@blamejs/core 0.15.12 → 0.15.14

package/lib/auth/access-lock.js

@@ -41,6 +41,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var requestHelpers = require("../request-helpers");
 
 var audit = lazyRequire(function () { return require("../audit"); });
 var observability = lazyRequire(function () { return require("../observability"); });
@@ -53,7 +54,7 @@ var SAFE_METHODS = Object.freeze({ GET: 1, HEAD: 1, OPTIONS: 1 });
 function _normalizeMode(mode) {
   if (typeof mode !== "string") return null;
   var m = mode.toLowerCase();
-  return VALID_MODES[m] ? m : null;
+  return Object.prototype.hasOwnProperty.call(VALID_MODES, m) ? m : null;
 }
 
 function create(opts) {
@@ -77,7 +78,6 @@ function create(opts) {
   }
   var passthroughPaths = Array.isArray(opts.passthroughPaths)
     ? opts.passthroughPaths.slice() : [];
-  var auditOn = opts.audit !== false;
   var getRole = typeof opts.getRole === "function" ? opts.getRole : null;
   var errorMessage = typeof opts.errorMessage === "string" && opts.errorMessage.length > 0
     ? opts.errorMessage : "service in restricted access mode";
@@ -87,33 +87,11 @@ function create(opts) {
   var modeSetBy   = "boot";
   var modeReason  = "initial mode at boot";
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "auth.access_lock." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit is best-effort */ }
-  }
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("auth.access_lock." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("auth.access_lock", opts.audit);
+  var _emitMetric = observability().namespaced("auth.access_lock");
 
-  function _isPassthrough(req) {
-    if (passthroughPaths.length === 0) return false;
-    var p = req.url || "";
-    var qpos = p.indexOf("?");
-    if (qpos !== -1) p = p.slice(0, qpos);
-    for (var i = 0; i < passthroughPaths.length; i++) {
-      var entry = passthroughPaths[i];
-      if (typeof entry === "string" && (p === entry || p.indexOf(entry + "/") === 0)) return true;
-      if (entry instanceof RegExp && entry.test(p)) return true;
-    }
-    return false;
-  }
+  var _isPassthrough = requestHelpers.makeSkipMatcher(
+    { skipPaths: passthroughPaths }, "auth.accessLock");
 
   function _hasUnlockRole(req) {
     if (!getRole || unlockRoles.length === 0) return false;
@@ -186,7 +164,7 @@ function create(opts) {
       if (_hasUnlockRole(req)) return next();
       if (currentMode === "read-only") {
         var method = (req.method || "GET").toUpperCase();
-        if (SAFE_METHODS[method]) return next();
+        if (Object.prototype.hasOwnProperty.call(SAFE_METHODS, method)) return next();
         _emitAudit("refused", "denied", { mode: currentMode, method: method, path: req.url });
         _emitMetric("refused", 1, { mode: currentMode, reason: "non-safe-method" });
         return _refuse(res, "non-safe-method-in-read-only");

package/lib/auth/bot-challenge.js

@@ -343,7 +343,7 @@ function create(opts) {
   var secret = opts.secret;
 
   var providerKey = opts.provider !== undefined ? opts.provider : DEFAULT_PROVIDER;
-  if (typeof providerKey !== "string" || !PROVIDERS[providerKey]) {
+  if (typeof providerKey !== "string" || !Object.prototype.hasOwnProperty.call(PROVIDERS, providerKey)) {
     var supported = Object.keys(PROVIDERS).join(", ");
     throw new BotChallengeError("bot-challenge/bad-opt",
       "provider: expected one of [" + supported + "], got " + JSON.stringify(providerKey));

