@blamejs/blamejs-shop 0.4.31 → 0.4.33

package/lib/vendor/blamejs/test/layer-0-primitives/saml-subjectconfirmation-notonorafter.test.js

@@ -0,0 +1,287 @@
+"use strict";
+/**
+ * b.auth.saml.sp.verifyResponse — SubjectConfirmationData NotOnOrAfter
+ * is mandatory and must fail closed.
+ *
+ * SAML 2.0 Web Browser SSO Profile §4.1.4.2 requires every Bearer
+ * SubjectConfirmationData to carry a `NotOnOrAfter` attribute that
+ * bounds the assertion's freshness window. A SubjectConfirmationData
+ * with no NotOnOrAfter — or an unparseable one — must be rejected:
+ * accepting it grants an unbounded, replay-forever confirmation. The
+ * Holder-of-Key confirmation (Profile §3.1, which incorporates the
+ * §3 time-bounding by reference) has the same requirement.
+ *
+ * These tests drive the shipped consumer path:
+ *   sp = b.auth.saml.sp.create({ ... }); sp.verifyResponse(b64, vopts).
+ * They mint a self-signed RSA IdP cert, build a genuinely XMLDSig-
+ * signed SAML Response (digest + SignatureValue computed through the
+ * framework's own b.xmlC14n so the verifier's recomputation matches),
+ * and vary ONLY the SubjectConfirmationData's NotOnOrAfter between the
+ * accepted and refused cases.
+ */
+
+var helpers    = require("../helpers");
+var check      = helpers.check;
+var b          = helpers.b;
+var nodeCrypto = require("node:crypto");
+var c14n       = require("../../lib/xml-c14n");
+
+var DS  = "http://www.w3.org/2000/09/xmldsig#";
+var EXC = "http://www.w3.org/2001/10/xml-exc-c14n#";
+
+var IDP_ENTITY_ID = "https://idp.example";
+var SP_ENTITY_ID  = "https://sp.example";
+var ACS_URL       = "https://sp.example/saml/acs";
+
+// Mint a self-signed RSA cert via the vendored @peculiar/x509 bundle.
+// verifyResponse parses idpCertPem with nodeCrypto.createPublicKey and
+// verifies an rsa-sha256 PKCS1 signature, so a real RSA cert + matching
+// private key is required — there is no test bypass of the signature
+// check.
+async function _mintRsaCert(cn) {
+  var pki  = require("../../lib/vendor/pki.cjs");
+  var x509 = pki.x509;
+  var keys = await nodeCrypto.webcrypto.subtle.generateKey(
+    { name: "RSASSA-PKCS1-v1_5", modulusLength: 2048,                                           // allow:raw-byte-literal — RFC 8301 §3.1 RSA bit floor
+      publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
+    true, ["sign", "verify"]);
+  var now = new Date();
+  var cert = await x509.X509CertificateGenerator.createSelfSigned({
+    serialNumber:     "01",
+    name:             "CN=" + cn,
+    notBefore:        now,
+    notAfter:         new Date(now.getTime() + 365 * 24 * 3600 * 1000),                         // allow:raw-time-literal — 1y fixture validity
+    signingAlgorithm: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    keys:             keys,
+  });
+  var pkcs8 = await nodeCrypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+  var keyPem = "-----BEGIN PRIVATE KEY-----\n" +
+    Buffer.from(pkcs8).toString("base64").match(/.{1,64}/g).join("\n") +
+    "\n-----END PRIVATE KEY-----\n";
+  return { certPem: cert.toString("pem"), keyPem: keyPem };
+}
+
+function _isoFromNow(ms) { return new Date(Date.now() + ms).toISOString(); }
+
+// Build a SAML Response with an Assertion-level enveloped XMLDSig
+// signature. The Assertion's Signature child is stripped before the
+// digest (the enveloped-signature transform), and both the digest and
+// the SignedInfo are canonicalized through b.xmlC14n so the values
+// match exactly what verifyResponse recomputes.
