@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/auth/oauth.js

@@ -512,6 +512,13 @@ var ATTESTATION_ALGS = Object.freeze([
   "EdDSA",
 ]);
 
+// draft-ietf-oauth-attestation-based-client-auth §4.1 / §5.1 — the REQUIRED,
+// distinct `typ` header of each JWT. One literal per role, used by BOTH the
+// builders (the value we emit) and the verifier (the value we pin) so the
+// produced typ and the checked typ can never drift apart.
+var ATTESTATION_JWT_TYP     = "oauth-client-attestation+jwt";
+var ATTESTATION_POP_JWT_TYP = "oauth-client-attestation-pop+jwt";
+
 // Cap on an attestation / PoP JWT. HTTP-header-borne JWTs are small;
 // 16 KiB refuses a pathological header without touching real tokens.
 var MAX_ATTESTATION_JWT_BYTES = C.BYTES.kib(16);
@@ -582,7 +589,10 @@ function _signAttestationJws(header, payload, privateKey, alg) {
 // Verify a compact JWS against an already-imported public KeyObject. The
 // alg is read from the header but MUST equal expectedAlg AND match the
 // key's kty (via the shared cross-check) — no alg-confusion window.
-function _verifyAttestationJws(jws, publicKeyJwk, label) {
+// `expectedTyp` (when supplied) pins the JOSE `typ` header so a JWT minted
+// for another purpose but signed by the same key can't be replayed into the
+// attestation / PoP slot.
+function _verifyAttestationJws(jws, publicKeyJwk, label, expectedTyp) {
   if (typeof jws !== "string" || jws.length === 0) {
     throw new OAuthError("auth-oauth/attestation-malformed", label + ": JWT must be a non-empty string");
   }
@@ -618,6 +628,18 @@ function _verifyAttestationJws(jws, publicKeyJwk, label) {
     throw new OAuthError("auth-oauth/attestation-crit-not-supported",
       label + ": JWS 'crit' header is not supported (RFC 7515 §4.1.11)");
   }
+  // Explicit typing (RFC 8725 §3.11 / draft-ietf-oauth-attestation-based-
+  // client-auth §6): the attestation and PoP JWTs each carry a REQUIRED,
+  // distinct `typ`. Pinning it stops a JWT minted for a different purpose
+  // but signed by the same key (a private_key_jwt client assertion, another
+  // proof-of-possession JWT) from being replayed into the attestation / PoP
+  // slot — the cross-JWT confused-deputy class. The framework's other JWS
+  // verifiers already pin typ (dpop+jwt, logout+jwt); this one now matches.
+  if (typeof expectedTyp === "string" && header.typ !== expectedTyp) {
+    throw new OAuthError("auth-oauth/attestation-wrong-typ",
+      label + ": header.typ must be '" + expectedTyp + "' (RFC 8725 §3.11 " +
+      "explicit typing); got " + JSON.stringify(header.typ));
+  }
   // CVE-2026-22817 — cross-check alg against the key's kty before verify.
   jwtExternal._assertAlgKtyMatch(header.alg, publicKeyJwk);
   var keyObject = _jwkToKey(publicKeyJwk);
@@ -744,7 +766,7 @@ function buildClientAttestation(aopts) {
     validateOpts.assignOwnEnumerable(payload, aopts.extraClaims, Object.keys(payload));
   }
   return _signAttestationJws(
-    { typ: "oauth-client-attestation+jwt", alg: alg }, payload, key, alg);
+    { typ: ATTESTATION_JWT_TYP, alg: alg }, payload, key, alg);
 }
 
 /**
@@ -819,7 +841,7 @@ function buildClientAttestationPop(popts) {
     payload.challenge = popts.challenge; // draft §5.2 — server nonce
   }
   return _signAttestationJws(
-    { typ: "oauth-client-attestation-pop+jwt", alg: alg }, payload, key, alg);
+    { typ: ATTESTATION_POP_JWT_TYP, alg: alg }, payload, key, alg);
 }
 
 /**
@@ -878,7 +900,8 @@ async function verifyClientAttestation(attestationJwt, popJwt, vopts) {
     "auth-oauth/attestation-no-expected-aud");
 
   // 1. Attestation signature against the TRUSTED attester key.
-  var att = _verifyAttestationJws(attestationJwt, vopts.attesterJwk, "client-attestation");
+  var att = _verifyAttestationJws(attestationJwt, vopts.attesterJwk, "client-attestation",
+    ATTESTATION_JWT_TYP);
   var ap = att.payload || {};
   if (typeof ap.sub !== "string" || ap.sub.length === 0) {
     throw new OAuthError("auth-oauth/attestation-no-sub",
@@ -912,7 +935,8 @@ async function verifyClientAttestation(attestationJwt, popJwt, vopts) {
   }
 