package/lib/auth/ciba.js

@@ -452,6 +452,23 @@ function create(opts) {
     });
   }
 
+  // Verify an OIDC ID token (if present) via the composed inner OAuth client,
+  // returning its verified claims, or null when no id_token was supplied. A
+  // present-but-invalid id_token throws (fail-closed) so a forged token's
+  // sub/acr/amr can never be returned as trusted.
+  async function _verifyIdTokenIfPresent(idToken, auditKey, op) {
+    if (!idToken) return null;
+    try {
+      return await inner.verifyIdToken(idToken);
+    } catch (e) {
+      _emitAudit("id_token_verify_fail", "failure",
+        auditKey ? { authReqIdHash: sha3Hash(auditKey) } : {});
+      throw new AuthError("auth-ciba/id-token-invalid",
+        "ciba." + op + ": id_token failed verification: " +
+        ((e && e.code) || (e && e.message) || String(e)));
+    }
+  }
+
   async function pollToken(popts) {
     popts = popts || {};
     if (typeof popts.authReqId !== "string" || popts.authReqId.length === 0) {
@@ -514,6 +531,12 @@ function create(opts) {
     }
     // Token issued — clear interval tracking for this authReqId.
     _intervalState.delete(popts.authReqId);
+    // Verify the ID token (OIDC Core §3.1.3.7) via the composed inner OAuth
+    // client — it applies the create()-level issuer / clientId / JWKS /
+    // accepted-algorithms and enforces signature + iss/aud/exp. Returning an
+    // unverified id_token let a forged token's sub/acr/amr be trusted.
+    var pollClaims = await _verifyIdTokenIfPresent(rv.id_token,
+      "auth-ciba:" + popts.authReqId, "pollToken");
     _emitAudit("token_received", "success", {
       authReqIdHash: sha3Hash("auth-ciba:" + popts.authReqId),
     });
@@ -521,6 +544,7 @@ function create(opts) {
     return {
       accessToken:  rv.access_token   || null,
       idToken:      rv.id_token       || null,
+      claims:       pollClaims,
       refreshToken: rv.refresh_token  || null,
       tokenType:    rv.token_type     || null,
       scope:        rv.scope          || null,
@@ -545,17 +569,23 @@ function create(opts) {
    *   - In **push** mode the body carries the full token-response
    *     object; no follow-up call needed.
    *
+   * Async because a pushed `id_token` is verified (signature + iss/aud/exp)
+   * via the composed inner OAuth client before it is returned — the
+   * verified claims are surfaced as `claims`. A present-but-invalid
+   * id_token throws `auth-ciba/id-token-invalid` (the notification-token
+   * bearer authenticates the caller, never the token itself).
+   *
    * @opts
    *   { body?: object }   // pre-parsed body; defaults to req.body
    *
    * @example
-   *   app.post("/ciba/notify", function (req, res) {
-   *     var info = ciba.parseNotification(req, { body: req.body });
-   *     // → { authReqId, accessToken, idToken, ... }
+   *   app.post("/ciba/notify", async function (req, res) {
+   *     var info = await ciba.parseNotification(req, { body: req.body });
+   *     // → { authReqId, accessToken, idToken, claims, ... }
    *     res.statusCode = 204; res.end();
    *   });
    */
-  function parseNotification(req, popts) {
+  async function parseNotification(req, popts) {
     popts = popts || {};
     if (!req || !req.headers) {
       throw new AuthError("auth-ciba/bad-notification-req",
@@ -605,6 +635,14 @@ function create(opts) {
       throw new AuthError("auth-ciba/no-auth-req-id-in-body",
         "ciba.parseNotification: body missing auth_req_id");
     }
+    // Verify the pushed ID token (CIBA §10.2 / OIDC Core MUST) via the
+    // composed inner OAuth client before returning it as trusted. The
+    // notification-token bearer authenticates the CALLER, not the token; a
+    // leaked/observed notification token previously let an attacker inject
+    // arbitrary id_token claims the RP would trust on the documented
+    // "no follow-up call" push path.
+    var pushClaims = await _verifyIdTokenIfPresent(body.id_token,
+      "auth-ciba:" + body.auth_req_id, "parseNotification");
     _emitAudit("notification_received", "success", {
       authReqIdHash: sha3Hash("auth-ciba:" + body.auth_req_id),
       mode:          deliveryMode,
@@ -614,6 +652,7 @@ function create(opts) {
       authReqId:    body.auth_req_id,
       accessToken:  body.access_token  || null,
       idToken:      body.id_token      || null,
+      claims:       pushClaims,
       refreshToken: body.refresh_token || null,
       tokenType:    body.token_type    || null,
       scope:        body.scope         || null,

