribute builders, and the HTTP response classifier — `transferDecode`/`transferEncode`, `parseCertsOnly`, `splitMultipartMixed`, `parseServerKeygenResponse`, `findIssuedCert`, `classifyResponse`, `paths`, and the builders |
-| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a request: a `PKCSReq` or `RenewalReq` wraps a PKCS#10 certification request, whose own proof-of-possession it verifies first; a `CertPoll` wraps an IssuerAndSubject naming the issuing CA and the request subject; and a `GetCert` or `GetCRL` wraps an IssuerAndSerialNumber naming a certificate by its issuer and a positive serial of at most 20 octets. It encrypts the messageData to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, `CertPoll`, `GetCert`, `GetCRL`, or `CertRep` back (a messageType outside the RFC 8894 registry is refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `getNextCACert(baseUrl, opts)`, `enroll(baseUrl, opts)`, `renew(baseUrl, opts)`, `getCert(baseUrl, opts)`, and `getCrl(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, `getNextCACert` fetches the CA's next (rollover) certificate and verifies the SignedData response against the current CA certificate (`caCertificate`) before returning it, refusing a response signed by any other key, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and poll a PENDING response with CertPoll requests until the CA answers or a bounded poll-count and total-wait budget is spent. `getCert` and `getCrl` retrieve an already-issued certificate or a CA CRL by issuer and serial number, authenticated the same way; RFC 8894 §2.6, §2.7, and §3.3.4 recommend these queries only where HTTP certificate-store access (RFC 4387), LDAP, or a CRL distribution point is unavailable, so prefer those where a CA offers them. Issuing a CertRep (the certification-authority side) is not yet built — `build`, `parse`, `parseCapabilities`, `getCACaps`, `getCACert`, `getNextCACert`, `enroll`, `renew`, `getCert`, `getCrl` |
+| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a request: a `PKCSReq` or `RenewalReq` wraps a PKCS#10 certification request, whose own proof-of-possession it verifies first; a `CertPoll` wraps an IssuerAndSubject naming the issuing CA and the request subject; and a `GetCert` or `GetCRL` wraps an IssuerAndSerialNumber naming a certificate by its issuer and a positive serial of at most 20 octets. It encrypts the messageData to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `build` also issues the CA-side `CertRep` response (§3.3.2): a SUCCESS envelopes a certs-only SignedData of the issued certificate (or the CRL for a GetCRL) to the requester and signs it under the CA key, while a FAILURE (carrying a `failInfo`) or a PENDING omits the pkcsPKIEnvelope and is signed detached, each echoing the request's senderNonce as `recipientNonce`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, `CertPoll`, `GetCert`, `GetCRL`, or `CertRep` back (a messageType outside the RFC 8894 registry is refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `getNextCACert(baseUrl, opts)`, `enroll(baseUrl, opts)`, `renew(baseUrl, opts)`, `getCert(baseUrl, opts)`, and `getCrl(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, `getNextCACert` fetches the CA's next (rollover) certificate and verifies the SignedData response against the current CA certificate (`caCertificate`) before returning it, refusing a response signed by any other key, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and poll a PENDING response with CertPoll requests until the CA answers or a bounded poll-count and total-wait budget is spent. `getCert` and `getCrl` retrieve an already-issued certificate or a CA CRL by issuer and serial number, authenticated the same way; RFC 8894 §2.6, §2.7, and §3.3.4 recommend these queries only where HTTP certificate-store access (RFC 4387), LDAP, or a CRL distribution point is unavailable, so prefer those where a CA offers them. GET-carried PKIOperation and HTTP proxy authentication are not yet built — `build`, `parse`, `parseCapabilities`, `getCACaps`, `getCACert`, `getNextCACert`, `enroll`, `renew`, `getCert`, `getCrl` |
 | `pki.transport` | The shared, fail-closed `node:https` transport the enrollment clients drive. `pki.transport.https(defaults)` returns a `transport(request) → { status, headers, body, tls }`, where `tls` carries the negotiated `protocol`, `cipher`, and raw `peerCertificate`. This is the toolkit's only socket choke point: an explicit trust anchor (or an opt-in to the system store) is required, `rejectUnauthorized` is always on, TLS is floored at 1.2, the response body is capped while it streams, and a stalled socket times out. The EST, ACME, and CMP clients reuse it verbatim. If you inject your own transport, return `tls` too: `pki.est.serverkeygen` asserts the negotiated cipher can protect the delivered private key, and a transport that reports no cipher is trusted rather than refused, so omitting the field silently skips that check — `https` |
 | `pki.jose` | Flattened JWS (RFC 7515) and JWK thumbprints (RFC 7638). `sign` and `verify` run a Flattened JWS against declarative profiles (ACME outer, EAB inner, keyChange inner) that carry the required and forbidden header rules as data. `base64url` is the strict RFC 4648 §5 codec, rejecting padding, non-alphabet characters, and non-canonical trailing bits. `parseJson` is a bounded reader that refuses duplicate members at any depth. `thumbprint` is the RFC 7638 / 8037 / 9964 canonical digest. The algorithm registry binds each `alg` to its key type (ES/RS/PS/EdDSA/ML-DSA), leaving no code path for `alg:none`, an RS256→HS256 key confusion, or an all-zero ECDSA signature; `assertPublicJwk` refuses a JWK carrying private material, so an exported private key is never published. `opts.key` names the key a message must be signed under and governs: where the profile also permits an embedded header `jwk`, the two must be the same key — compared as RFC 7638 thumbprints, so member order cannot make equal keys differ — and a disagreement is refused rather than resolved in the message's favor. `keySource` reports which key answered, since a signature checked against a key you named is a different claim from one checked against the key the message carried — `sign`, `verify`, `base64url`, `parseJson`, `thumbprint`, `assertPublicJwk` |
 | `pki.acme` | ACME (RFC 8555 / 8737 / 8738 / 9773). `client(directoryUrl, opts)` is a stateful client driving a live CA directory over `pki.transport`: `newAccount`, `newOrder`, `newAuthz`, `getOrder`, `getAuthorization`, `getChallenge`, `respondToChallenge`, `finalize`, `pollOrder`, `pollAuthorization`, and `downloadCertificate` walk the issuance flow, with `newAuthz` pre-authorizing a single identifier (§7.4.1) and `downloadCertificate` binding the issued certificate to the order — its key, its identifiers, or both; at least one is required by default and the result reports `boundToKey` / `boundToIdentifiers` — before choosing among alternate chains (`Link rel="alternate"`, §7.4.2, via a `selectChain` predicate bounded by `maxAlternates`). `revokeCert` (account-key or certificate-key signed), `keyChange`, `updateAccount` (change the account contacts, §7.3.2), `listOrders` (the account's orders list, following the §7.1.2.1 `Link rel="next"` pagination bounded by a page cap and confined to the orders origin), `deactivateAccount`, `deactivateAuthorization`, `renewalInfo` (ARI), and `renewalWindow` (the RFC 9773 §4.2/4.3 renewal decision) complete the lifecycle. Every URL is HTTPS only, an explicit trust anchor is required, each request carries a fresh single-use nonce with a bounded badNonce retry (and, when `opts.resignKeys` supplies caller-approved alternative account-key algorithms, a bounded RFC 8555 §6.2 badSignatureAlgorithm re-sign that the CA's advertised list can only filter, never widen, so it cannot force a weaker algorithm), reads are POST-as-GET, polling is bounded and sleeps on a Retry-After via an injectable sleeper capped by a poll count and a total-wait budget, and every response body is size-capped. The transport is injectable via `opts.transport`. Over the message layer it composes resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, the request builders (newAccount with External Account Binding, newOrder with `replaces`, finalize with a CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns and ip identifier validators, and the ARI certID with serial sign-padding preserved — `client`, `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |

package/lib/acme.js

@@ -223,7 +223,7 @@ var STATUS = {
   challenge:     ["pending", "processing", "valid", "invalid"],
 };
 
-var SPECS = {
+var SPECS = intrinsic.assign(intrinsic.create(null), {
   directory: [
     { name: "newNonce", type: "url", required: true },
     { name: "newAccount", type: "url", required: true },
@@ -275,7 +275,7 @@ var SPECS = {
   ordersList: [
     { name: "orders", type: "array", required: true, elemType: "url" },
   ],
-};
+});
 
 function _checkType(kind, field, value, obj) {
   switch (field.type) {
@@ -408,11 +408,11 @@ function _canonicalizeIpv6(value) {
 }
 
 
-var TRANSITIONS = {
+var TRANSITIONS = intrinsic.assign(intrinsic.create(null), {
   challenge:     { pending: ["processing", "valid", "invalid"], processing: ["processing", "valid", "invalid"] },
   authorization: { pending: ["valid", "invalid", "deactivated"], valid: ["expired", "deactivated", "revoked"] },
   order:         { pending: ["ready", "invalid"], ready: ["processing", "valid", "invalid"], processing: ["valid", "invalid"] },
-};
+});
 
 /**
  * @primitive  pki.acme.assertTransition
@@ -434,7 +434,7 @@ function assertTransition(kind, from, to) {
   var table = TRANSITIONS[kind];
   if (!table) throw E("acme/bad-input", "unknown resource kind " + JSON.stringify(kind));
   if (from === to) return;
-  var allowed = table[from];
+  var allowed = _hasOwn(table, from) ? table[from] : null;
   if (!allowed || allowed.indexOf(to) === -1) throw E("acme/bad-transition", "illegal " + kind + " transition " + JSON.stringify(from) + " -> " + JSON.stringify(to) + " (RFC 8555 sec. 7.1.6)");
 }
 
@@ -817,7 +817,7 @@ function newAccount(o) {
   });
 }
 
-var _HMAC_HASH = { HS256: "SHA-256", HS384: "SHA-384", HS512: "SHA-512" };
+var _HMAC_HASH = intrinsic.assign(intrinsic.create(null), { HS256: "SHA-256", HS384: "SHA-384", HS512: "SHA-512" });
 
 /**
  * @primitive  pki.acme.externalAccountBinding

package/lib/cmp-build.js

@@ -75,18 +75,18 @@ var KNOWN_HEADER_KEYS = {
   sender: 1, recipient: 1, pvno: 1, messageTime: 1, senderKID: 1, recipKID: 1,
   transactionID: 1, senderNonce: 1, recipNonce: 1, freeText: 1, generalInfo: 1,
 };
-var KNOWN_BODY_KEYS = {
+var KNOWN_BODY_KEYS = intrinsic.assign(intrinsic.create(null), {
   ir: 1, cr: 1, kur: 1, krr: 1, ccr: 1, p10cr: 1, certConf: 1, pollReq: 1, genm: 1, rr: 1,
   ip: 1, cp: 1, kup: 1, ccp: 1, krp: 1, rp: 1, genp: 1, error: 1, pollRep: 1, pkiconf: 1,
   nested: 1,
-};
-var BODY_TAG = {
+});
+var BODY_TAG = intrinsic.assign(intrinsic.create(null), {
   ir: 0, cr: 2, p10cr: 4, kur: 7, krr: 9, ccr: 13, rr: 11, genm: 21, certConf: 24, pollReq: 25,
   ip: 1, cp: 3, kup: 8, krp: 10, rp: 12, ccp: 14, pkiconf: 19, genp: 22, error: 23, pollRep: 26,
   nested: 20,
-};
-var CRMF_BODY = { ir: 1, cr: 1, kur: 1, krr: 1, ccr: 1 };
-var CERT_REP_ARM = { ip: 1, cp: 1, kup: 1, ccp: 1 };
+});
+var CRMF_BODY = intrinsic.assign(intrinsic.create(null), { ir: 1, cr: 1, kur: 1, krr: 1, ccr: 1 });
+var CERT_REP_ARM = intrinsic.assign(intrinsic.create(null), { ip: 1, cp: 1, kup: 1, ccp: 1 });
 var KNOWN_OPTS_KEYS = { key: 1, cert: 1, mac: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 };
 var KNOWN_OPTS_SIG_KEYS = { key: 1, cert: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 };
 var KNOWN_OPTS_MAC_KEYS = { mac: 1, extraCerts: 1, pem: 1 };
@@ -100,17 +100,17 @@ var PBMAC1_DEFAULT_KEYLEN = 32;
 var PBMAC1_MIN_KEYLEN = 20;
 var PBMAC1_MAX_KEYLEN = 1024;
 var PBMAC1_MIN_ITER = 1000;
-var PBMAC1_PRF = { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" };
-var PBMAC1_MAC_OID = { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" };
+var PBMAC1_PRF = intrinsic.assign(intrinsic.create(null), { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" });
+var PBMAC1_MAC_OID = intrinsic.assign(intrinsic.create(null), { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" });
 var PBMAC1_PRF_HLEN = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
 var FAIL_INFO_NAMES = ["badAlg", "badMessageCheck", "badRequest", "badTime", "badCertId", "badDataFormat",
   "wrongAuthority", "incorrectData", "missingTimeStamp", "badPOP", "certRevoked", "certConfirmed",
   "wrongIntegrity", "badRecipientNonce", "timeNotAvailable", "unacceptedPolicy", "unacceptedExtension",
   "addInfoNotAvailable", "badSenderNonce", "badCertTemplate", "signerNotTrusted", "transactionIdInUse",
   "unsupportedVersion", "notAuthorized", "systemUnavail", "systemFailure", "duplicateCertReq"];
-var FAIL_INFO_INDEX = {};
+var FAIL_INFO_INDEX = intrinsic.create(null);
 FAIL_INFO_NAMES.forEach(function (n, i) { FAIL_INFO_INDEX[n] = i; });
-var CERT_CONF_HASH_ALGS = { sha1: 1, sha256: 1, sha384: 1, sha512: 1, "sha3-256": 1, "sha3-512": 1 };
+var CERT_CONF_HASH_ALGS = intrinsic.assign(intrinsic.create(null), { sha1: 1, sha256: 1, sha384: 1, sha512: 1, "sha3-256": 1, "sha3-512": 1 });
 