+function _buildSignedResponse(idp, parts) {
+  var assertionId  = "_assertion-" + parts.tag;
+  var responseId   = "_response-" + parts.tag;
+  var issueInstant = _isoFromNow(0);
+  var subjectConfirmation =
+    "<saml:SubjectConfirmation Method=\"" + parts.method + "\">" +
+    parts.scd +
+    "</saml:SubjectConfirmation>";
+
+  var assertionInner =
+    "<saml:Issuer>" + IDP_ENTITY_ID + "</saml:Issuer>" +
+    "SIGNATURE_PLACEHOLDER" +
+    "<saml:Subject>" +
+    "<saml:NameID Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\">" +
+    parts.nameId + "</saml:NameID>" +
+    subjectConfirmation +
+    "</saml:Subject>" +
+    "<saml:Conditions NotBefore=\"" + _isoFromNow(-5 * 60 * 1000) +                             // allow:raw-time-literal — 5m skew window
+    "\" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\">" +                                 // allow:raw-time-literal — 5m skew window
+    "<saml:AudienceRestriction><saml:Audience>" + SP_ENTITY_ID +
+    "</saml:Audience></saml:AudienceRestriction>" +
+    "</saml:Conditions>" +
+    "<saml:AuthnStatement SessionIndex=\"_sess-1\" AuthnInstant=\"" + issueInstant + "\">" +
+    "<saml:AuthnContext><saml:AuthnContextClassRef>" +
+    "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" +
+    "</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement>";
+
+  var assertionOpen =
+    "<saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" " +
+    "ID=\"" + assertionId + "\" Version=\"2.0\" IssueInstant=\"" + issueInstant + "\">";
+  var assertionClose = "</saml:Assertion>";
+
+  // Digest the assertion with no Signature child (enveloped-signature
+  // transform output), canonicalized through b.xmlC14n.
+  var assertionNoSig = assertionOpen +
+    assertionInner.replace("SIGNATURE_PLACEHOLDER", "") + assertionClose;
+  var digest = nodeCrypto.createHash("sha256")
+    .update(c14n.canonicalize(assertionNoSig)).digest("base64");
+
+  var signedInfo =
+    "<ds:SignedInfo xmlns:ds=\"" + DS + "\">" +
+    "<ds:CanonicalizationMethod Algorithm=\"" + EXC + "\"></ds:CanonicalizationMethod>" +
+    "<ds:SignatureMethod Algorithm=\"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256\"></ds:SignatureMethod>" +
+    "<ds:Reference URI=\"#" + assertionId + "\">" +
+    "<ds:Transforms>" +
+    "<ds:Transform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"></ds:Transform>" +
+    "<ds:Transform Algorithm=\"" + EXC + "\"></ds:Transform>" +
+    "</ds:Transforms>" +
+    "<ds:DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"></ds:DigestMethod>" +
+    "<ds:DigestValue>" + digest + "</ds:DigestValue>" +
+    "</ds:Reference>" +
+    "</ds:SignedInfo>";
+  var priv = nodeCrypto.createPrivateKey({ key: idp.keyPem, format: "pem" });
+  var sigValue = nodeCrypto.sign("sha256", c14n.canonicalize(signedInfo),
+    { key: priv, padding: nodeCrypto.constants.RSA_PKCS1_PADDING }).toString("base64");
+
+  var signatureXml =
+    "<ds:Signature xmlns:ds=\"" + DS + "\">" + signedInfo +
+    "<ds:SignatureValue>" + sigValue + "</ds:SignatureValue></ds:Signature>";
+  var assertionFull = assertionOpen +
+    assertionInner.replace("SIGNATURE_PLACEHOLDER", signatureXml) + assertionClose;
+
+  var response =
+    "<samlp:Response xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" " +
+    "xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" " +
