@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/lib/archive-tar.js

@@ -175,10 +175,20 @@ function _writeString(buf, value, offset, width) {
 
 function _readOctal(buf, offset, width) {
   // Read an octal-encoded field. Terminator may be space or NUL.
+  //
+  // POSIX permits numeric fields to be LEFT-padded with spaces (as well as
+  // zeros) — star, BSD tar, and several Java/Perl tar libraries emit them,
+  // and GNU tar / libarchive skip them. Treating a leading space as a
+  // terminator silently misreads such a field as 0 (a parser-differential:
+  // the reader would disagree with every other tar on the same bytes, and a
+  // misread size desyncs the block walker). Skip leading-space padding first;
+  // a space or NUL AFTER the digits still terminates the field.
+  var i = 0;
+  while (i < width && buf[offset + i] === 0x20) i += 1;                              // ASCII space (0x20) leading padding per POSIX numeric field
   var s = "";
-  for (var i = 0; i < width; i += 1) {
+  for (; i < width; i += 1) {
     var c = buf[offset + i];
-    if (c === 0x20 || c === 0) break;                                                // ASCII space (0x20) + NUL (0x00) field terminators
+    if (c === 0x20 || c === 0) break;                                                // ASCII space (0x20) + NUL (0x00) field terminators after digits
     if (c < 0x30 || c > 0x37) {                                                      // ASCII '0' (0x30) .. '7' (0x37) octal digits
       throw new TarError("archive-tar/bad-octal",
         "non-octal byte 0x" + c.toString(16) + " at offset " + (offset + i));        // radix=16 for diagnostic hex format

package/lib/vendor/blamejs/lib/arg-parser.js

@@ -625,7 +625,7 @@ function create(opts) {
 
 /**
  * @primitive b.argParser.parseRaw
- * @signature b.argParser.parseRaw(argv)
+ * @signature b.argParser.parseRaw(argv, opts?)
  * @since     0.8.48
  * @status    stable
  * @related   b.argParser.create
@@ -638,6 +638,21 @@ function create(opts) {
  * value`, `--key=value`, and bare `--bool`. `--` terminates flag
  * parsing.
  *
+ * Pass `opts.booleanNames` (an array of long-flag names) to declare flags
+ * that never consume a following token as their value — a bare
+ * `--version` stays boolean instead of swallowing the next token, so
+ * `--version foo` yields `flags.version === true` with `foo` left as a
+ * positional. An inline `--version=x` still records the explicit value.
+ *
+ * A flag repeated on the command line accumulates every occurrence into
+ * an array, in order — `--watch a --watch b` yields `["a", "b"]`, not
+ * just the last value. A flag seen once stays a scalar. This keeps
+ * repeatable flags (the `dev` command's `--arg` / `--watch` / `--ignore`)
+ * from silently dropping all but the final occurrence.
+ *
+ * @opts
+ *   booleanNames: string[],   // long-flag names that never consume a following token as a value (default: none)
+ *
  * @example
  *   var r = b.argParser.parseRaw(
  *     ["build", "--target=node", "-v", "--out", "dist", "--", "extra"]);
@@ -646,11 +661,39 @@ function create(opts) {
  *   r.flags.v;         // → true
  *   r.flags.out;       // → "dist"
  */
-function parseRaw(argv) {
+// Record a parsed flag, accumulating repeats. First occurrence stores the
+// scalar as-is (so single-value flags keep their string/boolean shape);
+// the second and later occurrences promote the entry to an array holding
+// every value in argv order. Without this a repeated flag would overwrite
+// the earlier value and a repeatable flag could never yield more than one.
+function _assignFlag(flags, name, val) {
+  if (Object.prototype.hasOwnProperty.call(flags, name)) {
+    var prev = flags[name];
+    if (Array.isArray(prev)) {
+      prev.push(val);
+    } else {
+      flags[name] = [prev, val];
+    }
+  } else {
+    flags[name] = val;
+  }
+}
+
+function parseRaw(argv, opts) {
   if (!Array.isArray(argv)) {
     throw new ArgParserError("arg-parser/argv-not-array",
       "argv must be an array of strings");
   }
+  opts = opts || {};
+  // Long-flag names declared boolean never consume a following token as a
+  // value (a bare `--version` stays true instead of swallowing the next
+  // token). Inline `--flag=value` still records the explicit value.
+  var booleanNames = Object.create(null);
+  if (Array.isArray(opts.booleanNames)) {
+    for (var bn = 0; bn < opts.booleanNames.length; bn++) {
+      booleanNames[opts.booleanNames[bn]] = true;
+    }
+  }
   var pos = [];
   var flags = Object.create(null);
   for (var i = 0; i < argv.length; i++) {
@@ -670,7 +713,8 @@ function parseRaw(argv) {
       if (eq !== -1) {
         val = name.slice(eq + 1);
         name = name.slice(0, eq);
-      } else if (i + 1 < argv.length && argv[i + 1].indexOf("--") !== 0) {
+      } else if (i + 1 < argv.length && argv[i + 1].indexOf("--") !== 0 &&
+                 booleanNames[name] !== true) {
         val = argv[++i];
       } else {
         val = true;
@@ -679,14 +723,14 @@ function parseRaw(argv) {
         throw new ArgParserError("arg-parser/argv-forbidden-name",
           "flag '--" + name + "' is reserved");
       }
-      flags[name] = val;
+      _assignFlag(flags, name, val);
     } else if (tok.indexOf("-") === 0 && tok.length === 2) {
       var s = tok.slice(1);
       if (pick.isPoisonedKey(s)) {
         throw new ArgParserError("arg-parser/argv-forbidden-name",
           "flag '-" + s + "' is reserved");
       }
-      flags[s] = true;
+      _assignFlag(flags, s, true);
     } else {
       pos.push(tok);
     }