   // 2. PoP signature against the attestation's cnf key (NOT the attester).
-  var pop = _verifyAttestationJws(popJwt, ap.cnf.jwk, "client-attestation-pop");
+  var pop = _verifyAttestationJws(popJwt, ap.cnf.jwk, "client-attestation-pop",
+    ATTESTATION_POP_JWT_TYP);
   var pp = pop.payload || {};
   // aud MUST be THIS AS issuer (constant-time, exact). Attacker-replayed
   // PoP minted for a different AS is refused (draft §8 step 7).
@@ -1123,6 +1147,16 @@ function create(opts) {
     backchannelAuthenticationEndpoint:
                            opts.backchannelAuthenticationEndpoint ||
                            (preset && preset.backchannelAuthenticationEndpoint) || null,
+    // _resolveEndpoint maps these three snake-case discovery keys, and the
+    // introspect / register / device-grant primitives resolve through it. A
+    // static (non-discovery) client must be able to supply them as opts —
+    // introspectToken's own no-endpoint refusal tells operators to set
+    // opts.introspectionEndpoint, so create() has to actually read it.
+    introspectionEndpoint: opts.introspectionEndpoint || (preset && preset.introspectionEndpoint) || null,
+    registrationEndpoint:  opts.registrationEndpoint  || (preset && preset.registrationEndpoint)  || null,
+    deviceAuthorizationEndpoint:
+                           opts.deviceAuthorizationEndpoint ||
+                           (preset && preset.deviceAuthorizationEndpoint) || null,
   };
 
   // Discovery + JWKS caches use b.cache.create + .wrap so concurrent
@@ -1746,20 +1780,43 @@ function create(opts) {
 
   async function _normalizeTokens(raw, vopts) {
     vopts = vopts || {};
+    // RFC 6749 §3.3 — scope is space-separated, ONLY U+0020. `\s+` previously
+    // matched U+0085 NEL, U+00A0 NBSP, etc., so a hostile AS returning
+    // `scope: "admin<NEL>read"` would surface as `["admin", "read"]` and the
+    // operator's scope allowlist saw two distinct scopes. Spec-strict split on
+    // single-space keeps a non-token separator inside one token.
+    //
+    // §5.1 also fixes the PRESENT-vs-ABSENT distinction that a bare truthiness
+    // test lost: an ABSENT scope ("OPTIONAL, if identical to the requested
+    // scope") means the client got what it asked for → mirror the request; a
+    // PRESENT scope is authoritative, INCLUDING the empty string, which grants
+    // ZERO scopes. Coercing "" to the requested set (its falsy value slipped
+    // the old `raw.scope ? …` test into the absent branch) would report a
+    // downscoped-to-nothing grant as the full requested set — a scope-based
+    // authorization guard downstream then treats denied scopes as granted. A
+    // malformed non-string scope is treated as zero (fail closed), never as
+    // the requested set.
+    var grantedScope;
+    if (typeof raw.scope === "string") {
+      grantedScope = raw.scope.split(" ").filter(function (s) { return s.length > 0; });
+    } else if (raw.scope === undefined) {
+      // ONLY a truly ABSENT property (undefined) mirrors the request (RFC 6749
+      // §3.3 "OPTIONAL, if identical to the requested scope"). A PRESENT but
+      // malformed value — `null`, a number, an object — is NOT an omitted
+      // scope; treating `{ "scope": null }` as absent would copy the full
+      // requested set and report a grant the AS never made. Fall through to
+      // zero (fail closed).
+      grantedScope = scope.slice();
+    } else {
+      grantedScope = [];
+    }
     var tokens = {
       accessToken:  raw.access_token,
       tokenType:    raw.token_type || "Bearer",
       expiresIn:    raw.expires_in || null,
       refreshToken: raw.refresh_token || null,
       idToken:      raw.id_token || null,
-      // RFC 6749 §3.3 — scope is space-separated, ONLY U+0020.
-      // `\s+` previously matched U+0085 NEL, U+00A0 NBSP, etc., so a
-      // hostile AS returning `scope: "admin<NEL>read"` would
-      // surface as `["admin", "read"]` and the operator's scope
-      // allowlist saw two distinct scopes. Spec-strict split on
-      // single-space + reject scope tokens that contain non-token
-      // chars.
-      scope:        raw.scope ? raw.scope.split(" ").filter(function (s) { return s.length > 0; }) : scope.slice(),
+      scope:        grantedScope,
       raw:          raw,
     };
     if (tokens.idToken && isOidc) {
@@ -1970,6 +2027,16 @@ function create(opts) {
     if (typeof payload.nbf === "number" && payload.nbf - skewSec > now) {
       throw new OAuthError("auth-oauth/nbf-future", "ID token nbf is in the future");
     }
+    if (isOidc && !issuer) {
+      // An OIDC id_token carries an `iss` that MUST be validated against a
+      // configured expected issuer (OIDC Core §3.1.3.7). With no issuer set the
+      // iss comparison below would be skipped entirely — the CVE-2026-23552
+      // cross-realm acceptance this verifier exists to close. Fail closed
+      // rather than accept an id_token whose issuer can't be authenticated.
+      throw new OAuthError("auth-oauth/issuer-required",
+        "verifyIdToken: an OIDC client must be configured with `issuer` to validate the " +
+        "id_token's iss (OIDC Core 3.1.3.7 / cross-realm-JWT defense); pass issuer to b.auth.oauth.create()");
+    }
     if (issuer) {
       // CVE-2026-23552 — cross-realm / cross-issuer JWT acceptance. The
       // expected issuer is operator-supplied; payload.iss is attacker-
@@ -2859,6 +2926,16 @@ function create(opts) {
       if (allowHttp) req.allowedProtocols = safeUrl.ALLOW_HTTP_ALL;
       if (allowInternal !== null) req.allowInternal = allowInternal;
       Object.assign(req, httpClientOpts);
+      // RFC 8628 §3.5 / RFC 6749 §5.2 return the device-grant errors
+      // (authorization_pending / slow_down and the terminal codes) as an
+      // HTTP 400 whose body carries `error`. The loop below reads that body,
+      // so the token request MUST NOT let b.httpClient reject the 4xx first —
+      // the default buffer mode would throw before the pending/slow_down/
+      // terminal handling runs, aborting the grant on the first poll (which
+      // is almost always authorization_pending). Force always-resolve AFTER
+      // merging httpClientOpts so an operator override cannot silently
+      // reinstate buffer mode.
+      req.responseMode = "always-resolve";
       var res    = await hc.request(req);
       var text   = res.body ? res.body.toString("utf8") : "";
       var parsed;

