@blamejs/pki 0.6.6 → 0.6.7

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.7 — 2026-08-31
+
+pki.scep gains the SCEP HTTP client verbs (RFC 8894): getCACaps, getCACert, enroll, and renew drive a certificate enrollment against a SCEP CA over the shipped pkiMessage codec.
+
+### Added
+
+- pki.scep.getCACaps(baseUrl, opts) queries a SCEP CA's advertised capabilities (RFC 8894 sec. 3.5) and returns the parsed keyword set; pki.scep.parseCapabilities(text) exposes the parser directly. The response is unauthenticated (sec. 7.5), so the verb reports what the CA claims without downgrading on it; pass expectSCEPStandard or requireStrongProfile to fail closed when the strong profile is absent.
+- pki.scep.getCACert(baseUrl, opts) retrieves the CA certificate, either a single DER certificate or a certs-only chain (RFC 8894 sec. 4.2). Pass an out-of-band expectedFingerprint (a hex string or Buffer, SHA-256 by default) and a returned certificate must match it or the response is refused (RFC 8894 sec. 2.2); omitting it returns the certificates for the caller to authenticate.
+- pki.scep.enroll(baseUrl, opts) and pki.scep.renew(baseUrl, opts) POST a PKCSReq or RenewalReq to ?operation=PKIOperation and read the CertRep. The response signature is authenticated against the CA certificate and its recipientNonce must echo the request's senderNonce; on SUCCESS the issued certificate is selected out of the response by SubjectPublicKeyInfo match, a FAILURE throws scep/enrollment-failed carrying the CA's failInfo, and a PENDING returns { status: "PENDING", transactionId } to retry. The content key is transported under RSAES-OAEP, so the CA certificate must be an RSA keyEncipherment certificate.
+
+### Fixed
+
+- The EST, SCEP, and ACME client verbs override the mTLS client certificate, key, and pinned servername on a cross-origin redirect rather than omitting them. A transport constructed with a default client credential (for example pki.transport.https({ tls: { cert, key } })) no longer presents that credential to the redirected origin.
+
 ## v0.6.6 — 2026-08-31
 
 pki.kem establishes a shared secret with composite ML-KEM (draft-ietf-lamps-pq-composite-kem): a post-quantum ML-KEM hybridized with a traditional RSA-OAEP, ECDH, X25519, or X448, so the secret holds if either component is later broken.