+    "ID=\"" + responseId + "\" Version=\"2.0\" IssueInstant=\"" + issueInstant + "\" " +
+    "Destination=\"" + ACS_URL + "\">" +
+    "<saml:Issuer>" + IDP_ENTITY_ID + "</saml:Issuer>" +
+    "<samlp:Status><samlp:StatusCode Value=\"urn:oasis:names:tc:SAML:2.0:status:Success\"/></samlp:Status>" +
+    assertionFull + "</samlp:Response>";
+
+  return Buffer.from(response, "utf8").toString("base64");
+}
+
+function _bearerScd(notOnOrAfterAttr, inResponseTo) {
+  return "<saml:SubjectConfirmationData" + notOnOrAfterAttr +
+    " Recipient=\"" + ACS_URL + "\"" +
+    " InResponseTo=\"" + inResponseTo + "\"/>";
+}
+
+function _certBodyB64(pem) {
+  return pem.replace(/-----BEGIN CERTIFICATE-----/, "")
+            .replace(/-----END CERTIFICATE-----/, "")
+            .replace(/\s+/g, "");
+}
+
+function _hokScd(notOnOrAfterAttr, holderCertPem) {
+  return "<saml:SubjectConfirmationData" + notOnOrAfterAttr +
+    " Recipient=\"" + ACS_URL + "\">" +
+    "<ds:KeyInfo xmlns:ds=\"" + DS + "\"><ds:X509Data><ds:X509Certificate>" +
+    _certBodyB64(holderCertPem) +
+    "</ds:X509Certificate></ds:X509Data></ds:KeyInfo>" +
+    "</saml:SubjectConfirmationData>";
+}
+
+function _newSp(idp) {
+  return b.auth.saml.sp.create({
+    entityId:                    SP_ENTITY_ID,
+    assertionConsumerServiceUrl: ACS_URL,
+    idpEntityId:                 IDP_ENTITY_ID,
+    idpSsoUrl:                   "https://idp.example/sso",
+    idpCertPem:                  idp.certPem,
+  });
+}
+
+function _verifyThrows(sp, b64, vopts) {
+  try { sp.verifyResponse(b64, vopts); return null; }
+  catch (e) { return e.code || e.message; }
+}
+
+// Case 1 — a valid future NotOnOrAfter succeeds. Proves the signer +
+// harness are correct and the fail-closed fix does not break the
+// happy path.
+async function testBearerValidNotOnOrAfterAccepted() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-valid";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-valid",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd(" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\"", inResponseTo),   // allow:raw-time-literal — 5m future
+  });
+  var info = sp.verifyResponse(b64, { expectedInResponseTo: inResponseTo });
+  check("Bearer with valid NotOnOrAfter verifies",       info && typeof info === "object");
+  check("Bearer valid: nameId returned",                 info.nameId === "alice@example.com");
+  check("Bearer valid: issuer matches IdP entityID",     info.issuer === IDP_ENTITY_ID);
+  check("Bearer valid: inResponseTo captured",           info.inResponseTo === inResponseTo);
+}
+
+// Case 2 — a Bearer SubjectConfirmationData with NO NotOnOrAfter must
+// be refused (§4.1.4.2). This is the RED case: on the unfixed tree the
+// confirmation is wrongly accepted as fresh-forever.
+async function testBearerMissingNotOnOrAfterRefused() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-missing";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-missing",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd("", inResponseTo),
+  });
+  var code = _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo });
+  check("Bearer missing NotOnOrAfter is refused",
+    code === "auth-saml/no-valid-confirmation");
+}
+
+// Case 3 — a Bearer SubjectConfirmationData with an UNPARSEABLE
+// NotOnOrAfter must be refused (it cannot bound freshness).
