@blamejs/blamejs-shop 0.4.69 → 0.4.71

package/lib/vendor/blamejs/lib/auth/bot-challenge.js

@@ -343,7 +343,7 @@ function create(opts) {
   var secret = opts.secret;
 
   var providerKey = opts.provider !== undefined ? opts.provider : DEFAULT_PROVIDER;
-  if (typeof providerKey !== "string" || !PROVIDERS[providerKey]) {
+  if (typeof providerKey !== "string" || !Object.prototype.hasOwnProperty.call(PROVIDERS, providerKey)) {
     var supported = Object.keys(PROVIDERS).join(", ");
     throw new BotChallengeError("bot-challenge/bad-opt",
       "provider: expected one of [" + supported + "], got " + JSON.stringify(providerKey));

package/lib/vendor/blamejs/lib/auth/ciba.js

@@ -452,6 +452,23 @@ function create(opts) {
     });
   }
 
+  // Verify an OIDC ID token (if present) via the composed inner OAuth client,
+  // returning its verified claims, or null when no id_token was supplied. A
+  // present-but-invalid id_token throws (fail-closed) so a forged token's
+  // sub/acr/amr can never be returned as trusted.
+  async function _verifyIdTokenIfPresent(idToken, auditKey, op) {
+    if (!idToken) return null;
+    try {
+      return await inner.verifyIdToken(idToken);
+    } catch (e) {
+      _emitAudit("id_token_verify_fail", "failure",
+        auditKey ? { authReqIdHash: sha3Hash(auditKey) } : {});
+      throw new AuthError("auth-ciba/id-token-invalid",
+        "ciba." + op + ": id_token failed verification: " +
+        ((e && e.code) || (e && e.message) || String(e)));
+    }
+  }
+
   async function pollToken(popts) {
     popts = popts || {};
     if (typeof popts.authReqId !== "string" || popts.authReqId.length === 0) {
@@ -514,6 +531,12 @@ function create(opts) {
     }
     // Token issued — clear interval tracking for this authReqId.
     _intervalState.delete(popts.authReqId);
+    // Verify the ID token (OIDC Core §3.1.3.7) via the composed inner OAuth
+    // client — it applies the create()-level issuer / clientId / JWKS /
+    // accepted-algorithms and enforces signature + iss/aud/exp. Returning an
+    // unverified id_token let a forged token's sub/acr/amr be trusted.
+    var pollClaims = await _verifyIdTokenIfPresent(rv.id_token,
+      "auth-ciba:" + popts.authReqId, "pollToken");
     _emitAudit("token_received", "success", {
       authReqIdHash: sha3Hash("auth-ciba:" + popts.authReqId),
     });
@@ -521,6 +544,7 @@ function create(opts) {
     return {
       accessToken:  rv.access_token   || null,
       idToken:      rv.id_token       || null,
+      claims:       pollClaims,
       refreshToken: rv.refresh_token  || null,
       tokenType:    rv.token_type     || null,
       scope:        rv.scope          || null,
@@ -545,17 +569,23 @@ function create(opts) {
    *   - In **push** mode the body carries the full token-response
    *     object; no follow-up call needed.
    *
+   * Async because a pushed `id_token` is verified (signature + iss/aud/exp)
+   * via the composed inner OAuth client before it is returned — the
+   * verified claims are surfaced as `claims`. A present-but-invalid
+   * id_token throws `auth-ciba/id-token-invalid` (the notification-token
+   * bearer authenticates the caller, never the token itself).
+   *
    * @opts
    *   { body?: object }   // pre-parsed body; defaults to req.body
    *
    * @example
-   *   app.post("/ciba/notify", function (req, res) {
-   *     var info = ciba.parseNotification(req, { body: req.body });
-   *     // → { authReqId, accessToken, idToken, ... }
+   *   app.post("/ciba/notify", async function (req, res) {
+   *     var info = await ciba.parseNotification(req, { body: req.body });
+   *     // → { authReqId, accessToken, idToken, claims, ... }
    *     res.statusCode = 204; res.end();
    *   });
    */
-  function parseNotification(req, popts) {
+  async function parseNotification(req, popts) {
     popts = popts || {};
     if (!req || !req.headers) {
       throw new AuthError("auth-ciba/bad-notification-req",
@@ -605,6 +635,14 @@ function create(opts) {
       throw new AuthError("auth-ciba/no-auth-req-id-in-body",
         "ciba.parseNotification: body missing auth_req_id");
     }
+    // Verify the pushed ID token (CIBA §10.2 / OIDC Core MUST) via the
+    // composed inner OAuth client before returning it as trusted. The
+    // notification-token bearer authenticates the CALLER, not the token; a
+    // leaked/observed notification token previously let an attacker inject
+    // arbitrary id_token claims the RP would trust on the documented
+    // "no follow-up call" push path.
+    var pushClaims = await _verifyIdTokenIfPresent(body.id_token,
+      "auth-ciba:" + body.auth_req_id, "parseNotification");
     _emitAudit("notification_received", "success", {
       authReqIdHash: sha3Hash("auth-ciba:" + body.auth_req_id),
       mode:          deliveryMode,
@@ -614,6 +652,7 @@ function create(opts) {
       authReqId:    body.auth_req_id,
       accessToken:  body.access_token  || null,
       idToken:      body.id_token      || null,
+      claims:       pushClaims,
       refreshToken: body.refresh_token || null,
       tokenType:    body.token_type    || null,
       scope:        body.scope         || null,

