@blamejs/pki 0.5.26 → 0.5.28

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.28 — 2026-08-23
+
+Importing the toolkit is now silent, and a key's WebCrypto algorithm can no longer change under a signature once the key has been created.
+
+### Changed
+
+- `require("@blamejs/pki")` no longer prints Node experimental-feature warnings on load. The engine's typed-array scan reads each global's property descriptor and uses only a data value, so it never touches a host's lazy accessor (Node's `localStorage` and `WASI` emit an `ExperimentalWarning` the moment they are read). Recognition of the concrete typed-array kinds -- the reason for the scan -- is unchanged, since those are ordinary data properties.
+
+### Security
+
+- A `CryptoKey`'s `algorithm` is immutable once the key is created: the property is non-writable so it cannot be replaced, and its value is frozen so its fields cannot be changed. This engine reads `key.algorithm.hash` at sign time, and a mutable algorithm let the hash checked against a JWS `alg` (an `RS256` header signs under SHA-256) be rewritten between that check and the signature -- by swapping the whole object or a field of it, including from a microtask during the signing await -- producing a JWS whose signature does not match the algorithm its header advertises. The frozen value is a copy, so a caller's own `importKey` parameters object is left untouched. A key adopted from another WebCrypto implementation is re-imported from its own algorithm; the keys this engine mints, which is what the enrollment builders sign with, carry the immutable one.
+
+## v0.5.27 — 2026-08-22
+
+A mistyped option passed to pki.trust.anchor or the pki.acme.client constructor is now refused, naming it, instead of being read as absent and silently defaulted.
+
+### Changed
+
+- `pki.trust.anchor(entry, opts)` rejects an option it does not recognize, naming it, instead of ignoring it and applying the default. The one option it reads is `purpose`.
+- The `pki.acme.client(directoryUrl, opts)` constructor rejects an unrecognized option the same way. The options it reads are `accountKey`, `accountJwk`, `alg`, `transport`, `tls`, `timeout`, `maxResponseBytes`, `maxRedirects`, `maxNonceRetries`, `maxPolls`, `maxTotalWait`, `sleep`, and `clock`; each method the client returns validates its own per-call options separately.
+
+### Security
+
+- An unrecognized option is a fail-closed error rather than a silent default. The prior behavior meant a security-relevant option -- a shorter redirect budget, a specific trust purpose -- that was misspelled took no effect and raised no error, so a caller could believe a stricter setting was in force when the default was.
+
 ## v0.5.26 — 2026-08-22
 
 Revoking a certificate and asking a certification authority what it offers now go through the same verified CMP transaction as enrollment.

package/lib/acme.js

@@ -1947,8 +1947,17 @@ function _parseLinkAlternates(headers, base) {
  *   var acct = await acme.newAccount({ termsOfServiceAgreed: true });
  *   var ord = await acme.newOrder({ identifiers: [{ type: "dns", value: "example.org" }] });
  */
+// The options pki.acme.client reads at construction. A near-miss spelling (a plural, a sibling verb's
+// word, a dropped letter) must be refused with a message naming it, not read as undefined and silently
+// defaulted -- a mistyped `maxRedirects` or `transport` would otherwise change the client's behavior with
+// no error. The per-request options each returned method takes are checked in those methods, not here.
+var _CLIENT_OPTS = {
+  accountKey: 1, accountJwk: 1, alg: 1, transport: 1, tls: 1, timeout: 1, maxResponseBytes: 1,
+  maxRedirects: 1, maxNonceRetries: 1, maxPolls: 1, maxTotalWait: 1, sleep: 1, clock: 1,
+};
 function client(directoryUrl, opts) {
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, E, "acme/bad-input", "pki.acme.client options");
+  guard.identifier.assertKnownKeys(opts, _CLIENT_OPTS, E, "acme/bad-input", "unknown pki.acme.client option ");
   if (!opts.accountKey) throw E("acme/bad-input", "client requires opts.accountKey (the account private key)");
   if (!_isObject(opts.accountJwk)) throw E("acme/bad-input", "client requires opts.accountJwk (the account public JWK)");
   if (!_isString(opts.alg)) throw E("acme/bad-input", "client requires opts.alg (the account-key JWS alg)");

package/lib/guard-identifier.js

@@ -433,13 +433,17 @@ var _INTRINSIC_HOLDERS = (function () {
   // built over `%TypedArray%.prototype`, and a bag inheriting `BYTES_PER_ELEMENT` from such an
   // object then read as an intrinsic member rather than as the unknown option it was.
   //
-  // Reading a global can run a getter, and a deprecated one can throw; a fault here would break
-  // this module's load over a name it does not need.
+  // Read the DESCRIPTOR, never the value through the runtime. `globalThis[n]` invokes a getter, and a
+  // host may define one that warns on read -- Node exposes `localStorage` and `WASI` as lazy accessors
+  // that emit an ExperimentalWarning the moment they are touched, so a plain read here printed that
+  // warning on every import -- or one that throws. A typed-array constructor is a plain data property, so
+  // taking `d.value` finds every concrete kind without ever invoking an accessor, which also means such
+  // an accessor can neither warn nor fault this load over a name it does not need.
   _forEach(_getOwnPropertyNames(globalThis), function (n) {
-    var C;
-    try { C = globalThis[n]; }
-    catch (_e) { /* allow:swallow-unverified this runs once at load over whatever globals the host defines, and no global in a supported runtime throws on read, so no test drives it; it is here so an embedder's throwing accessor cannot stop this module loading over a name it does not need */ return; }
-    if (typeof C !== "function" || typeof C.BYTES_PER_ELEMENT !== "number") return;
+    var d = _getOwnPropertyDescriptor(globalThis, n);
+    if (!d || typeof d.value !== "function") return;
+    var C = d.value;
+    if (typeof C.BYTES_PER_ELEMENT !== "number") return;
     if (!C.prototype || _getPrototypeOf(C.prototype) !== _TYPED_ARRAY_PROTO) return;
     _mapSet(m, C.prototype, _CONCRETE_TYPED_MEMBERS);
   });