+async function testBearerUnparseableNotOnOrAfterRefused() {
+  var idp = await _mintRsaCert("idp.example");
+  var sp  = _newSp(idp);
+  var inResponseTo = "_req-bad";
+  var b64 = _buildSignedResponse(idp, {
+    tag:    "bearer-bad",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:bearer",
+    nameId: "alice@example.com",
+    scd:    _bearerScd(" NotOnOrAfter=\"not-a-date\"", inResponseTo),
+  });
+  var code = _verifyThrows(sp, b64, { expectedInResponseTo: inResponseTo });
+  check("Bearer unparseable NotOnOrAfter is refused",
+    code === "auth-saml/no-valid-confirmation");
+}
+
+// Case 4 — the Holder-of-Key sibling: an HoK SubjectConfirmationData
+// missing NotOnOrAfter (and one with an unparseable value) must be
+// refused. On the unfixed tree both are wrongly accepted (the missing
+// case skips the check; the unparseable case is masked by an `&&`
+// short-circuit).
+async function testHolderOfKeyNotOnOrAfterRefused() {
+  var idp    = await _mintRsaCert("idp.example");
+  var holder = await _mintRsaCert("holder.example");
+  var sp     = _newSp(idp);
+  var vopts  = { holderOfKey: { presentedCertPem: holder.certPem } };
+
+  // Sanity — a valid HoK NotOnOrAfter verifies (harness correctness).
+  var b64ok = _buildSignedResponse(idp, {
+    tag:    "hok-valid",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:holder-of-key",
+    nameId: "bob@example.com",
+    scd:    _hokScd(" NotOnOrAfter=\"" + _isoFromNow(5 * 60 * 1000) + "\"", holder.certPem),    // allow:raw-time-literal — 5m future
+  });
+  var info = sp.verifyResponse(b64ok, vopts);
+  check("HoK with valid NotOnOrAfter verifies",          info && info.nameId === "bob@example.com");
+
+  var b64missing = _buildSignedResponse(idp, {
+    tag:    "hok-missing",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:holder-of-key",
+    nameId: "bob@example.com",
+    scd:    _hokScd("", holder.certPem),
+  });
+  check("HoK missing NotOnOrAfter is refused",
+    _verifyThrows(sp, b64missing, vopts) === "auth-saml/no-valid-confirmation");
+
+  var b64bad = _buildSignedResponse(idp, {
+    tag:    "hok-bad",
+    method: "urn:oasis:names:tc:SAML:2.0:cm:holder-of-key",
+    nameId: "bob@example.com",
+    scd:    _hokScd(" NotOnOrAfter=\"not-a-date\"", holder.certPem),
+  });
+  check("HoK unparseable NotOnOrAfter is refused",
+    _verifyThrows(sp, b64bad, vopts) === "auth-saml/no-valid-confirmation");
+}
+
+async function run() {
+  await testBearerValidNotOnOrAfterAccepted();
+  await testBearerMissingNotOnOrAfterRefused();
+  await testBearerUnparseableNotOnOrAfterRefused();
+  await testHolderOfKeyNotOnOrAfterRefused();
+}
+
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/scheduler-watchdog-stale-settle.test.js

@@ -0,0 +1,71 @@
+"use strict";
+// #130: the scheduler watchdog force-clears task.running after maxJobMs and
+// lets the next tick re-fire. The ORIGINAL (slow) run's promise then settles
+// late and, before the fix, unconditionally wrote back task.running/lastFinish/
+// lastError AND emitted system.scheduler.task.success|failure — clobbering the
+// state the watchdog (and the new run) had moved on from, and double-counting.
+// The fix tags each run with a generation the watchdog + each fire bump; a
+// settle whose tag is stale is ignored.
+//
+// Driven through the public scheduler with a run() whose promise the test
+// controls. RED on the buggy tree: resolving the watchdog-abandoned run emits
+// a stale success. GREEN: it emits nothing; only the current run settles.