package/lib/vendor/blamejs/lib/auth/dpop.js

@@ -92,7 +92,7 @@ function thumbprint(key) {
   if (!key || typeof key !== "object" || typeof key.kty !== "string" || key.kty.length === 0) {
     throw new AuthError("auth-dpop/bad-jwk", "jwk must be an object with a kty");
   }
-  if (!DPOP_KTY[key.kty]) {
+  if (!Object.prototype.hasOwnProperty.call(DPOP_KTY, key.kty)) {
     throw new AuthError("auth-dpop/refused-kty", "jwk.kty='" + key.kty + "' is not allowed (DPoP requires asymmetric kty)");
   }
   // The RFC 7638 thumbprint itself is computed by b.jwk.
@@ -348,6 +348,11 @@ async function verify(proof, opts) {
       "DPoP proof declares 'crit' header — refused");
   }
 
+  // Bind the declared alg to the embedded JWK's kty/curve before handing
+  // the self-asserted key to node:crypto — every other JWS verifier in the
+  // framework enforces this (alg-confusion family, CVE-2026-22817 class).
+  jwtExternal._assertAlgKtyMatch(header.alg, header.jwk);
+
   // Verify signature against the embedded jwk
   var key = _jwkToKeyObject(header.jwk);
   var params = _signParamsForAlg(header.alg);

package/lib/vendor/blamejs/lib/auth/fido-mds3.js

@@ -43,6 +43,7 @@ var safeJson     = require("../safe-json");
 var safeBuffer   = require("../safe-buffer");
 var lazyRequire  = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var x509Chain    = require("../x509-chain");
 var jwtExternal  = require("./jwt-external");
 var _wa          = require("../vendor/simplewebauthn-server.cjs");
 var { FidoMds3Error } = require("../framework-error");
@@ -239,7 +240,10 @@ function _validateChain(x5c, rootPems) {
     var root;
     try { root = new nodeCrypto.X509Certificate(rootPems[r]); }
     catch (_e) { continue; }
-    if (tail.checkIssued(root) && tail.verify(root.publicKey)) {
+    // issuerValidlyIssued enforces basicConstraints cA:TRUE on the root in
+    // addition to the issuance + signature linkage — a non-CA cert cannot
+    // anchor the x5c chain (basicConstraints bypass, CVE-2002-0862 class).
+    if (x509Chain.issuerValidlyIssued(root, tail)) {
       anchored = true;
       break;
     }