 
 function _reqOctets(v, what) {

package/lib/cms-encrypt.js

@@ -34,14 +34,14 @@ function _normCertDer(cert, what) {
   throw _err("cms/bad-input", (what || "a certificate") + " must be a DER Buffer, Uint8Array, or PEM string");
 }
 
-var CONTENT_ALGS = {
+var CONTENT_ALGS = intrinsic.assign(intrinsic.create(null), {
   "aes-128-gcm": { oid: "aes128-GCM", keyBits: 128, aead: true },
   "aes-192-gcm": { oid: "aes192-GCM", keyBits: 192, aead: true },
   "aes-256-gcm": { oid: "aes256-GCM", keyBits: 256, aead: true },
   "aes-128-cbc": { oid: "aes128-CBC", keyBits: 128, aead: false },
   "aes-192-cbc": { oid: "aes192-CBC", keyBits: 192, aead: false },
   "aes-256-cbc": { oid: "aes256-CBC", keyBits: 256, aead: false },
-};
+});
 
 function _wrapOidForKek(keyBytes) {
   if (keyBytes === 16) return "aes128-wrap";
@@ -83,7 +83,7 @@ function _assertKeyUsage(cert, bitName, arm) {
   if (ku && ku[bitName] !== true) throw _err("cms/bad-key-usage", "the " + arm + " recipient certificate's keyUsage does not assert " + bitName);
 }
 
-var OAEP_HASH = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
+var OAEP_HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 function _oaepParams(hashName) {
   var hAlg = _algId(hashName, "null");
   var mgf = b.sequence([b.oid(O("mgf1")), hAlg]);
@@ -282,7 +282,7 @@ function _pwriWrapIv(kek, cek, iv) {
   }
 }
 
-var PRF_HASH = { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" };
+var PRF_HASH = intrinsic.assign(intrinsic.create(null), { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" });
 function _prfHash(prf) { if (!PRF_HASH[prf]) throw _err("cms/bad-input", "unsupported pwri prf " + JSON.stringify(prf)); return PRF_HASH[prf]; }
 
 var _PWRI_KEYS = { password: 1, iterations: 1, prf: 1, salt: 1 };
@@ -557,13 +557,13 @@ function _tlvHeaderLen(der) {
 }
 
 
-var MAC_ALGS = {
+var MAC_ALGS = intrinsic.assign(intrinsic.create(null), {
   "hmac-sha256": { oid: "hmacWithSHA256", wc: "SHA-256", node: "sha256" },
   "hmac-sha384": { oid: "hmacWithSHA384", wc: "SHA-384", node: "sha384" },
   "hmac-sha512": { oid: "hmacWithSHA512", wc: "SHA-512", node: "sha512" },
-};
+});
 var MAC_KEY_OCTETS = 32;
-var SUPPORTED_DIGEST = { sha256: 1, sha384: 1, sha512: 1 };
+var SUPPORTED_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: 1, sha384: 1, sha512: 1 });
 
 async function authenticate(content, recipients, opts) {
   opts = opts || {};

package/lib/key.js

@@ -36,7 +36,7 @@ var PemError = frameworkError.PemError;
 function O(n) { return oid.byName(n); }
 function _err(code, msg, cause) { return new KeyError(code, msg, cause); }
 
-var CIPHER_NAME = { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" };
+var CIPHER_NAME = Object.assign(Object.create(null), { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" });
 
 var INFER_ALG = {};
 ["Ed25519", "Ed448", "X25519", "X448"].forEach(function (n) { INFER_ALG[O(n)] = { name: n }; });

package/lib/lint.js

@@ -44,7 +44,7 @@ var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 
 
 
-var SEVERITY = { fatal: 5, error: 4, warn: 3, notice: 2, pass: 1 };
+var SEVERITY = Object.assign(Object.create(null), { fatal: 5, error: 4, warn: 3, notice: 2, pass: 1 });
 var VALID_SEVERITY = Object.keys(SEVERITY);
 
 function _worst(findings) {
@@ -191,7 +191,7 @@ function _rsaModulusBits(spki) {
     return mod.toString(2).length;
   } catch (_e) { return null; }
 }
-var RSA_KEY_ALGS = { rsaEncryption: 1, rsassaPss: 1, rsaesOaep: 1 };
+var RSA_KEY_ALGS = Object.assign(Object.create(null), { rsaEncryption: 1, rsassaPss: 1, rsaesOaep: 1 });
 var APPROVED_EC_CURVES = ["prime256v1", "secp384r1", "secp521r1"];
 function _ecCurveName(spki) {
   try {
@@ -476,7 +476,7 @@ var CABF_TLS_RULES = [
   },
 ];
 
