@blamejs/core 0.16.21 → 0.16.22

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.22 (2026-07-12) — **Bind an OpenID-Federation entity's configuration to the keys its superior attests, bind the COSE null-digest signature algorithms (EdDSA / ML-DSA-87) to the key type, make the verifiable-credential COSE media-type header mandatory, and turn two PGP parse crashes into typed refusals.** Covering untested adversarial branches across the federation, COSE, verifiable-credential, and PGP verifiers surfaced a set of fail-open and crash defects, fixed at the root. b.auth.openidFederation.buildTrustChain verified each entity configuration only against its own self-published keys (integrity, not provenance) and never re-verified it against the keys the superior's subordinate statement attests, so an attacker controlling an entity's .well-known endpoint (but not its attested signing key) could serve forged metadata and have the chain accept it; each non-anchor entity's configuration is now bound to its superior-attested keys. b.cose.verify bound only the ECDSA algorithms to their curve and left the null-digest algorithms (EdDSA, ML-DSA-87) with no key binding, so node:crypto -- which dispatches on the key type, not the declared COSE alg -- accepted an EdDSA signature under an ML-DSA-only allowlist against an Ed25519 key (and the reverse); every signable COSE algorithm is now bound to its key type or curve, on both sign and verify. b.vc enforced the vc+cose / vp+cose media-type header only when present, so a COSE credential omitting it was accepted with no media-type binding; the header is now mandatory, symmetric with the JOSE path. And two PGP parsers (an rsa-pss key type that cannot express the module's signatures, and a truncated post-quantum decrypt envelope) crashed with an untyped Error instead of a typed refusal. **Fixed:** *b.mail.crypto.pgp turns an rsa-pss key and a truncated decrypt envelope into typed refusals* — Two adversarial inputs escaped as an untyped Error (which an operator catch keyed on b.mail.crypto.isMailCryptoError never catches) instead of the module's typed refusal. An rsa-pss key type was declared-accepted by sign() and verify() but cannot express the module's PKCS#1-v1.5 signatures and crashes in the shared JWK extraction before any crypto runs; it is now refused as a typed bad-key-type / key-alg-mismatch. And the post-quantum decrypt envelope parser advanced its offset using attacker-controlled length fields without bounds-checking, so a truncated envelope threw a RangeError; every read and slice in the envelope parser is now bounds-checked and a truncated envelope fails closed with a typed refusal. Valid signatures and envelopes are unaffected. · *b.vc rejects a non-XSD validity date* — The validFrom / validUntil parser used Date.parse, which is lenient -- a bare year, a slash-date, a date without a time, and locale strings all parsed to some instant and were given a heuristic validity window, weakening the expiry decision the verifier relies on (Verifiable Credentials Data Model 2.0 §4.9 requires an XSD dateTime). The parser now asserts an XSD dateTime shape before parsing, so a non-conformant validity value fails closed at both issue and verify. · *b.audit.checkpoint is idempotent on an already-anchored tip* — Anchoring a checkpoint read the audit-log tip, optionally skipped if unchanged, then inserted a checkpoint row whose atMonotonicCounter is unique -- but the read and the insert were not atomic, so two checkpoints of the same tip (concurrent anchors, or a second checkpoint() call without skipIfUnchanged) both computed the same counter and the loser threw a raw UNIQUE-constraint error instead of the documented no-op. Because two anchors of one tip sign the identical payload, the collision means the counter is already anchored: checkpoint() now returns null in that case (matching the skipIfUnchanged already-anchored path) and any unrecognized database error still surfaces. **Security:** *b.auth.openidFederation binds each entity configuration to its superior-attested keys* — buildTrustChain verified every entity configuration against its own self-published JWKS (integrity) and separately verified the superior-signed subordinate statement, but never re-verified an entity's own configuration -- the source of the effective metadata resolveLeaf returns -- against the keys the superior attests. An attacker who controls an entity's <entity_id>/.well-known/openid-federation endpoint but not its attested signing key could serve a self-signed configuration carrying forged metadata and attacker keys; the honest superior's subordinate statement pinned the entity's real keys, the chain was accepted, and the forged metadata was returned (OpenID Federation 1.0 §9 requires the leaf/intermediate configuration to be verified with the JWKS the superior pins). Each non-anchor entity's configuration is now verified against its superior-attested JWKS before those keys are adopted, so the operator-pinned trust anchor flows down to gate every entity's own configuration; the anchor is already verified against the operator-pinned keys. · *b.cose binds the null-digest signature algorithms (EdDSA / ML-DSA-87) to the key type* — verify() honored the declared COSE algorithm allowlist but bound only the ECDSA algorithms to their curve; the null-digest algorithms (EdDSA -8, ML-DSA-87 -50) had no key binding at all. node:crypto.verify(null, ...) dispatches on the key type and ignores the declared COSE alg, so an EdDSA signature was accepted and reported as ML-DSA-87 when the verifier's allowlist was PQC-only and it held an Ed25519 key (and the reverse), fully bypassing the algorithm allowlist; sign() had the mirror defect and could emit an EdDSA-labeled token signed with an ML-DSA key. Every signable algorithm is now bound to its key -- ECDSA by curve, EdDSA / ML-DSA-87 by key type -- on both sign and verify. The AEAD and HMAC paths bind the algorithm into the AAD / MAC structure, so no key-dispatch confusion exists there. · *b.vc requires the COSE media-type header on a verifiable credential and presentation* — The COSE verify path enforced the vc+cose / vp+cose type header (RFC 9596) only when it was present, while the JOSE path mandated it -- so an issuer-signed COSE credential or presentation that omitted the header was accepted with no binding to its media type (a cross-media-type-confusion fail-open on the verify seam, where two securing forms diverged on the same should-be-mandatory check). The COSE path now requires the type header unconditionally, symmetric with the JOSE path; b.vc.issue / b.vc.present always emit it, so no round-trip regresses.