package/README.md

@@ -222,7 +222,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.schema.cmp` | CMP messages (RFC 9810): the header (version, sender and recipient including the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` and `bodyBytes` slices an external verifier reconstructs the protected part from. The CMP-before-OCSP dispatch order is enforced Fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csrattrs` | EST CSR Attributes (`CsrAttrs`, RFC 8951 §3.5 / RFC 9908) — the `AttrOrOID` items a server sends to shape an enrollment: bare OIDs, attributes with raw values, and decoded views of the RFC 9908 meaningful types (extension requests, EC and RSA key-type conventions, the certification-request-info template). Unknown types are surfaced raw; structure and the RFC 9908 semantic MUSTs are fail-closed — `parse` |
 | `pki.est` | Enrollment over Secure Transport (RFC 7030 / 8951 / 9908 / 7616). The client verbs `cacerts`, `simpleenroll`, `simplereenroll`, `serverkeygen`, `csrattrs`, and `fullcmc` drive the RFC 7030 flow over `pki.transport` (inject your own via `opts.transport`, or take the fail-closed default): HTTPS only, an explicit trust anchor required, same-origin redirects followed while a downgrade or loop is refused, a 202 Retry-After surfaced but never slept, HTTP Basic or Digest (RFC 7616, SHA-256 / SHA-512-256; MD5 and no-qop refused by default) answered only after the server is authenticated, and the issued certificate chosen by public-key match. `serverkeygen` requests a server-generated key, cleartext or an opaque CMS EnvelopedData, with encryption bound to the CSR's key-identifier attribute over a confidentiality-bearing cipher. `csrattrs` fetches the CA's RFC 9908 attributes policy. `fullcmc` (§4.3) carries a CMC Full PKI Request and reduces the CA's answer through `pki.cmc.verify` to one terminal outcome, refusing a response that fails to echo the transaction and nonce the request carried, or that covers a key the request never asked for; a certs-only reply to a bound request is refused rather than read as an issuance. Under the verbs sit the transport-agnostic codecs they compose: the RFC 8951 base64 transfer codec (which ignores Content-Transfer-Encoding), the `multipart/mixed` splitter, the certs-only and serverkeygen response validators over CMS, the enroll-attribute builders, and the HTTP response classifier — `transferDecode`/`transferEncode`, `parseCertsOnly`, `splitMultipartMixed`, `parseServerKeygenResponse`, `findIssuedCert`, `classifyResponse`, `paths`, and the builders |
-| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a `PKCSReq` or `RenewalReq` request: it verifies the PKCS#10 certification request's own proof-of-possession, encrypts it to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, or `CertRep` back (the `CertPoll`, `GetCert`, and `GetCRL` client queries are refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. Issuing a CertRep is not yet built — `build`, `parse` |
+| `pki.scep` | SCEP pkiMessage codec (RFC 8894), the client side of Simple Certificate Enrollment. `build(spec)` assembles a `PKCSReq` or `RenewalReq` request: it verifies the PKCS#10 certification request's own proof-of-possession, encrypts it to the CA as the inner EnvelopedData (`pkcsPKIEnvelope`, AES-128-CBC), and signs that under the transaction attributes RFC 8894 §3.2 defines, a messageType, a caller-unique transactionId, and a 16-byte senderNonce. The recipient CA certificate must assert `keyEncipherment`. `parse(bytes, opts?)` reads a `PKCSReq`, `RenewalReq`, or `CertRep` back (the `CertPoll`, `GetCert`, and `GetCRL` client queries are refused): it verifies the outer signature first and refuses a message whose signature does not check, so the transaction attributes it returns come only from a verified signer, never alongside a false verdict. Because a valid signature only proves self-consistency with the embedded certificate, pass `opts.signerCert` to authenticate a CA response against the CA certificate you hold (a public-key mismatch is refused, `signerAuthenticated` reports the result); a caller that omits it gets a crypto-only verdict and must authenticate the surfaced `signerCert` itself. It maps the messageType, pkiStatus, failInfo, and the nonces from their RFC 8894 enumerants and refuses an unknown one; given `recipientKey` it decrypts the `pkcsPKIEnvelope` to the messageData, and given `expectedSenderNonce` it refuses a response whose recipientNonce does not echo it. It reads a CA's CertRep in full. `getCACaps(baseUrl, opts?)`, `getCACert(baseUrl, opts?)`, `enroll(baseUrl, opts)`, and `renew(baseUrl, opts)` carry that codec to a live CA over HTTP (RFC 8894 §4) through an injectable transport (`pki.transport.https` by default): `getCACaps` reports the CA's advertised capabilities and never lowers the client's algorithm choice on the unauthenticated response, `getCACert` pins the CA certificate to an out-of-band `expectedFingerprint` a returned certificate must match, and `enroll` and `renew` POST a PKCSReq or RenewalReq, authenticate the CertRep against the CA certificate and its nonce echo, select the issued certificate by public-key match, throw on a FAILURE with the CA's failInfo, and return a PENDING to retry. Issuing a CertRep, `GetNextCACert`, and automatic polling are not yet built — `build`, `parse`, `getCACaps`, `getCACert`, `enroll`, `renew` |
 | `pki.transport` | The shared, fail-closed `node:https` transport the enrollment clients drive. `pki.transport.https(defaults)` returns a `transport(request) → { status, headers, body, tls }`, where `tls` carries the negotiated `protocol`, `cipher`, and raw `peerCertificate`. This is the toolkit's only socket choke point: an explicit trust anchor (or an opt-in to the system store) is required, `rejectUnauthorized` is always on, TLS is floored at 1.2, the response body is capped while it streams, and a stalled socket times out. The EST, ACME, and CMP clients reuse it verbatim. If you inject your own transport, return `tls` too: `pki.est.serverkeygen` asserts the negotiated cipher can protect the delivered private key, and a transport that reports no cipher is trusted rather than refused, so omitting the field silently skips that check — `https` |
 | `pki.jose` | Flattened JWS (RFC 7515) and JWK thumbprints (RFC 7638). `sign` and `verify` run a Flattened JWS against declarative profiles (ACME outer, EAB inner, keyChange inner) that carry the required and forbidden header rules as data. `base64url` is the strict RFC 4648 §5 codec, rejecting padding, non-alphabet characters, and non-canonical trailing bits. `parseJson` is a bounded reader that refuses duplicate members at any depth. `thumbprint` is the RFC 7638 / 8037 / 9964 canonical digest. The algorithm registry binds each `alg` to its key type (ES/RS/PS/EdDSA/ML-DSA), leaving no code path for `alg:none`, an RS256→HS256 key confusion, or an all-zero ECDSA signature; `assertPublicJwk` refuses a JWK carrying private material, so an exported private key is never published. `opts.key` names the key a message must be signed under and governs: where the profile also permits an embedded header `jwk`, the two must be the same key — compared as RFC 7638 thumbprints, so member order cannot make equal keys differ — and a disagreement is refused rather than resolved in the message's favor. `keySource` reports which key answered, since a signature checked against a key you named is a different claim from one checked against the key the message carried — `sign`, `verify`, `base64url`, `parseJson`, `thumbprint`, `assertPublicJwk` |
 | `pki.acme` | ACME (RFC 8555 / 8737 / 8738 / 9773). `client(directoryUrl, opts)` is a stateful client driving a live CA directory over `pki.transport`: `newAccount`, `newOrder`, `newAuthz`, `getOrder`, `getAuthorization`, `getChallenge`, `respondToChallenge`, `finalize`, `pollOrder`, `pollAuthorization`, and `downloadCertificate` walk the issuance flow, with `newAuthz` pre-authorizing a single identifier (§7.4.1) and `downloadCertificate` binding the issued certificate to the order — its key, its identifiers, or both; at least one is required by default and the result reports `boundToKey` / `boundToIdentifiers` — before choosing among alternate chains (`Link rel="alternate"`, §7.4.2, via a `selectChain` predicate bounded by `maxAlternates`). `revokeCert` (account-key or certificate-key signed), `keyChange`, `updateAccount` (change the account contacts, §7.3.2), `listOrders` (the account's orders list, following the §7.1.2.1 `Link rel="next"` pagination bounded by a page cap and confined to the orders origin), `deactivateAccount`, `deactivateAuthorization`, `renewalInfo` (ARI), and `renewalWindow` (the RFC 9773 §4.2/4.3 renewal decision) complete the lifecycle. Every URL is HTTPS only, an explicit trust anchor is required, each request carries a fresh single-use nonce with a bounded badNonce retry, reads are POST-as-GET, polling is bounded and sleeps on a Retry-After via an injectable sleeper capped by a poll count and a total-wait budget, and every response body is size-capped. The transport is injectable via `opts.transport`. Over the message layer it composes resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, the request builders (newAccount with External Account Binding, newOrder with `replaces`, finalize with a CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns and ip identifier validators, and the ARI certID with serial sign-padding preserved — `client`, `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |

package/index.js

@@ -171,7 +171,7 @@ module.exports = {
   // splitter, certs-only + serverkeygen validators over CMS, the enroll-attribute
   // builders, the HTTP response classifier). est opens no socket; fail-closed.
   est:       est,
-  scep:      { build: scep.build, parse: scep.parse },
+  scep:      { build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert, enroll: scep.enroll, renew: scep.renew, parseCapabilities: scep.parseCapabilities },
   // `transport` is the shared fail-closed node:https transport the enrollment clients
   // drive -- pki.transport.https(defaults) returns a transport(request) -> {status,
   // headers, body}. The toolkit's sole socket choke point: explicit trust anchors,

package/lib/acme.js

@@ -2346,9 +2346,13 @@ function client(directoryUrl, opts) {
     // pin, or a stricter host check) that node re-evaluates against the actual host, so a pin keeps applying
     // and a host-pinned check fails the wrong host closed; dropping it would accept the cross-origin host
     // under only the default hostname validation, bypassing the pin.
-    if (new URL(url).origin !== trustedOrigin && (t.cert != null || t.key != null || t.servername != null)) {
+    if (new URL(url).origin !== trustedOrigin) {
+      // Every cross-origin hop overrides the client identity with an explicit null, unconditionally: an
+      // omitted field falls back to the transport's own configured defaults (http-transport resolves
+      // reqTls.cert !== undefined ? reqTls.cert : tlsDefaults.cert), so the override must fire even when the
+      // request-level tls carries no credential, or a transport default would still reach the new origin.
       t = Object.assign({}, t);
-      delete t.cert; delete t.key; delete t.servername;
+      t.cert = null; t.key = null; t.servername = null;
     }
     return t;
   }