package/lib/vendor/blamejs/lib/auth/oid4vci.js

@@ -190,26 +190,29 @@ async function _verifyProofJwt(proofJwt, expectedAud, expectedCNonce, expectedCl
     throw new AuthError("auth-oid4vci/wrong-proof-aud",
       "credential issuance: proof JWT aud \"" + payload.aud + "\" mismatch (expected \"" + expectedAud + "\")");
   }
-  // c_nonce expectation has three states the caller distinguishes:
-  //   null      → no nonce check expected (caller deliberately skips it).
-  //   string    → the c_nonce the wallet must echo (compared below).
-  //   undefined → a nonce WAS expected but the store missed/expired it
-  //               (cNonceStore.get returns undefined on miss/expiry, and
-  //               the c_nonce TTL is shorter than the access token's).
-  //               Refuse with a typed code — comparing against undefined
-  //               would otherwise throw a raw TypeError from timingSafeEqual.
-  if (expectedCNonce === undefined) {
+  // The c_nonce is the OID4VCI proof replay + holder-binding challenge
+  // (§7.2.1.1). Every access token is minted with a c_nonce in
+  // exchangePreAuthorizedCode, so a missing value at /credential means the
+  // c_nonce TTL elapsed (shorter than the access token's) — it MUST refuse
+  // and force the wallet to fetch a fresh one. There is NO issuance mode
+  // that legitimately skips the compare, so `expectedCNonce` is required to
+  // be a non-empty string. Fail closed on ANY other shape: a conforming
+  // b.cache signals a miss with `undefined`, but a store fronting Redis /
+  // a Map / a SQL row commonly signals a miss with `null`; the prior
+  // `!== null` guard let that null fall THROUGH the nonce compare entirely,
+  // silently disabling the replay defense (a forged proof with any nonce
+  // was then accepted). Treating undefined / null / non-string uniformly
+  // as "expired" closes that store-shape fail-open.
+  if (typeof expectedCNonce !== "string" || expectedCNonce.length === 0) {
     throw new AuthError("auth-oid4vci/c-nonce-expired",
       "credential issuance: c_nonce expected but missing/expired — wallet must request a fresh c_nonce (the /token response's c_nonce TTL elapsed before /credential was called)");
   }
-  if (expectedCNonce !== null) {
-    // Constant-time c_nonce compare — secret-shaped value vs
-    // attacker-controlled wallet payload.
-    if (typeof payload.nonce !== "string" ||
-        !timingSafeEqual(payload.nonce, expectedCNonce)) {
-      throw new AuthError("auth-oid4vci/wrong-proof-nonce",
-        "credential issuance: proof JWT nonce mismatch (replay defense — wallet must use the c_nonce from the most recent issuer response)");
-    }
+  // Constant-time c_nonce compare — secret-shaped value vs
+  // attacker-controlled wallet payload.
+  if (typeof payload.nonce !== "string" ||
+      !timingSafeEqual(payload.nonce, expectedCNonce)) {
+    throw new AuthError("auth-oid4vci/wrong-proof-nonce",
+      "credential issuance: proof JWT nonce mismatch (replay defense — wallet must use the c_nonce from the most recent issuer response)");
   }
   if (typeof payload.iat !== "number") {
     throw new AuthError("auth-oid4vci/no-proof-iat",