+
+var helpers   = require("../helpers");
+var b         = helpers.b;
+var check     = helpers.check;
+var auditMod  = require("../../lib/audit");
+
+var TASK = "wd-stale-settle-test";
+
+async function run() {
+  var realEmit = auditMod.safeEmit;
+  var successes = 0;
+  auditMod.safeEmit = function (ev) {
+    if (ev && ev.action === "system.scheduler.task.success" &&
+        ev.metadata && ev.metadata.name === TASK) {
+      successes += 1;
+    }
+    return realEmit.call(auditMod, ev);
+  };
+
+  var resolvers = [];   // one resolve fn per fire — the test settles them by hand
+  var sched = b.scheduler.create({ maxJobMs: 1, audit: true });   // 1ms watchdog → any stuck run is reaped next tick
+  try {
+    sched.schedule({
+      name:  TASK,
+      every: 1000,       // builder floor is 1000ms; fire 1 ≈ 1s, watchdog re-fire ≈ 2s
+      run:   function () { return new Promise(function (resolve) { resolvers.push(resolve); }); },
+    });
+    sched.start();
+
+    // Wait until the watchdog has reaped fire 1 (still pending) and re-fired,
+    // so two runs exist: resolvers[0] (abandoned) + resolvers[1] (current).
+    await helpers.waitUntil(function () { return resolvers.length >= 2; },
+      { timeoutMs: 9000, label: "#130: watchdog re-fired the task after a stuck run" });
+
+    var before = successes;
+    // Settle the FIRST run — the one the watchdog abandoned. Its late resolve
+    // must NOT emit a success (its generation is stale).
+    resolvers[0]();
+    await helpers.passiveObserve(400, "#130: stale-settle window for the abandoned run");
+    check("#130 a watchdog-abandoned run's late resolve emits NO stale success",
+          successes === before);
+
+    // The current run still settles normally → exactly one success.
+    resolvers[1]();
+    await helpers.waitUntil(function () { return successes === before + 1; },
+      { timeoutMs: 5000, label: "#130: the current run records its success" });
+    check("#130 the current (post-watchdog) run still records its success",
+          successes === before + 1);
+  } finally {
+    sched.stop();
+    auditMod.safeEmit = realEmit;
+  }
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (err) { process.stderr.write(String(err && err.stack || err) + "\n"); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/sd-jwt-vc-ecdsa-p1363.test.js

@@ -0,0 +1,79 @@
+"use strict";
+// #135: SD-JWT-VC ES256/ES384 signatures must be JOSE-encoded (raw r||s,
+// "ieee-p1363"), not node:crypto's default DER. A DER signature (ASN.1
+// SEQUENCE, leading 0x30, ~70-72 bytes for P-256) is rejected by every
+// conformant JOSE / EUDI-wallet verifier, and this library would likewise
+// reject a conformant wallet's raw-r||s signature. The issuer JWT and the
+// holder KB-JWT both sign through the core _signJwt, so the format applies
+// to both.
+//
+// RED on the buggy tree: the issuer-JWT signature is DER (length != 64,
+// first byte 0x30) and a JOSE-conformant verifier (dsaEncoding ieee-p1363)
+// rejects it. GREEN after the fix: signature is exactly 64 bytes and the
+// conformant verifier accepts it.
+
+var helpers = require("../helpers");
+var b = helpers.b;
+var check = helpers.check;
+var nodeCrypto = require("node:crypto");
+var sdJwtVc = b.auth.sdJwtVc;
+
+function _b64uToBuf(s) {
+  return Buffer.from(s, "base64url");
+}
+
+async function run() {
+  var issuer = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+
+  var sd = sdJwtVc.issue({
+    issuer:  "https://issuer.example.com",
+    subject: "did:web:alice",
+    vct:     "https://example.com/vct/identity",
+    claims:  { given_name: "Alice", country: "US" },
+    selectivelyDisclosed: ["given_name"],
+    issuerKey: issuer.privateKey,
+    algorithm: "ES256",
+  });
+
+  // An SD-JWT serializes as <issuerJWT>~<disclosure>~…~ — strip the
+  // tilde-joined disclosures to get the issuer JWT before splitting on ".".