package/lib/vendor/blamejs/lib/asn1-der.js

@@ -132,6 +132,18 @@ function readNode(buf, offset) {
     for (var i = 0; i < lenOctets; i += 1) {
       length = (length * 256) + buf[offset + headerLen + i];                    // base-256 length bytes
     }
+    // X.690 §10.1: DER requires the MINIMUM number of length octets. Long
+    // form is only permitted for lengths >= 128, and must carry no leading-
+    // zero octet — reject both non-minimal forms so an attacker-supplied
+    // certificate / CMS / OCSP response cannot smuggle a BER/DER parser-
+    // differential encoding through the shared walker. The decoder already
+    // refuses every other BER-ism (indefinite length, non-minimal OID
+    // subidentifiers, non-minimal high-tag-number tags); enforcing minimal
+    // lengths closes the remaining gap.
+    if (length < 128 || buf[offset + headerLen] === 0) {                        // X.690 §10.1 short-form boundary / no leading-zero octet
+      throw new Asn1Error("asn1/length-non-minimal",
+        "long-form length is not DER-minimal (length=" + length + ")");
+    }
     headerLen += lenOctets;
   }
 

package/lib/vendor/blamejs/lib/audit-sign.js

@@ -204,6 +204,24 @@ function _computeFingerprint(publicKeyPem) {
 // untouched). Changing this invalidates every prior anchor.
 var ANCHOR_FORMAT = "blamejs-chain-anchor-v1";
 