package/lib/vendor/blamejs/lib/auth/openid-federation.js

@@ -59,6 +59,7 @@
 var lazyRequire  = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 var safeJson     = require("../safe-json");
+var pick         = require("../pick");
 var nodeCrypto   = require("node:crypto");
 var bCrypto      = require("../crypto");
 var C            = require("../constants");
@@ -240,11 +241,151 @@ function verifyEntityStatement(jwt, jwks, vopts) {
   return parsed.claims;
 }
 
+// ---- Metadata-policy set-ops + cross-level merge (OIDF 1.0 section 6.1.5) ----
+
+// Union of two arrays (dedupe, first-seen order). The single array set-op the
+// `add` / `superset_of` operators and the cross-level merge both compose,
+// rather than hand-rolling the shape per call site.
+function _arrayUnion(a, b) {
+  var out = Array.isArray(a) ? a.slice() : [];
+  if (Array.isArray(b)) {
+    b.forEach(function (v) { if (out.indexOf(v) === -1) out.push(v); });
+  }
+  return out;
+}
+
+// Intersection of two arrays (values in both, a's order). The narrowing op the
+// merge uses for `one_of` / `subset_of`: a subordinate can only narrow.
+function _arrayIntersect(a, b) {
+  if (!Array.isArray(a) || !Array.isArray(b)) return [];
+  return a.filter(function (v) { return b.indexOf(v) !== -1; });
+}
+
+// a is a subset of b: every element of `a` is present in `b`. The set-op the
+// OIDF 1.0 section 6.1.3 combination-consistency rules compose (add within
+// subset_of, default within subset_of, superset_of within subset_of, ...).
+function _arraySubset(a, b) {
+  if (!Array.isArray(a) || !Array.isArray(b)) return false;
+  return a.every(function (v) { return b.indexOf(v) !== -1; });
+}
+
+// View a metadata value as an array for the array policy operators. OAuth
+// `scope` (and similar parameters) is a space-delimited string that OIDF 1.0
+// section 6.1.3.1.8 processes as a string array, so a string is split on
+// whitespace; an array is returned as-is; anything else yields null (the
+// caller decides whether an absent / malformed value is a violation).
+function _coerceOperandArray(val) {
+  if (Array.isArray(val)) return val;
+  if (typeof val === "string") return val.split(/\s+/).filter(Boolean);
+  return null;
+}
+
+// OIDF 1.0 section 6.1.3 fixed operator processing order: the value-MODIFICATION
+// operators (value, add, default) run first to produce the value, then the
+// value-CHECK operators (one_of, subset_of, superset_of, essential) validate it.
+var _OP_ORDER = ["value", "add", "default", "one_of", "subset_of", "superset_of", "essential"];
+
+// Validate a merged claim's operator set for the two cross-level cases the
+// fixed-order apply step cannot catch on its own. The apply step already runs
+// every merged CHECK operator (one_of / subset_of / superset_of / essential)
+// against the FINAL value the MODIFIER operators (value / add / default)
+// produced -- coercing a space-delimited scope string to an array -- so a
+// value, add, or default inconsistent with a co-present constraint is refused
+// there against the merged (most-restrictive) constraint. This adds only what
+// apply cannot see:
+//   (1) `value` + `add` where `add` would WIDEN the exact pin -- the union
+//       escapes `value`, and with no constraint operator present the apply step
+//       has nothing to reject it. `add` already within `value` is a no-op,
+//       allowed (OIDF 1.0 section 6.1.3.1.1).
+//   (2) a `one_of` whose cross-level intersection is EMPTY -- no value can ever
+//       satisfy the chain, a policy error per section 6.1.3.1.4 rather than a
+//       silent accept-when-absent.
+// Same-operator value/default equality is checked during the merge itself.
+function _assertPolicyCombination(claim, acc) {
+  function has(op) { return Object.prototype.hasOwnProperty.call(acc, op); }
+  function conflict(why) {
+    throw new AuthError("auth-openid-federation/policy-merge-conflict",
+      "metadata_policy['" + claim + "']: " + why +
+      " (a subordinate cannot widen a superior's constraint)");
+  }
+  if (has("value") && has("add")) {
+    var pinned = _coerceOperandArray(acc.value) || [acc.value];
+    if (!_arraySubset(acc.add, pinned)) {
+      conflict("`add` would widen the pinned `value`");
+    }
+  }
+  if (has("one_of") && acc.one_of.length === 0) {
+    conflict("`one_of` values are disjoint across the chain (no allowed value remains)");
+  }
+}
+
+// Combine the metadata_policy blocks from EVERY chain level into ONE policy per
+// OIDF 1.0 section 6.1.5.3, so a subordinate can only NARROW a superior's
+// constraint, never override it, and the combined policy is applied ONCE. Two
+// levels pinning a DIFFERENT `value` (or `default`) is a cross-level conflict
+// that makes the chain invalid and throws -- the pre-merge sequential apply let
+// a leaf-ward `value` silently OVERWRITE the anchor's pinned value, a trust
+// downgrade (e.g. token_endpoint_auth_method private_key_jwt -> none) the anchor
+// forbade. `blocks` are ordered superior-first (anchor policy first).
+function _mergeMetadataPolicies(blocks) {
+  var merged = Object.create(null);
+  blocks.forEach(function (block) {