package/lib/auth/dpop.js

@@ -29,9 +29,11 @@
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("../crypto");
 var jwk = require("../jwk");
+var jwtExternal = require("./jwt-external");
 var safeJson = require("../safe-json");
 var safeUrl = require("../safe-url");
 var validateOpts = require("../validate-opts");
+var nonceStore = require("../nonce-store");
 var C = require("../constants");
 var { AuthError } = require("../framework-error");
 
@@ -74,16 +76,12 @@ var REFUSED_ALGS = ["HS256", "HS384", "HS512", "none"];
 
 function _b64urlEncode(buf) { return bCrypto.toBase64Url(buf); }
 
-function _b64urlDecode(s) {
-  if (typeof s !== "string") {
-    throw new AuthError("auth-dpop/bad-base64", "expected base64url string");
-  }
-  try { return bCrypto.fromBase64Url(s); }
-  catch (_e) {
-    throw new AuthError("auth-dpop/bad-base64",
-      "DPoP segment is not valid base64url");
-  }
-}
+var _b64urlDecode = bCrypto.makeBase64UrlDecoder({
+  errorClass:  AuthError,
+  code:        "auth-dpop/bad-base64",
+  typeMessage: "expected base64url string",
+  badMessage:  "DPoP segment is not valid base64url",
+});
 
 // Asymmetric key types DPoP accepts (its proof model relies on a
 // signature, so symmetric "oct" keys are refused). AKP is the IANA key
@@ -94,7 +92,7 @@ function thumbprint(key) {
   if (!key || typeof key !== "object" || typeof key.kty !== "string" || key.kty.length === 0) {
     throw new AuthError("auth-dpop/bad-jwk", "jwk must be an object with a kty");
   }
-  if (!DPOP_KTY[key.kty]) {
+  if (!Object.prototype.hasOwnProperty.call(DPOP_KTY, key.kty)) {
     throw new AuthError("auth-dpop/refused-kty", "jwk.kty='" + key.kty + "' is not allowed (DPoP requires asymmetric kty)");
   }
   // The RFC 7638 thumbprint itself is computed by b.jwk.
@@ -128,16 +126,10 @@ function _normalizeHtu(htu) {
 // Pick alg-specific node:crypto verify params. PQC algs use
 // signWithoutAlgorithm shape (`null` algorithm).
 function _signParamsForAlg(alg) {
-  if (alg === "RS256") return { hash: "sha256", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-  if (alg === "RS384") return { hash: "sha384", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-  if (alg === "RS512") return { hash: "sha512", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-  if (alg === "PS256") return { hash: "sha256", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 32 };  // RFC 7518 PS256 salt length
-  if (alg === "PS384") return { hash: "sha384", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 48 };  // RFC 7518 PS384 salt length
-  if (alg === "PS512") return { hash: "sha512", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 64 };  // RFC 7518 PS512 salt length
-  if (alg === "ES256") return { hash: "sha256", dsaEncoding: "ieee-p1363" };
-  if (alg === "ES384") return { hash: "sha384", dsaEncoding: "ieee-p1363" };
-  if (alg === "ES512") return { hash: "sha512", dsaEncoding: "ieee-p1363" };
-  if (alg === "EdDSA") return { hash: null };
+  // Classical-JOSE params (RS/PS/ES/EdDSA) from the shared table; DPoP layers
+  // PQC ML-DSA-87 on top (the only verifier that accepts it).
+  var params = jwtExternal.algParams(alg);
+  if (params) return params;
   if (alg === "ML-DSA-87") return { hash: null, pqc: true };
   throw new AuthError("auth-dpop/unsupported-alg",
     "alg '" + alg + "' is not supported by DPoP");
@@ -195,11 +187,11 @@ function _detectAlgFromKey(key) {
 }
 
