@blamejs/core 0.15.13 → 0.15.14

package/lib/audit-tools.js

@@ -58,6 +58,7 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var pkg = require("../package.json");
 var atomicFile = require("./atomic-file");
+var C = require("./constants");
 var auditChain = require("./audit-chain");
 var canonicalJson = require("./canonical-json");
 var auditSign = require("./audit-sign");
@@ -349,6 +350,12 @@ async function _defaultReadPredecessorRowHash(firstCounter) {
 async function _buildBundle(args) {
   var kind         = args.kind;
   var rows         = args.rows;
+  // Verification witnesses: the rows between the purgeable slice's tip and
+  // the covering checkpoint's anchored counter. They ride the bundle so the
+  // chain can be walked up to the SIGNED atRowHash, but they are NOT part of
+  // the purgeable range (the manifest range below is computed from `rows`,
+  // and purge() only deletes [first..lastCounter]).
+  var witnessRows  = args.witnessRows || [];
   var checkpoint   = args.checkpoint || null;
   var passphrase   = args.passphrase;
   var predecessorRowHash = args.predecessorRowHash;
@@ -357,8 +364,9 @@ async function _buildBundle(args) {
   var lastRow  = rows[rows.length - 1];
   var files = {};
 
-  // 1. Encrypt the rows JSONL
-  var jsonl = rows.map(function (r) {
+  // 1. Encrypt the rows JSONL — purgeable slice followed by any witnesses
+  // (contiguous, ascending) so the verifier walks one unbroken chain.
+  var jsonl = rows.concat(witnessRows).map(function (r) {
     return JSON.stringify(_rowToWireForm(r));
   }).join("\n") + "\n";
   var rowsEnc = await backupCrypto.encryptWithFreshSalt(jsonl, passphrase);
@@ -437,26 +445,39 @@ async function _readBundle(inDir, passphrase) {
       "bundle directory does not exist: " + inDir);
   }
   var manifestPath = nodePath.join(inDir, "manifest.json");
-  if (!nodeFs.existsSync(manifestPath)) {
-    throw new AuditToolsError("audit-tools/no-manifest",
-      "manifest.json missing in " + inDir);
-  }
-  var manifest = safeJson.parse(nodeFs.readFileSync(manifestPath, "utf8"));
+  // Capped fd-bound read (no existsSync check-then-read window): an externally-
+  // supplied bundle manifest is parsed before verification, so an oversized
+  // manifest.json would OOM the verifier before safeJson sees it. 4 MiB is far
+  // above any real manifest.
+  var manifest = safeJson.parse(atomicFile.fdSafeReadSync(manifestPath, {
+    maxBytes: C.BYTES.mib(4), encoding: "utf8",
+    errorFor: function (kind, detail) {
+      if (kind === "enoent") return new AuditToolsError("audit-tools/no-manifest", "manifest.json missing in " + inDir);
+      if (kind === "too-large") return new AuditToolsError("audit-tools/bad-format", "manifest.json too large (" + detail.size + " > " + detail.max + ")");
+      return new AuditToolsError("audit-tools/bad-format", "manifest.json unreadable: " + kind);
+    },
+  }), { maxBytes: C.BYTES.mib(4) });
   if (!manifest || manifest.format !== BUNDLE_FORMAT) {
     throw new AuditToolsError("audit-tools/bad-format",
       "manifest.format is not " + BUNDLE_FORMAT);
   }
-  if (!VALID_KINDS[manifest.kind]) {
+  if (!Object.prototype.hasOwnProperty.call(VALID_KINDS, manifest.kind)) {
     throw new AuditToolsError("audit-tools/bad-kind",
       "manifest.kind must be one of " + Object.keys(VALID_KINDS).join(", "));
   }
 