+    Object.keys(block).forEach(function (claim) {
+      if (pick.isPoisonedKey(claim)) {
+        throw new AuthError("auth-openid-federation/poisoned-policy-key",
+          "metadata_policy claim name \"" + claim + "\" is a prototype-pollution vector");
+      }
+      var rules = block[claim];
+      if (!rules || typeof rules !== "object") {
+        throw new AuthError("auth-openid-federation/bad-policy-rules",
+          "metadata_policy['" + claim + "'] must be an object");
+      }
+      var acc = merged[claim] || (merged[claim] = {});
+      Object.keys(rules).forEach(function (op) {
+        var v = rules[op];
+        if (op === "value" || op === "default") {
+          if (Object.prototype.hasOwnProperty.call(acc, op) &&
+              JSON.stringify(acc[op]) !== JSON.stringify(v)) {
+            throw new AuthError("auth-openid-federation/policy-merge-conflict",
+              "metadata_policy['" + claim + "']." + op + " conflicts across the chain (" +
+              JSON.stringify(acc[op]) + " vs " + JSON.stringify(v) +
+              "): a subordinate cannot override a superior's pinned " + op);
+          }
+          acc[op] = v;
+        } else if (op === "add" || op === "superset_of") {
+          if (!Array.isArray(v)) {
+            throw new AuthError("auth-openid-federation/bad-policy-" + (op === "add" ? "add" : "superset-of"),
+              "metadata_policy['" + claim + "']." + op + " requires an array");
+          }
+          acc[op] = _arrayUnion(acc[op], v);
+        } else if (op === "one_of" || op === "subset_of") {
+          if (!Array.isArray(v)) {
+            throw new AuthError("auth-openid-federation/bad-policy-" + (op === "one_of" ? "one-of" : "subset-of"),
+              "metadata_policy['" + claim + "']." + op + " requires an array");
+          }
+          acc[op] = Object.prototype.hasOwnProperty.call(acc, op) ? _arrayIntersect(acc[op], v) : v.slice();
+        } else if (op === "essential") {
+          acc[op] = acc[op] === true || v === true;
+        } else {
+          throw new AuthError("auth-openid-federation/unknown-policy-op",
+            "metadata_policy['" + claim + "'] unknown operator \"" + op + "\"");
+        }
+      });
+    });
+  });
+  Object.keys(merged).forEach(function (claim) { _assertPolicyCombination(claim, merged[claim]); });
+  return merged;
+}
+
 /**
- * Apply a single metadata_policy block to a metadata object and
- * return the resulting object. Pure — never mutates input.
+ * Apply an already-merged metadata_policy block to a metadata object and
+ * return the resulting object. Pure — never mutates input. Operators are
+ * applied in the OIDF 1.0 §6.1.3 fixed order (value, add, default, one_of,
+ * subset_of, superset_of, essential) so the value-CHECK operators validate the
+ * value the value-MODIFICATION operators produced; the combined policy's
+ * operator combination was validated during the merge (_assertPolicyCombination).
  *
- * Operators per OIDF §6.2.1:
+ * Operators per OIDF 1.0 §6.1.3:
  *   value      — set claim to a fixed value (overrides subordinate)
  *   add        — array claim: append values not already present
  *   default    — provide a default if the claim is absent
@@ -254,14 +395,34 @@ function verifyEntityStatement(jwt, jwks, vopts) {
  *   essential  — claim must be present (else throw)
  */
 function _applyOnePolicy(metadata, policy) {
-  var out = Object.assign({}, metadata);
+  // Build the working copy from own, non-prototype-polluting keys only -- a
+  // metadata object carrying a "__proto__" / "constructor" / "prototype" own
+  // key (e.g. from JSON.parse) would otherwise set out's prototype via
+  // assignment; the merged policy's claim names are already poison-guarded.
+  var out = {};
+  Object.keys(metadata).forEach(function (mk) {
+    if (!pick.isPoisonedKey(mk)) out[mk] = metadata[mk];
+  });
   Object.keys(policy).forEach(function (claimName) {
+    if (pick.isPoisonedKey(claimName)) return;
     var rules = policy[claimName];
     if (!rules || typeof rules !== "object") {
       throw new AuthError("auth-openid-federation/bad-policy-rules",
         "metadata_policy['" + claimName + "'] must be an object");
     }
+    // Apply operators in the OIDF 1.0 section 6.1.3 fixed order so the
+    // value-CHECK operators (one_of/subset_of/superset_of/essential) validate
+    // the value AFTER the value-MODIFICATION operators (value/add/default) have
+    // produced it -- Object.keys order let a check run before the value it must
+    // guard was set. Any operator outside the fixed set is refused first.
     Object.keys(rules).forEach(function (op) {
+      if (_OP_ORDER.indexOf(op) === -1) {
+        throw new AuthError("auth-openid-federation/unknown-policy-op",
+          "metadata_policy['" + claimName + "'] unknown operator \"" + op + "\"");
+      }
+    });
+    _OP_ORDER.forEach(function (op) {
+      if (!Object.prototype.hasOwnProperty.call(rules, op)) return;
       var v = rules[op];
       switch (op) {
         case "value":
@@ -275,8 +436,8 @@ function _applyOnePolicy(metadata, policy) {
