@blamejs/pki 0.6.33 → 0.6.35

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.35 — 2026-09-04
+
+Three redundant C509 spellings are refused, so a certificate has one encoding and an issuer signature cannot cover two different C509 byte strings.
+
+### Fixed
+
+- pki.schema.c509.encode refuses a serialNumberHex that is not an even-length hexadecimal string instead of decoding a prefix of it. An odd-length or partly non-hexadecimal value previously became a different, valid serial number without any error, which the encoder's own re-parse could not catch. The check applies whether the result is re-emitted from its preserved field bytes or built field by field, so a caller is told the value is malformed rather than having it quietly ignored.
+
+### Security
+
+- pki.schema.c509.parse refuses an unsigned bignum whose first octet is 0x00, including a value that is only that octet, so every number has exactly one C509 encoding (draft sec. 3.1.2). A zero serial previously had two spellings that reconstructed byte-identical DER, letting one issuer signature cover two distinct C509 certificates. The rule covers the certificate serial number, the authorityKeyIdentifier serial, and the RSA modulus and exponent.
+- pki.schema.c509.parse refuses an RSA subjectPublicKey written as [modulus, 65537] instead of the bare modulus. Draft sec. 3.1.9 omits the array and the exponent when the exponent is 65537, so the array spelling of such a key is a second encoding of one certificate, reconstructing byte-identical DER. An RSA key with any other exponent still uses the array form.
+- pki.schema.c509.parse refuses a notAfter written as the epoch 253402300799 rather than the CBOR simple value null. Draft sec. 3.1.5 encodes the no-expiration time 99991231235959Z as null, so the explicit epoch is a second spelling that reconstructs the same GeneralizedTime and therefore the same DER. A notBefore is unaffected, and pki.schema.c509.encode refuses that Date on notAfter instead of emitting a form the decoder rejects.
+
+## v0.6.34 — 2026-09-04
+
+An injected transport that does not return a promise is reported as a typed option error naming the option, in every client that accepts one.
+
+### Changed
+
+- pki.est, pki.acme, pki.cmp, and pki.scep reject with est/bad-input, acme/bad-input, cmp/bad-input, or scep/bad-input when opts.transport returns something that is not a promise of the response, instead of failing with a raw TypeError or a misleading response verdict. A transport returning any thenable is still accepted, and the documented signature now states the promise contract.
+
 ## v0.6.33 — 2026-09-04
 
 pki.transport reports the RFC 9266 tls-exporter channel binding of a TLS 1.3 connection, so every connection the toolkit opens now carries the binding its protocol version defines.

package/lib/acme.js

@@ -1763,7 +1763,7 @@ function _parseLinkNext(headers, base) { var m = _parseLinkRelation(headers, bas
  *
  * @opts
  *   - `accountKey` / `accountJwk` / `alg` -- REQUIRED: the account private key, its public JWK, and the JWS alg.
- *   - `transport` -- injectable transport(request) -> {status, headers, body}; default pki.transport.https.
+ *   - `transport` -- injectable `transport(request) -> Promise<{status, headers, body}>`; default pki.transport.https. It must return a promise of the response; anything else is `acme/bad-input`.
  *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity } for the default transport.
  *   - `timeout` / `maxResponseBytes` / `maxRedirects` -- transport budgets; `maxNonceRetries` -- badNonce retry cap (default 1).
  *   - `proxy` -- reach the ACME server through a forward HTTP proxy (`{ url, auth?, tls? }`; see pki.transport).
@@ -1911,7 +1911,9 @@ function client(directoryUrl, opts) {
   function _send(method, url, headers, body) { return _sendFollowing(method, url, headers, body, 0); }
   function _sendFollowing(method, url, headers, body, redirects) {
     var reqHeaders = Object.assign({ "user-agent": CLIENT_USER_AGENT }, headers || {});
-    return transport({ method: method, url: url, headers: reqHeaders, body: body, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function (res) {
+    return guard.async.deferred(function () {
+      return guard.async.awaited(transport({ method: method, url: url, headers: reqHeaders, body: body, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }), E, "acme/bad-input", "opts.transport");
+    }).then(function (res) {
       res = res || {};
       var h = {};
       Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });

package/lib/cmp-build.js

@@ -809,7 +809,7 @@ function _transfer(url, message, opts) {
   });
   headers["content-type"] = PKIXCMP;
   var tls = _tlsForTransfer(opts);
-  return Promise.resolve(transport({ method: "POST", url: parsedUrl.href, headers: headers, body: der, tls: tls, proxy: proxy, timeout: timeout, maxResponseBytes: maxResponseBytes })).then(function (res) {
+  return guard.async.awaited(transport({ method: "POST", url: parsedUrl.href, headers: headers, body: der, tls: tls, proxy: proxy, timeout: timeout, maxResponseBytes: maxResponseBytes }), _err, "cmp/bad-input", "opts.transport").then(function (res) {
     res = res || {};
     var h = {};
     Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });

package/lib/cmp-session.js

@@ -285,7 +285,7 @@ function _certConfHash(certDer) {
  *   - `expectedSender` -- optional CA signer certificate (DER Buffer / PEM string / already-parsed `pki.schema.x509.parse` object); when set, every signed response's authenticated header sender MUST bind to it under the RFC 5280 sec. 7 subject-or-subjectAltName rule cmp.verify uses, so a re-encoded-but-equivalent DN and an empty-subject CA named only by a directoryName SAN both match. Given as bytes/PEM it also resolves a first response that omits its own extraCerts (a CA that assumes the client already holds its certificate). Absent, the session pins the first signed response's signer certificate and requires every later leg's sender to bind to it, rejecting a switch to a different trusted signer while permitting same-identity certificate/key rotation.
  *   - `implicitConfirm` -- request implicit confirmation (skip the certConf leg when the CA grants it).
  *   - `acceptCert` -- an async policy `(certDer, { status, grantedWithMods }) => boolean` consulted before the certConf; return true to accept, anything else to veto (a `grantedWithMods` certificate the CA changed). A veto sends a rejecting certConf and yields `outcome: "rejected"` with the certificate still surfaced. Incompatible with `implicitConfirm` (no reject leg exists), so the combination throws at construction.
- *   - `transport` -- injectable transport(request) -> {status, headers, body}; default pki.transport.https.
+ *   - `transport` -- injectable `transport(request) -> Promise<{status, headers, body}>`; default pki.transport.https. It must return a promise of the response; anything else is `cmp/bad-input`.
  *   - `tls` / `headers` / `timeout` / `maxResponseBytes` -- transport config + budgets.
  *   - `proxy` -- reach the CA through a forward HTTP proxy (`{ url, auth?, tls? }`; see pki.transport).
  *   - `maxPolls` / `maxTotalWait` / `sleep` -- poll-loop budgets + an injectable sleeper; `time` -- verify-time clock.

package/lib/est.js

@@ -882,7 +882,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   }
   function step() {
     var hopBody = (typeof body === "function" && budgets.onAttempt) ? budgets.onAttempt() : body;
-    return transport({ method: method, url: url.href, headers: _headersFor(url), body: hopBody, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function (res) {
+    return guard.async.awaited(transport({ method: method, url: url.href, headers: _headersFor(url), body: hopBody, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }), E, "est/bad-input", "opts.transport").then(function (res) {
       res = res || {};
       var blen = _bodyLen(res);
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
@@ -1486,7 +1486,7 @@ function _enroll(op, baseUrl, csrInput, opts, proxySnap) {
  * anchor on the next call.
  *
  * @opts
- *   - `transport`: an injected transport(request) -> {status, headers, body, tls}; default pki.transport.https.
+ *   - `transport`: an injected `transport(request) -> Promise<{status, headers, body, tls}>`; default pki.transport.https. It must return a promise of the response; anything else is `est/bad-input`.
  *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }.
  *   - `label` -- an OPTIONAL CA label path segment; `timeout` / `maxResponseBytes` / `maxRedirects` -- budgets.
  *   - `proxy` -- reach the CA through a forward HTTP proxy (`{ url, auth?, tls? }`; see pki.transport).