+  var issuerJwt = sd.token.split("~")[0];
+  var parts = issuerJwt.split(".");
+  check("issuer JWT has 3 parts", parts.length === 3);
+  var signingInput = parts[0] + "." + parts[1];
+  var sig = _b64uToBuf(parts[2]);
+
+  // ES256 raw r||s is exactly 64 bytes; DER is variable (~70-72) and starts
+  // with the 0x30 SEQUENCE tag.
+  check("#135 ES256 signature is JOSE raw r||s (64 bytes), not DER",
+        sig.length === 64);
+  check("#135 ES256 signature does not carry the DER SEQUENCE tag",
+        sig[0] !== 0x30 || sig.length === 64);
+
+  // A JOSE-conformant verifier (explicit ieee-p1363) must accept it. On the
+  // buggy tree the signature is DER, so a conformant verifier rejects it.
+  var conformantOk = nodeCrypto.verify(
+    "sha256",
+    Buffer.from(signingInput, "ascii"),
+    { key: issuer.publicKey, dsaEncoding: "ieee-p1363" },
+    sig);
+  check("#135 a JOSE-conformant verifier (ieee-p1363) accepts the issuer JWT",
+        conformantOk === true);
+
+  // ES384 carries the same root — exercise it too (96-byte raw r||s).
+  var issuer384 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-384" });
+  var sd384 = sdJwtVc.issue({
+    issuer:  "https://issuer.example.com",
+    subject: "did:web:carol",
+    vct:     "https://example.com/vct/identity",
+    claims:  { given_name: "Carol" },
+    selectivelyDisclosed: ["given_name"],
+    issuerKey: issuer384.privateKey,
+    algorithm: "ES384",
+  });
+  var sig384 = _b64uToBuf(sd384.token.split("~")[0].split(".")[2]);
+  check("#135 ES384 signature is JOSE raw r||s (96 bytes), not DER",
+        sig384.length === 96);
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/sd-jwt-vc.test.js

@@ -695,6 +695,55 @@ async function testHolderAlgFromKeyType() {
         rsaThrew && rsaThrew.code === "auth-sd-jwt-vc/holder-key-unsupported");
 }
 
+// ---- FIX 4B: holder KB-JWT alg/kty cross-check ----
+
+// The KB-JWT header alg is attacker-controllable (the holder mints the
+// KB-JWT). The verifier must cross-check it against the holder's cnf.jwk
+// key type BEFORE handing bytes to node:crypto.verify — the same
+// CVE-2026-22817 defense the issuer path applies. An EC cnf key with a
+// KB-JWT header claiming EdDSA (which requires kty=OKP) must be refused
+// with the precise alg-mismatch error.
+async function testKbAlgKtyCrossCheck() {
+  var issuer = _newKeyPair();
+  var holder = _newKeyPair();   // EC P-256
+  var sd = sdJwtVc.issue({
+    issuer:   "https://issuer", vct: "x",
+    claims:   { given_name: "Alice" },
+    selectivelyDisclosed: ["given_name"],
+    issuerKey: issuer.privateKey,
+    holderKey: _jwk(holder.publicKey),
+  });
+  // Build a valid presentation, then replace its real KB-JWT with a forged
+  // one whose header declares EdDSA against the EC holder key.
+  var pres = sdJwtVc.present({
+    sdJwt:               sd.token,
+    disclosedClaimNames: ["given_name"],
+    audience:            "https://verifier",
+    nonce:               "n-1",
+    holderKey:           holder.privateKey,
+    algorithm:           "ES256",
+  });
+  var segs = pres.presentation.split("~");
+  // Forge a KB-JWT segment: EdDSA header (OKP), EC holder key → mismatch.