package/lib/vendor/blamejs/lib/auth/jwt.js

@@ -117,7 +117,7 @@ function _toKeyObject(pemOrKey, kind) {
 }
 
 function _resolveAlgorithm(alg) {
-  if (typeof alg !== "string" || !ALGORITHM_TO_NODE[alg]) {
+  if (typeof alg !== "string" || !Object.prototype.hasOwnProperty.call(ALGORITHM_TO_NODE, alg)) {
     throw new AuthError("auth-jwt/unsupported-algorithm",
       "algorithm must be one of " + SUPPORTED_ALGORITHMS.join(", ") + " (got: " + alg + ")");
   }
@@ -222,7 +222,7 @@ async function verify(token, opts) {
   // Validate the allowlist itself — typoed entries should surface here,
   // not as silent "every token rejected."
   for (var i = 0; i < allowed.length; i++) {
-    if (!ALGORITHM_TO_NODE[allowed[i]]) {
+    if (!Object.prototype.hasOwnProperty.call(ALGORITHM_TO_NODE, allowed[i])) {
       throw new AuthError("auth-jwt/unsupported-algorithm",
         "opts.algorithms[" + i + "] = '" + allowed[i] + "' is not in the supported list (" +
         SUPPORTED_ALGORITHMS.join(", ") + ")");

package/lib/vendor/blamejs/lib/auth/lockout.js

@@ -80,6 +80,7 @@
  */
 
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
@@ -119,7 +120,7 @@ function _requireString(name, val) {
 }
 
 function _requirePositiveInt(name, val) {
-  if (typeof val !== "number" || !isFinite(val) || val < 1 || Math.floor(val) !== val) {
+  if (!numericBounds.isPositiveFiniteInt(val)) {
     throw _err("BAD_OPT", name + ": expected positive integer, got " +
                typeof val + " " + JSON.stringify(val));
   }
@@ -261,7 +262,22 @@ function create(opts) {
 
   // ---- Public surface ----
 
-  async function recordFailure(key, callOpts) {
+  // Per-key serialization of the failure counter (read→increment→write on an
+  // async store): concurrent recordFailure calls for the same key would lose
+  // updates, letting parallel failures stay under the lockout threshold. A
+  // per-key promise chain applies them sequentially in-process.
+  var _recordChains = new Map();
+  function recordFailure(key, callOpts) {
+    var prev = _recordChains.get(key) || Promise.resolve();
+    var run = prev.then(function () { return _doRecordFailure(key, callOpts); },
+                        function () { return _doRecordFailure(key, callOpts); });
+    var tail = run.then(function () {}, function () {});
+    _recordChains.set(key, tail);
+    tail.then(function () { if (_recordChains.get(key) === tail) _recordChains.delete(key); });
+    return run;
+  }
+
+  async function _doRecordFailure(key, callOpts) {
     _requireKey(key);
     callOpts = callOpts || {};
     var now = clock();

package/lib/vendor/blamejs/lib/auth/passkey.js

@@ -385,7 +385,7 @@ function _largeBlobExt(args) {
   var SUPPORT = { preferred: 1, required: 1 };
   var modes = 0;
   if (args.support !== undefined) {
-    if (!SUPPORT[args.support]) {
+    if (!Object.prototype.hasOwnProperty.call(SUPPORT, args.support)) {
       throw new AuthError("auth-passkey/bad-largeblob-support",
         "extensions.largeBlob support must be 'preferred' or 'required'");
     }

package/lib/vendor/blamejs/lib/auth/password.js

@@ -282,7 +282,7 @@ function policy(opts) {
   // Apply named profile FIRST, then operator opts on top so the
   // operator can override profile defaults per-field.
   if (typeof opts.profile === "string" && opts.profile.length > 0) {
-    if (!POLICY_PROFILES[opts.profile]) {
+    if (!Object.prototype.hasOwnProperty.call(POLICY_PROFILES, opts.profile)) {
       throw new AuthError("auth-password/bad-policy",
         "policy.profile must be one of " + Object.keys(POLICY_PROFILES).join("/") +
         ", got " + JSON.stringify(opts.profile));