+// The anchor signed-bytes layout below is newline-delimited, so a literal
+// newline inside any operator-influenced string field (format / tipHash /
+// prevTipHash) would let content migrate across a field boundary WITHOUT
+// changing the signed bytes: two different { tipHash, prevTipHash } splits
+// collide on one signature, so a signature minted for one split verifies for a
+// different split. That defeats the "prevTipHash is bound into the signature"
+// linkage guarantee — an attacker could rewrite the apparent tip / linkage of a
+// stored anchor while keeping verify() happy. counter + createdAt are numbers
+// (String() of a finite number can never contain the delimiter), so only the
+// three string fields need guarding. Reject the delimiter at BOTH sign time
+// (so no ambiguous signature is ever minted) and verify time (so a pre-existing
+// or hand-crafted ambiguous anchor is refused, not accepted). The wire format
+// stays byte-identical for every legitimate (delimiter-free) anchor.
+var ANCHOR_FIELD_DELIMITER = "\n";
+function _containsAnchorDelimiter(s) {
+  return typeof s === "string" && s.indexOf(ANCHOR_FIELD_DELIMITER) !== -1;
+}
+
 // Build the canonical signed bytes for one anchor. Fixed multi-line layout (no
 // JSON serializer quirks). prevTipHash IS part of the signed payload, so the
 // link between consecutive anchors is tamper-evident — an attacker cannot
@@ -878,10 +896,20 @@ function _normalizeTip(tip, fnLabel) {
     throw _err("ANCHOR_BAD_TIPHASH",
       "auditSign." + fnLabel + ": tip.tipHash must be a non-empty string");
   }
+  if (_containsAnchorDelimiter(tip.tipHash)) {
+    throw _err("ANCHOR_BAD_TIPHASH",
+      "auditSign." + fnLabel + ": tip.tipHash must not contain a newline (the anchor " +
+      "record delimiter — it would make the signed bytes ambiguous)");
+  }
   if (tip.prevTipHash != null && typeof tip.prevTipHash !== "string") {
     throw _err("ANCHOR_BAD_PREV",
       "auditSign." + fnLabel + ": tip.prevTipHash, when present, must be a string");
   }
+  if (_containsAnchorDelimiter(tip.prevTipHash)) {
+    throw _err("ANCHOR_BAD_PREV",
+      "auditSign." + fnLabel + ": tip.prevTipHash must not contain a newline (the anchor " +
+      "record delimiter — it would make the signed bytes ambiguous)");
+  }
   return {
     counter:     counter,
     tipHash:     tip.tipHash,
@@ -916,7 +944,9 @@ function _normalizeTip(tip, fnLabel) {
  * that key store (not fully store-free) — keep the history with the anchors.
  *
  * Throws `AuditSignError` (`ANCHOR_BAD_TIP` / `ANCHOR_BAD_COUNTER` /
- * `ANCHOR_BAD_TIPHASH` / `ANCHOR_BAD_PREV`) on a malformed tip;
+ * `ANCHOR_BAD_TIPHASH` / `ANCHOR_BAD_PREV` / `ANCHOR_BAD_FORMAT`) on a malformed
+ * tip — including any `format` / `tipHash` / `prevTipHash` that carries a
+ * newline, which would make the signed bytes ambiguous;
  * `audit-sign/not-initialized` when `init()` has not been awaited.
  *
  * @opts
@@ -934,6 +964,11 @@ function anchor(tip, opts) {
   _requireInit();
   opts = opts || {};
   var t = _normalizeTip(tip, "anchor");
+  if (_containsAnchorDelimiter(opts.format)) {
+    throw _err("ANCHOR_BAD_FORMAT",
+      "auditSign.anchor: opts.format must not contain a newline (the anchor " +
+      "record delimiter — it would make the signed bytes ambiguous)");
+  }
   var format = (typeof opts.format === "string" && opts.format.length > 0) ? opts.format : ANCHOR_FORMAT;
   var createdAt = (typeof opts.createdAt === "number" && isFinite(opts.createdAt)) ? opts.createdAt : Date.now();
   var payload = anchorPayload(t.counter, t.tipHash, t.prevTipHash, createdAt, format);
@@ -962,6 +997,17 @@ function _verifyOneAnchor(a) {
   if (typeof a.counter !== "number" || !isFinite(a.counter)) {
     return { ok: false, reason: "anchor counter is not a finite number" };
   }
+  // Fail closed on a delimiter-bearing field: the newline-delimited signed
+  // bytes are ambiguous when format / tipHash / prevTipHash carries the
+  // delimiter, so ONE signature can be valid for several different logical
+  // { tipHash, prevTipHash } splits. Refuse rather than accept the ambiguity —
+  // a legitimate anchor is delimiter-free (anchor() rejects a newline field at
+  // sign time), so this only ever rejects a hand-crafted / boundary-shifted one.
+  if (_containsAnchorDelimiter(a.tipHash) ||
+      _containsAnchorDelimiter(a.format) ||
+      _containsAnchorDelimiter(a.prevTipHash)) {
+    return { ok: false, reason: "anchor field contains the record delimiter (ambiguous canonicalization)" };
+  }
   var pub = getPublicKeyByFingerprint(a.publicKeyFingerprint);
   if (!pub) {
     return { ok: false, reason: "no audit-signing key on record for this anchor's fingerprint" };