-var ML_KEM_EK_LEN = {};
+var ML_KEM_EK_LEN = Object.create(null);
 ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { ML_KEM_EK_LEN[n] = oid.kemParams(n).ek; });
 function _isMlKem(cert) {
   var spki = cert.subjectPublicKeyInfo;
@@ -510,11 +510,11 @@ var RFC9935_RULES = [
   },
 ];
 
-var PROFILES = {
+var PROFILES = Object.assign(Object.create(null), {
   "rfc5280": RFC5280_RULES,
   "rfc9935": RFC9935_RULES,
   "cabf-tls": CABF_TLS_RULES,
-};
+});
 var ALL_RULES = RFC5280_RULES.concat(RFC9935_RULES).concat(CABF_TLS_RULES);
 
 function _selectRules(profile) {

package/lib/pbes2.js

@@ -13,7 +13,7 @@ var C = require("./constants");
 var b = asn1.build;
 function O(n) { return oid.byName(n); }
 
-var PRF_NODE_BY_NAME = { hmacWithSHA1: "sha1", hmacWithSHA256: "sha256", hmacWithSHA384: "sha384", hmacWithSHA512: "sha512" };
+var PRF_NODE_BY_NAME = Object.assign(Object.create(null), { hmacWithSHA1: "sha1", hmacWithSHA256: "sha256", hmacWithSHA384: "sha384", hmacWithSHA512: "sha512" });
 var PRF_NODE_BY_OID = {}; Object.keys(PRF_NODE_BY_NAME).forEach(function (n) { PRF_NODE_BY_OID[O(n)] = PRF_NODE_BY_NAME[n]; });
 
 var CONTENT_KEYBITS = {}, CONTENT_MODE = {};

package/lib/pkcs12-build.js

@@ -51,18 +51,18 @@ var MAX_PBMAC1_KEYLEN = 1024;
 var CLASSIC_MAC_MAX_ITERATIONS = 1000000;
 var KDF_MAX_ROUNDS = CLASSIC_MAC_MAX_ITERATIONS;
 
-var P12_KDF_UV = {
+var P12_KDF_UV = intrinsic.assign(intrinsic.create(null), {
   sha1: { u: 20, v: 64 }, sha224: { u: 28, v: 64 }, sha256: { u: 32, v: 64 },
   sha384: { u: 48, v: 128 }, sha512: { u: 64, v: 128 },
-};
-var PBMAC1_PRF = {
+});
+var PBMAC1_PRF = intrinsic.assign(intrinsic.create(null), {
   sha256: { prfName: "hmacWithSHA256", wc: "SHA-256", keyLen: 32 },
   sha384: { prfName: "hmacWithSHA384", wc: "SHA-384", keyLen: 48 },
   sha512: { prfName: "hmacWithSHA512", wc: "SHA-512", keyLen: 64 },
-};
-var PRF_WC = { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" };
-var CIPHER_NAME = { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" };
-var DIGEST_NAME = { sha1: "sha1", sha256: "sha256", sha384: "sha384", sha512: "sha512" };
+});
+var PRF_WC = intrinsic.assign(intrinsic.create(null), { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" });
+var CIPHER_NAME = intrinsic.assign(intrinsic.create(null), { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" });
+var DIGEST_NAME = intrinsic.assign(intrinsic.create(null), { sha1: "sha1", sha256: "sha256", sha384: "sha384", sha512: "sha512" });
 
 
 
@@ -77,14 +77,14 @@ var _BUILD_OPTS_SHORTHAND = { integrity: 1, mac: 1, password: 1, pem: 1, recipie
 var _SAFE_RECIPIENTS_KEYS = { bags: 1, recipients: 1, contentEncryptionAlgorithm: 1 };
 var _SAFE_PASSWORD_KEYS = { bags: 1, encrypt: 1 };
 var _SAFE_PLAINTEXT_KEYS = { bags: 1 };
-var _BAG_KEYS_BY_TYPE = {
+var _BAG_KEYS_BY_TYPE = intrinsic.assign(intrinsic.create(null), {
   key:          { type: 1, friendlyName: 1, localKeyId: 1, key: 1 },
   shroudedKey:  { type: 1, friendlyName: 1, localKeyId: 1, key: 1, encrypt: 1 },
   cert:         { type: 1, friendlyName: 1, localKeyId: 1, cert: 1 },
   crl:          { type: 1, friendlyName: 1, localKeyId: 1, crl: 1 },
   secret:       { type: 1, friendlyName: 1, localKeyId: 1, secretTypeId: 1, secretValue: 1 },
   safeContents: { type: 1, friendlyName: 1, localKeyId: 1, nested: 1 },
-};
+});
 var _ENCRYPT_KEYS = { password: 1, cipher: 1, salt: 1, iterations: 1, prf: 1 };
 var _MAC_KEYS = { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 };
 var _MAC_KEYS_HMAC = { algorithm: 1, hash: 1, salt: 1, iterations: 1, password: 1 };

package/lib/scep.js

@@ -16,8 +16,8 @@
  *   outer SignedData that signs it under a set of authenticated transaction
  *   attributes -- messageType, transactionID, pkiStatus, failInfo, and the
  *   sender/recipient nonces (RFC 8894 sec. 3). `pki.scep.build` assembles a
- *   request pkiMessage (PKCSReq, RenewalReq, CertPoll, GetCert, or GetCRL);
- *   `pki.scep.parse` verifies the
+ *   request pkiMessage (PKCSReq, RenewalReq, CertPoll, GetCert, or GetCRL) or a
+ *   CA-side CertRep response; `pki.scep.parse` verifies the
  *   outer signature, reads the transaction attributes BOUND to the verified
  *   signer, and (given the recipient key) decrypts the pkcsPKIEnvelope to the
  *   messageData.
@@ -29,10 +29,10 @@
  *   pki.transport separately.
  *
  * @card
- *   Build and read SCEP (RFC 8894) client messages: a PKCSReq, RenewalReq,
- *   CertPoll, GetCert, or GetCRL request wrapped in the signed-over-encrypted CMS
- *   layering, and any of those or a CertRep parsed back to its verified transaction
- *   attributes and decrypted messageData.
+ *   Build and read SCEP (RFC 8894) messages: a PKCSReq, RenewalReq, CertPoll,
+ *   GetCert, or GetCRL request, or a CA-side CertRep response, wrapped in the
+ *   signed-over-encrypted CMS layering, and any of them parsed back to its verified
+ *   transaction attributes and decrypted messageData.
  */
 
 var frameworkError = require("./framework-error");
@@ -63,14 +63,14 @@ function _err(code, msg, cause) { return new ScepError(code, msg, cause); }
 
 var _KU_NS = pkix.makeNS("scep", ScepError, oid);
 