package/lib/est.js

@@ -1100,9 +1100,13 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   // restores its identity rather than permanently losing the SNI at the first cross-origin boundary.
   function _tlsFor(u) {
     var t = budgets.tls;
-    if (t && u.origin !== initialOrigin && (t.cert != null || t.key != null || t.servername != null)) {
+    if (t && u.origin !== initialOrigin) {
+      // Every cross-origin hop overrides the client identity with an explicit null, unconditionally: an
+      // omitted field falls back to the transport's own configured defaults (http-transport resolves
+      // reqTls.cert !== undefined ? reqTls.cert : tlsDefaults.cert), so the override must fire even when the
+      // request-level tls carries no credential, or a transport default would still reach the new origin.
       t = Object.assign({}, t);
-      delete t.cert; delete t.key; delete t.servername;
+      t.cert = null; t.key = null; t.servername = null;
     }
     return t;
   }

package/lib/http-transport.js

@@ -351,7 +351,11 @@ function httpsTransport(defaults) {
     // SNI (and RFC 6125 identity) uses a hostname; node forbids a servername that is an IP
     // literal, so it is omitted for an IP host (node then matches the IP against the cert's
     // IP SANs). A caller connecting by hostname gets SNI + name verification by default.
-    var sni = reqTls.servername || tlsDefaults.servername || host;
+    // The per-request servername falls back to the factory default only when it is ABSENT
+    // (as cert/key do); an explicit value, INCLUDING null, overrides the default, so a caller
+    // that sets servername to null on a cross-origin hop suppresses a configured default SNI
+    // rather than falsy-coalescing back to it.
+    var sni = (reqTls.servername !== undefined ? reqTls.servername : tlsDefaults.servername) || host;
     if (sni && !nodeNet.isIP(sni)) options.servername = sni;
     // Build node's `ca`: the explicit anchors (DER wrapped as PEM) and, when useSystemStore is opted
     // in, the OS system store + bundled roots. Node's `ca` REPLACES the default set, so both sources

package/lib/scep.js

@@ -52,6 +52,7 @@ var schemaCrl = require("./schema-crl");
 var pkix = require("./schema-pkix");
 var guard = require("./guard-all");
 var C = require("./constants");
+var httpTransport = require("./http-transport");   // the injectable https transport for the client verbs (sec. 4)
 var nodeCrypto = require("node:crypto");
 
 function _err(code, msg, cause) { return new ScepError(code, msg, cause); }
@@ -553,9 +554,511 @@ async function parse(bytes, opts) {
 }
 var _PARSE_KEYS = { recipientKey: 1, expectedSenderNonce: 1, signerCert: 1 };
 