   var rowsEncPath = nodePath.join(inDir, frameworkFiles.fileName("rowsEnc"));
-  if (!nodeFs.existsSync(rowsEncPath)) {
-    throw new AuditToolsError("audit-tools/no-rows-blob",
-      "rows.enc missing in " + inDir);
-  }
-  var rowsEnc = nodeFs.readFileSync(rowsEncPath);
+  // Capped fd-bound read: rows.enc is the PQC-encrypted archived audit slice
+  // (can be large); a hostile multi-GB blob would be read + decrypted in memory
+  // before the checksum check. 512 MiB ceiling bounds it (opt-tunable).
+  var rowsEnc = atomicFile.fdSafeReadSync(rowsEncPath, {
+    maxBytes: C.BYTES.mib(512),
+    errorFor: function (kind) {
+      if (kind === "enoent") return new AuditToolsError("audit-tools/no-rows-blob", "rows.enc missing in " + inDir);
+      if (kind === "too-large") return new AuditToolsError("audit-tools/rows-too-large", "rows.enc exceeds the bundle size cap");
+      return new AuditToolsError("audit-tools/no-rows-blob", "rows.enc unreadable: " + kind);
+    },
+  });
   if (manifest.checksum && manifest.checksum.rowsSha3_512 &&
       backupCrypto.checksum(rowsEnc) !== manifest.checksum.rowsSha3_512) {
     throw new AuditToolsError("audit-tools/rows-checksum-mismatch",
@@ -470,11 +491,16 @@ async function _readBundle(inDir, passphrase) {
   var checkpoint = null;
   if (manifest.kind === KIND_ARCHIVE) {
     var ckptPath = nodePath.join(inDir, frameworkFiles.fileName("checkpointEnc"));
-    if (!nodeFs.existsSync(ckptPath)) {
-      throw new AuditToolsError("audit-tools/no-checkpoint-blob",
-        "checkpoint.enc missing in " + inDir + " (archive bundles must include the covering checkpoint)");
-    }
-    var ckptEnc = nodeFs.readFileSync(ckptPath);
+    // Capped fd-bound read: checkpoint.enc is a single PQC-encrypted
+    // audit_checkpoints row (a few KiB); 4 MiB bounds a hostile blob.
+    var ckptEnc = atomicFile.fdSafeReadSync(ckptPath, {
+      maxBytes: C.BYTES.mib(4),
+      errorFor: function (kind) {
+        if (kind === "enoent") return new AuditToolsError("audit-tools/no-checkpoint-blob", "checkpoint.enc missing in " + inDir + " (archive bundles must include the covering checkpoint)");
+        if (kind === "too-large") return new AuditToolsError("audit-tools/checkpoint-too-large", "checkpoint.enc exceeds the cap");
+        return new AuditToolsError("audit-tools/no-checkpoint-blob", "checkpoint.enc unreadable: " + kind);
+      },
+    });
     if (manifest.checksum && manifest.checksum.checkpointSha3_512 &&
         backupCrypto.checksum(ckptEnc) !== manifest.checksum.checkpointSha3_512) {
       throw new AuditToolsError("audit-tools/checkpoint-checksum-mismatch",
@@ -562,10 +588,31 @@ async function archive(opts) {
 
   var predecessorRowHash = await readPredecessorHash(firstCounter);
 
+  // The signed checkpoint is the bundle's only unforgeable anchor; it commits
+  // the row at checkpoint.atMonotonicCounter. When that counter sits BEYOND
+  // the purgeable slice's tip (the operator archived a subset older than the
+  // last checkpoint), carry the in-between rows as verification witnesses so
+  // verifyBundle can chain-walk up to the anchored row and bind atRowHash to
+  // it. Without them an attacker could pair any genuine high-counter
+  // checkpoint with a wholly fabricated slice. The witnesses are NOT purged.
+  var anchorCounter = Number(checkpoint.atMonotonicCounter);
+  var witnessRows = [];
+  if (anchorCounter > lastCounter) {
+    witnessRows = await readRows({ firstCounter: lastCounter + 1, lastCounter: anchorCounter });
+    var witnessTip = witnessRows.length ? Number(witnessRows[witnessRows.length - 1].monotonicCounter) : null;
+    if (witnessTip !== anchorCounter) {
+      throw new AuditToolsError("audit-tools/anchor-rows-missing",
+        "archive: covering checkpoint anchors counter=" + anchorCounter +
+        " but the rows up to it are not all available (read up to " + witnessTip +
+        ") — cannot prove the slice chains to the signed anchor");
+    }
+  }
+
   if (returnBytes) {
     var built = await _buildBundle({
       kind:       KIND_ARCHIVE,
       rows:       rows,
+      witnessRows: witnessRows,
       checkpoint: checkpoint,
       passphrase: opts.passphrase,
       predecessorRowHash: predecessorRowHash,
@@ -582,6 +629,7 @@ async function archive(opts) {
     outDir:     opts.out,
     kind:       KIND_ARCHIVE,
     rows:       rows,
+    witnessRows: witnessRows,
     checkpoint: checkpoint,
     passphrase: opts.passphrase,
     predecessorRowHash: predecessorRowHash,
@@ -769,26 +817,41 @@ async function verifyBundle(opts) {
     };
   }
 