package/lib/trust.js

@@ -629,6 +629,9 @@ function _csvDate(cell, label) {
   if (!m) throw E("trust/bad-csv", label + " must be a Y-M-D date, got " + JSON.stringify(s));
   var pad = function (x) { return x.length === 1 ? "0" + x : x; };
   var payload = Buffer.from(m[1] + pad(m[2]) + pad(m[3]) + "235959Z", "latin1");
+  // _strictTime tags every rejection (a rolled-over month/day among them) with the code passed here,
+  // so the re-throw carries it unchanged; the wrap normalizes any other failure to the same typed code
+  // so a bad row is always trust/bad-csv, never an untyped exception escaping parseCcadbCsv.
   try { return _strictTime(payload, "trust/bad-csv", label); }
   catch (e) {
     if (e && e.code === "trust/bad-csv") throw e;
@@ -774,11 +777,16 @@ function parseCcadbCsv(text) {
  *   await pki.path.validate([pki.schema.x509.parse(der)],
  *     { time: new Date("2026-06-01T00:00:00Z"), trustAnchor: anchor, checkPurpose: "serverAuth" });
  */
+// `purpose` is the only option, and it gates the authorization itself, so a near-miss spelling must not
+// pass silently: a caller who wrote the plural `purposes` (or carried a sibling's word) would otherwise get
+// the anchor with NO purpose restriction rather than an error naming the option they meant.
+var _ANCHOR_OPTS = { purpose: 1 };
 function anchor(entry, opts) {
   if (!entry || typeof entry !== "object") {
     throw E("trust/bad-input", "anchor expects a trust-store entry ({ name, publicKey, algorithm, ... })");
   }
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, E, "trust/bad-input", "pki.trust.anchor options");
+  guard.identifier.assertKnownKeys(opts, _ANCHOR_OPTS, E, "trust/bad-input", "unknown pki.trust.anchor option ");
   // Where this entry came from a store, everything the anchor asserts is read from the record the
   // store minted, not from the entry -- the entry is a plain object the caller holds and can write
   // to. `purposes` is the authorization itself, so an entry whose serverAuth bit was flipped after

package/lib/webcrypto.js

@@ -254,7 +254,20 @@ var SECRET_KEY_NAMES = { "AES-GCM": true, "AES-CBC": true, "AES-CTR": true, "AES
 function CryptoKey(type, extractable, algorithm, usages, handle) {
   this.type = type;
   this.extractable = !!extractable;
-  this.algorithm = algorithm;
+  // The algorithm is immutable both ways. The PROPERTY is defined non-writable and non-configurable so
+  // it cannot be REPLACED wholesale (`key.algorithm = { hash: "SHA-512" }`), and its value is a frozen
+  // COPY -- a caller's importKey params object is left untouched -- so its fields, the nested `hash` an
+  // RSA/HMAC signature reads among them, cannot be MUTATED. This engine reads key.algorithm.hash live
+  // when it signs, and a W3C CryptoKey's [[algorithm]] is immutable for exactly this reason: neither
+  // swapping the object nor a field of it (e.g. from a microtask during a signing await) can make the
+  // hash the signature is computed under differ from the one checked against a header algorithm.
+  var frozenAlg = algorithm;
+  if (frozenAlg && typeof frozenAlg === "object") {
+    frozenAlg = _assign({}, algorithm);
+    if (frozenAlg.hash && typeof frozenAlg.hash === "object") frozenAlg.hash = intrinsic.freeze(_assign({}, frozenAlg.hash));
+    frozenAlg = intrinsic.freeze(frozenAlg);
+  }
+  _defineProperty(this, "algorithm", { value: frozenAlg, enumerable: true });
   // The copy is what the key will be asked about for the rest of its life, so the method that makes
   // it is the captured one: a replaced `slice` hands back a list the caller still controls. The
   // list-ness is checked rather than left to the copy to discover -- `Array.prototype.slice` on a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.26",
+  "version": "0.5.28",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:af65ad7a-ef35-4bc4-8aef-24a43cb8ece0",
+  "serialNumber": "urn:uuid:c0564356-6da6-47da-a75d-a05ee2125d32",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-23T00:05:35.940Z",
+    "timestamp": "2026-08-23T03:34:40.100Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.26",
+      "bom-ref": "@blamejs/pki@0.5.28",
       "type": "application",
       "name": "pki",
-      "version": "0.5.26",
+      "version": "0.5.28",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.26",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.28",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.26",
+      "ref": "@blamejs/pki@0.5.28",
       "dependsOn": []
     }
   ]