-var MESSAGE_TYPE = { CertRep: "3", RenewalReq: "17", PKCSReq: "19", CertPoll: "20", GetCert: "21", GetCRL: "22" };
-var PKI_STATUS = { SUCCESS: "0", FAILURE: "2", PENDING: "3" };
-var FAIL_INFO = { badAlg: "0", badMessageCheck: "1", badRequest: "2", badTime: "3", badCertId: "4" };
+var MESSAGE_TYPE = Object.assign(Object.create(null), { CertRep: "3", RenewalReq: "17", PKCSReq: "19", CertPoll: "20", GetCert: "21", GetCRL: "22" });
+var PKI_STATUS = Object.assign(Object.create(null), { SUCCESS: "0", FAILURE: "2", PENDING: "3" });
+var FAIL_INFO = Object.assign(Object.create(null), { badAlg: "0", badMessageCheck: "1", badRequest: "2", badTime: "3", badCertId: "4" });
 
 function _invert(table) { var o = Object.create(null); for (var k in table) if (Object.prototype.hasOwnProperty.call(table, k)) o[table[k]] = k; return o; }
 var MESSAGE_TYPE_BY_CODE = _invert(MESSAGE_TYPE), PKI_STATUS_BY_CODE = _invert(PKI_STATUS), FAIL_INFO_BY_CODE = _invert(FAIL_INFO);
 
-var _PARSE_SUPPORTED = { PKCSReq: 1, RenewalReq: 1, CertRep: 1, CertPoll: 1, GetCert: 1, GetCRL: 1 };
+var _PARSE_SUPPORTED = Object.assign(Object.create(null), { PKCSReq: 1, RenewalReq: 1, CertRep: 1, CertPoll: 1, GetCert: 1, GetCRL: 1 });
 
 var ENVELOPE_CIPHER = "aes-128-cbc";
 