 function _jwkToKeyObject(jwk) {
-  try { return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }
-  catch (e) {
-    throw new AuthError("auth-dpop/bad-jwk",
-      "could not import jwk: " + ((e && e.message) || String(e)));
-  }
+  return bCrypto.importPublicJwk(jwk, {
+    errorClass:    AuthError,
+    code:          "auth-dpop/bad-jwk",
+    messagePrefix: "could not import jwk: ",
+  });
 }
 
 // ---- buildProof ----
@@ -356,6 +348,11 @@ async function verify(proof, opts) {
       "DPoP proof declares 'crit' header — refused");
   }
 
+  // Bind the declared alg to the embedded JWK's kty/curve before handing
+  // the self-asserted key to node:crypto — every other JWS verifier in the
+  // framework enforces this (alg-confusion family, CVE-2026-22817 class).
+  jwtExternal._assertAlgKtyMatch(header.alg, header.jwk);
+
   // Verify signature against the embedded jwk
   var key = _jwkToKeyObject(header.jwk);
   var params = _signParamsForAlg(header.alg);
@@ -460,16 +457,12 @@ async function verify(proof, opts) {
       "verify: replayStore", AuthError, "auth-dpop/bad-replay-store",
       "must expose checkAndInsert(jti, expireAtMs) — use b.nonceStore.create()");
     var expireAtMs = nowMs + iatWindowSec * C.TIME.seconds(1) * 2;
-    var inserted;
-    try { inserted = await opts.replayStore.checkAndInsert(payload.jti, expireAtMs); }
-    catch (e) {
-      throw new AuthError("auth-dpop/replay-store-failed",
-        "replayStore.checkAndInsert threw: " + ((e && e.message) || String(e)));
-    }
-    if (inserted === false) {
-      throw new AuthError("auth-dpop/replay",
-        "DPoP proof jti='" + payload.jti + "' has been seen before — replay refused");
-    }
+    await nonceStore.enforceReplay(opts.replayStore, payload.jti, expireAtMs, {
+      errorClass:      AuthError,
+      storeFailedCode: "auth-dpop/replay-store-failed",
+      replayCode:      "auth-dpop/replay",
+      tokenLabel:      "DPoP proof",
+    });
   }
 
   return { header: header, payload: payload, jkt: jkt };

package/lib/auth/fido-mds3.js

@@ -43,6 +43,8 @@ var safeJson     = require("../safe-json");
 var safeBuffer   = require("../safe-buffer");
 var lazyRequire  = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var x509Chain    = require("../x509-chain");
+var jwtExternal  = require("./jwt-external");
 var _wa          = require("../vendor/simplewebauthn-server.cjs");
 var { FidoMds3Error } = require("../framework-error");
 