package/lib/vendor/blamejs/lib/auth/saml.js

@@ -170,7 +170,7 @@ function _verifyXmldsig(envelope, signatureNode, certPem) {
   }
   var sigMethodNode = _findChild(signedInfo, "SignatureMethod");
   var sigAlgo = sigMethodNode && _attr(sigMethodNode, "Algorithm");
-  if (!SUPPORTED_SIG[sigAlgo]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_SIG, sigAlgo)) {
     throw new AuthError("auth-saml/unsupported-sig-alg",
       "Unsupported SignatureMethod: " + sigAlgo);
   }
@@ -184,7 +184,7 @@ function _verifyXmldsig(envelope, signatureNode, certPem) {
   var refId = refUri.substring(1);
   var digestMethodNode = _findChild(refNode, "DigestMethod");
   var digestAlgo = digestMethodNode && _attr(digestMethodNode, "Algorithm");
-  if (!SUPPORTED_DIGEST[digestAlgo]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_DIGEST, digestAlgo)) {
     throw new AuthError("auth-saml/unsupported-digest",
       "Unsupported DigestMethod: " + digestAlgo);
   }
@@ -745,26 +745,46 @@ function create(opts) {
       var cNotOnOrAfter = _attr(conditions, "NotOnOrAfter");
       if (cNotBefore) {
         var cnb = Date.parse(cNotBefore) / 1000;                                                // ms→s
-        if (isFinite(cnb) && cnb > nowSec + clockSkewSec) {
+        // Fail CLOSED on a present-but-unparseable bound (mirrors the Bearer
+        // SCD path at line ~708) instead of skipping the window via isFinite().
+        if (!isFinite(cnb)) {
+          throw new AuthError("auth-saml/conditions-bad-timestamp",
+            "Conditions NotBefore is present but unparseable");
+        }
+        if (cnb > nowSec + clockSkewSec) {
           throw new AuthError("auth-saml/conditions-not-yet-valid",
             "Conditions NotBefore is in the future");
         }
       }
       if (cNotOnOrAfter) {
         var cnoa = Date.parse(cNotOnOrAfter) / 1000;                                            // ms→s
-        if (isFinite(cnoa) && cnoa < nowSec - clockSkewSec) {
+        if (!isFinite(cnoa)) {
+          throw new AuthError("auth-saml/conditions-bad-timestamp",
+            "Conditions NotOnOrAfter is present but unparseable");
+        }
+        if (cnoa < nowSec - clockSkewSec) {
           throw new AuthError("auth-saml/conditions-expired",
             "Conditions NotOnOrAfter has passed");
         }
       }
-      var ar = _findChild(conditions, "AudienceRestriction", SAML_NS.assertion);
-      if (ar) {
-        var audiences = _findAllChildren(ar, "Audience", SAML_NS.assertion).map(_textContent);
-        if (audiences.indexOf(audience) === -1) {
-          throw new AuthError("auth-saml/wrong-audience",
-            "Audience \"" + audience + "\" not in assertion's AudienceRestriction (got " +
-            JSON.stringify(audiences) + ")");
-        }
+    }
+    // Audience binding — a signed assertion is bound to THIS SP via
+    // AudienceRestriction. A missing Conditions or AudienceRestriction means
+    // it is not bound here (audience-confusion: an assertion minted for another
+    // SP). Fail closed when an audience is configured; opt out only via
+    // vopts.requireAudienceRestriction === false.
+    if (audience && vopts.requireAudienceRestriction !== false) {
+      var ar = conditions && _findChild(conditions, "AudienceRestriction", SAML_NS.assertion);
+      if (!ar) {
+        throw new AuthError("auth-saml/no-audience-restriction",
+          "verifyResponse: assertion has no AudienceRestriction binding it to \"" +
+          audience + "\" (audience-confusion defense; set requireAudienceRestriction:false to opt out)");
+      }
+      var audiences = _findAllChildren(ar, "Audience", SAML_NS.assertion).map(_textContent);
+      if (audiences.indexOf(audience) === -1) {
+        throw new AuthError("auth-saml/wrong-audience",
+          "Audience \"" + audience + "\" not in assertion's AudienceRestriction (got " +
+          JSON.stringify(audiences) + ")");
       }
     }
 