+// ---- HTTP client (RFC 8894 sec. 4) -------------------------------------------
+//
+// The client verbs compose the shipped pkiMessage codec (build / parse) over an injectable transport
+// (pki.transport.https by default; tests inject a fake). SCEP's message security is the CMS layer, not
+// the transport (RFC 8894 sec. 2.8), so https is not forced at the URL level; a caller with a plain-HTTP
+// CA injects its own transport. This release ships the mandatory-to-implement set (GetCACaps, GetCACert,
+// PKCSReq via HTTP POST, AES-128-CBC + SHA-256, sec. 2.9) plus RenewalReq. Deferred, each re-opening
+// under its named condition: GetNextCACert (the rollover-certificate authentication model, sec. 4.7);
+// auto-poll / GetCert / GetCRL (their CertPoll / IssuerAndSerialNumber messageData builders are not in
+// this codec); GET-carried PKIOperation (POST is mandatory, sec. 4.3); and HTTP auth (a CA behind an
+// authenticating proxy).
+var DEFAULT_TIMEOUT = C.TIME.seconds(30);
+var MAX_TIMEOUT = C.TIME.seconds(600);
+
+// The SCEP media types (RFC 8894 sec. 4.2 / 4.6). A 200 response MUST carry the operation's media type;
+// a proxy error page or a wrong type is refused (fail-closed).
+var CT_CA_CERT = "application/x-x509-ca-cert";       // GetCACert, a single DER certificate
+var CT_CA_RA_CERT = "application/x-x509-ca-ra-cert";  // GetCACert, a certs-only CMS chain
+var CT_PKI_MESSAGE = "application/x-pki-message";      // PKIOperation, a pkiMessage
+var CT_PLAIN = "text/plain";                           // GetCACaps, a newline-separated capability list
+
+function _isWs(c) { return c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d || c === 0x0b || c === 0x0c; }
+function _foldLower(s) { var o = "", i, n = s.length; for (i = 0; i < n; i++) { var c = s.charCodeAt(i); o += String.fromCharCode(c >= 65 && c <= 90 ? c + 32 : c); } return o; }
+function _foldUpper(s) { var o = "", i, n = s.length; for (i = 0; i < n; i++) { var c = s.charCodeAt(i); o += String.fromCharCode(c >= 97 && c <= 122 ? c - 32 : c); } return o; }
+function _trim(s) { var a = 0, e = s.length; while (a < e && _isWs(s.charCodeAt(a))) a += 1; while (e > a && _isWs(s.charCodeAt(e - 1))) e -= 1; return s.slice(a, e); }
+
+// A case-insensitive single-header read. A duplicated header is refused: an injected transport promises
+// only { status, headers, body }, and a smuggled duplicate must never be silently coalesced.
+function _header(headers, name) {
+  if (!headers || typeof headers !== "object") return null;
+  var found = null, seen = 0, k;
+  for (k in headers) {
+    if (!Object.prototype.hasOwnProperty.call(headers, k)) continue;
+    if (_foldLower(String(k)) === name) { found = headers[k]; seen += 1; }
+  }
+  if (seen > 1) throw _err("scep/bad-response", "the response carried more than one " + name + " header");
+  return found == null ? null : String(found);
+}
+// The bare media type of a Content-Type (strip parameters, lower-case), by character scan (no regex).
+function _mediaType(ct) {
+  if (ct == null) return "";
+  var s = String(ct), semi = s.indexOf(";");
+  return _foldLower(_trim(semi === -1 ? s : s.slice(0, semi)));
+}
+function _bodyBuf(body) {
+  if (Buffer.isBuffer(body)) return body;
+  if (body == null) return Buffer.alloc(0);
+  if (typeof body === "string") return Buffer.from(body, "utf8");
+  // A BufferSource (Uint8Array, ArrayBuffer, DataView) from an injected transport: normalize its raw bytes
+  // rather than String()-coercing it, which would turn a Uint8Array into its "48,1,..." toString.
+  return guard.bytes.snapshotSource(body, ScepError, "scep/bad-response", "the response body");
+}
+// The byte length of a transport response body, read without a full copy so the size cap is enforced before
+// the body is materialized (cap-before-copy): a string is measured as UTF-8, a Buffer or other BufferSource
+// through the byte guard, which reads the length via a captured intrinsic rather than a shadowable accessor.
+function _responseLen(body) {
+  if (body == null) return 0;
+  if (typeof body === "string") return Buffer.byteLength(body, "utf8");
+  if (Buffer.isBuffer(body)) return guard.bytes.lengthOf(body);
+  return guard.bytes.lengthOf(guard.bytes.view(body, ScepError, "scep/bad-response", "the response body"));
+}
+// Map opts.tls to the transport request.tls shape. rejectUnauthorized is NOT set -- the transport forces
+// it on for an https connection.
+function _tlsForRequest(opts) {
+  var t = opts.tls || {};
+  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+}
+// Resolve a redirect target: refuse an https->http downgrade (a stripping MITM) and a cross-origin
+// redirect on a non-idempotent method without opt-in; an unparseable Location is scep/bad-url.
+function _redirectTarget(current, location, method, allowCrossOrigin) {
+  if (location == null || _trim(String(location)) === "") throw _err("scep/bad-response", "a redirect response carried no Location header");
+  var resolved;
+  try { resolved = new URL(String(location), current.href); }
+  catch (e) { throw _err("scep/bad-url", "a redirect Location did not parse: " + location, e); }
+  // SCEP is an HTTP operation (RFC 8894 sec. 4): a redirect target on any other scheme (ftp:, file:, ...)
+  // is refused before it reaches the transport, so a CA cannot steer an injected transport off HTTP.
+  if (resolved.protocol !== "http:" && resolved.protocol !== "https:") throw _err("scep/bad-url", "a redirect to a non-HTTP scheme is refused: " + resolved.protocol);
+  if (current.protocol === "https:" && resolved.protocol !== "https:") throw _err("scep/insecure-redirect", "a redirect from https to " + resolved.protocol + " is refused");
+  var safe = method === "GET" || method === "HEAD";
+  if (resolved.origin !== current.origin && !safe && !allowCrossOrigin) throw _err("scep/cross-origin-redirect", "a cross-origin redirect on a " + method + " needs opts.allowCrossOriginRedirect");
+  return resolved;
+}
+// Build a SCEP operation URL: the caller's base URL with ?operation=<op> appended (RFC 8894 sec. 4.1;
+// SCEPPATH is whatever the base carries, the CA typically ignores it).
+function _scepUrl(baseUrl, operation) {
+  var url;
+  try { url = new URL(String(baseUrl)); }
+  catch (e) { throw _err("scep/bad-url", "the SCEP base URL did not parse: " + String(baseUrl), e); }
+  // SCEP is an HTTP operation (RFC 8894 sec. 4): any other scheme (ftp:, file:, ...) is refused before the
+  // URL reaches the transport, so an injected transport cannot be steered off HTTP.
+  if (url.protocol !== "http:" && url.protocol !== "https:") throw _err("scep/bad-url", "the SCEP base URL must be http or https, got " + url.protocol);
+  if (url.hash) throw _err("scep/bad-url", "the SCEP base URL must not carry a fragment");
+  url.searchParams.set("operation", operation);
+  return url;
+}
+// The transport request / redirect loop. Returns the terminal transport response ({ status, headers,