-  // 2. Confirm the stored firstRowHash + lastRowHash match the slice
+  // 2. Confirm the stored firstRowHash + lastRowHash match the PURGEABLE
+  // slice boundary. The slice tip is the row at range.lastCounter — not
+  // necessarily the physical last row, which may be a verification witness
+  // carried past the slice so the chain can reach the signed checkpoint.
+  var lastCounterN = Number(read.manifest.range.lastCounter);
+  var sliceLastRow = null;
+  for (var ri = 0; ri < read.rows.length; ri++) {
+    if (Number(read.rows[ri].monotonicCounter) === lastCounterN) { sliceLastRow = read.rows[ri]; break; }
+  }
   if (read.rows[0].rowHash !== read.manifest.range.firstRowHash) {
     return {
       ok: false, kind: read.manifest.kind, rowsVerified: read.rows.length,
       reason: "manifest.range.firstRowHash does not match first row's rowHash",
     };
   }
-  if (read.rows[read.rows.length - 1].rowHash !== read.manifest.range.lastRowHash) {
+  if (!sliceLastRow || sliceLastRow.rowHash !== read.manifest.range.lastRowHash) {
     return {
       ok: false, kind: read.manifest.kind, rowsVerified: read.rows.length,
-      reason: "manifest.range.lastRowHash does not match last row's rowHash",
+      reason: "manifest.range.lastRowHash does not match the slice row at lastCounter",
     };
   }
 
-  // 3. (archive only) verify the covering checkpoint signature
+  // 3. (archive only) verify the covering checkpoint signature AND bind its
+  // anchored rowHash to the slice. The signature alone proves only that a
+  // checkpoint exists for some (counter, rowHash); without binding atRowHash
+  // to the archived rows, any genuine high-counter checkpoint could be paired
+  // with a wholly fabricated slice. The row at checkpoint.atMonotonicCounter
+  // must be present in the bundle (slice or witness) and its rowHash must
+  // equal checkpoint.atRowHash — mirroring b.audit.verifyCheckpoints against
+  // the live table.
   if (read.manifest.kind === KIND_ARCHIVE) {
     if (!read.checkpoint) {
       return { ok: false, kind: KIND_ARCHIVE, reason: "checkpoint missing from archive bundle" };
     }
-    if (Number(read.checkpoint.atMonotonicCounter) < Number(read.manifest.range.lastCounter)) {
+    if (Number(read.checkpoint.atMonotonicCounter) < lastCounterN) {
       return {
         ok: false, kind: KIND_ARCHIVE,
         reason: "checkpoint atMonotonicCounter (" + read.checkpoint.atMonotonicCounter +
@@ -805,6 +868,28 @@ async function verifyBundle(opts) {
         };
       }
     }
+    // Bind: the row the signature anchors must be in the bundle and match.
+    var anchorCounterN = Number(read.checkpoint.atMonotonicCounter);
+    var anchoredRow = null;
+    for (var ai = 0; ai < read.rows.length; ai++) {
+      if (Number(read.rows[ai].monotonicCounter) === anchorCounterN) { anchoredRow = read.rows[ai]; break; }
+    }
+    if (!anchoredRow) {
+      return {
+        ok: false, kind: KIND_ARCHIVE,
+        reason: "checkpoint anchors counter=" + anchorCounterN +
+                " but no such row is present in the bundle — checkpoint not bound to the archived slice",
+      };
+    }
+    if (anchoredRow.rowHash !== read.checkpoint.atRowHash) {
+      return {
+        ok: false, kind: KIND_ARCHIVE,
+        reason: "checkpoint atRowHash does not match the bundle row at counter=" + anchorCounterN +
+                " — the signed anchor does not bind this slice",
+        expected: read.checkpoint.atRowHash,
+        actual:   anchoredRow.rowHash,
+      };
+    }
   }
 
   return {

package/lib/audit.js

@@ -797,7 +797,12 @@ async function query(criteria) {
   if (criteria.resourceKind)    q = q.where({ resourceKind: criteria.resourceKind });
   if (criteria.outcome)         q = q.where({ outcome: criteria.outcome });
 
-  q.orderBy("monotonicCounter", "asc");
+  // order: "asc" (default, chronological) | "desc" (newest-first). A capped
+  // query (limit set) returns the FIRST `limit` rows in this order — so a
+  // consumer that wants the most RECENT events under a cap (e.g. the daily
+  // review) must pass order:"desc", else `limit` keeps the OLDEST and drops the
+  // newest events in the window.
+  q.orderBy("monotonicCounter", criteria.order === "desc" ? "desc" : "asc");
   if (criteria.limit  != null)  q.limit(criteria.limit);
   if (criteria.offset != null)  q.offset(criteria.offset);
 