@@ -1897,7 +1917,7 @@ function _verifyEmbeddedXmlDsig(xml, idpVerifyKey, idpVerifyAlg, expectedRootLoc
   // Allow either sha3-512 (framework default) or the SHA-2 family.
   var digestAlgName;
   if (digestUri === "http://www.w3.org/2007/05/xmldsig-more#sha3-512") digestAlgName = "sha3-512";
-  else if (SUPPORTED_DIGEST[digestUri]) digestAlgName = SUPPORTED_DIGEST[digestUri];
+  else if (Object.prototype.hasOwnProperty.call(SUPPORTED_DIGEST, digestUri)) digestAlgName = SUPPORTED_DIGEST[digestUri];
   else {
     throw new AuthError("auth-saml/unsupported-digest",
       "_verifyEmbeddedXmlDsig: DigestMethod " + digestUri + " not supported");

package/lib/vendor/blamejs/lib/auth/sd-jwt-vc.js

@@ -212,7 +212,7 @@ function issue(opts) {
       "issue: algorithm must be one of " + SUPPORTED_ALGS.join(", "));
   }
   var hashAlg = opts.hashAlg || DEFAULT_HASH_ALG;
-  if (!SUPPORTED_HASH_ALGS[hashAlg]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, hashAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "issue: hashAlg must be one of " + Object.keys(SUPPORTED_HASH_ALGS).join(", "));
   }
@@ -413,8 +413,8 @@ async function verify(presentation, opts) {
   validateOpts.requireObject(opts, "auth.sdJwtVc.verify", AuthError);
   validateOpts(opts, [
     "issuerKeyResolver", "audience", "nonce",
-    "now", "expectedVct", "maxClockSkewSec",
-    "requireKeyBinding",
+    "now", "expectedVct", "expectedIssuer", "maxClockSkewSec",
+    "requireKeyBinding", "requireExp",
     "keyAttestationVerifier", "requireKeyAttestation",
   ], "auth.sdJwtVc.verify");
 
@@ -528,6 +528,15 @@ async function verify(presentation, opts) {
     throw new AuthError("auth-sd-jwt-vc/iat-future",
       "verify: iat is in the future (clock skew?)");
   }
+  // SD-JWT-VC makes `exp` OPTIONAL, so the default only checks it when present.
+  // Operators with a time-bounded trust expectation (esp. for FOREIGN issuers
+  // resolved via issuerKeyResolver) pass requireExp:true to fail closed on a
+  // missing / non-numeric exp — mirroring jwt-external's unconditional exp
+  // requirement (a credential that never expires is accepted otherwise).
+  if (opts.requireExp === true && typeof jwtParsed.payload.exp !== "number") {
+    throw new AuthError("auth-sd-jwt-vc/missing-exp",
+      "verify: requireExp is set but the credential has no numeric exp claim");
+  }
   if (typeof jwtParsed.payload.exp === "number" && jwtParsed.payload.exp < nowSec - skew) {
     throw new AuthError("auth-sd-jwt-vc/expired",
       "verify: token is expired");
@@ -556,7 +565,7 @@ async function verify(presentation, opts) {
   // to its own DEFAULT_HASH_ALG (`sha3-512`) which broke verification
   // against spec-conformant issuers when `_sd_alg` was omitted.
   var hashAlg = jwtParsed.payload._sd_alg || "sha-256";
-  if (!SUPPORTED_HASH_ALGS[hashAlg]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, hashAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "verify: _sd_alg \"" + hashAlg + "\" not supported");
   }
@@ -638,6 +647,17 @@ async function verify(presentation, opts) {
     jwtExternal._assertAlgKtyMatch(kbAlg, holderKey);
     var holderKeyObj = bCrypto.importPublicJwk(holderKey);
     var kbParsed = _verifyJwt(maybeKbJwt, holderKeyObj, kbAlg);
+    // A KB-JWT proves holder possession of THIS presentation's bytes (sd_hash),
+    // but binds it to a verifier + a fresh challenge only via aud + nonce. If
+    // the caller processes a KB-JWT without supplying both, the aud/nonce
+    // compares below would silently skip — making the presentation replayable
+    // and acceptable at any verifier. Fail CLOSED: require both (oid4vp always
+    // supplies them). RFC: SD-JWT-VC §KB-JWT / OIDC4VP nonce binding.
+    if (typeof opts.audience !== "string" || opts.audience.length === 0 ||
+        typeof opts.nonce !== "string" || opts.nonce.length === 0) {
+      throw new AuthError("auth-sd-jwt-vc/missing-replay-binding",
+        "verify: a KB-JWT requires opts.audience + opts.nonce to bind the presentation to this verifier and a fresh challenge (replay / audience-redirection defense)");
+    }
     // Constant-time compares: the nonce is a verifier-issued replay-defense
     // value, so a short-circuiting !== leaks a matching-prefix timing oracle.
     // Matches the sd_hash check below (the framework's hash/token discipline).

