@blamejs/pki 0.5.26 → 0.5.27

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.27 — 2026-08-23
+
+A mistyped option passed to pki.trust.anchor or the pki.acme.client constructor is now refused, naming it, instead of being read as absent and silently defaulted.
+
+### Changed
+
+- `pki.trust.anchor(entry, opts)` rejects an option it does not recognize, naming it, instead of ignoring it and applying the default. The one option it reads is `purpose`.
+- The `pki.acme.client(directoryUrl, opts)` constructor rejects an unrecognized option the same way. The options it reads are `accountKey`, `accountJwk`, `alg`, `transport`, `tls`, `timeout`, `maxResponseBytes`, `maxRedirects`, `maxNonceRetries`, `maxPolls`, `maxTotalWait`, `sleep`, and `clock`; each method the client returns validates its own per-call options separately.
+
+### Security
+
+- An unrecognized option is a fail-closed error rather than a silent default. The prior behavior meant a security-relevant option -- a shorter redirect budget, a specific trust purpose -- that was misspelled took no effect and raised no error, so a caller could believe a stricter setting was in force when the default was.
+
 ## v0.5.26 — 2026-08-22
 
 Revoking a certificate and asking a certification authority what it offers now go through the same verified CMP transaction as enrollment.

package/lib/acme.js

@@ -1947,8 +1947,17 @@ function _parseLinkAlternates(headers, base) {
  *   var acct = await acme.newAccount({ termsOfServiceAgreed: true });
  *   var ord = await acme.newOrder({ identifiers: [{ type: "dns", value: "example.org" }] });
  */
+// The options pki.acme.client reads at construction. A near-miss spelling (a plural, a sibling verb's
+// word, a dropped letter) must be refused with a message naming it, not read as undefined and silently
+// defaulted -- a mistyped `maxRedirects` or `transport` would otherwise change the client's behavior with
+// no error. The per-request options each returned method takes are checked in those methods, not here.
+var _CLIENT_OPTS = {
+  accountKey: 1, accountJwk: 1, alg: 1, transport: 1, tls: 1, timeout: 1, maxResponseBytes: 1,
+  maxRedirects: 1, maxNonceRetries: 1, maxPolls: 1, maxTotalWait: 1, sleep: 1, clock: 1,
+};
 function client(directoryUrl, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, E, "acme/bad-input", "pki.acme.client options");
+  guard.identifier.assertKnownKeys(opts, _CLIENT_OPTS, E, "acme/bad-input", "unknown pki.acme.client option ");
   if (!opts.accountKey) throw E("acme/bad-input", "client requires opts.accountKey (the account private key)");
   if (!_isObject(opts.accountJwk)) throw E("acme/bad-input", "client requires opts.accountJwk (the account public JWK)");
   if (!_isString(opts.alg)) throw E("acme/bad-input", "client requires opts.alg (the account-key JWS alg)");

package/lib/trust.js

@@ -629,6 +629,9 @@ function _csvDate(cell, label) {
   if (!m) throw E("trust/bad-csv", label + " must be a Y-M-D date, got " + JSON.stringify(s));
   var pad = function (x) { return x.length === 1 ? "0" + x : x; };
   var payload = Buffer.from(m[1] + pad(m[2]) + pad(m[3]) + "235959Z", "latin1");
+  // _strictTime tags every rejection (a rolled-over month/day among them) with the code passed here,
+  // so the re-throw carries it unchanged; the wrap normalizes any other failure to the same typed code
+  // so a bad row is always trust/bad-csv, never an untyped exception escaping parseCcadbCsv.
   try { return _strictTime(payload, "trust/bad-csv", label); }
   catch (e) {
     if (e && e.code === "trust/bad-csv") throw e;
@@ -774,11 +777,16 @@ function parseCcadbCsv(text) {
  *   await pki.path.validate([pki.schema.x509.parse(der)],
  *     { time: new Date("2026-06-01T00:00:00Z"), trustAnchor: anchor, checkPurpose: "serverAuth" });
  */
+// `purpose` is the only option, and it gates the authorization itself, so a near-miss spelling must not
+// pass silently: a caller who wrote the plural `purposes` (or carried a sibling's word) would otherwise get
+// the anchor with NO purpose restriction rather than an error naming the option they meant.
+var _ANCHOR_OPTS = { purpose: 1 };
 function anchor(entry, opts) {
   if (!entry || typeof entry !== "object") {
     throw E("trust/bad-input", "anchor expects a trust-store entry ({ name, publicKey, algorithm, ... })");
   }
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, E, "trust/bad-input", "pki.trust.anchor options");
+  guard.identifier.assertKnownKeys(opts, _ANCHOR_OPTS, E, "trust/bad-input", "unknown pki.trust.anchor option ");
   // Where this entry came from a store, everything the anchor asserts is read from the record the
   // store minted, not from the entry -- the entry is a plain object the caller holds and can write
   // to. `purposes` is the authorization itself, so an entry whose serverAuth bit was flipped after

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.26",
+  "version": "0.5.27",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:af65ad7a-ef35-4bc4-8aef-24a43cb8ece0",
+  "serialNumber": "urn:uuid:3e85b1a0-56f6-459d-a525-da732c14e1d6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-23T00:05:35.940Z",
+    "timestamp": "2026-08-23T02:01:07.534Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.26",
+      "bom-ref": "@blamejs/pki@0.5.27",
       "type": "application",
       "name": "pki",
-      "version": "0.5.26",
+      "version": "0.5.27",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.26",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.27",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.26",
+      "ref": "@blamejs/pki@0.5.27",
       "dependsOn": []
     }
   ]