@@ -834,7 +839,7 @@ async function _queryCluster(criteria) {
   if (criteria.resourceKind) qb.where("resourceKind", criteria.resourceKind);
   if (criteria.outcome)      qb.where("outcome", criteria.outcome);
 
-  qb.orderBy("monotonicCounter", "asc");
+  qb.orderBy("monotonicCounter", criteria.order === "desc" ? "desc" : "asc");
   if (criteria.limit  != null) qb.limit(criteria.limit);
   if (criteria.offset != null) qb.offset(criteria.offset);
 

package/lib/auth/access-lock.js

@@ -54,7 +54,7 @@ var SAFE_METHODS = Object.freeze({ GET: 1, HEAD: 1, OPTIONS: 1 });
 function _normalizeMode(mode) {
   if (typeof mode !== "string") return null;
   var m = mode.toLowerCase();
-  return VALID_MODES[m] ? m : null;
+  return Object.prototype.hasOwnProperty.call(VALID_MODES, m) ? m : null;
 }
 
 function create(opts) {
@@ -164,7 +164,7 @@ function create(opts) {
       if (_hasUnlockRole(req)) return next();
       if (currentMode === "read-only") {
         var method = (req.method || "GET").toUpperCase();
-        if (SAFE_METHODS[method]) return next();
+        if (Object.prototype.hasOwnProperty.call(SAFE_METHODS, method)) return next();
         _emitAudit("refused", "denied", { mode: currentMode, method: method, path: req.url });
         _emitMetric("refused", 1, { mode: currentMode, reason: "non-safe-method" });
         return _refuse(res, "non-safe-method-in-read-only");

package/lib/auth/bot-challenge.js

@@ -343,7 +343,7 @@ function create(opts) {
   var secret = opts.secret;
 
   var providerKey = opts.provider !== undefined ? opts.provider : DEFAULT_PROVIDER;
-  if (typeof providerKey !== "string" || !PROVIDERS[providerKey]) {
+  if (typeof providerKey !== "string" || !Object.prototype.hasOwnProperty.call(PROVIDERS, providerKey)) {
     var supported = Object.keys(PROVIDERS).join(", ");
     throw new BotChallengeError("bot-challenge/bad-opt",
       "provider: expected one of [" + supported + "], got " + JSON.stringify(providerKey));