             throw new AuthError("auth-openid-federation/bad-policy-add",
               "metadata_policy['" + claimName + "'].add requires an array");
           }
-          if (!Array.isArray(out[claimName])) out[claimName] = [];
-          v.forEach(function (val) { if (out[claimName].indexOf(val) === -1) out[claimName].push(val); });
+          var _addResult = _arrayUnion(_coerceOperandArray(out[claimName]) || [], v);
+          out[claimName] = typeof out[claimName] === "string" ? _addResult.join(" ") : _addResult;
           break;
         case "one_of":
           if (!Array.isArray(v)) {
@@ -294,8 +455,14 @@ function _applyOnePolicy(metadata, policy) {
             throw new AuthError("auth-openid-federation/bad-policy-subset-of",
               "metadata_policy['" + claimName + "'].subset_of requires an array");
           }
-          if (Array.isArray(out[claimName])) {
-            out[claimName].forEach(function (val) {
+          if (out[claimName] !== undefined && out[claimName] !== null) {
+            var _subArr = _coerceOperandArray(out[claimName]);
+            if (_subArr === null) {
+              throw new AuthError("auth-openid-federation/policy-subset-of-failed",
+                "metadata_policy['" + claimName + "']: value " + JSON.stringify(out[claimName]) +
+                " is neither an array nor a space-delimited string; subset_of constrains an array-valued claim");
+            }
+            _subArr.forEach(function (val) {
               if (v.indexOf(val) === -1) {
                 throw new AuthError("auth-openid-federation/policy-subset-of-failed",
                   "metadata_policy['" + claimName + "']: value \"" + JSON.stringify(val) +
@@ -309,8 +476,9 @@ function _applyOnePolicy(metadata, policy) {
             throw new AuthError("auth-openid-federation/bad-policy-superset-of",
               "metadata_policy['" + claimName + "'].superset_of requires an array");
           }
+          var _supArr = _coerceOperandArray(out[claimName]) || [];
           v.forEach(function (req) {
-            if (!Array.isArray(out[claimName]) || out[claimName].indexOf(req) === -1) {
+            if (_supArr.indexOf(req) === -1) {
               throw new AuthError("auth-openid-federation/policy-superset-of-failed",
                 "metadata_policy['" + claimName + "']: missing required value \"" + req + "\"");
             }
@@ -350,9 +518,11 @@ function _applyOnePolicy(metadata, policy) {
  * own self-config metadata_policy is therefore ignored.
  *
  * The chain is leaf-first; each `chain[i].subordinate` is the statement
- * signed by the superior directly above entity `i`, so walking high
- * index → low index applies the anchor's policy first, then each
- * intermediate's, narrowing down to the leaf (§6.2 narrow-only merge).
+ * signed by the superior directly above entity `i`; every level's policy
+ * is merged into ONE combined policy so a subordinate can only NARROW a
+ * superior's constraint (a leaf-ward level pinning a different
+ * value/default refuses the chain as a trust downgrade), then applied
+ * once (OIDF 1.0 §6.1.5.3).
  *
  * @example
  *   var effective = b.auth.openidFederation.applyMetadataPolicy(
@@ -371,21 +541,27 @@ function applyMetadataPolicy(metadata, chain, kind) {
     throw new AuthError("auth-openid-federation/bad-chain",
       "applyMetadataPolicy: chain must be an array");
   }
-  var out = Object.assign({}, metadata);
-  // Walk top-down (anchor last in leaf-first array). Read the policy
-  // from each node's SUPERIOR-SIGNED subordinate statement — never from
-  // the entity's own self-config — so the anchor/intermediate
-  // constraints can't be dropped by a self-declared policy. The anchor
-  // node carries no `.subordinate` (it terminates the chain) and is
-  // skipped; the leaf's self-config policy is never read.
+  Object.keys(metadata).forEach(function (mk) {
+    if (pick.isPoisonedKey(mk)) {
+      throw new AuthError("auth-openid-federation/poisoned-metadata-key",
+        "applyMetadataPolicy: metadata key \"" + mk + "\" is a prototype-pollution vector");
+    }
+  });
+  // Gather each SUPERIOR-SIGNED subordinate statement's policy for this kind,
+  // superior-first (anchor policy first; the anchor node terminates the chain
+  // with no .subordinate, and the leaf's own self-config policy is never read),
+  // then MERGE every level into ONE combined policy so a subordinate can only
+  // NARROW a superior's constraint (OIDF 1.0 section 6.1.5.3) -- a leaf-ward
+  // level pinning a different value/default is a conflict that refuses the
+  // chain -- and apply the merged policy ONCE.
+  var blocks = [];
   for (var i = chain.length - 1; i >= 0; i--) {
     var stmt = chain[i];
     if (!stmt || !stmt.subordinate) continue;
-    if (stmt.subordinate.metadata_policy && stmt.subordinate.metadata_policy[kind]) {
-      out = _applyOnePolicy(out, stmt.subordinate.metadata_policy[kind]);
-    }
+    var mp = stmt.subordinate.metadata_policy;
+    if (mp && mp[kind]) blocks.push(mp[kind]);
   }
-  return out;
+  return _applyOnePolicy(Object.assign({}, metadata), _mergeMetadataPolicies(blocks));
 }
 