@@ -141,21 +143,14 @@ function _parseJws(token) {
 // in practice; PS* and EdDSA are listed for completeness so future
 // BLOBs over the same surface validate without a code edit.
 function _verifyParamsForAlg(alg) {
-  switch (alg) {
-    case "RS256": return { hash: "sha256", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-    case "RS384": return { hash: "sha384", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-    case "RS512": return { hash: "sha512", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-    case "PS256": return { hash: "sha256", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 32 };  // SHA-256 hash length
-    case "PS384": return { hash: "sha384", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 48 };  // SHA-384 hash length
-    case "PS512": return { hash: "sha512", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 64 };  // SHA-512 hash length
-    case "ES256": return { hash: "sha256", dsaEncoding: "ieee-p1363" };
-    case "ES384": return { hash: "sha384", dsaEncoding: "ieee-p1363" };
-    case "ES512": return { hash: "sha512", dsaEncoding: "ieee-p1363" };
-    case "EdDSA": return { hash: null };
-    default:
-      throw new FidoMds3Error("fido-mds3/unsupported-alg",
-        "JWS alg '" + alg + "' is not supported");
-  }
+  // Classical-JOSE alg→crypto params (RS/PS/ES/EdDSA) shared with the rest of
+  // the JOSE verifiers — jwtExternal.algParams owns the single table.
+  var params = jwtExternal.algParams(alg);
+  if (!params) {
+    throw new FidoMds3Error("fido-mds3/unsupported-alg",
+      "JWS alg '" + alg + "' is not supported");
+  }
+  return params;
 }
 
 // Resolve the trust roots. Operator override via caCertificate lets
@@ -245,7 +240,10 @@ function _validateChain(x5c, rootPems) {
     var root;
     try { root = new nodeCrypto.X509Certificate(rootPems[r]); }
     catch (_e) { continue; }
-    if (tail.checkIssued(root) && tail.verify(root.publicKey)) {
+    // issuerValidlyIssued enforces basicConstraints cA:TRUE on the root in
+    // addition to the issuance + signature linkage — a non-CA cert cannot
+    // anchor the x5c chain (basicConstraints bypass, CVE-2002-0862 class).
+    if (x509Chain.issuerValidlyIssued(root, tail)) {
       anchored = true;
       break;
     }

package/lib/auth/jwt-external.js

@@ -117,7 +117,16 @@ function _b64urlDecode(s) {
 // supplied alg the key can't actually produce.
 var _EC_CURVE_ALG = { prime256v1: "ES256", secp384r1: "ES384", secp521r1: "ES512" };
 
-function _verifyParamsForAlg(alg) {
+// algParams — JOSE alg → node:crypto sign/verify parameters (hash + RSA
+// PKCS1 padding / RSASSA-PSS saltLength / ECDSA dsaEncoding). The classical-
+// JOSE table (RS/PS/ES per RFC 7518 §3, EdDSA per RFC 8037) lives HERE once,
+// in the classical-JOSE domain owner: dpop proofs, fido-mds3 MDS3 BLOBs,
+// oauth ID-token verify, and this module's own sign/verify all read the
+// identical mapping. Returns null for an unrecognised alg so every caller
+// throws its OWN typed error and keeps its OWN supported set — oauth omits
+// EdDSA, dpop layers the PQC ML-DSA-87 on top. The values are sign/verify-
+// symmetric (node:crypto uses the same params for both).
+function algParams(alg) {
   if (alg === "RS256") return { hash: "sha256", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
   if (alg === "RS384") return { hash: "sha384", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
   if (alg === "RS512") return { hash: "sha512", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
@@ -128,8 +137,16 @@ function _verifyParamsForAlg(alg) {
   if (alg === "ES384") return { hash: "sha384", dsaEncoding: "ieee-p1363" };
   if (alg === "ES512") return { hash: "sha512", dsaEncoding: "ieee-p1363" };
   if (alg === "EdDSA") return { hash: null };
-  throw new AuthError("auth-jwt-external/unsupported-alg",
-    "alg '" + alg + "' is not supported by verifyExternal");
+  return null;
+}
+
+function _verifyParamsForAlg(alg) {
+  var params = algParams(alg);
+  if (!params) {
+    throw new AuthError("auth-jwt-external/unsupported-alg",
+      "alg '" + alg + "' is not supported by verifyExternal");
+  }
+  return params;
 }
 