@@ -225,16 +225,26 @@ function _captureRecipientKey(rk) {
  * CA-issued certificate instead, which is why this is the caller's choice rather than an enforced
  * match. The proof-of-possession over the PKCS#10 itself is verified regardless.
  *
+ * A `CertRep` response is the CA (responder) side: it carries the transaction `pkiStatus`, echoes the
+ * request's senderNonce as `recipientNonce`, and is signed under the CA's `signer`. A SUCCESS response
+ * envelopes a certs-only SignedData of the issued `certificates` (or the `crls` of a GetCRL response) to
+ * the requester's `recipient` certificate; a FAILURE (which carries a `failInfo`) or a PENDING response
+ * omits the pkcsPKIEnvelope and is signed detached (RFC 8894 sec. 3.3.2).
+ *
  * @opts
- *   - `messageType` -- "PKCSReq" | "RenewalReq" | "CertPoll" | "GetCert" | "GetCRL".
+ *   - `messageType` -- "PKCSReq" | "RenewalReq" | "CertPoll" | "GetCert" | "GetCRL" | "CertRep".
  *   - `messageData` -- the PKCS#10 CertificationRequest DER, for a PKCSReq or RenewalReq.
  *   - `requestSubject` -- the request subject Name DER, for a CertPoll.
  *   - `certificate` -- for a GetCert or GetCRL, the certificate DER whose issuer and serial name the target (the convenience form).
  *   - `issuer` / `serialNumber` -- for a GetCert or GetCRL, the issuer Name DER and a positive serial (a BigInt, number, or hex string) naming the target directly. For a CertPoll, `issuer` alone names the issuing CA (defaulting to the recipient's subject) when the request is encrypted to a separate RA.
- *   - `recipient` -- the CA (or RA) certificate DER the messageData is encrypted to (an RSA key-transport certificate; a non-RSA recipient is refused, since the envelope uses RSAES-OAEP).
- *   - `signer` -- `{ cert, key }`, the outer SignedData signer (the client for a request).
- *   - `transactionId` -- a caller-unique PrintableString identifying the transaction.
+ *   - `recipient` -- the certificate DER the pkcsPKIEnvelope is encrypted to (an RSA key-transport certificate; a non-RSA recipient is refused, since the envelope uses RSAES-OAEP): the CA or RA certificate for a request, the requester's certificate for a SUCCESS CertRep.
+ *   - `signer` -- `{ cert, key }`, the outer SignedData signer (the client for a request, the CA for a CertRep).
+ *   - `transactionId` -- a caller-unique PrintableString identifying the transaction (echoes the request's on a CertRep).
  *   - `senderNonce` -- a 16-byte Buffer (generated when omitted).
+ *   - `pkiStatus` -- for a CertRep, "SUCCESS" | "FAILURE" | "PENDING".
+ *   - `recipientNonce` -- for a CertRep, the 16-byte value echoing the request's senderNonce (required).
+ *   - `certificates` / `crls` -- for a SUCCESS CertRep, arrays of the issued certificate DER (or CRL DER) the certs-only SignedData carries.
+ *   - `failInfo` / `failInfoText` -- for a FAILURE CertRep, the failInfo (badAlg / badMessageCheck / badRequest / badTime / badCertId) and an optional detail string.
  * @example
  *   // requires: csrDer -- the PKCS#10 CertificationRequest DER to enrol
  *   // requires: caCertDer -- the SCEP CA (or RA) certificate the request is encrypted to (keyEncipherment)
@@ -246,11 +256,15 @@ function _captureRecipientKey(rk) {
  */
 async function build(spec) {
   spec = guard.identifier.optionsObject(spec, _err, "scep/bad-input", "pki.scep.build spec");
-  guard.identifier.assertKnownKeys(spec, _BUILD_KEYS, _err, "scep/bad-input", "pki.scep.build has an unknown option: ");
   var mtCode = MESSAGE_TYPE[spec.messageType];
   if (mtCode == null) throw _err("scep/bad-message-type", "unknown messageType " + JSON.stringify(spec.messageType) + " (RFC 8894 sec. 3.2.1.2)");
+  if (spec.messageType === "CertRep") {
+    guard.identifier.assertKnownKeys(spec, _CERTREP_KEYS, _err, "scep/bad-input", "pki.scep.build (CertRep) has an unknown option: ");
+    return await _buildCertRep(spec);
+  }
+  guard.identifier.assertKnownKeys(spec, _REQUEST_KEYS, _err, "scep/bad-input", "pki.scep.build has an unknown option: ");
   if (spec.messageType !== "PKCSReq" && spec.messageType !== "RenewalReq" && spec.messageType !== "CertPoll" && spec.messageType !== "GetCert" && spec.messageType !== "GetCRL") {
-    throw _err("scep/bad-message-type", "pki.scep.build issues a request (PKCSReq / RenewalReq / CertPoll / GetCert / GetCRL); " + spec.messageType + " is not built in this release");
+    throw _err("scep/bad-message-type", "pki.scep.build issues a request (PKCSReq / RenewalReq / CertPoll / GetCert / GetCRL) or a CertRep response; " + spec.messageType + " is not built in this release");
   }
   if (spec.signer == null || typeof spec.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
   var senderNonce = _nonce(spec.senderNonce, "senderNonce");
@@ -293,7 +307,69 @@ async function build(spec) {
     throw e;
   }
 }
-var _BUILD_KEYS = { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, certificate: 1, serialNumber: 1, signer: 1, transactionId: 1, senderNonce: 1 };
+var _REQUEST_KEYS = { messageType: 1, messageData: 1, recipient: 1, requestSubject: 1, issuer: 1, certificate: 1, serialNumber: 1, signer: 1, transactionId: 1, senderNonce: 1 };
+var _CERTREP_KEYS = { messageType: 1, signer: 1, transactionId: 1, senderNonce: 1, pkiStatus: 1, recipientNonce: 1, certificates: 1, crls: 1, recipient: 1, failInfo: 1, failInfoText: 1 };
+
+async function _buildCertRep(spec) {
+  if (spec.signer == null || typeof spec.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
+  if (typeof spec.pkiStatus !== "string") throw _err("scep/bad-input", "a CertRep pkiStatus must be SUCCESS, FAILURE, or PENDING (RFC 8894 sec. 3.2.1.3), got " + JSON.stringify(spec.pkiStatus));
+  var statusCode = PKI_STATUS[spec.pkiStatus];
+  if (statusCode == null) throw _err("scep/bad-input", "a CertRep pkiStatus must be SUCCESS, FAILURE, or PENDING (RFC 8894 sec. 3.2.1.3), got " + JSON.stringify(spec.pkiStatus));
+  var txnId = _transactionId(spec.transactionId);
+  if (spec.recipientNonce == null) throw _err("scep/bad-input", "a CertRep must echo the request's senderNonce as recipientNonce (RFC 8894 sec. 3.2.1.5)");
+  var recipientNonce = _nonce(spec.recipientNonce, "recipientNonce");
+  var senderNonce = _nonce(spec.senderNonce, "senderNonce");
+  var signerCert = guard.bytes.snapshotSource(spec.signer.cert, ScepError, "scep/bad-input", "signer.cert");
+  var signerKey = spec.signer.key;
+  _assertSigningKeyUsage(signerCert, "signer certificate");
+  var attrs = [
+    _attr("scepMessageType", b.printable(MESSAGE_TYPE.CertRep)),
+    _attr("scepTransactionId", b.printable(txnId)),
+    _attr("scepSenderNonce", b.octetString(senderNonce)),
+    _attr("scepPkiStatus", b.printable(statusCode)),
+    _attr("scepRecipientNonce", b.octetString(recipientNonce)),
+  ];
+  if (spec.pkiStatus !== "FAILURE" && (spec.failInfo != null || spec.failInfoText != null)) {
+    throw _err("scep/bad-input", "failInfo and failInfoText are only valid on a FAILURE CertRep (RFC 8894 sec. 3.2.1.4)");
+  }
+  var content = null;
+  if (spec.pkiStatus === "SUCCESS") {
+    var certs = spec.certificates != null ? spec.certificates : [];
+    var crls = spec.crls != null ? spec.crls : [];
+    if (!Array.isArray(certs) || !Array.isArray(crls)) throw _err("scep/bad-input", "a CertRep certificates and crls must be arrays of certificate / CRL DER");
+    if (certs.length === 0 && crls.length === 0) throw _err("scep/bad-input", "a SUCCESS CertRep must carry at least one certificate or CRL (RFC 8894 sec. 3.3.2.1)");
+    if (spec.recipient == null) throw _err("scep/bad-input", "a SUCCESS CertRep needs a recipient certificate to encrypt the pkcsPKIEnvelope to (RFC 8894 sec. 3.2.2)");
+    var recipient = guard.bytes.snapshotSource(spec.recipient, ScepError, "scep/bad-input", "recipient");
+    _assertRsaRecipient(recipient);
+    var certsOnlyDer;
+    try { certsOnlyDer = cmsSign.certsOnly(certs, { crls: crls }); }
+    catch (e) { throw _err("scep/bad-input", "a SUCCESS CertRep certificates / crls must be valid certificate / CRL DER (RFC 8894 sec. 3.4): " + e.message, e); }
+    try { content = await cmsEncrypt.encrypt(certsOnlyDer, [{ cert: recipient }], { contentEncryptionAlgorithm: ENVELOPE_CIPHER }); }
+    catch (e) {
+      if (e && e.isPkiError) throw _err("scep/bad-input", "the SUCCESS CertRep pkcsPKIEnvelope could not be built (the recipient must be a keyEncipherment certificate): " + e.message, e);
+      throw e;
+    }
+  } else {
+    if (spec.certificates != null || spec.crls != null || spec.recipient != null) {
+      throw _err("scep/bad-input", "a " + spec.pkiStatus + " CertRep must omit certificates, crls, and recipient: the pkcsPKIEnvelope is omitted (RFC 8894 sec. 3.3.2." + (spec.pkiStatus === "FAILURE" ? "2" : "3") + ")");
+    }
+    if (spec.pkiStatus === "FAILURE") {
+      var failCode = FAIL_INFO[spec.failInfo];
+      if (failCode == null) throw _err("scep/bad-input", "a FAILURE CertRep must carry a failInfo of badAlg / badMessageCheck / badRequest / badTime / badCertId (RFC 8894 sec. 3.2.1.4), got " + JSON.stringify(spec.failInfo));
+      attrs.push(_attr("scepFailInfo", b.printable(failCode)));
+      if (spec.failInfoText != null) attrs.push(_attr("scepFailInfoText", b.utf8(String(spec.failInfoText))));
+    }
+  }
+  var signOpts = { additionalSignedAttributes: attrs };
+  var signContent = content;
+  if (content == null) { signContent = Buffer.alloc(0); signOpts.detached = true; }
+  try {
+    return await cmsSign.sign(signContent, { cert: signerCert, key: signerKey }, signOpts);
+  } catch (e) {
+    if (e && e.isPkiError) throw _err("scep/bad-input", "the CertRep could not be signed: " + e.message, e);
+    throw e;
+  }
+}
 