 async function _defaultFetcher(url) {
@@ -593,6 +769,21 @@ async function buildTrustChain(opts) {
     // The subordinate statement pins this entity's jwks — adopt the
     // attested keys for the next link down, and reflect them on the node.
     if (node.subordinate.jwks && Array.isArray(node.subordinate.jwks.keys)) {
+      // Bind the entity's OWN self-configuration to the superior-attested
+      // keys. resolveLeaf reads the effective metadata from the entity's
+      // self-config (chain[i].claims.metadata), and Phase 1 verified that
+      // config only against its OWN self-published jwks — which proves the
+      // document isn't garbled, NOT that a federation-attested key signed
+      // it. An attacker who controls the entity's .well-known endpoint (but
+      // not its attested signing key) can serve a self-signed config that
+      // carries forged metadata + attacker jwks and sails through the Phase 1
+      // self-verify; without this check the pinned keys never gate the very
+      // document whose metadata is trusted. Re-verify the config against the
+      // pinned keys so a config not signed by an attested key fails the whole
+      // chain (OIDF 1.0 §9 — the leaf/intermediate Entity Configuration is
+      // verified with the jwks pinned by its superior's Subordinate
+      // Statement, never with the config's self-declared jwks).
+      verifyEntityStatement(node.jwt, node.subordinate.jwks);
       node.claims.jwks = node.subordinate.jwks;
       attestedJwks = node.subordinate.jwks;
     } else {