package/lib/auth/ciba.js

@@ -452,6 +452,23 @@ function create(opts) {
     });
   }
 
+  // Verify an OIDC ID token (if present) via the composed inner OAuth client,
+  // returning its verified claims, or null when no id_token was supplied. A
+  // present-but-invalid id_token throws (fail-closed) so a forged token's
+  // sub/acr/amr can never be returned as trusted.
+  async function _verifyIdTokenIfPresent(idToken, auditKey, op) {
+    if (!idToken) return null;
+    try {
+      return await inner.verifyIdToken(idToken);
+    } catch (e) {
+      _emitAudit("id_token_verify_fail", "failure",
+        auditKey ? { authReqIdHash: sha3Hash(auditKey) } : {});
+      throw new AuthError("auth-ciba/id-token-invalid",
+        "ciba." + op + ": id_token failed verification: " +
+        ((e && e.code) || (e && e.message) || String(e)));
+    }
+  }
+
   async function pollToken(popts) {
     popts = popts || {};
     if (typeof popts.authReqId !== "string" || popts.authReqId.length === 0) {
@@ -514,6 +531,12 @@ function create(opts) {
     }
     // Token issued — clear interval tracking for this authReqId.
     _intervalState.delete(popts.authReqId);
+    // Verify the ID token (OIDC Core §3.1.3.7) via the composed inner OAuth
+    // client — it applies the create()-level issuer / clientId / JWKS /
+    // accepted-algorithms and enforces signature + iss/aud/exp. Returning an
+    // unverified id_token let a forged token's sub/acr/amr be trusted.
+    var pollClaims = await _verifyIdTokenIfPresent(rv.id_token,
+      "auth-ciba:" + popts.authReqId, "pollToken");
     _emitAudit("token_received", "success", {
       authReqIdHash: sha3Hash("auth-ciba:" + popts.authReqId),
     });
@@ -521,6 +544,7 @@ function create(opts) {
     return {
       accessToken:  rv.access_token   || null,
       idToken:      rv.id_token       || null,
+      claims:       pollClaims,
       refreshToken: rv.refresh_token  || null,
       tokenType:    rv.token_type     || null,
       scope:        rv.scope          || null,
@@ -545,17 +569,23 @@ function create(opts) {
    *   - In **push** mode the body carries the full token-response
    *     object; no follow-up call needed.
    *
+   * Async because a pushed `id_token` is verified (signature + iss/aud/exp)
+   * via the composed inner OAuth client before it is returned — the
+   * verified claims are surfaced as `claims`. A present-but-invalid
+   * id_token throws `auth-ciba/id-token-invalid` (the notification-token
+   * bearer authenticates the caller, never the token itself).
+   *
    * @opts
    *   { body?: object }   // pre-parsed body; defaults to req.body
    *
    * @example
-   *   app.post("/ciba/notify", function (req, res) {
-   *     var info = ciba.parseNotification(req, { body: req.body });
-   *     // → { authReqId, accessToken, idToken, ... }
+   *   app.post("/ciba/notify", async function (req, res) {
+   *     var info = await ciba.parseNotification(req, { body: req.body });
+   *     // → { authReqId, accessToken, idToken, claims, ... }
    *     res.statusCode = 204; res.end();
    *   });
    */
-  function parseNotification(req, popts) {
+  async function parseNotification(req, popts) {
     popts = popts || {};
     if (!req || !req.headers) {
       throw new AuthError("auth-ciba/bad-notification-req",
@@ -605,6 +635,14 @@ function create(opts) {
       throw new AuthError("auth-ciba/no-auth-req-id-in-body",
         "ciba.parseNotification: body missing auth_req_id");
     }
+    // Verify the pushed ID token (CIBA §10.2 / OIDC Core MUST) via the
+    // composed inner OAuth client before returning it as trusted. The
+    // notification-token bearer authenticates the CALLER, not the token; a
+    // leaked/observed notification token previously let an attacker inject
+    // arbitrary id_token claims the RP would trust on the documented
+    // "no follow-up call" push path.
+    var pushClaims = await _verifyIdTokenIfPresent(body.id_token,
+      "auth-ciba:" + body.auth_req_id, "parseNotification");
     _emitAudit("notification_received", "success", {
       authReqIdHash: sha3Hash("auth-ciba:" + body.auth_req_id),
       mode:          deliveryMode,
@@ -614,6 +652,7 @@ function create(opts) {
       authReqId:    body.auth_req_id,
       accessToken:  body.access_token  || null,
       idToken:      body.id_token      || null,
+      claims:       pushClaims,
       refreshToken: body.refresh_token || null,
       tokenType:    body.token_type    || null,
       scope:        body.scope         || null,

package/lib/auth/dpop.js

@@ -92,7 +92,7 @@ function thumbprint(key) {
   if (!key || typeof key !== "object" || typeof key.kty !== "string" || key.kty.length === 0) {
     throw new AuthError("auth-dpop/bad-jwk", "jwk must be an object with a kty");
   }
-  if (!DPOP_KTY[key.kty]) {
+  if (!Object.prototype.hasOwnProperty.call(DPOP_KTY, key.kty)) {
     throw new AuthError("auth-dpop/refused-kty", "jwk.kty='" + key.kty + "' is not allowed (DPoP requires asymmetric kty)");
   }
   // The RFC 7638 thumbprint itself is computed by b.jwk.
@@ -348,6 +348,11 @@ async function verify(proof, opts) {
       "DPoP proof declares 'crit' header — refused");
   }
 
+  // Bind the declared alg to the embedded JWK's kty/curve before handing
+  // the self-asserted key to node:crypto — every other JWS verifier in the
+  // framework enforces this (alg-confusion family, CVE-2026-22817 class).
+  jwtExternal._assertAlgKtyMatch(header.alg, header.jwk);
+
   // Verify signature against the embedded jwk
   var key = _jwkToKeyObject(header.jwk);
   var params = _signParamsForAlg(header.alg);

package/lib/auth/fido-mds3.js

@@ -43,6 +43,7 @@ var safeJson     = require("../safe-json");
 var safeBuffer   = require("../safe-buffer");
 var lazyRequire  = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var x509Chain    = require("../x509-chain");
 var jwtExternal  = require("./jwt-external");
 var _wa          = require("../vendor/simplewebauthn-server.cjs");
 var { FidoMds3Error } = require("../framework-error");
@@ -239,7 +240,10 @@ function _validateChain(x5c, rootPems) {
     var root;
     try { root = new nodeCrypto.X509Certificate(rootPems[r]); }
     catch (_e) { continue; }
-    if (tail.checkIssued(root) && tail.verify(root.publicKey)) {
+    // issuerValidlyIssued enforces basicConstraints cA:TRUE on the root in
+    // addition to the issuance + signature linkage — a non-CA cert cannot
+    // anchor the x5c chain (basicConstraints bypass, CVE-2002-0862 class).
+    if (x509Chain.issuerValidlyIssued(root, tail)) {
       anchored = true;
       break;
     }