package/lib/vendor/blamejs/lib/audit.js

@@ -218,6 +218,45 @@ async function _insertCheckpoint(values) {
   );
 }
 
+// A concurrent anchor of the SAME tip loses the race to INSERT the
+// atMonotonicCounter (UNIQUE): two anchors of one tip sign the identical
+// payload, so the collision means the counter is ALREADY anchored, not a
+// corruption. Recognize it BACKEND-AGNOSTICALLY so the loser returns null like
+// the skipIfUnchanged "already anchored" path instead of throwing. Each driver
+// surfaces the violation differently: SQLite names the column in the message
+// (`... audit_checkpoints.atMonotonicCounter`); Postgres carries the unique
+// INDEX name (idx_chkpt_counter) in `constraint`/`detail` with SQLSTATE 23505;
+// MySQL reports the key name in `sqlMessage` with errno 1062. Gather every such
+// field, and require BOTH a reference to the counter column OR its unique index
+// AND a uniqueness signal, so no unrelated error is ever swallowed (anything
+// unrecognized rethrows — fail-closed).
+// Tokens that name the counter column (sqlite) or its unique index (pg/mysql).
+var _DUP_COUNTER_REFS = ["atmonotoniccounter", "chkpt_counter"];
+// A uniqueness-violation signal on any backend: sqlite message/code, postgres
+// text/SQLSTATE 23505, mysql text/code-name/errno 1062.
+var _DUP_UNIQUE_SIGNALS = [
+  "unique constraint failed", "sqlite_constraint", "duplicate key",
+  "23505", "duplicate entry", "er_dup_entry", "1062",
+];
+function _errorTextContainsAny(text, needles) {
+  for (var i = 0; i < needles.length; i++) {
+    if (text.indexOf(needles[i]) !== -1) return true;
+  }
+  return false;
+}
+function _isDuplicateCheckpointCounter(e) {
+  if (!e) return false;
+  var parts = [e.message, e.detail, e.constraint, e.sqlMessage, e.table, e.code, e.errno];
+  var text = "";
+  for (var i = 0; i < parts.length; i++) {
+    if (parts[i] != null) text += " " + String(parts[i]);
+  }
+  if (typeof e.toString === "function") text += " " + e.toString();
+  text = text.toLowerCase();
+  return _errorTextContainsAny(text, _DUP_COUNTER_REFS) &&
+         _errorTextContainsAny(text, _DUP_UNIQUE_SIGNALS);
+}
+
 async function _upsertAuditTip(counter, rowHash, signedAt, fencingToken) {
   // Cluster-mode only. Single atomic INSERT … ON CONFLICT … DO UPDATE
   // … WHERE … RETURNING. The WHERE clause is the canonical
@@ -1001,9 +1040,30 @@ async function checkpoint(opts) {
 
   var ckptId = generateToken(TRACE_ID_BYTES);
   var fencingToken = cluster.fencingToken();
-  await _insertCheckpoint(
-    [ckptId, createdAt, counter, tip.rowHash, signature, pubFp, fencingToken]
-  );
+  try {
+    await _insertCheckpoint(
+      [ckptId, createdAt, counter, tip.rowHash, signature, pubFp, fencingToken]
+    );
+  } catch (e) {
+    // Lost the INSERT race to another anchor of this same tip counter: the
+    // counter is already anchored (both anchors sign the identical payload).
+    // In SINGLE-NODE mode that is purely idempotent — return null like the
+    // skipIfUnchanged "already anchored" path and let the winner own the
+    // sidecar write below. In CLUSTER mode the duplicate can instead mean a
+    // NEWER LEADER anchored this tip while we still hold an OLDER fencingToken,
+    // so we must NOT silently swallow it: run the audit-tip fence first, whose
+    // fencing-token WHERE guard throws FENCED_OUT when a higher token has been
+    // stored — surfacing the leadership-loss step-down instead of a benign
+    // null. If the fence passes (a same-node concurrent race), it is idempotent.
+    // Any non-duplicate error rethrows.
+    if (_isDuplicateCheckpointCounter(e)) {
+      if (cluster.isClusterMode()) {
+        await _upsertAuditTip(counter, tip.rowHash, String(createdAt), fencingToken);
+      }
+      return null;
+    }
+    throw e;
+  }
 