+// body }). Digest / Basic auth is not answered (deferred); a 401 is returned to the verb, which throws.
+function _drive(method, url, body, headers, opts, transport, budgets) {
+  var redirects = 0, curMethod = method, curBody = body, initialOrigin = url.origin;
+  // Snapshot the caller's TLS fields and redirect policy once, at the start, before the first transport call:
+  // the redirect loop reruns per hop after each transport promise settles, so a hop must use the identity and
+  // policy the initial hop did even if opts (or opts.tls) is replaced while a request is in flight.
+  var tlsBase = _tlsForRequest(opts);
+  var allowCrossOrigin = !!opts.allowCrossOriginRedirect;
+  // The mTLS client identity (cert / key / pinned SNI) is sent ONLY to the origin the caller intended; a
+  // cross-origin redirect gets a copy with those stripped, so a CA that redirects to another origin cannot
+  // make the client authenticate to it with the caller's client credential. Derived fresh each hop, so a
+  // redirect back to the original origin restores it.
+  function _hopTls(current) {
+    var t = tlsBase;
+    if (current.origin !== initialOrigin) {
+      // Every cross-origin hop overrides the client identity with an explicit null, unconditionally: an
+      // omitted field falls back to the transport's own configured defaults (http-transport resolves
+      // reqTls.cert !== undefined ? reqTls.cert : tlsDefaults.cert), so the override must fire even when the
+      // request-level tls carries no credential, or a transport default would still reach the new origin.
+      t = Object.assign({}, t);
+      t.cert = null; t.key = null; t.servername = null;
+    }
+    return t;
+  }
+  function step(current) {
+    var req = { method: curMethod, url: current.href, headers: headers, tls: _hopTls(current), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes };
+    if (curBody != null) req.body = curBody;
+    return transport(req).then(function (res) {
+      res = res || {};
+      var blen = _responseLen(res.body);
+      if (blen > budgets.maxResponseBytes) throw _err("scep/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap");
+      var status = res.status;
+      if (status >= 300 && status < 400) {
+        if (redirects >= budgets.maxRedirects) throw _err("scep/too-many-redirects", "the SCEP request exceeded the " + budgets.maxRedirects + "-redirect cap");
+        redirects += 1;
+        var target = _redirectTarget(current, _header(res.headers, "location"), curMethod, allowCrossOrigin);
+        if (status === 303 && curMethod !== "GET" && curMethod !== "HEAD") { curMethod = "GET"; curBody = null; }
+        return step(target);
+      }
+      return res;
+    });
+  }
+  return step(url);
+}
+function _client(method, url, body, headers, opts) {
+  var transport = opts.transport || httpTransport.https({ E: _err, errPrefix: "scep" });
+  var budgets = {
+    timeout: guard.limits.cap(opts.timeout, "timeout", DEFAULT_TIMEOUT, { E: _err, code: "scep/bad-input", min: 1, max: MAX_TIMEOUT }),
+    maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", C.LIMITS.HTTP_MAX_RESPONSE_BYTES, { E: _err, code: "scep/bad-input", min: 1, max: C.LIMITS.HTTP_MAX_RESPONSE_BYTES }),
+    maxRedirects: guard.limits.cap(opts.maxRedirects, "maxRedirects", 5, { E: _err, code: "scep/bad-input", min: 0, max: 32 }),
+  };
+  return _drive(method, url, body, Object.assign({}, headers), opts, transport, budgets);
+}
+// Require a 200 with one of the expected media types; otherwise a typed error. Returns the body Buffer.
+function _requireOk(res, expected, what) {
+  var status = res.status;
+  if (status !== 200) {
+    var text = Buffer.isBuffer(res.body) ? res.body.toString("utf8", 0, 256) : String(res.body == null ? "" : res.body).slice(0, 256);
+    throw _err("scep/http-error", "the SCEP " + what + " returned HTTP " + status + (text ? ": " + text : ""));
+  }
+  if (expected) {
+    var ct = _mediaType(_header(res.headers, "content-type"));
+    if (expected.indexOf(ct) === -1) throw _err("scep/bad-content-type", "a 200 " + what + " response must carry content-type " + expected.join(" or ") + ", got " + JSON.stringify(ct));
+  }
+  return _bodyBuf(res.body);
+}
+
+// The GetCACaps keyword set (RFC 8894 sec. 3.5.2, Table 7). Comparison is case-folded; the canonical
+// spelling is stored. An unknown keyword is ignored (sec. 3.5.2). SCEPStandard implies the sec. 2.9 set.
+var CAP_CANON = { AES: "AES", DES3: "DES3", GETNEXTCACERT: "GetNextCACert", POSTPKIOPERATION: "POSTPKIOperation",
+  RENEWAL: "Renewal", "SHA-1": "SHA-1", "SHA-256": "SHA-256", "SHA-512": "SHA-512", SCEPSTANDARD: "SCEPStandard" };
+function _splitLines(s) {
+  var out = [], start = 0, i, n = s.length;
+  for (i = 0; i < n; i++) if (s.charCodeAt(i) === 0x0a) { out.push(s.slice(start, i)); start = i + 1; }
+  out.push(s.slice(start));
+  return out;
+}
+
+/**
+ * @primitive  pki.scep.parseCapabilities
+ * @signature  pki.scep.parseCapabilities(text) -> { AES?, "SHA-256"?, POSTPKIOperation?, ... }
+ * @since      0.6.7
+ * @status     stable
+ * @spec       RFC 8894
+ * @related    pki.scep.getCACaps
+ *
+ * Parse a GetCACaps response body (RFC 8894 sec. 3.5.2): one capability keyword per line, CR/LF or LF
+ * delimited. The returned object has a `true` property for each recognized keyword (`AES`, `DES3`,
+ * `GetNextCACert`, `POSTPKIOperation`, `Renewal`, `SHA-1`, `SHA-256`, `SHA-512`, `SCEPStandard`);
+ * comparison is case-insensitive and an unknown keyword is ignored (sec. 3.5.2). `SCEPStandard` implies
+ * `AES`, `POSTPKIOperation`, and `SHA-256` (the sec. 2.9 mandatory profile), which are set on the result.
+ * An empty body yields an empty set ("none supported", sec. 3.5.1).
+ *
+ * @example
+ *   var caps = pki.scep.parseCapabilities("AES\r\nSHA-256\r\nPOSTPKIOperation\r\n");
+ *   caps.POSTPKIOperation === true;
+ */
+function parseCapabilities(text) {
+  var raw = Buffer.isBuffer(text) ? text.toString("latin1") : String(text == null ? "" : text);
+  var set = {}, lines = _splitLines(raw), i;
+  for (i = 0; i < lines.length; i++) {
+    var kw = _foldUpper(_trim(lines[i]));
+    if (kw !== "" && CAP_CANON[kw]) set[CAP_CANON[kw]] = true;
+  }
+  if (set.SCEPStandard) { set.AES = true; set.POSTPKIOperation = true; set["SHA-256"] = true; }
+  return set;
+}
+function _assertStrongProfile(caps, profile) {
+  if (profile.expectSCEPStandard && !caps.SCEPStandard) throw _err("scep/weak-profile", "the CA did not advertise SCEPStandard (RFC 8894 sec. 3.5.2); the GetCACaps response is unauthenticated, so its absence is a downgrade signal (sec. 7.5)");
+  if (profile.requireStrongProfile && (!caps.AES || !caps["SHA-256"] || !caps.POSTPKIOperation)) throw _err("scep/weak-profile", "the CA did not advertise the strong profile (AES + SHA-256 + POSTPKIOperation)");
+}
+
+/**
+ * @primitive  pki.scep.getCACaps
+ * @signature  pki.scep.getCACaps(baseUrl, opts?) -> Promise<capabilities>