package/lib/guard-async.js

@@ -5,6 +5,7 @@
 var _intrinsic = require("./guard-intrinsic");
 var _resolve = _intrinsic.uncurry(_intrinsic.promiseResolve);
 var _reject = _intrinsic.uncurry(_intrinsic.promiseReject);
+var _apply = _intrinsic.apply;
 var _Promise = Promise;
 // @internal
 // @enforced-by behavioral -- the rule has no rename-proof code shape (it is the ABSENCE of a wrapper
@@ -13,4 +14,19 @@ function deferred(body) {
   catch (e) { return _reject(_Promise, e); }
 }
 
-module.exports = _intrinsic.freeze({ deferred: deferred });
+// @internal
+// @enforced-by behavioral -- a RED vector in each client suite refuses a transport yielding no thenable
+function awaited(value, E, code, label) {
+  var thenFn;
+  try { thenFn = value == null ? null : value.then; }
+  catch (_te) { thenFn = null; }
+  if (typeof thenFn !== "function") {
+    throw E(code, label + " must return a promise of the response; got " +
+      (value === null ? "null" : typeof value));
+  }
+  return _resolve(_Promise, {
+    then: function (resolve, reject) { _apply(thenFn, value, [resolve, reject]); },
+  });
+}
+
+module.exports = _intrinsic.freeze({ deferred: deferred, awaited: awaited });

package/lib/scep.js

@@ -700,7 +700,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
     var req = { method: curMethod, url: current.href, headers: headers, tls: _hopTls(current), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes };
     if (proxySnap != null) req.proxy = proxySnap;
     if (curBody != null) req.body = curBody;
-    return transport(req).then(function (res) {
+    return guard.async.awaited(transport(req), _err, "scep/bad-input", "opts.transport").then(function (res) {
       res = res || {};
       var blen = _responseLen(res.body);
       if (blen > budgets.maxResponseBytes) throw _err("scep/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");

package/lib/schema-c509.js

@@ -33,6 +33,7 @@ var C = constants;
 var C509Error = frameworkError.C509Error;
 function _err(code, message, cause) { return new C509Error(code, message, cause); }
 var MAX_EPOCH_SECONDS = 8640000000000n;
+var NO_EXPIRY_SECONDS = 253402300799n;
 
 function _name(n) { var d = oid.byName(n); if (!d) { throw new Error("schema-c509: unregistered OID name " + JSON.stringify(n)); } return n; }
 
@@ -142,14 +143,29 @@ function _biguint(node, code, label) {
   if (!node || node.majorType !== 2) throw _err(code, label + " must be an unwrapped CBOR byte string (~biguint)");
   var b = node.content;
   if (b.length > C.LIMITS.CBOR_MAX_BIGUINT_BYTES) throw _err(code, label + " exceeds the ~biguint byte cap");
-  if (b.length > 1 && b[0] === 0x00) throw _err("c509/non-minimal-serial", label + " has a redundant leading 0x00 (~biguint omits the sign octet)");
+  if (b.length > 0 && b[0] === 0x00) throw _err("c509/non-minimal-serial", label + " has a redundant leading 0x00 (~biguint omits the sign octet)");
   return b.length ? BigInt("0x" + b.toString("hex")) : 0n;
 }
 