package/lib/auth/jwt.js

@@ -117,7 +117,7 @@ function _toKeyObject(pemOrKey, kind) {
 }
 
 function _resolveAlgorithm(alg) {
-  if (typeof alg !== "string" || !ALGORITHM_TO_NODE[alg]) {
+  if (typeof alg !== "string" || !Object.prototype.hasOwnProperty.call(ALGORITHM_TO_NODE, alg)) {
     throw new AuthError("auth-jwt/unsupported-algorithm",
       "algorithm must be one of " + SUPPORTED_ALGORITHMS.join(", ") + " (got: " + alg + ")");
   }
@@ -222,7 +222,7 @@ async function verify(token, opts) {
   // Validate the allowlist itself — typoed entries should surface here,
   // not as silent "every token rejected."
   for (var i = 0; i < allowed.length; i++) {
-    if (!ALGORITHM_TO_NODE[allowed[i]]) {
+    if (!Object.prototype.hasOwnProperty.call(ALGORITHM_TO_NODE, allowed[i])) {
       throw new AuthError("auth-jwt/unsupported-algorithm",
         "opts.algorithms[" + i + "] = '" + allowed[i] + "' is not in the supported list (" +
         SUPPORTED_ALGORITHMS.join(", ") + ")");

package/lib/auth/lockout.js

@@ -80,6 +80,7 @@
  */
 
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
@@ -119,7 +120,7 @@ function _requireString(name, val) {
 }
 
 function _requirePositiveInt(name, val) {
-  if (typeof val !== "number" || !isFinite(val) || val < 1 || Math.floor(val) !== val) {
+  if (!numericBounds.isPositiveFiniteInt(val)) {
     throw _err("BAD_OPT", name + ": expected positive integer, got " +
                typeof val + " " + JSON.stringify(val));
   }
@@ -261,7 +262,22 @@ function create(opts) {
 
   // ---- Public surface ----
 
-  async function recordFailure(key, callOpts) {
+  // Per-key serialization of the failure counter (read→increment→write on an
+  // async store): concurrent recordFailure calls for the same key would lose
+  // updates, letting parallel failures stay under the lockout threshold. A
+  // per-key promise chain applies them sequentially in-process.
+  var _recordChains = new Map();
+  function recordFailure(key, callOpts) {
+    var prev = _recordChains.get(key) || Promise.resolve();
+    var run = prev.then(function () { return _doRecordFailure(key, callOpts); },
+                        function () { return _doRecordFailure(key, callOpts); });
+    var tail = run.then(function () {}, function () {});
+    _recordChains.set(key, tail);
+    tail.then(function () { if (_recordChains.get(key) === tail) _recordChains.delete(key); });
+    return run;
+  }
+
+  async function _doRecordFailure(key, callOpts) {
     _requireKey(key);
     callOpts = callOpts || {};
     var now = clock();

package/lib/auth/passkey.js

@@ -385,7 +385,7 @@ function _largeBlobExt(args) {
   var SUPPORT = { preferred: 1, required: 1 };
   var modes = 0;
   if (args.support !== undefined) {
-    if (!SUPPORT[args.support]) {
+    if (!Object.prototype.hasOwnProperty.call(SUPPORT, args.support)) {
       throw new AuthError("auth-passkey/bad-largeblob-support",
         "extensions.largeBlob support must be 'preferred' or 'required'");
     }

package/lib/auth/password.js

@@ -282,7 +282,7 @@ function policy(opts) {
   // Apply named profile FIRST, then operator opts on top so the
   // operator can override profile defaults per-field.
   if (typeof opts.profile === "string" && opts.profile.length > 0) {
-    if (!POLICY_PROFILES[opts.profile]) {
+    if (!Object.prototype.hasOwnProperty.call(POLICY_PROFILES, opts.profile)) {
       throw new AuthError("auth-password/bad-policy",
         "policy.profile must be one of " + Object.keys(POLICY_PROFILES).join("/") +
         ", got " + JSON.stringify(opts.profile));