+ * @since      0.6.7
+ * @status     stable
+ * @spec       RFC 8894
+ * @related    pki.scep.parseCapabilities, pki.scep.enroll
+ *
+ * Query a SCEP CA's advertised capabilities (RFC 8894 sec. 3.5.1): a GET `?operation=GetCACaps` whose
+ * `text/plain` body is parsed by `parseCapabilities`. The GetCACaps response is UNAUTHENTICATED (sec.
+ * 7.5), so a client MUST NOT downgrade its algorithm choice based on it; this verb only reports what the
+ * CA claims. Pass `expectSCEPStandard: true` (or `requireStrongProfile: true`) to fail closed when the
+ * strong profile is absent, treating the absence as the downgrade signal it is.
+ *
+ * @opts
+ *   - `transport` -- an injected transport (defaults to `pki.transport.https`); the request is a GET with no body.
+ *   - `expectSCEPStandard` -- refuse (`scep/weak-profile`) if the response does not advertise `SCEPStandard`.
+ *   - `requireStrongProfile` -- refuse unless AES + SHA-256 + POSTPKIOperation are all advertised.
+ *   - `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
+ * @example
+ *   // requires: scepTransport -- an injected transport (omit to use pki.transport.https)
+ *   var caps = await pki.scep.getCACaps("http://ca.example/scep", { transport: scepTransport });
+ *   caps.AES === true;
+ */
+async function getCACaps(baseUrl, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getCACaps options");
+  guard.identifier.assertKnownKeys(opts, _CACAPS_KEYS, _err, "scep/bad-input", "pki.scep.getCACaps has an unknown option: ");
+  // Capture the strong-profile policy at the door: the downgrade check runs only after the GET await, so a
+  // caller must not be able to relax its own guard by mutating opts while the request is in flight.
+  var profile = { expectSCEPStandard: !!opts.expectSCEPStandard, requireStrongProfile: !!opts.requireStrongProfile };
+  var res = await _client("GET", _scepUrl(baseUrl, "GetCACaps"), null, {}, opts);
+  // An HTTP error or empty body means "none supported" (RFC 8894 sec. 3.5.1); a non-200 that is not a
+  // clean error is still surfaced so a caller is not silently told "no capabilities" on a broken CA.
+  if (res.status === 200) {
+    // A conforming GetCACaps response carries content-type text/plain (RFC 8894 sec. 3.5.1). Enforcing it
+    // stops a proxy's 200 HTML error page from being read as an empty (no capabilities) capability set.
+    var caps = parseCapabilities(_requireOk(res, [CT_PLAIN], "GetCACaps"));
+    _assertStrongProfile(caps, profile);
+    return caps;
+  }
+  // A CA that does not implement GetCACaps signals it with an HTTP error, which RFC 8894 sec. 3.5.1 reads
+  // as "no capabilities advertised": the codes that mean the operation is unsupported or unrecognized are
+  // 400 (an old CA that does not parse the query), 404 (no such operation), 405 (GET not allowed on it), and
+  // 501 Not Implemented. A transient server error (500, 502, 503) is surfaced instead of masked.
+  if (res.status === 204 || res.status === 400 || res.status === 404 || res.status === 405 || res.status === 501) { _assertStrongProfile({}, profile); return {}; }
+  throw _err("scep/http-error", "the SCEP GetCACaps returned HTTP " + res.status);
+}
+
+// The exact SPKI byte-match that identifies an issued certificate (RFC 5272 sec. 4.1); positional
+// guessing is forbidden. `certs` is an array of raw cert Buffers, `wantSpki` the SPKI Buffer to match.
+function findIssuedCert(certs, wantSpki) {
+  if (!Buffer.isBuffer(wantSpki)) return null;
+  for (var i = 0; i < certs.length; i++) {
+    var spki;
+    try { spki = schemaX509.parse(certs[i]).subjectPublicKeyInfo; }
+    catch (_e) { continue; }
+    if (spki && Buffer.isBuffer(spki.bytes) && spki.bytes.equals(wantSpki)) return certs[i];
+  }
+  return null;
+}
+// Normalize an expected fingerprint (hex string, optionally colon/space separated, or a Buffer) to
+// { algorithm, value }. Character-scan the hex (Hard rule #11).
+function _normalizeFingerprint(fp, algName) {
+  var algorithm = _foldLower(String(algName == null ? "sha256" : algName));
+  // Validate the digest name at the entry point so a misspelled or build-unavailable fingerprintAlgorithm
+  // is the typed scep/bad-input the client API documents, not a native createHash exception downstream.
+  try { nodeCrypto.createHash(algorithm); }
+  catch (_e) { throw _err("scep/bad-input", "fingerprintAlgorithm " + JSON.stringify(algorithm) + " is not an available hash"); }
+  var value;
+  if (Buffer.isBuffer(fp)) value = Buffer.from(fp);
+  else if (typeof fp === "string") {
+    var hex = "", i, n = fp.length;
+    for (i = 0; i < n; i++) {
+      var c = fp.charCodeAt(i);
+      if ((c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70)) hex += fp.charAt(i);
+      else if (c === 0x3a || c === 0x20) continue;
+      else throw _err("scep/bad-input", "expectedFingerprint must be a hex string or a Buffer");
+    }
+    if (hex.length === 0 || hex.length % 2 !== 0) throw _err("scep/bad-input", "expectedFingerprint hex has an odd or zero length");
+    value = Buffer.from(hex, "hex");
+  } else throw _err("scep/bad-input", "expectedFingerprint must be a hex string or a Buffer");
+  return { algorithm: algorithm, value: value };
+}
+
+/**
+ * @primitive  pki.scep.getCACert
+ * @signature  pki.scep.getCACert(baseUrl, opts?) -> Promise<{ caCertificate, certificates }>
+ * @since      0.6.7
+ * @status     stable
+ * @spec       RFC 8894
+ * @related    pki.scep.enroll, pki.path.validate
+ *
+ * Retrieve a SCEP CA's certificate (RFC 8894 sec. 4.2): a GET `?operation=GetCACert` returning either a
+ * single DER certificate (`application/x-x509-ca-cert`) or a certs-only CMS chain
+ * (`application/x-x509-ca-ra-cert`). GetCACert is served in the clear; the ONLY authentication is an
+ * out-of-band fingerprint (RFC 8894 sec. 2.2). Pass `expectedFingerprint` (a hex string or Buffer, with
+ * `fingerprintAlgorithm` defaulting to SHA-256) and this refuses (`scep/fingerprint-mismatch`) unless a
+ * returned certificate matches it, returning that certificate as `caCertificate`. A single-certificate
+ * response is unambiguously the CA, so `caCertificate` holds it. A ca-ra chain lists the CA, any
+ * intermediates, and RA certificate(s) in a CMS order that does not identify the CA role, so without a
+ * fingerprint `caCertificate` is null and the caller reads `certificates` to identify and authenticate
+ * the CA itself.
+ *
+ * @opts
+ *   - `expectedFingerprint` -- a hex string or Buffer; a returned certificate must hash to it, or the response is refused.
+ *   - `fingerprintAlgorithm` -- the hash for the fingerprint (default "sha256").
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
+ * @example
+ *   // requires: scepCaCertTransport -- an injected transport returning a single CA certificate
+ *   var ca = await pki.scep.getCACert("http://ca.example/scep", { transport: scepCaCertTransport });