package/lib/vendor/blamejs/lib/auth/saml.js

@@ -54,6 +54,7 @@ var zlib         = require("node:zlib");
 var nodeCrypto   = require("node:crypto");
 var pqcSoftware  = require("../pqc-software");
 var bCrypto      = require("../crypto");
+var C            = require("../constants");
 var { generateToken, timingSafeEqual } = bCrypto;
 var { AuthError } = require("../framework-error");
 
@@ -703,6 +704,24 @@ function create(opts) {
         }
         var recipHok = _attr(scdHok, "Recipient");
         if (!recipHok || recipHok !== opts.assertionConsumerServiceUrl) continue;   // §3.1→§4.1.4.2 — Recipient is mandatory; absent fails the endpoint binding
+        // §3.1→§4.1.4.2 — a solicited response's SubjectConfirmationData
+        // InResponseTo MUST equal the stored AuthnRequest ID. The Bearer path
+        // below enforces this when the operator supplies expectedInResponseTo;
+        // holder-of-key is a sibling reader of the SAME SubjectConfirmationData
+        // and applies the identical replay check. Omitting it let an operator
+        // that opted into InResponseTo binding silently lose it on every HoK
+        // confirmation (possession-proof is a separate control, not a licence
+        // to skip the solicited-response correlation the operator requested).
+        var irtHok = _attr(scdHok, "InResponseTo");
+        if (vopts.expectedInResponseTo) {
+          if (irtHok === null || irtHok === undefined ||
+              !timingSafeEqual(irtHok, vopts.expectedInResponseTo)) {
+            throw new AuthError("auth-saml/bad-in-response-to",
+              "SubjectConfirmation InResponseTo does not match expected " +
+              "AuthnRequest ID (replay defense)");
+          }
+        }
+        matchedInResponseTo = irtHok;
         hokOk = true;
         break;
       }
@@ -835,7 +854,7 @@ function create(opts) {
       sessionIndex:    sessionIndex,
       attributes:      attributes,
       audience:        audience,
-      inResponseTo:    bearerOk ? matchedInResponseTo : null,
+      inResponseTo:    (bearerOk || hokOk) ? matchedInResponseTo : null,
       issuer:          issuer,
     };
   }
@@ -1681,16 +1700,16 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
         "OAEP unwrap failed: " + ((eR && eR.message) || String(eR)));
     }
   } else if (keyAlg === "urn:blamejs:experimental:xmlenc:ml-kem-1024") {
-    // Framework PQC envelope — wrappedKey carries the ML-KEM
-    // ciphertext concatenated with the AEAD-wrapped CEK. We invoke
-    // b.pqcSoftware.ml_kem_1024.decapsulate to recover the shared
-    // secret, then ChaCha20-Poly1305 unwrap. The exact wire shape is
-    // the framework's `b.crypto.envelope` format.
+    // Framework PQC key transport — the EncryptedKey CipherValue carries
+    // a b.crypto envelope (ML-KEM-1024 KEM-only suite) whose plaintext IS
+    // the content-encryption key. b.crypto.decrypt parses the envelope
+    // magic + suite header, decapsulates with the SP's ML-KEM-1024 private
+    // key, and returns the CEK bytes. `raw: true` keeps the CEK as a
+    // Buffer (it is binary key material, not utf8 text); the SP private
+    // key travels as the PEM the envelope opener expects.
     try {
-      cek = bCrypto.decryptEnvelope({
-        envelope:   wrappedKey,
-        privateKey: nodeCrypto.createPrivateKey({ key: spPrivateKeyPem, format: "pem" }),
-      });
+      cek = bCrypto.decrypt(wrappedKey.toString("base64"),
+        { privateKey: spPrivateKeyPem }, { raw: true });
     } catch (eM) {
       throw new AuthError("auth-saml/encrypted-key-unwrap-failed",
         "ML-KEM-1024 unwrap failed: " + ((eM && eM.message) || String(eM)));
@@ -1744,17 +1763,16 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
       throw new AuthError("auth-saml/encrypted-content-too-short",
         "XChaCha20-Poly1305 CipherValue too short");
     }
-    var xnonce = contentBlob.subarray(0, 24);                                                       // XChaCha20 nonce size
-    var xtag   = contentBlob.subarray(contentBlob.length - 16);                                    // Poly1305 tag size
-    var xct    = contentBlob.subarray(24, contentBlob.length - 16);
+    // XMLEnc content wire is nonce(24) || ciphertext || Poly1305-tag(16).
+    // b.crypto.decryptPacked reads a 1-byte format tag followed by that
+    // exact 24-byte-nonce + (ciphertext||tag) tail, so prepending the
+    // XChaCha20-Poly1305 format byte routes the content through the
+    // framework's own AEAD (which verifies the Poly1305 tag) instead of a
+    // hand-rolled cipher call.
+    var packedContent = Buffer.concat([
+      Buffer.from([C.FORMAT.XCHACHA20_POLY1305]), contentBlob]);
     try {
-      clearBytes = bCrypto.aeadDecrypt({
-        alg:   "xchacha20-poly1305",
-        key:   cek,
-        nonce: xnonce,
-        ct:    xct,
-        tag:   xtag,
-      });
+      clearBytes = bCrypto.decryptPacked(packedContent, cek);
     } catch (eX) {
       throw new AuthError("auth-saml/encrypted-content-tag-mismatch",
         "XChaCha20-Poly1305 tag mismatch: " + ((eX && eX.message) || String(eX)));