package/lib/auth/saml.js

@@ -170,7 +170,7 @@ function _verifyXmldsig(envelope, signatureNode, certPem) {
   }
   var sigMethodNode = _findChild(signedInfo, "SignatureMethod");
   var sigAlgo = sigMethodNode && _attr(sigMethodNode, "Algorithm");
-  if (!SUPPORTED_SIG[sigAlgo]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_SIG, sigAlgo)) {
     throw new AuthError("auth-saml/unsupported-sig-alg",
       "Unsupported SignatureMethod: " + sigAlgo);
   }
@@ -184,7 +184,7 @@ function _verifyXmldsig(envelope, signatureNode, certPem) {
   var refId = refUri.substring(1);
   var digestMethodNode = _findChild(refNode, "DigestMethod");
   var digestAlgo = digestMethodNode && _attr(digestMethodNode, "Algorithm");
-  if (!SUPPORTED_DIGEST[digestAlgo]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_DIGEST, digestAlgo)) {
     throw new AuthError("auth-saml/unsupported-digest",
       "Unsupported DigestMethod: " + digestAlgo);
   }
@@ -745,26 +745,46 @@ function create(opts) {
       var cNotOnOrAfter = _attr(conditions, "NotOnOrAfter");
       if (cNotBefore) {
         var cnb = Date.parse(cNotBefore) / 1000;                                                // ms→s
-        if (isFinite(cnb) && cnb > nowSec + clockSkewSec) {
+        // Fail CLOSED on a present-but-unparseable bound (mirrors the Bearer
+        // SCD path at line ~708) instead of skipping the window via isFinite().
+        if (!isFinite(cnb)) {
+          throw new AuthError("auth-saml/conditions-bad-timestamp",
+            "Conditions NotBefore is present but unparseable");
+        }
+        if (cnb > nowSec + clockSkewSec) {
           throw new AuthError("auth-saml/conditions-not-yet-valid",
             "Conditions NotBefore is in the future");
         }
       }
       if (cNotOnOrAfter) {
         var cnoa = Date.parse(cNotOnOrAfter) / 1000;                                            // ms→s
-        if (isFinite(cnoa) && cnoa < nowSec - clockSkewSec) {
+        if (!isFinite(cnoa)) {
+          throw new AuthError("auth-saml/conditions-bad-timestamp",
+            "Conditions NotOnOrAfter is present but unparseable");
+        }
+        if (cnoa < nowSec - clockSkewSec) {
           throw new AuthError("auth-saml/conditions-expired",
             "Conditions NotOnOrAfter has passed");
         }
       }
-      var ar = _findChild(conditions, "AudienceRestriction", SAML_NS.assertion);
-      if (ar) {
-        var audiences = _findAllChildren(ar, "Audience", SAML_NS.assertion).map(_textContent);
-        if (audiences.indexOf(audience) === -1) {
-          throw new AuthError("auth-saml/wrong-audience",
-            "Audience \"" + audience + "\" not in assertion's AudienceRestriction (got " +
-            JSON.stringify(audiences) + ")");
-        }
+    }
+    // Audience binding — a signed assertion is bound to THIS SP via
+    // AudienceRestriction. A missing Conditions or AudienceRestriction means
+    // it is not bound here (audience-confusion: an assertion minted for another
+    // SP). Fail closed when an audience is configured; opt out only via
+    // vopts.requireAudienceRestriction === false.
+    if (audience && vopts.requireAudienceRestriction !== false) {
+      var ar = conditions && _findChild(conditions, "AudienceRestriction", SAML_NS.assertion);
+      if (!ar) {
+        throw new AuthError("auth-saml/no-audience-restriction",
+          "verifyResponse: assertion has no AudienceRestriction binding it to \"" +
+          audience + "\" (audience-confusion defense; set requireAudienceRestriction:false to opt out)");
+      }
+      var audiences = _findAllChildren(ar, "Audience", SAML_NS.assertion).map(_textContent);
+      if (audiences.indexOf(audience) === -1) {
+        throw new AuthError("auth-saml/wrong-audience",
+          "Audience \"" + audience + "\" not in assertion's AudienceRestriction (got " +
+          JSON.stringify(audiences) + ")");
       }
     }
 