   // Update rollback-detection sidecar (single-node) or audit-tip row
   // (cluster mode).
@@ -1739,12 +1799,14 @@ function generateActorBindingTriggerSql(opts) {
   // so operator-supplied opts.column / opts.tableName / opts.roleMappingFn
   // can't reach raw concatenation. PostgreSQL + SQLite both use the
   // double-quote dialect.
-  var qColumn   = safeSql.quoteIdentifier(columnRaw, "postgres");
-  var qTable    = safeSql.quoteIdentifier(tableNameRaw, "postgres");
-  var qFn       = safeSql.quoteIdentifier(fnNameRaw, "postgres");
-  var qTrig     = safeSql.quoteIdentifier(trigNameRaw, "postgres");
+  // allowReserved: parity with b.db.from() — an operator column/table/function
+  // named as a SQL keyword must quote here too (safe once quoted).
+  var qColumn   = safeSql.quoteIdentifier(columnRaw, "postgres", { allowReserved: true });
+  var qTable    = safeSql.quoteIdentifier(tableNameRaw, "postgres", { allowReserved: true });
+  var qFn       = safeSql.quoteIdentifier(fnNameRaw, "postgres", { allowReserved: true });
+  var qTrig     = safeSql.quoteIdentifier(trigNameRaw, "postgres", { allowReserved: true });
   var qRoleMapFn = opts.roleMappingFn
-    ? safeSql.quoteIdentifier(opts.roleMappingFn, "postgres")
+    ? safeSql.quoteIdentifier(opts.roleMappingFn, "postgres", { allowReserved: true })
     : null;
   var allowList = allowRoles.length === 0 ? "" :
     "  IF current_user IN (" +
@@ -1919,4 +1981,5 @@ module.exports = {
   CHECKPOINT_FORMAT:    CHECKPOINT_FORMAT,
   FRAMEWORK_NAMESPACES: FRAMEWORK_NAMESPACES,
   _resetForTest:        _resetForTest,
+  _isDuplicateCheckpointCounter: _isDuplicateCheckpointCounter,   // test seam: cross-backend dup-counter recognition
 };

package/lib/vendor/blamejs/lib/auth/ciba.js

@@ -278,6 +278,13 @@ function create(opts) {
     };
     Object.assign(req, opts.httpClientOpts || {});
     if (opts.allowHttp === true) req.allowedProtocols = safeUrl.ALLOW_HTTP_ALL;
+    // Thread the operator's explicit SSRF waiver onto the backchannel-auth
+    // and token POSTs too — create() already hands allowInternal to the
+    // inner OAuth client for discovery / JWKS, so an internal-network IdP
+    // whose discovery resolves would still have its /bc-auth and /token
+    // requests blocked here without this. Matches oauth's per-request
+    // threading; the SSRF guard stays on unless allowInternal is set.
+    if (opts.allowInternal != null) req.allowInternal = opts.allowInternal;
     var res = await hc.request(req);
     if (res.statusCode < 200 || res.statusCode >= 300) {
       var bodyText = res.body ? res.body.toString("utf8") : "";
@@ -625,11 +632,16 @@ function create(opts) {
     // node:http's normalization could re-introduce the unreachable
     // branch). Read lowercase only.
     var authzHeader = req.headers["authorization"];
-    if (!authzHeader || authzHeader.indexOf("Bearer ") !== 0) {
+    // RFC 7235 §2.1 — the auth-scheme token ("Bearer") is ASCII
+    // case-insensitive; match it case-insensitively so a spec-compliant
+    // `bearer <token>` sender isn't wrongly refused. The token that follows
+    // keeps its case (it is compared verbatim below).
+    var BEARER_PREFIX = "bearer ";
+    if (!authzHeader || authzHeader.slice(0, BEARER_PREFIX.length).toLowerCase() !== BEARER_PREFIX) {
       throw new AuthError("auth-ciba/missing-bearer",
         "ciba.parseNotification: Authorization: Bearer header missing");
     }
-    var presented = authzHeader.substring("Bearer ".length).trim();
+    var presented = authzHeader.slice(BEARER_PREFIX.length).trim();
     if (presented.length === 0 || !clientNotificationToken) {
       throw new AuthError("auth-ciba/bad-bearer",
         "ciba.parseNotification: empty bearer or no expected token configured");