+ *   ca.caCertificate;   // the CA certificate DER (a single-certificate response identifies it)
+ */
+async function getCACert(baseUrl, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep.getCACert options");
+  guard.identifier.assertKnownKeys(opts, _CACERT_KEYS, _err, "scep/bad-input", "pki.scep.getCACert has an unknown option: ");
+  // Normalize the expected fingerprint at the synchronous entry point: fail fast on a bad hash before the
+  // network call, and pin against the value the caller supplied at the call rather than one mutated while
+  // the GET is in flight.
+  var fp = opts.expectedFingerprint != null ? _normalizeFingerprint(opts.expectedFingerprint, opts.fingerprintAlgorithm) : null;
+  var res = await _client("GET", _scepUrl(baseUrl, "GetCACert"), null, {}, opts);
+  var body = _requireOk(res, [CT_CA_CERT, CT_CA_RA_CERT], "GetCACert");
+  var ct = _mediaType(_header(res.headers, "content-type")), certs, single = false;
+  if (ct === CT_CA_CERT) {
+    try { schemaX509.parse(body); } catch (e) { throw _err("scep/bad-response", "the GetCACert response is not a valid X.509 certificate", e); }
+    certs = [Buffer.from(body)];
+    single = true;
+  } else {
+    // parseCertsOnly fails closed with scep/no-certificates on an empty CertificateSet, so certs is non-empty here.
+    certs = schemaCms.parseCertsOnly(body, _err, "scep").certificates;
+  }
+  var caCertificate = null;
+  if (fp != null) {
+    var matched = null, j;
+    for (j = 0; j < certs.length; j++) {
+      var got = nodeCrypto.createHash(fp.algorithm).update(certs[j]).digest();
+      if (got.length === fp.value.length && got.equals(fp.value)) { matched = certs[j]; break; }
+    }
+    if (!matched) throw _err("scep/fingerprint-mismatch", "no GetCACert certificate matched the expected " + fp.algorithm + " fingerprint (RFC 8894 sec. 2.2)");
+    caCertificate = matched;
+  } else if (single) {
+    // A single-certificate response (application/x-x509-ca-cert) is unambiguously the CA certificate. A
+    // ca-ra chain carries the CA, any intermediates, and RA certificate(s) in a CMS CertificateSet whose
+    // DER order does not identify the CA role, so caCertificate stays null there unless a fingerprint pins it.
+    caCertificate = certs[0];
+  }
+  return { caCertificate: caCertificate, certificates: certs };
+}
+
+// The default transaction ID: 16 random bytes, hex-encoded. RFC 8894 sec. 3.2.1.1 requires the ID to be
+// unique per operation, so a per-key value would collide across separate enrollments of the same key (a
+// renewal could not be told from the original request). A caller wanting a stable per-device ID passes an
+// explicit transactionId.
+function _defaultTransactionId() {
+  return nodeCrypto.randomBytes(16).toString("hex");
+}
+async function _pkiOperation(messageType, baseUrl, opts, verbName) {
+  opts = guard.identifier.optionsObject(opts, _err, "scep/bad-input", "pki.scep." + verbName + " options");
+  guard.identifier.assertKnownKeys(opts, _ENROLL_KEYS, _err, "scep/bad-input", "pki.scep." + verbName + " has an unknown option: ");
+  if (opts.csr == null) throw _err("scep/bad-input", "a csr (PKCS#10 DER) is required");
+  if (opts.caCert == null) throw _err("scep/bad-input", "a caCert (the SCEP CA certificate DER) is required");
+  if (opts.signer == null || typeof opts.signer !== "object") throw _err("scep/bad-input", "a signer { cert, key } is required");
+  if (opts.recipientKey == null || typeof opts.recipientKey !== "object") throw _err("scep/bad-input", "a recipientKey { cert, key } is required to decrypt the CA response");
+  // Snapshot the response-authentication inputs at the synchronous entry point: the response is
+  // authenticated (signerCert) and decrypted (recipientKey) only after the build and POST awaits, so a
+  // caller mutating opts mid-flight cannot switch the trusted signer, or the CA the request was encrypted
+  // to, out from under the exchange. Certificate bytes are copied; the recipient private key and the
+  // request signer are held by reference.
+  var caCert = guard.bytes.snapshotSource(opts.caCert, ScepError, "scep/bad-input", "the caCert");
+  var signerCert = opts.responderCert != null ? guard.bytes.snapshotSource(opts.responderCert, ScepError, "scep/bad-input", "the responderCert") : caCert;
+  // Capture the recipient-key FIELDS at the door (snapshotSource copies the cert bytes; the private key is
+  // held by reference), not the opts.recipientKey object: a caller replacing opts.recipientKey.cert or .key
+  // while the POST is in flight must not switch the credential the response is decrypted with.
+  var recipientKey = _captureRecipientKey(opts.recipientKey);
+  var signer = opts.signer;
+  // The transport options are read by _client only after the build await, so snapshot them at the door too:
+  // a caller replacing opts.transport (rerouting the completed request) or opts.tls.cert/.key (presenting the
+  // next operation's mTLS identity) while the POST is in flight must not take effect. tls is shallow-copied
+  // so a replaced field does not reach the transport; the transport function and budgets are held by value.
+  var clientOpts = {
+    transport: opts.transport,
+    tls: opts.tls != null ? Object.assign({}, opts.tls) : opts.tls,
+    maxRedirects: opts.maxRedirects,
+    allowCrossOriginRedirect: opts.allowCrossOriginRedirect,
+    timeout: opts.timeout,
+    maxResponseBytes: opts.maxResponseBytes,
+  };
+  // Resolve the request URL at the door: _scepUrl reads String(baseUrl) only when the POST is sent (after the
+  // build await), so a baseUrl whose toString() the caller changes mid-flight could otherwise redirect it.
+  var postUrl = _scepUrl(baseUrl, "PKIOperation");
+  var csrView = guard.bytes.snapshotSource(opts.csr, ScepError, "scep/bad-input", "the csr");
+  var spki;
+  try { spki = schemaCsr.parse(csrView).subjectPublicKeyInfo; }
+  catch (e) { throw _err("scep/bad-input", "the csr is not a valid PKCS#10 CertificationRequest", e); }
+  var senderNonce = nodeCrypto.randomBytes(16);
+  var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
+  var reqMsg = await build({ messageType: messageType, messageData: csrView, recipient: caCert, signer: signer, transactionId: transactionId, senderNonce: senderNonce });
+  var res = await _client("POST", postUrl, reqMsg, { "content-type": CT_PKI_MESSAGE }, clientOpts);
+  var body = _requireOk(res, [CT_PKI_MESSAGE], "PKIOperation");
+  var rep = await parse(body, { signerCert: signerCert, expectedSenderNonce: senderNonce, recipientKey: recipientKey });
+  if (rep.messageType !== "CertRep") throw _err("scep/unexpected-message-type", "the SCEP response is a " + rep.messageType + ", not a CertRep");
+  // Every message in one SCEP transaction carries the same transactionID (RFC 8894 sec. 3.2.1.1); a
+  // response whose transactionID does not echo the request is for a different exchange and is refused,
+  // even if its nonce and signer check out.