+  function b64u(obj) { return Buffer.from(JSON.stringify(obj), "utf8").toString("base64url"); }
+  var forgedHeader = b64u({ typ: "kb+jwt", alg: "EdDSA" });
+  var forgedPayload = b64u({ aud: "https://verifier", nonce: "n-1", iat: Math.floor(Date.now() / 1000), sd_hash: "x" });
+  segs[segs.length - 1] = forgedHeader + "." + forgedPayload + ".AAAA";
+  var forgedPres = segs.join("~");
+
+  var threw = null;
+  try {
+    await sdJwtVc.verify(forgedPres, {
+      issuerKeyResolver: async function () { return issuer.publicKey; },
+      audience:          "https://verifier",
+      nonce:             "n-1",
+      requireKeyBinding: true,
+    });
+  } catch (e) { threw = e; }
+  check("KB alg/kty: mismatched KB-JWT alg refused with precise error",
+        threw && threw.code === "auth-jwt-external/alg-kty-mismatch");
+}
+
 // ---- Module exports ----
 
 function testExports() {
@@ -742,5 +791,6 @@ function testExports() {
   await testHolderPresentNonexistent();
   testHolderValidation();
   await testHolderAlgFromKeyType();
+  await testKbAlgKtyCrossCheck();
   testExports();
 })().catch(function (e) { console.error(e); process.exit(1); });

package/lib/vendor/blamejs/test/layer-0-primitives/security-headers.test.js

@@ -168,8 +168,9 @@ function testReportOnlyHeadersEmittedWhenOptedIn() {
 
 function testReportOnlyDoesNotTouchEnforcingHeaders() {
   // Monitor-mode opt-ins must not alter the enforcing COOP / COEP /
-  // Document-Policy headers: COOP stays same-origin, COEP stays off by
-  // default, Document-Policy keeps its enforcing default.
+  // Document-Policy headers: COOP stays same-origin, the enforcing COEP
+  // keeps its default-on `credentialless` value (the report-only opt is a
+  // separate header), Document-Policy keeps its enforcing default.
   var mw = b.middleware.securityHeaders({
     coopReportOnly: "same-origin",
     coepReportOnly: "require-corp",
@@ -178,8 +179,8 @@ function testReportOnlyDoesNotTouchEnforcingHeaders() {
   mw({ headers: {} }, res, function () {});
   check("enforcing COOP unchanged by coopReportOnly",
     res._hdrs["Cross-Origin-Opener-Policy"] === "same-origin");
-  check("COEP stays off by default despite coepReportOnly",
-    res._hdrs["Cross-Origin-Embedder-Policy"] === undefined);
+  check("enforcing COEP keeps its default-on value despite coepReportOnly",
+    res._hdrs["Cross-Origin-Embedder-Policy"] === "credentialless");
   check("enforcing Document-Policy unchanged by report-only opts",
     res._hdrs["Document-Policy"] === b.middleware._modules.securityHeaders.DEFAULT_DOCUMENT_POLICY);
 }
@@ -254,6 +255,31 @@ function testUnknownOptStillRefused() {
   check("typo'd report-only opt refused at config-time", threw);
 }
 
+function testCoepDefaultOnAndOptOut() {
+  // Default-on (v0.15.0): the enforcing Cross-Origin-Embedder-Policy is
+  // emitted as `credentialless` with no operator action, so COOP+COEP
+  // together yield cross-origin isolation out of the box.
+  var resDefault = _mkRes();
+  b.middleware.securityHeaders()({ headers: {} }, resDefault, function () {});
+  check("COEP default-on: Cross-Origin-Embedder-Policy is credentialless",
+    resDefault._hdrs["Cross-Origin-Embedder-Policy"] === "credentialless");
+  check("COOP stays same-origin alongside the default COEP",
+    resDefault._hdrs["Cross-Origin-Opener-Policy"] === "same-origin");
+
+  // Tighten: operators serving only same-origin / CORP-marked subresources
+  // pass coep: "require-corp" for the strict enforcing mode.