package/lib/vendor/blamejs/lib/auth/fido-mds3.js

@@ -344,12 +344,16 @@ function _parseNextUpdate(s) {
   return d;
 }
 
-// Internal verify-blob helper used by both fetch (live HTTP) and the
-// fetch-with-injected-body test path. Operator-facing surface goes
-// through fetch().
-function _verifyAndParseBlob(token) {
+// Single source of truth for the BLOB-trust decision: JWS + x5c-chain verify
+// against the supplied trust roots, payload-shape validation, AND the
+// stale-BLOB refusal. fetch() (operator-supplied roots via caCertificate) and
+// _verifyAndParseBlob (default vendored roots) BOTH route here so no check can
+// ever be present on one path but missing on the other. The stale-refusal used
+// to live only in this helper's caller-inlined twin, so the operator-facing
+// fetch path silently accepted (and cached) a signed-but-expired BLOB; keeping
+// one body closes that class.
+function _verifyBlobWithRoots(token, rootPems) {
   var jws = _parseJws(token);
-  var rootPems = _resolveRoots(undefined);
   var chain = _validateChain(jws.header.x5c, rootPems);
   _verifyJws(jws, chain[0]);
   var payload = jws.payload;
@@ -366,19 +370,19 @@ function _verifyAndParseBlob(token) {
     throw new FidoMds3Error("fido-mds3/bad-payload",
       "BLOB payload 'nextUpdate' missing or not YYYY-MM-DD: " + payload.nextUpdate);
   }
-  // Stale-BLOB refusal — FIDO MDS3 §3.1.7 says clients SHOULD refresh
-  // by nextUpdate; a BLOB whose nextUpdate is already in the past is
-  // not safe to trust even though its cert chain still validates.
-  // Pre-v0.9.2 the staleness was floored to MIN_CACHE_TTL_MS in
-  // _ttlFromNextUpdate but the BLOB itself was still served from
-  // cache; an attacker serving an ancient signed-but-expired BLOB
-  // could keep operators on a revoked-authenticator-list-frozen-at-X.
-  // Refuse at parse time so neither fetch nor cache lookup honors it.
+  // Stale-BLOB refusal (FIDO MDS3 section 3.1.7): clients SHOULD refresh by
+  // nextUpdate; a BLOB whose nextUpdate is already in the past is not safe to
+  // trust even though its cert chain still validates. Flooring the staleness to
+  // MIN_CACHE_TTL_MS in _ttlFromNextUpdate is not enough on its own -- the BLOB
+  // itself must be refused, or an attacker serving an ancient signed-but-
+  // expired BLOB keeps operators pinned to a revoked-authenticator list frozen
+  // at that time. Refuse at parse time so neither fetch nor a cache lookup ever
+  // honors it.
   if (nextUpdate.getTime() < Date.now()) {
     throw new FidoMds3Error("fido-mds3/blob-stale",
       "BLOB payload nextUpdate \"" + payload.nextUpdate +
-      "\" is in the past — refusing to trust a stale metadata BLOB " +
-      "(FIDO MDS3 §3.1.7)");
+      "\" is in the past -- refusing to trust a stale metadata BLOB " +
+      "(FIDO MDS3 section 3.1.7)");
   }
   return {
     entries:     payload.entries,
@@ -388,6 +392,13 @@ function _verifyAndParseBlob(token) {
   };
 }
 
+// Internal verify-blob helper used by tests to exercise the verifier against
+// the DEFAULT vendored MDS3 trust roots without standing up a real HTTPS
+// endpoint. Operator-facing surface goes through fetch().
+function _verifyAndParseBlob(token) {
+  return _verifyBlobWithRoots(token, _resolveRoots(undefined));
+}
+
 // ---- public surface ----
 