 function _buildIssuerAndSubject(recipientCertDer, requestSubjectSource, issuerOverride) {
   var subject = guard.bytes.snapshotSource(requestSubjectSource, ScepError, "scep/bad-input", "requestSubject");

package/lib/schema-c509.js

@@ -47,7 +47,7 @@ var PK_ALG_BY_INT = {
   2: { alg: _name("ecPublicKey"), curve: _name("secp384r1") },
   3: { alg: _name("ecPublicKey"), curve: _name("secp521r1") },
 };
-var EC_FIELD_BYTES = { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 };
+var EC_FIELD_BYTES = Object.assign(Object.create(null), { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 });
 
 var ATTR_BY_INT = {
   0: _name("emailAddress"),
@@ -87,14 +87,14 @@ var EXT_BY_INT = {
   36: _name("ocspNoCheck"),
   38: _name("tlsFeature"),
 };
-var EXT_COMPACT = {
+var EXT_COMPACT = Object.assign(Object.create(null), {
   subjectKeyIdentifier: 1, keyUsage: 1, basicConstraints: 1, authorityKeyIdentifier: 1,
   extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
   subjectAltName: 1, issuerAltName: 1, nameConstraints: 1, cRLDistributionPoints: 1,
   freshestCRL: 1, authorityInfoAccess: 1, subjectInfoAccess: 1, certificatePolicies: 1,
   policyMappings: 1, policyConstraints: 1, subjectDirectoryAttributes: 1,
   ipAddrBlocks: 1, autonomousSysIds: 1, ipAddrBlocksV2: 1, autonomousSysIdsV2: 1,
-};
+});
 var EKU_BY_INT = {
   0: _name("anyExtendedKeyUsage"), 1: _name("serverAuth"), 2: _name("clientAuth"),
   3: _name("codeSigning"), 4: _name("emailProtection"), 8: _name("timeStamping"), 9: _name("ocspSigning"),
@@ -1561,11 +1561,11 @@ function matches(node) {
 }
 
 
-var SIG_ALG_TO_INT = { ecdsaWithSHA256: 0, ecdsaWithSHA384: 1, ecdsaWithSHA512: 2 };
-var PK_ALG_TO_INT = { rsaEncryption: 0, "ecPublicKey|prime256v1": 1, "ecPublicKey|secp384r1": 2, "ecPublicKey|secp521r1": 3 };
-var ATTR_TO_INT = {};
+var SIG_ALG_TO_INT = Object.assign(Object.create(null), { ecdsaWithSHA256: 0, ecdsaWithSHA384: 1, ecdsaWithSHA512: 2 });
+var PK_ALG_TO_INT = Object.assign(Object.create(null), { rsaEncryption: 0, "ecPublicKey|prime256v1": 1, "ecPublicKey|secp384r1": 2, "ecPublicKey|secp521r1": 3 });
+var ATTR_TO_INT = Object.create(null);
 Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_TO_INT[ATTR_BY_INT[k]] = Number(k); });
-var EXT_TO_INT = {};
+var EXT_TO_INT = Object.create(null);
 Object.keys(EXT_BY_INT).forEach(function (k) { if (EXT_COMPACT[EXT_BY_INT[k]]) EXT_TO_INT[EXT_BY_INT[k]] = Number(k); });
 
 function _minBytes(n) {
@@ -1754,9 +1754,9 @@ function _keyUsageBitsFromDer(extnValue) {
   return _namedBitsFromContent(bs.bytes, bs.unusedBits);
 }
 var _NO_EXPIRY = Date.UTC(9999, 11, 31, 23, 59, 59);
-var NODE_TO_WEBCRYPTO = { "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521" };
-var WEBCRYPTO_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
-var SIG_ALG_TO_CURVE = { "ecdsaWithSHA256": "P-256", "ecdsaWithSHA384": "P-384", "ecdsaWithSHA512": "P-521" };
+var NODE_TO_WEBCRYPTO = Object.assign(Object.create(null), { "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521" });
+var WEBCRYPTO_FIELD_BYTES = Object.assign(Object.create(null), { "P-256": 32, "P-384": 48, "P-521": 66 });
+var SIG_ALG_TO_CURVE = Object.assign(Object.create(null), { "ecdsaWithSHA256": "P-256", "ecdsaWithSHA384": "P-384", "ecdsaWithSHA512": "P-521" });
 function _magBytes(intNode) {
   var c = intNode.content, i = 0;
   while (i < c.length - 1 && c[i] === 0x00) i++;

package/lib/sign-scheme.js

@@ -24,8 +24,8 @@ var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
 var _isU8 = intrinsic.types.isUint8Array;
 
-var HASH = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
-var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" };
+var HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
+var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" });
 var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
 var ECDSA_ALG = { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" };
 var RSA_PKCS1_SIG = { sha256: "sha256WithRSAEncryption", sha384: "sha384WithRSAEncryption", sha512: "sha512WithRSAEncryption" };

package/lib/tsp-sign.js

@@ -47,7 +47,7 @@ var _b = pkiBuild.makeBuilder({
   NAME_SCHEMA: pkix.name(_NS), SPKI_SCHEMA: pkix.spki(_NS),
 });
 
-var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
+var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512" });
 var HASH_LEN = { sha256: 32, sha384: 48, sha512: 64 };
 
 var _REVOCATION_RANK = { "false": 0, "undetermined": 1, "waived": 2, "determined": 3 };
@@ -397,9 +397,9 @@ function response(token, opts) {
 function parseResponse(input) { return schemaTsp.parse(input); }
 