+  var resStrict = _mkRes();
+  b.middleware.securityHeaders({ coep: "require-corp" })({ headers: {} }, resStrict, function () {});
+  check("COEP tighten: coep:'require-corp' overrides the default",
+    resStrict._hdrs["Cross-Origin-Embedder-Policy"] === "require-corp");
+
+  // Documented opt-out: coep:false disables COEP entirely (no header).
+  var resOff = _mkRes();
+  b.middleware.securityHeaders({ coep: false })({ headers: {} }, resOff, function () {});
+  check("COEP opt-out: coep:false emits no Cross-Origin-Embedder-Policy header",
+    resOff._hdrs["Cross-Origin-Embedder-Policy"] === undefined);
+}
+
 async function run() {
   testFencedFrameSrcInDefaultCsp();
   testDocumentPolicyDefault();
@@ -276,6 +302,7 @@ async function run() {
   testServiceWorkerAllowedDefaultOff();
   testNewOptsNonStringIgnored();
   testUnknownOptStillRefused();
+  testCoepDefaultOnAndOptOut();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/session-extensions.test.js

@@ -273,6 +273,50 @@ async function testUpdateDataPreservesFingerprint() {
   }
 }
 
+async function testRotateRekeysFingerprint() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "ses-rotate-fp-"));
+  try {
+    await setupTestDb(tmpDir);
+    var req = _makeReq({ "user-agent": "ua-rot-1", "x-forwarded-for": "203.0.113.10" });
+    var s = await b.session.create({
+      userId:            "u-rot",
+      data:              { roles: ["user"] },
+      req:               req,
+      fingerprintFields: ["clientIp", "userAgent"],
+    });
+    var pre = await b.session.verify(s.token, { req: req, fingerprintFields: ["clientIp", "userAgent"] });
+    check("rotate-fp: pre-rotation no drift", pre && pre.fingerprintDrift === false);
+
+    // Rotation (login transition / role escalation) moves the sid. __bj_fingerprint
+    // is sid-keyed, so the new session must RE-KEY the binding to the new sid from
+    // the live request — otherwise verify(newToken, sameReq) recomputes against the
+    // new sid and falsely reports drift (logout under strict operators), or the
+    // binding silently breaks.
+    var rotated = await b.session.rotate(s.token, {
+      req: req, fingerprintFields: ["clientIp", "userAgent"],
+    });
+    check("rotate-fp: rotation returns a new token", rotated && typeof rotated.token === "string");
+
+    var sameDevice = await b.session.verify(rotated.token, {
+      req: req, fingerprintFields: ["clientIp", "userAgent"],
+    });
+    check("rotate-fp: same device → no drift after rotation (binding re-keyed)",
+          sameDevice && sameDevice.fingerprintDrift === false);
+    check("rotate-fp: operator data carried across rotation",
+          sameDevice && sameDevice.data && sameDevice.data.roles && sameDevice.data.roles[0] === "user");
+
+    // A different device must still drift — proves the binding is live, not dropped.
+    var otherReq = _makeReq({ "user-agent": "ua-OTHER", "x-forwarded-for": "198.51.100.7" });
+    var otherDevice = await b.session.verify(rotated.token, {
+      req: otherReq, fingerprintFields: ["clientIp", "userAgent"],
+    });
+    check("rotate-fp: different device → drift after rotation (binding still enforced)",
+          otherDevice && otherDevice.fingerprintDrift === true);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function run() {
   await testSealedCookieDefault();
   await testSealedCookieRotateAndDestroy();
@@ -283,6 +327,7 @@ async function run() {
   await testPluggableStoreValidation();
   await testUpdateDataReplaceAndMerge();
   await testUpdateDataPreservesFingerprint();
+  await testRotateRekeysFingerprint();
 }
 
 module.exports = { run: run };