 // _toPrivateKey — import the operator's classical signing key from any of
@@ -231,11 +248,11 @@ function _signCompactJws(header, payload, privateKey, alg) {
 }
 
 function _jwkToKey(jwk) {
-  try { return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }
-  catch (e) {
-    throw new AuthError("auth-jwt-external/bad-jwk",
-      "could not import JWK (kid=" + (jwk && jwk.kid) + "): " + ((e && e.message) || String(e)));
-  }
+  return bCrypto.importPublicJwk(jwk, {
+    errorClass:    AuthError,
+    code:          "auth-jwt-external/bad-jwk",
+    messagePrefix: "could not import JWK (kid=" + (jwk && jwk.kid) + "): ",
+  });
 }
 
 // CVE-2026-22817 — RS256→HS256 alg-confusion + the broader alg/kty
@@ -725,6 +742,7 @@ module.exports = {
   REFUSED_ALGS:             REFUSED_ALGS,
   // Shared JOSE defenses — routed from oauth.verifyIdToken /
   // oid4vci proof verify / sd-jwt-vc.verify / openid-federation.
+  algParams:                algParams,
   _assertAlgKtyMatch:       _assertAlgKtyMatch,
   _issuerMatches:           _issuerMatches,
   // Classical-JWS signer internals — composed by oauth.js's attestation

package/lib/auth/jwt.js

@@ -78,6 +78,7 @@ var C = require("../constants");
 var bCrypto = require("../crypto");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
+var nonceStore = require("../nonce-store");
 var { AuthError } = require("../framework-error");
 
 // Algorithm registry. The string keys are the JWT header `alg` values
@@ -92,11 +93,12 @@ var SUPPORTED_ALGORITHMS = Object.freeze(Object.keys(ALGORITHM_TO_NODE));
 
 function _b64urlEncode(buf) { return bCrypto.toBase64Url(buf); }
 
-function _b64urlDecode(s) {
-  if (typeof s !== "string") throw new AuthError("auth-jwt/malformed", "expected base64url string");
-  try { return bCrypto.fromBase64Url(s); }
-  catch (_e) { throw new AuthError("auth-jwt/malformed", "JWT segment is not valid base64url"); }
-}
+var _b64urlDecode = bCrypto.makeBase64UrlDecoder({
+  errorClass:  AuthError,
+  code:        "auth-jwt/malformed",
+  typeMessage: "expected base64url string",
+  badMessage:  "JWT segment is not valid base64url",
+});
 
 function _toKeyObject(pemOrKey, kind) {
   // kind is 'private' or 'public' — passes through if already a KeyObject;
@@ -115,7 +117,7 @@ function _toKeyObject(pemOrKey, kind) {
 }
 
 function _resolveAlgorithm(alg) {
-  if (typeof alg !== "string" || !ALGORITHM_TO_NODE[alg]) {
+  if (typeof alg !== "string" || !Object.prototype.hasOwnProperty.call(ALGORITHM_TO_NODE, alg)) {
     throw new AuthError("auth-jwt/unsupported-algorithm",
       "algorithm must be one of " + SUPPORTED_ALGORITHMS.join(", ") + " (got: " + alg + ")");
   }
@@ -220,7 +222,7 @@ async function verify(token, opts) {
   // Validate the allowlist itself — typoed entries should surface here,
   // not as silent "every token rejected."
   for (var i = 0; i < allowed.length; i++) {
-    if (!ALGORITHM_TO_NODE[allowed[i]]) {
+    if (!Object.prototype.hasOwnProperty.call(ALGORITHM_TO_NODE, allowed[i])) {
       throw new AuthError("auth-jwt/unsupported-algorithm",
         "opts.algorithms[" + i + "] = '" + allowed[i] + "' is not in the supported list (" +
         SUPPORTED_ALGORITHMS.join(", ") + ")");
@@ -409,16 +411,12 @@ async function verify(token, opts) {
     if (typeof p.exp === "number") {
       expireAtMs = p.exp * C.TIME.seconds(1);
     }
-    var inserted;
-    try { inserted = await opts.replayStore.checkAndInsert(p.jti, expireAtMs); }
-    catch (e) {
-      throw new AuthError("auth-jwt/replay-store-failed",
-        "replayStore.checkAndInsert threw: " + ((e && e.message) || String(e)));
-    }
-    if (inserted === false) {
-      throw new AuthError("auth-jwt/replay",
-        "token jti='" + p.jti + "' has been seen before — replay refused");
-    }
+    await nonceStore.enforceReplay(opts.replayStore, p.jti, expireAtMs, {
+      errorClass:      AuthError,
+      storeFailedCode: "auth-jwt/replay-store-failed",
+      replayCode:      "auth-jwt/replay",
+      tokenLabel:      "token",
+    });
   }
 