+  if (rep.transactionId !== transactionId) throw _err("scep/transaction-id-mismatch", "the CertRep transactionID does not match the request (RFC 8894 sec. 3.2.1.1)");
+  if (rep.pkiStatus === "FAILURE") {
+    // Surface the CA's reason as structured fields, not only interpolated text, so a caller can branch on
+    // the failInfo enumerant (RFC 8894 sec. 3.3.2.1) without parsing the human-readable message.
+    var failErr = _err("scep/enrollment-failed", "the CA refused the request with failInfo " + JSON.stringify(rep.failInfo) + (rep.failInfoText ? " (" + rep.failInfoText + ")" : ""));
+    failErr.failInfo = rep.failInfo;
+    failErr.failInfoText = rep.failInfoText;
+    throw failErr;
+  }
+  if (rep.pkiStatus === "PENDING") return { status: "PENDING", transactionId: rep.transactionId, senderNonce: senderNonce };
+  var repCerts = rep.certificates || [];
+  var issued = findIssuedCert(repCerts, spki.bytes);
+  if (issued == null) throw _err("scep/no-issued-cert", "the SUCCESS CertRep did not carry a certificate matching the request public key");
+  // A CMS CertificateSet states no issuance order, so a second certificate carrying the request public key
+  // (a same-key renewal returning old and new, or a duplicate) leaves the issued certificate ambiguous; it
+  // is refused rather than resolved by position.
+  if (findIssuedCert(repCerts.filter(function (c) { return c !== issued; }), spki.bytes) != null) {
+    throw _err("scep/ambiguous-issued-cert", "the SUCCESS CertRep carried more than one certificate matching the request public key; the issued certificate is ambiguous (RFC 8894 sec. 3.3)");
+  }
+  return { status: "SUCCESS", certificate: issued, certificates: repCerts, transactionId: rep.transactionId };
+}
+
+/**
+ * @primitive  pki.scep.enroll
+ * @signature  pki.scep.enroll(baseUrl, opts) -> Promise<{ status, certificate?, certificates?, transactionId }>
+ * @since      0.6.7
+ * @status     stable
+ * @spec       RFC 8894
+ * @related    pki.scep.build, pki.scep.getCACert, pki.csr.sign
+ *
+ * Enrol for a certificate over SCEP (RFC 8894 sec. 4.3): build a PKCSReq wrapping the caller's PKCS#10 in
+ * a pkcsPKIEnvelope encrypted to the CA certificate, HTTP POST it to `?operation=PKIOperation`, and read
+ * the CertRep. The CA response is authenticated against the CA certificate and its `recipientNonce` must
+ * echo the request's fresh `senderNonce`. On SUCCESS the issued certificate is selected out of the
+ * response by SubjectPublicKeyInfo byte-match against the request; a FAILURE throws
+ * `scep/enrollment-failed` carrying the CA's failInfo; a PENDING returns `{ status: "PENDING",
+ * transactionId }` for the caller to retry. The content key is transported under RSAES-OAEP, so the CA
+ * certificate must be an RSA `keyEncipherment` certificate that accepts OAEP; the shared-secret
+ * authenticator (RFC 8894 sec. 2.4) is the `challengePassword` the caller placed in the PKCS#10.
+ *
+ * @opts
+ *   - `csr` -- the PKCS#10 CertificationRequest DER to enrol (place a `challengePassword` in it for shared-secret auth).
+ *   - `caCert` -- the SCEP CA certificate DER the request is encrypted to.
+ *   - `signer` -- `{ cert, key }`, the outer SignedData signer (for a PKCSReq, a self-signed certificate over the request key).
+ *   - `recipientKey` -- `{ cert, key }`, the RSA key the CA encrypts the response to, to decrypt the CertRep.
+ *   - `responderCert` -- the certificate to authenticate the CA's response signature against (defaults to `caCert`).
+ *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded, unique per call).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` -- transport bounds.
+ * @example
+ *   // requires: scepCsr, caCertDer, clientCertDer, clientKeyPkcs8, scepTransport
+ *   var out = await pki.scep.enroll("http://ca.example/scep", { csr: scepCsr, caCert: caCertDer,
+ *     signer: { cert: clientCertDer, key: clientKeyPkcs8 },
+ *     recipientKey: { cert: clientCertDer, key: clientKeyPkcs8 }, transport: scepTransport });
+ *   out.status;   // "SUCCESS", or "PENDING" to retry
+ */
+function enroll(baseUrl, opts) { return _pkiOperation("PKCSReq", baseUrl, opts, "enroll"); }
+
+/**
+ * @primitive  pki.scep.renew
+ * @signature  pki.scep.renew(baseUrl, opts) -> Promise<{ status, certificate?, certificates?, transactionId }>
+ * @since      0.6.7
+ * @status     stable
+ * @spec       RFC 8894
+ * @related    pki.scep.enroll
+ *
+ * Renew a certificate over SCEP (RFC 8894 sec. 4.3): identical to `enroll` but building a RenewalReq,
+ * whose outer SignedData is signed with the caller's existing CA-issued certificate rather than a
+ * self-signed one. Because the request is signed with the existing key and not the new PKCS#10 key, a
+ * RenewalReq does not itself prove possession of the new key (RFC 8894 sec. 7.6); the proof-of-possession
+ * over the PKCS#10 is still verified. Options are the same as `enroll`, with `signer` being the existing
+ * certificate and key.
+ *
+ * @example
+ *   // requires: scepCsr, caCertDer, clientCertDer, clientKeyPkcs8, scepTransport
+ *   var out = await pki.scep.renew("http://ca.example/scep", { csr: scepCsr, caCert: caCertDer,
+ *     signer: { cert: clientCertDer, key: clientKeyPkcs8 },
+ *     recipientKey: { cert: clientCertDer, key: clientKeyPkcs8 }, transport: scepTransport });
+ */
+function renew(baseUrl, opts) { return _pkiOperation("RenewalReq", baseUrl, opts, "renew"); }
+
+var _TRANSPORT_KEYS = { transport: 1, timeout: 1, maxResponseBytes: 1, maxRedirects: 1, tls: 1, allowCrossOriginRedirect: 1 };
+function _withKeys(extra) { var o = {}, k; for (k in _TRANSPORT_KEYS) o[k] = 1; for (k in extra) o[k] = 1; return o; }
+var _CACAPS_KEYS = _withKeys({ expectSCEPStandard: 1, requireStrongProfile: 1 });
+var _CACERT_KEYS = _withKeys({ expectedFingerprint: 1, fingerprintAlgorithm: 1 });
+var _ENROLL_KEYS = _withKeys({ csr: 1, caCert: 1, signer: 1, recipientKey: 1, responderCert: 1, transactionId: 1 });
+
 module.exports = {
   build: build,
   parse: parse,
+  getCACaps: getCACaps,
+  getCACert: getCACert,
+  enroll: enroll,
+  renew: renew,
+  parseCapabilities: parseCapabilities,
   MESSAGE_TYPES: MESSAGE_TYPE,
   PKI_STATUS: PKI_STATUS,
   FAIL_INFO: FAIL_INFO,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a919550f-e9fd-4370-816d-2d179d45f774",
+  "serialNumber": "urn:uuid:2201f01a-1b89-4433-a2aa-df6cc354e171",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-31T07:36:11.594Z",
+    "timestamp": "2026-08-31T11:43:15.117Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.6",
+      "bom-ref": "@blamejs/pki@0.6.7",
       "type": "application",
       "name": "pki",
-      "version": "0.6.6",
+      "version": "0.6.7",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.6",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.7",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.6",
+      "ref": "@blamejs/pki@0.6.7",
       "dependsOn": []
     }
   ]