 /**
@@ -481,39 +492,22 @@ async function fetch(opts) {   // allow:raw-outbound-http-framework-internal —
     }
     var token = rsp.body.toString("ascii").trim();
 
-    var jws = _parseJws(token);
-    var chain = _validateChain(jws.header.x5c, rootPems);
-    _verifyJws(jws, chain[0]);
-    var payload = jws.payload;
-    if (!payload || !Array.isArray(payload.entries)) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload missing 'entries' array");
-    }
-    if (typeof payload.no !== "number" || !isFinite(payload.no)) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload missing or non-numeric 'no'");
-    }
-    var nextUpdate = _parseNextUpdate(payload.nextUpdate);
-    if (!nextUpdate) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload 'nextUpdate' missing or not YYYY-MM-DD: " + payload.nextUpdate);
-    }
-    var record = {
-      entries:     payload.entries,
-      no:          payload.no,
-      nextUpdate:  nextUpdate,
-      url:         url,
-      legalHeader: payload.legalHeader,
-    };
+    // Route the trust decision through the shared verifier so this operator-
+    // facing path enforces the identical checks (chain verify, payload shape,
+    // AND the stale-BLOB refusal) as the internal helper -- fetch previously
+    // reimplemented the parse inline and omitted the stale check, silently
+    // accepting and caching an ancient signed-but-expired BLOB.
+    var record = _verifyBlobWithRoots(token, rootPems);
+    record.url = url;
     // Re-assert TTL based on the BLOB's nextUpdate (overrides the
     // wrap-call's safe-minimum seed).
-    try { await c.set(cacheKey, record, _ttlFromNextUpdate(nextUpdate)); }
+    try { await c.set(cacheKey, record, _ttlFromNextUpdate(record.nextUpdate)); }
     catch (_e) { /* cache.set best-effort */ }
     try { audit().safeEmit({
       action:   "auth.fido_mds3.fetch",
       outcome:  "success",
-      metadata: { url: url, no: payload.no, entries: payload.entries.length,
-                  nextUpdate: payload.nextUpdate },
+      metadata: { url: url, no: record.no, entries: record.entries.length,
+                  nextUpdate: record.nextUpdate.toISOString().slice(0, 10) },
     }); } catch (_e) { /* audit best-effort */ }
     return record;
   }, MIN_CACHE_TTL_MS);
@@ -577,18 +571,35 @@ function lookupAaguid(blob, aaguid) {
 function _certifiedLevel(statusReports) {
   if (!Array.isArray(statusReports)) return { level: 0, plus: false };
   var latest = null;
-  var latestDate = null;
+  var latestDate = null;   // null == no comparable date (missing / malformed)
   for (var i = 0; i < statusReports.length; i++) {
     var sr = statusReports[i];
     // Only certification-status reports move the level: a level grant, or its
     // explicit revocation (NOT_FIDO_CERTIFIED). Other statuses (UPDATE_AVAILABLE,
-    // REVOKED, …) are handled elsewhere and must not be read as a level. The
-    // status length is bounded before the regex test below — FIDO status tokens
+    // REVOKED, etc.) are handled elsewhere and must not be read as a level. The
+    // status length is bounded before the regex test below -- FIDO status tokens
     // are short enums; bounding input before any .test() is the convention.
     if (!sr || typeof sr.status !== "string" || sr.status.length > 64) continue;
     if (!CERT_LEVEL_RE.test(sr.status) && sr.status !== "NOT_FIDO_CERTIFIED") continue;
-    var d = typeof sr.effectiveDate === "string" ? sr.effectiveDate : "";
-    if (latest === null || d >= latestDate) {
+    // Only a well-formed calendar date is comparable. Reuse _parseNextUpdate
+    // (which already validates YYYY-MM-DD AND rejects impossible dates such as
+    // 2026-02-31) and compare epoch ms. A missing / malformed effectiveDate is
+    // "no comparable date" (null) and falls back to array order (append order,
+    // which the spec defines as chronological): the report later in the array
+    // is the more recent one. Coercing a missing date to "" and running it
+    // through a lexical compare made an undated report lose to EVERY earlier
+    // dated report, so a later decertification / downgrade / upgrade whose
+    // effectiveDate was absent never superseded the earlier grant -- freezing
+    // certifiedLevel at a stale value (an authenticator-assurance bypass: a
+    // decertified or downgraded authenticator kept reporting its prior level to
+    // step-up / risk policy).
+    var parsed = typeof sr.effectiveDate === "string" ? _parseNextUpdate(sr.effectiveDate) : null;
+    var d = parsed ? parsed.getTime() : null;
+    if (latest === null) { latest = sr; latestDate = d; continue; }
+    // sr is later in array order than the current latest. A missing/malformed
+    // date on EITHER side means array order decides -> sr (later) wins. Both
+    // dated -> the newer-or-equal date wins (sr, being later, takes ties).
+    if (d === null || latestDate === null || d >= latestDate) {
       latest = sr; latestDate = d;
     }
   }