+function _hexBytes(s, code, label) {
+  if (typeof s !== "string") throw _err(code, label + " must be a hexadecimal string");
+  if ((s.length % 2) !== 0) throw _err(code, label + " must have an even number of hexadecimal digits");
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charCodeAt(i);
+    if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70))) {
+      throw _err(code, label + " must be hexadecimal");
+    }
+  }
+  return Buffer.from(s, "hex");
+}
+
 function _time(node, allowNull, label) {
   if (allowNull && node.majorType === 7 && node.ai === 22) return null;
   if (node.majorType !== 0) throw _err("c509/bad-validity", label + " must be an unwrapped CBOR epoch integer (~time)");
   var secs = node.argument;
+  if (allowNull && secs === NO_EXPIRY_SECONDS) {
+    throw _err("c509/bad-validity", label + " of 99991231235959Z is encoded as the CBOR simple value null (draft sec. 3.1.5), not as the epoch " + NO_EXPIRY_SECONDS);
+  }
   if (secs > MAX_EPOCH_SECONDS) throw _err("c509/bad-validity", label + " is outside the representable Date range");
   return new Date(C.TIME.seconds(Number(secs)));
 }
@@ -1521,6 +1537,7 @@ function parse(input) {
     if (f[8].majorType === 2) rsaKey = { modulus: _biguint(f[8], "c509/bad-spki", "RSA modulus"), exponent: 65537n };
     else if (f[8].majorType === 4 && f[8].children && f[8].children.length === 2) {
       rsaKey = { modulus: _biguint(f[8].children[0], "c509/bad-spki", "RSA modulus"), exponent: _biguint(f[8].children[1], "c509/bad-spki", "RSA exponent") };
+      if (rsaKey.exponent === 65537n) throw _err("c509/bad-spki", "an RSA subjectPublicKey with exponent 65537 omits the array and the exponent (sec. 3.1.9)");
     } else throw _err("c509/bad-spki", "an RSA subjectPublicKey must be a ~biguint modulus or [modulus, exponent]");
     if (rsaKey.modulus < 1n || rsaKey.exponent < 1n) throw _err("c509/bad-spki", "an RSA modulus and public exponent must be positive");
   } else {
@@ -1650,6 +1667,7 @@ function _validityUint(date, label) {
 function _encodeC509Array(r) {
   if (Buffer.isBuffer(r._fieldBytes)) {
     if (!Buffer.isBuffer(r.signatureValue)) throw _err("c509/bad-input", "a re-emitted certificate must carry a Buffer signatureValue");
+    if (r.serialNumberHex != null) _hexBytes(r.serialNumberHex, "c509/bad-serial", "serialNumberHex");
     var out = Buffer.concat([Buffer.from([0x8b]), r._fieldBytes, cbor.build.byteString(r.signatureValue)]);
     parse(out);
     return out;
@@ -1658,7 +1676,7 @@ function _encodeC509Array(r) {
   var pkKey = r.subjectPublicKeyAlgorithm.curve ? r.subjectPublicKeyAlgorithm.name + "|" + r.subjectPublicKeyAlgorithm.curve : r.subjectPublicKeyAlgorithm.name;
   var arr = cbor.build.array([
     cbor.build.int(BigInt(r.certificateType)),
-    cbor.build.byteString(r.serialNumberHex != null ? Buffer.from(r.serialNumberHex, "hex") : _minBytes(r.serialNumber)),
+    cbor.build.byteString(r.serialNumberHex != null ? _hexBytes(r.serialNumberHex, "c509/bad-serial", "serialNumberHex") : _minBytes(r.serialNumber)),
     _encAlgorithm(r.signatureAlgorithm, SIG_ALG_TO_INT, r.signatureAlgorithm.name),
     _encName(r.issuer, false),
     _validityUint(r.validity.notBefore, "validityNotBefore"),
@@ -1753,7 +1771,7 @@ function _keyUsageBitsFromDer(extnValue) {
   }
   return _namedBitsFromContent(bs.bytes, bs.unusedBits);
 }
-var _NO_EXPIRY = Date.UTC(9999, 11, 31, 23, 59, 59);
+var _NO_EXPIRY = C.TIME.seconds(Number(NO_EXPIRY_SECONDS));
 var NODE_TO_WEBCRYPTO = Object.assign(Object.create(null), { "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521" });
 var WEBCRYPTO_FIELD_BYTES = Object.assign(Object.create(null), { "P-256": 32, "P-384": 48, "P-521": 66 });
 var SIG_ALG_TO_CURVE = Object.assign(Object.create(null), { "ecdsaWithSHA256": "P-256", "ecdsaWithSHA384": "P-384", "ecdsaWithSHA512": "P-521" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.33",
+  "version": "0.6.35",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:aa5ec092-0f56-46b7-bfb3-469fc4202b37",
+  "serialNumber": "urn:uuid:3601ee14-7f92-4a66-bdb2-bab4e6360e45",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-04T18:56:11.300Z",
+    "timestamp": "2026-09-04T23:41:31.757Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.33",
+      "bom-ref": "@blamejs/pki@0.6.35",
       "type": "application",
       "name": "pki",
-      "version": "0.6.33",
+      "version": "0.6.35",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.33",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.35",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.33",
+      "ref": "@blamejs/pki@0.6.35",
       "dependsOn": []
     }
   ]