package/lib/vendor/blamejs/lib/auth/status-list.js

@@ -78,7 +78,7 @@ var _fromB64url = bCrypto.makeBase64UrlDecoder({
 });
 
 function _validateBits(bits) {
-  if (!SUPPORTED_BIT_SIZES[bits]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_BIT_SIZES, bits)) {
     throw new StatusListError("status-list/bad-bits",
       "statusList: bits must be 1, 2, 4, or 8 (draft §6.1.1) — got " + bits);
   }
@@ -249,7 +249,19 @@ async function fromJwt(token, opts) {
     list: {
       size:     size,
       bits:     bits,
-      get:      function (idx) { return _getAt(inflated, bits, idx); },
+      // Bounds-check the relying-party status read, mirroring create().get. An
+      // out-of-range index must FAIL CLOSED (throw): _getAt over-reads the buffer
+      // and returns 0 for an out-of-bounds index, and status 0 = VALID — so a
+      // credential whose status_list index points past the list would otherwise
+      // read as "not revoked", a revocation bypass.
+      get:      function (idx) {
+        if (typeof idx !== "number" || idx < 0 || idx >= size || (idx >> 0) !== idx) {
+          throw new StatusListError("status-list/bad-index",
+            "statusList.fromJwt get: idx out of range — got " + idx + ", size=" + size +
+            " (an out-of-range status index fails closed, never reads as status 0/valid)");
+        }
+        return _getAt(inflated, bits, idx);
+      },
       snapshot: function () { return { size: size, bits: bits, bytes: Buffer.from(inflated) }; },
     },
     claims: claims,

package/lib/vendor/blamejs/lib/auth/step-up.js

@@ -386,7 +386,15 @@ function parseChallenge(headerValue) {
     if (key === "error")              out.error     = val;
     else if (key === "scope")         out.scope     = val;
     else if (key === "acr_values")    out.acrValues = val.split(/\s+/);
-    else if (key === "max_age")       out.maxAge    = parseInt(val, 10);
+    else if (key === "max_age") {
+      // Defensive: a malformed max_age (non-numeric / negative) from the
+      // server's challenge must not land as NaN — a downstream `age > maxAge`
+      // comparison against NaN is always false and would silently mis-handle
+      // the freshness requirement. Omit it unless it parses to a non-negative
+      // integer, so callers fall back to their own default.
+      var ma = parseInt(val, 10);
+      if (isFinite(ma) && ma >= 0) out.maxAge = ma;
+    }
   });
   return out;
 }

package/lib/vendor/blamejs/lib/auth-bot-challenge.js

@@ -40,6 +40,7 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var requestHelpers = require("./request-helpers");
 var validateOpts = require("./validate-opts");
+var numericBounds = require("./numeric-bounds");
 var { AuthBotChallengeError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -67,7 +68,7 @@ function _requireFunction(name, val) {
 }
 