   return p;

package/lib/auth/lockout.js

@@ -80,6 +80,7 @@
  */
 
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
@@ -119,7 +120,7 @@ function _requireString(name, val) {
 }
 
 function _requirePositiveInt(name, val) {
-  if (typeof val !== "number" || !isFinite(val) || val < 1 || Math.floor(val) !== val) {
+  if (!numericBounds.isPositiveFiniteInt(val)) {
     throw _err("BAD_OPT", name + ": expected positive integer, got " +
                typeof val + " " + JSON.stringify(val));
   }
@@ -200,32 +201,13 @@ function create(opts) {
 
   function _scopedKey(key) { return namespace + ":" + key; }
 
-  function _emitObs(name, labels) {
-    var sink = obsInst || _safeGlobalObs();
-    if (!sink) return;
-    try { sink.event(name, 1, labels); } catch (_e) { /* observability is best-effort */ }
-  }
-
-  // Fall back to the framework's global observability registry when the
-  // operator didn't pass their own. event() is a no-op when no registry
-  // is wired, so this is zero-cost in apps without observability.
-  function _safeGlobalObs() {
-    try { return observability(); } catch (_e) { return null; }
-  }
+  // Emit to the operator's configured observability instance, else the
+  // framework's global registry (a no-op when none is wired), drop-silent.
+  var _emitObs = observability().makeCounterEmitter(obsInst);
 
-  function _emitAudit(action, key, outcome, metadata, req) {
-    if (!auditInst) return;
-    try {
-      var event = {
-        action:   action,
-        outcome:  outcome,
-        resource: { kind: "auth.lockout", id: namespace + ":" + key },
-        metadata: metadata || {},
-      };
-      if (req) event.actor = requestHelpers.extractActorContext(req);
-      auditInst.safeEmit(event);
-    } catch (_e) { /* audit best-effort */ }
-  }
+  var _emitAudit = requestHelpers.makeResourceAuditEmitter(auditInst, "auth.lockout", function (key) {
+    return namespace + ":" + key;
+  });
 
   // Cache failures fail-OPEN by design (per the framework's
   // documented brute-force-lockout posture — rather than crash the
@@ -280,7 +262,22 @@ function create(opts) {
 
   // ---- Public surface ----
 
-  async function recordFailure(key, callOpts) {
+  // Per-key serialization of the failure counter (read→increment→write on an
+  // async store): concurrent recordFailure calls for the same key would lose
+  // updates, letting parallel failures stay under the lockout threshold. A
+  // per-key promise chain applies them sequentially in-process.
+  var _recordChains = new Map();
+  function recordFailure(key, callOpts) {
+    var prev = _recordChains.get(key) || Promise.resolve();
+    var run = prev.then(function () { return _doRecordFailure(key, callOpts); },
+                        function () { return _doRecordFailure(key, callOpts); });
+    var tail = run.then(function () {}, function () {});
+    _recordChains.set(key, tail);
+    tail.then(function () { if (_recordChains.get(key) === tail) _recordChains.delete(key); });
+    return run;
+  }
+
+  async function _doRecordFailure(key, callOpts) {
     _requireKey(key);
     callOpts = callOpts || {};
     var now = clock();