package/lib/vendor/blamejs/lib/auth/jwt.js

@@ -126,6 +126,27 @@ function _resolveAlgorithm(alg) {
   return ALGORITHM_TO_NODE[alg];
 }
 
+// Bind the declared `alg` to the key that will actually produce/verify the
+// signature. node:crypto.sign/verify with a null digest select the algorithm
+// from the KeyObject's intrinsic type — NOT from the JWS `alg` header — so the
+// header value is only an unauthenticated label unless we cross-check it here.
+// Without this, verify()'s algorithm allowlist gates on that label while the
+// crypto runs against whatever the key is: an ML-DSA-signed token can declare
+// alg="SLH-DSA-SHAKE-256f" and pass an SLH-only allowlist (CWE-347 algorithm
+// confusion / allowlist bypass), and sign() can emit a token whose header
+// misstates its own signature algorithm. `alg` MUST already be a registry key
+// (callers validate via _resolveAlgorithm or the verify allowlist gate).
+function _assertAlgMatchesKey(alg, key, kind) {
+  var expectedNodeType = ALGORITHM_TO_NODE[alg];
+  var actual = key && typeof key.asymmetricKeyType === "string" ? key.asymmetricKeyType : null;
+  if (actual !== expectedNodeType) {
+    throw new AuthError("auth-jwt/alg-key-mismatch",
+      "declared alg '" + alg + "' requires a '" + expectedNodeType + "' key but the " +
+      kind + " key is '" + (actual || "unknown") + "' — the JWS alg header must be bound to " +
+      "the key's actual algorithm (CWE-347 algorithm confusion)");
+  }
+}
+
 // ---- sign ----
 
 async function sign(claims, opts) {
@@ -136,6 +157,10 @@ async function sign(claims, opts) {
   var alg = opts.algorithm || DEFAULT_ALGORITHM;
   _resolveAlgorithm(alg);
   var key = _toKeyObject(opts.privateKey, "private");
+  // Refuse to emit a token whose header alg misstates the signing key's real
+  // algorithm — that mislabeled token is exactly what the verify-side
+  // allowlist bypass consumes. Config-time throw (operator catches the typo).
+  _assertAlgMatchesKey(alg, key, "private");
 
   var nowMs = opts.now || Date.now();
   var nowSec = Math.floor(nowMs / C.TIME.seconds(1));
@@ -306,6 +331,15 @@ async function verify(token, opts) {
       "token alg='" + decoded.header.alg + "' is not in the allowed list [" + allowed.join(", ") + "]");
   }
 
+  // The allowlist gate above only constrains the SELF-DECLARED header.alg — a
+  // label the issuer controls. node:crypto.verify(null, ...) selects the real
+  // algorithm from the KeyObject, so a token can pass an SLH-only allowlist
+  // while being verified with an ML-DSA key (or vice versa). Bind the declared
+  // alg to the resolved key's actual algorithm before verifying, so the
+  // allowlist genuinely constrains which algorithm authenticated the token
+  // (CWE-347). decoded.header.alg is a registry key here (it passed the gate).
+  _assertAlgMatchesKey(decoded.header.alg, key, "public");
+
   var verified = false;
   try {
     verified = nodeCrypto.verify(null, Buffer.from(decoded.signingInput, "ascii"), key, decoded.signature);