 function _requirePositiveInt(name, val) {
-  if (typeof val !== "number" || !isFinite(val) || val < 1 || Math.floor(val) !== val) {
+  if (!numericBounds.isPositiveFiniteInt(val)) {
     throw new AuthBotChallengeError("auth-bot-challenge/bad-opt",
       name + ": expected positive integer, got " + JSON.stringify(val));
   }
@@ -272,7 +273,25 @@ function create(opts) {
 
   // ---- Internal staircase advance ----
 
-  async function _advanceFailure(key, req) {
+  // Per-key serialization: the failure staircase is a read→increment→write on
+  // an async store, so concurrent recordFailure calls for the SAME key would
+  // both read N and both write N+1 (lost update), letting an attacker fire
+  // parallel failures to stay under the challenge / lockout thresholds. A
+  // per-key promise chain applies advances for a key sequentially. (Cross-node
+  // atomicity additionally needs an atomic store; this fixes the in-process
+  // race the gate actually depends on.)
+  var _advanceChains = new Map();
+  function _advanceFailure(key, req) {
+    var prev = _advanceChains.get(key) || Promise.resolve();
+    var run = prev.then(function () { return _doAdvanceFailure(key, req); },
+                        function () { return _doAdvanceFailure(key, req); });
+    var tail = run.then(function () {}, function () {});
+    _advanceChains.set(key, tail);
+    tail.then(function () { if (_advanceChains.get(key) === tail) _advanceChains.delete(key); });
+    return run;
+  }
+
+  async function _doAdvanceFailure(key, req) {
     var now = clock();
     var state = await _readState(key) || {
       stage: STATE_NEW, failures: 0, challengedAt: null, passedAt: null,

package/lib/vendor/blamejs/lib/backup/bundle.js

@@ -160,14 +160,18 @@ async function create(opts) {
       },
     });
     var checksum = bCrypto.checksum(plain);
-    var encResult = await bCrypto.encryptWithFreshSalt(plain, passphrase);
+    // Bind the ciphertext to this blob's canonical relativePath as AEAD
+    // associated data. A blob copied to a different manifest entry (the
+    // restore-corruption / blob-remap attack) then fails the Poly1305 tag on
+    // restore — tamper-evident even on an unsigned bundle (manifest.aadBound).
+    var encResult = await bCrypto.encryptWithFreshSalt(plain, passphrase, entry.relativePath);
     var encPath = _encryptedPathFor(entry.relativePath);
     var destFull = nodePath.join(outDir, encPath);
     atomicFile.ensureDir(nodePath.dirname(destFull));
     atomicFile.writeSync(destFull, encResult.encrypted, { fileMode: 0o600 });
 
     var kind = entry.kind || "raw";
-    if (!backupManifest.VALID_KINDS[kind]) {
+    if (!Object.prototype.hasOwnProperty.call(backupManifest.VALID_KINDS, kind)) {
       throw new BackupBundleError("backup-bundle/bad-kind",
         "create: files[" + i + "].kind must be one of raw, vault-sealed, plaintext (got '" + kind + "')");
     }
@@ -205,6 +209,7 @@ async function create(opts) {
     vaultKeyEnc:  wrappedVk.encrypted.toString("base64"),
     files:        fileEntries,
     metadata:     opts.metadata || undefined,
+    aadBound:     true,   // every blob above was sealed with its relativePath as AEAD AAD
   });
   // Sign the manifest with the audit-sign keypair so a tampered
   // manifest fails verification on restore. The signer is best-

package/lib/vendor/blamejs/lib/backup/crypto.js

@@ -117,7 +117,21 @@ async function deriveKey(passphrase, saltHex, opts) {
   return hash;
 }
 
