@blamejs/pki 0.6.33 → 0.6.34

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.34 — 2026-09-04
+
+An injected transport that does not return a promise is reported as a typed option error naming the option, in every client that accepts one.
+
+### Changed
+
+- pki.est, pki.acme, pki.cmp, and pki.scep reject with est/bad-input, acme/bad-input, cmp/bad-input, or scep/bad-input when opts.transport returns something that is not a promise of the response, instead of failing with a raw TypeError or a misleading response verdict. A transport returning any thenable is still accepted, and the documented signature now states the promise contract.
+
 ## v0.6.33 — 2026-09-04
 
 pki.transport reports the RFC 9266 tls-exporter channel binding of a TLS 1.3 connection, so every connection the toolkit opens now carries the binding its protocol version defines.

package/lib/acme.js

@@ -1763,7 +1763,7 @@ function _parseLinkNext(headers, base) { var m = _parseLinkRelation(headers, bas
  *
  * @opts
  *   - `accountKey` / `accountJwk` / `alg` -- REQUIRED: the account private key, its public JWK, and the JWS alg.
- *   - `transport` -- injectable transport(request) -> {status, headers, body}; default pki.transport.https.
+ *   - `transport` -- injectable `transport(request) -> Promise<{status, headers, body}>`; default pki.transport.https. It must return a promise of the response; anything else is `acme/bad-input`.
  *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity } for the default transport.
  *   - `timeout` / `maxResponseBytes` / `maxRedirects` -- transport budgets; `maxNonceRetries` -- badNonce retry cap (default 1).
  *   - `proxy` -- reach the ACME server through a forward HTTP proxy (`{ url, auth?, tls? }`; see pki.transport).
@@ -1911,7 +1911,9 @@ function client(directoryUrl, opts) {
   function _send(method, url, headers, body) { return _sendFollowing(method, url, headers, body, 0); }
   function _sendFollowing(method, url, headers, body, redirects) {
     var reqHeaders = Object.assign({ "user-agent": CLIENT_USER_AGENT }, headers || {});
-    return transport({ method: method, url: url, headers: reqHeaders, body: body, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function (res) {
+    return guard.async.deferred(function () {
+      return guard.async.awaited(transport({ method: method, url: url, headers: reqHeaders, body: body, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }), E, "acme/bad-input", "opts.transport");
+    }).then(function (res) {
       res = res || {};
       var h = {};
       Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });

package/lib/cmp-build.js

@@ -809,7 +809,7 @@ function _transfer(url, message, opts) {
   });
   headers["content-type"] = PKIXCMP;
   var tls = _tlsForTransfer(opts);
-  return Promise.resolve(transport({ method: "POST", url: parsedUrl.href, headers: headers, body: der, tls: tls, proxy: proxy, timeout: timeout, maxResponseBytes: maxResponseBytes })).then(function (res) {
+  return guard.async.awaited(transport({ method: "POST", url: parsedUrl.href, headers: headers, body: der, tls: tls, proxy: proxy, timeout: timeout, maxResponseBytes: maxResponseBytes }), _err, "cmp/bad-input", "opts.transport").then(function (res) {
     res = res || {};
     var h = {};
     Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });

package/lib/cmp-session.js

@@ -285,7 +285,7 @@ function _certConfHash(certDer) {
  *   - `expectedSender` -- optional CA signer certificate (DER Buffer / PEM string / already-parsed `pki.schema.x509.parse` object); when set, every signed response's authenticated header sender MUST bind to it under the RFC 5280 sec. 7 subject-or-subjectAltName rule cmp.verify uses, so a re-encoded-but-equivalent DN and an empty-subject CA named only by a directoryName SAN both match. Given as bytes/PEM it also resolves a first response that omits its own extraCerts (a CA that assumes the client already holds its certificate). Absent, the session pins the first signed response's signer certificate and requires every later leg's sender to bind to it, rejecting a switch to a different trusted signer while permitting same-identity certificate/key rotation.
  *   - `implicitConfirm` -- request implicit confirmation (skip the certConf leg when the CA grants it).
  *   - `acceptCert` -- an async policy `(certDer, { status, grantedWithMods }) => boolean` consulted before the certConf; return true to accept, anything else to veto (a `grantedWithMods` certificate the CA changed). A veto sends a rejecting certConf and yields `outcome: "rejected"` with the certificate still surfaced. Incompatible with `implicitConfirm` (no reject leg exists), so the combination throws at construction.
- *   - `transport` -- injectable transport(request) -> {status, headers, body}; default pki.transport.https.
+ *   - `transport` -- injectable `transport(request) -> Promise<{status, headers, body}>`; default pki.transport.https. It must return a promise of the response; anything else is `cmp/bad-input`.
  *   - `tls` / `headers` / `timeout` / `maxResponseBytes` -- transport config + budgets.
  *   - `proxy` -- reach the CA through a forward HTTP proxy (`{ url, auth?, tls? }`; see pki.transport).
  *   - `maxPolls` / `maxTotalWait` / `sleep` -- poll-loop budgets + an injectable sleeper; `time` -- verify-time clock.