@@ -1897,7 +1917,7 @@ function _verifyEmbeddedXmlDsig(xml, idpVerifyKey, idpVerifyAlg, expectedRootLoc
   // Allow either sha3-512 (framework default) or the SHA-2 family.
   var digestAlgName;
   if (digestUri === "http://www.w3.org/2007/05/xmldsig-more#sha3-512") digestAlgName = "sha3-512";
-  else if (SUPPORTED_DIGEST[digestUri]) digestAlgName = SUPPORTED_DIGEST[digestUri];
+  else if (Object.prototype.hasOwnProperty.call(SUPPORTED_DIGEST, digestUri)) digestAlgName = SUPPORTED_DIGEST[digestUri];
   else {
     throw new AuthError("auth-saml/unsupported-digest",
       "_verifyEmbeddedXmlDsig: DigestMethod " + digestUri + " not supported");

package/lib/auth/sd-jwt-vc.js

@@ -212,7 +212,7 @@ function issue(opts) {
       "issue: algorithm must be one of " + SUPPORTED_ALGS.join(", "));
   }
   var hashAlg = opts.hashAlg || DEFAULT_HASH_ALG;
-  if (!SUPPORTED_HASH_ALGS[hashAlg]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, hashAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "issue: hashAlg must be one of " + Object.keys(SUPPORTED_HASH_ALGS).join(", "));
   }
@@ -413,8 +413,8 @@ async function verify(presentation, opts) {
   validateOpts.requireObject(opts, "auth.sdJwtVc.verify", AuthError);
   validateOpts(opts, [
     "issuerKeyResolver", "audience", "nonce",
-    "now", "expectedVct", "maxClockSkewSec",
-    "requireKeyBinding",
+    "now", "expectedVct", "expectedIssuer", "maxClockSkewSec",
+    "requireKeyBinding", "requireExp",
     "keyAttestationVerifier", "requireKeyAttestation",
   ], "auth.sdJwtVc.verify");
 
@@ -528,6 +528,15 @@ async function verify(presentation, opts) {
     throw new AuthError("auth-sd-jwt-vc/iat-future",
       "verify: iat is in the future (clock skew?)");
   }
+  // SD-JWT-VC makes `exp` OPTIONAL, so the default only checks it when present.
+  // Operators with a time-bounded trust expectation (esp. for FOREIGN issuers
+  // resolved via issuerKeyResolver) pass requireExp:true to fail closed on a
+  // missing / non-numeric exp — mirroring jwt-external's unconditional exp
+  // requirement (a credential that never expires is accepted otherwise).
+  if (opts.requireExp === true && typeof jwtParsed.payload.exp !== "number") {
+    throw new AuthError("auth-sd-jwt-vc/missing-exp",
+      "verify: requireExp is set but the credential has no numeric exp claim");
+  }
   if (typeof jwtParsed.payload.exp === "number" && jwtParsed.payload.exp < nowSec - skew) {
     throw new AuthError("auth-sd-jwt-vc/expired",
       "verify: token is expired");
@@ -556,7 +565,7 @@ async function verify(presentation, opts) {
   // to its own DEFAULT_HASH_ALG (`sha3-512`) which broke verification
   // against spec-conformant issuers when `_sd_alg` was omitted.
   var hashAlg = jwtParsed.payload._sd_alg || "sha-256";
-  if (!SUPPORTED_HASH_ALGS[hashAlg]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, hashAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "verify: _sd_alg \"" + hashAlg + "\" not supported");
   }
@@ -638,6 +647,17 @@ async function verify(presentation, opts) {
     jwtExternal._assertAlgKtyMatch(kbAlg, holderKey);
     var holderKeyObj = bCrypto.importPublicJwk(holderKey);
     var kbParsed = _verifyJwt(maybeKbJwt, holderKeyObj, kbAlg);
+    // A KB-JWT proves holder possession of THIS presentation's bytes (sd_hash),
+    // but binds it to a verifier + a fresh challenge only via aud + nonce. If
+    // the caller processes a KB-JWT without supplying both, the aud/nonce
+    // compares below would silently skip — making the presentation replayable
+    // and acceptable at any verifier. Fail CLOSED: require both (oid4vp always
+    // supplies them). RFC: SD-JWT-VC §KB-JWT / OIDC4VP nonce binding.
+    if (typeof opts.audience !== "string" || opts.audience.length === 0 ||
+        typeof opts.nonce !== "string" || opts.nonce.length === 0) {
+      throw new AuthError("auth-sd-jwt-vc/missing-replay-binding",
+        "verify: a KB-JWT requires opts.audience + opts.nonce to bind the presentation to this verifier and a fresh challenge (replay / audience-redirection defense)");
+    }
     // Constant-time compares: the nonce is a verifier-issued replay-defense
     // value, so a short-circuiting !== leaks a matching-prefix timing oracle.
     // Matches the sd_hash check below (the framework's hash/token discipline).