-async function encryptWithPassphrase(plaintext, passphrase, saltHex) {
+// Normalize optional associated-authenticated-data (AAD) into the
+// Uint8Array the AEAD expects, or undefined when none. AAD is NOT encrypted
+// but IS authenticated: ciphertext sealed under one AAD fails the Poly1305
+// tag when decrypted under a different AAD. Backup file blobs pass their
+// canonical relativePath so a blob remapped to a different manifest entry is
+// cryptographically rejected (the blob-remap / restore-corruption defense).
+function _aadBytes(aad) {
+  if (aad === undefined || aad === null) return undefined;
+  if (Buffer.isBuffer(aad)) return new Uint8Array(aad);
+  if (typeof aad === "string") return new Uint8Array(Buffer.from(aad, "utf8"));
+  throw new BackupCryptoError("backup-crypto/bad-aad",
+    "associated data must be a Buffer or string");
+}
+
+async function encryptWithPassphrase(plaintext, passphrase, saltHex, aad) {
   if (!Buffer.isBuffer(plaintext) && typeof plaintext !== "string") {
     throw new BackupCryptoError("backup-crypto/bad-plaintext",
       "encryptWithPassphrase: plaintext must be a Buffer or string");
@@ -125,11 +139,11 @@ async function encryptWithPassphrase(plaintext, passphrase, saltHex) {
   var plainBuf = Buffer.isBuffer(plaintext) ? plaintext : Buffer.from(plaintext, "utf8");
   var key = await deriveKey(passphrase, saltHex);
   var nonce = nodeCrypto.randomBytes(NONCE_BYTES);
-  var ct = xchacha20poly1305(new Uint8Array(key), nonce).encrypt(new Uint8Array(plainBuf));
+  var ct = xchacha20poly1305(new Uint8Array(key), nonce, _aadBytes(aad)).encrypt(new Uint8Array(plainBuf));
   return Buffer.concat([nonce, Buffer.from(ct)]);
 }
 
-async function decryptWithPassphrase(encrypted, passphrase, saltHex) {
+async function decryptWithPassphrase(encrypted, passphrase, saltHex, aad) {
   if (!Buffer.isBuffer(encrypted)) {
     throw new BackupCryptoError("backup-crypto/bad-input",
       "decryptWithPassphrase: encrypted must be a Buffer");
@@ -143,11 +157,11 @@ async function decryptWithPassphrase(encrypted, passphrase, saltHex) {
   var ct    = encrypted.subarray(NONCE_BYTES);
   var plain;
   try {
-    plain = xchacha20poly1305(new Uint8Array(key), new Uint8Array(nonce))
+    plain = xchacha20poly1305(new Uint8Array(key), new Uint8Array(nonce), _aadBytes(aad))
       .decrypt(new Uint8Array(ct));
   } catch (e) {
     throw new BackupCryptoError("backup-crypto/decrypt-failed",
-      "XChaCha20-Poly1305 decryption failed (wrong passphrase or tampered ciphertext): " +
+      "XChaCha20-Poly1305 decryption failed (wrong passphrase, tampered ciphertext, or blob remapped to a different path): " +
       ((e && e.message) || String(e)));
   }
   return Buffer.from(plain);
@@ -155,11 +169,12 @@ async function decryptWithPassphrase(encrypted, passphrase, saltHex) {
 
 // Convenience for the common "encrypt this with a fresh salt" pattern.
 // Returns the salt as hex so callers can store it alongside the
-// ciphertext in the bundle manifest.
-async function encryptWithFreshSalt(plaintext, passphrase) {
+// ciphertext in the bundle manifest. `aad` (optional) is bound as AEAD
+// associated data (see _aadBytes).
+async function encryptWithFreshSalt(plaintext, passphrase, aad) {
   var salt = nodeCrypto.randomBytes(SALT_BYTES);
   var saltHex = salt.toString("hex");
-  var encrypted = await encryptWithPassphrase(plaintext, passphrase, saltHex);
+  var encrypted = await encryptWithPassphrase(plaintext, passphrase, saltHex, aad);
   return { encrypted: encrypted, salt: saltHex };
 }