package/lib/est.js

@@ -882,7 +882,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   }
   function step() {
     var hopBody = (typeof body === "function" && budgets.onAttempt) ? budgets.onAttempt() : body;
-    return transport({ method: method, url: url.href, headers: _headersFor(url), body: hopBody, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function (res) {
+    return guard.async.awaited(transport({ method: method, url: url.href, headers: _headersFor(url), body: hopBody, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }), E, "est/bad-input", "opts.transport").then(function (res) {
       res = res || {};
       var blen = _bodyLen(res);
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
@@ -1486,7 +1486,7 @@ function _enroll(op, baseUrl, csrInput, opts, proxySnap) {
  * anchor on the next call.
  *
  * @opts
- *   - `transport`: an injected transport(request) -> {status, headers, body, tls}; default pki.transport.https.
+ *   - `transport`: an injected `transport(request) -> Promise<{status, headers, body, tls}>`; default pki.transport.https. It must return a promise of the response; anything else is `est/bad-input`.
  *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }.
  *   - `label` -- an OPTIONAL CA label path segment; `timeout` / `maxResponseBytes` / `maxRedirects` -- budgets.
  *   - `proxy` -- reach the CA through a forward HTTP proxy (`{ url, auth?, tls? }`; see pki.transport).

package/lib/guard-async.js

@@ -5,6 +5,7 @@
 var _intrinsic = require("./guard-intrinsic");
 var _resolve = _intrinsic.uncurry(_intrinsic.promiseResolve);
 var _reject = _intrinsic.uncurry(_intrinsic.promiseReject);
+var _apply = _intrinsic.apply;
 var _Promise = Promise;
 // @internal
 // @enforced-by behavioral -- the rule has no rename-proof code shape (it is the ABSENCE of a wrapper
@@ -13,4 +14,19 @@ function deferred(body) {
   catch (e) { return _reject(_Promise, e); }
 }
 
-module.exports = _intrinsic.freeze({ deferred: deferred });
+// @internal
+// @enforced-by behavioral -- a RED vector in each client suite refuses a transport yielding no thenable
+function awaited(value, E, code, label) {
+  var thenFn;
+  try { thenFn = value == null ? null : value.then; }
+  catch (_te) { thenFn = null; }
+  if (typeof thenFn !== "function") {
+    throw E(code, label + " must return a promise of the response; got " +
+      (value === null ? "null" : typeof value));
+  }
+  return _resolve(_Promise, {
+    then: function (resolve, reject) { _apply(thenFn, value, [resolve, reject]); },
+  });
+}
+
+module.exports = _intrinsic.freeze({ deferred: deferred, awaited: awaited });

package/lib/scep.js

@@ -700,7 +700,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
     var req = { method: curMethod, url: current.href, headers: headers, tls: _hopTls(current), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes };
     if (proxySnap != null) req.proxy = proxySnap;
     if (curBody != null) req.body = curBody;
-    return transport(req).then(function (res) {
+    return guard.async.awaited(transport(req), _err, "scep/bad-input", "opts.transport").then(function (res) {
       res = res || {};
       var blen = _responseLen(res.body);
       if (blen > budgets.maxResponseBytes) throw _err("scep/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.33",
+  "version": "0.6.34",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:aa5ec092-0f56-46b7-bfb3-469fc4202b37",
+  "serialNumber": "urn:uuid:c595f123-cf34-46db-924e-ffa5c0c5018e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-04T18:56:11.300Z",
+    "timestamp": "2026-09-04T22:46:35.510Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.33",
+      "bom-ref": "@blamejs/pki@0.6.34",
       "type": "application",
       "name": "pki",
-      "version": "0.6.33",
+      "version": "0.6.34",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.33",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.34",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.33",
+      "ref": "@blamejs/pki@0.6.34",
       "dependsOn": []
     }
   ]