 
-var _VERIFY_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", sha1: "sha1" };
-var _VERIFY_DIGEST_LEN = { sha1: 20, sha256: 32, sha384: 48, sha512: 64 };
-var _BIND_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
+var _VERIFY_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", sha1: "sha1" });
+var _VERIFY_DIGEST_LEN = intrinsic.assign(intrinsic.create(null), { sha1: 20, sha256: 32, sha384: 48, sha512: 64 });
+var _BIND_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512" });
 
 function _imprintMatches(mi, data) {
   var name = mi.hashAlgorithm && mi.hashAlgorithm.name;

package/lib/webcrypto.js

@@ -122,7 +122,7 @@ function _normalizeAlg(algorithm, who) {
   return out;
 }
 
-var _STD_ALG_NAME = { "RSASSA-PKCS1-V1_5": "RSASSA-PKCS1-v1_5", "ED25519": "Ed25519", "ED448": "Ed448" };
+var _STD_ALG_NAME = intrinsic.assign(intrinsic.create(null), { "RSASSA-PKCS1-V1_5": "RSASSA-PKCS1-v1_5", "ED25519": "Ed25519", "ED448": "Ed448" });
 function _stdName(name) { return _STD_ALG_NAME[name] || name; }
 
 var HASH_NODE = {
@@ -164,24 +164,24 @@ function _hmacLengthBits(alg, who) {
   return alg.length;
 }
 
-var CURVE_NODE = { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" };
-var CURVE_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
+var CURVE_NODE = intrinsic.assign(intrinsic.create(null), { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" });
+var CURVE_FIELD_BYTES = intrinsic.assign(intrinsic.create(null), { "P-256": 32, "P-384": 48, "P-521": 66 });
 
-var ML_DSA_NODE = { "ML-DSA-44": "ml-dsa-44", "ML-DSA-65": "ml-dsa-65", "ML-DSA-87": "ml-dsa-87" };
-var ML_KEM_NODE = { "ML-KEM-512": "ml-kem-512", "ML-KEM-768": "ml-kem-768", "ML-KEM-1024": "ml-kem-1024" };
+var ML_DSA_NODE = intrinsic.assign(intrinsic.create(null), { "ML-DSA-44": "ml-dsa-44", "ML-DSA-65": "ml-dsa-65", "ML-DSA-87": "ml-dsa-87" });
+var ML_KEM_NODE = intrinsic.assign(intrinsic.create(null), { "ML-KEM-512": "ml-kem-512", "ML-KEM-768": "ml-kem-768", "ML-KEM-1024": "ml-kem-1024" });
 
-var SLH_DSA_NODE = {};
+var SLH_DSA_NODE = intrinsic.create(null);
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
 ].forEach(function (s) { SLH_DSA_NODE["SLH-DSA-" + _toUpperCase(s)] = "slh-dsa-" + s; });
 
-var SIGN_VERIFY_NAMES = {};
+var SIGN_VERIFY_NAMES = intrinsic.create(null);
 ["RSASSA-PKCS1-V1_5", "RSA-PSS", "ECDSA", "ED25519", "ED448", "HMAC"]
   .concat(_keys(ML_DSA_NODE), _keys(SLH_DSA_NODE))
   .forEach(function (n) { SIGN_VERIFY_NAMES[n] = true; });
-var ENCRYPT_DECRYPT_NAMES = { "RSA-OAEP": true, "AES-GCM": true, "AES-CBC": true, "AES-CTR": true };
-var DERIVE_NAMES = { "ECDH": true, "X25519": true, "X448": true, "HKDF": true, "PBKDF2": true, "X963KDF": true };
-var SECRET_KEY_NAMES = { "AES-GCM": true, "AES-CBC": true, "AES-CTR": true, "AES-KW": true, "HMAC": true, "HKDF": true, "PBKDF2": true, "X963KDF": true };
+var ENCRYPT_DECRYPT_NAMES = intrinsic.assign(intrinsic.create(null), { "RSA-OAEP": true, "AES-GCM": true, "AES-CBC": true, "AES-CTR": true });
+var DERIVE_NAMES = intrinsic.assign(intrinsic.create(null), { "ECDH": true, "X25519": true, "X448": true, "HKDF": true, "PBKDF2": true, "X963KDF": true });
+var SECRET_KEY_NAMES = intrinsic.assign(intrinsic.create(null), { "AES-GCM": true, "AES-CBC": true, "AES-CTR": true, "AES-KW": true, "HMAC": true, "HKDF": true, "PBKDF2": true, "X963KDF": true });
 
 
 /**
@@ -974,12 +974,12 @@ function _importRawPublic(name, alg, raw, extractable, usages) {
   throw new WebCryptoError("webcrypto/not-supported", "importKey raw: unsupported public-key algorithm " + _stringify(name));
 }
 
-var IMPORT_KEY_TYPE = {
+var IMPORT_KEY_TYPE = intrinsic.assign(intrinsic.create(null), {
   "RSASSA-PKCS1-V1_5": { rsa: 1 }, "RSA-PSS": { rsa: 1, "rsa-pss": 1 }, "RSA-OAEP": { rsa: 1 },
   "ECDSA": { ec: 1 }, "ECDH": { ec: 1 },
   "ED25519": { ed25519: 1 }, "ED448": { ed448: 1 },
   "X25519": { x25519: 1 }, "X448": { x448: 1 },
-};
+});
 [ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE].forEach(function (m) {
   _forEach(_keys(m), function (webName) { var t = {}; t[m[webName]] = 1; IMPORT_KEY_TYPE[webName] = t; });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.18",
+  "version": "0.6.21",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:12f32901-e931-42b5-b817-2f304d987943",
+  "serialNumber": "urn:uuid:ba3e8f6b-69f8-4691-b5ee-3d227fe61113",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-01T15:21:55.160Z",
+    "timestamp": "2026-09-01T20:36:49.754Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.18",
+      "bom-ref": "@blamejs/pki@0.6.21",
       "type": "application",
       "name": "pki",
-      "version": "0.6.18",
+      "version": "0.6.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.18",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.18",
+      "ref": "@blamejs/pki@0.6.21",
       "dependsOn": []
     }
   ]