+
 - v0.16.21 (2026-07-12) — **Bind the declared JWS/HTTP-signature algorithm to the key's real type across b.auth.jwt and b.crypto.httpSig (closing an algorithm-confusion allowlist bypass), refuse a JWT whose payload is not a JSON object in b.guardJwt, and enforce the SAML InResponseTo replay check on the holder-of-key confirmation.** Covering untested adversarial branches across the token and assertion verifiers surfaced a set of fail-open auth defects, fixed at the root. b.auth.jwt.verify gated its algorithm allowlist on the self-declared JWS alg header while node:crypto verified against the key's intrinsic type, so a token signed by an ML-DSA key but declaring a SLH-DSA alg passed a SLH-only allowlist and verified against the ML-DSA key -- a full algorithm-allowlist bypass (CWE-347). The declared alg is now bound to the key's real type at both sign and verify. The same class existed unenforced in b.crypto.httpSig (a peer could sign with a classical ed25519 key while declaring the PQC alg ml-dsa-65, emitting an authenticated but false PQC-signed label); it now binds the alg to the key's type at sign and verify too. b.guardJwt skipped its entire claim-sanity block (required-claims + exp/nbf/iat) when the payload did not decode to a JSON object, so a token carrying no readable claims set was admitted at strict; a non-object payload is now refused symmetrically with the header. And b.auth.saml validated InResponseTo on the Bearer subject-confirmation but not the holder-of-key one, silently dropping an operator's replay binding on every HoK assertion; the holder-of-key path now applies the identical check. **Security:** *b.auth.jwt binds the declared algorithm to the key's real type (algorithm-confusion bypass)* — verify() constrained the algorithm allowlist against the self-declared JWS `alg` header -- a value the token issuer controls -- while node:crypto.verify(null, ...) selects the actual algorithm from the KeyObject's intrinsic type. The two could diverge: a token signed by an ML-DSA-87 key but declaring alg="SLH-DSA-SHAKE-256f" passed an SLH-only allowlist and was verified against the ML-DSA public key, and sign() could emit a token whose header alg misstated its own signing algorithm -- the exact mislabeled artifact the verify bypass consumes (CWE-347 algorithm confusion). Both sign() and verify() now assert the declared alg matches the resolved key's asymmetricKeyType, so the allowlist genuinely constrains which algorithm authenticated the token; a matched alg/key round-trip is unaffected. · *b.crypto.httpSig binds the declared algorithm to the key's real type* — HTTP Message Signature sign() and verify() validated the declared `alg` against the supported set but never bound it to the key's type -- so a peer could sign with a classical ed25519 key while declaring the post-quantum alg ml-dsa-65 (an authenticated but false PQC-signed label a verifier trusting the label would honor), the same algorithm-confusion class. sign() now refuses to emit a token whose alg misstates the private key's type, and verify() refuses -- before the crypto check -- a resolved key whose type differs from the declared alg. Legitimate ed25519 and ml-dsa-65 round-trips are unaffected. · *b.guardJwt refuses a JWT whose payload is not a JSON object* — The guard skipped its entire payload claim-sanity block -- required-claims and exp/nbf/iat -- whenever the payload segment did not decode to a JSON object (undecodable base64url, non-JSON bytes, a JSON primitive, or a JSON array), so a token carrying no readable claims set was admitted at the strict profile (validate returned ok and gate returned serve), defeating the guard's advertised missing-claim refusals. A non-object payload is now refused with a high-severity payload-decode finding, symmetric with the header-decode path, at every profile. · *b.auth.saml enforces the InResponseTo replay check on holder-of-key confirmations* — verifyResponse validated the SubjectConfirmationData InResponseTo against the expected AuthnRequest ID on the Bearer confirmation path but not the holder-of-key one, so an operator that opted into InResponseTo binding (solicited-response / replay correlation) silently lost it on every holder-of-key assertion -- a HoK assertion with a mismatched or absent InResponseTo was accepted, and the returned value was hardcoded to null. The holder-of-key path now applies the identical constant-time InResponseTo check the Bearer path uses and echoes the validated value, so the replay binding holds on both confirmation methods.
 
 - v0.16.20 (2026-07-12) — **Make the ClamAV scan-verdict classifier fail closed on a coalesced infected+clean reply, refuse a session under a strict device-binding threshold when the anomaly score can't be computed, guard the MessageFormat select renderer against prototype-chain keys, and reject a non-canonical webhook timestamp.** Covering untested adversarial branches across the mail scanner, the session device-binding verifier, the i18n message renderer, and the webhook verifier surfaced a set of fail-open and correctness defects, fixed at the root. The mail scanner's ClamAV INSTREAM reply classifier tested the benign OK token before the malign FOUND token, so a reply carrying both (a coalesced or stale-then-fresh reply on a reused connection) resolved to clean and delivered an infected message; the classifier now tests FOUND, then ERROR, then OK, so a malign signal always dominates and only an OK with no FOUND/ERROR is clean. Session verification under a strict maxAnomalyScore device-binding policy admitted a relocated device whenever no decisive anomaly score could be produced (no scorer supplied, or a scorer that threw or returned a non-finite value) -- it now fails closed, matching the unreadable-binding discipline. The ICU-style MessageFormat select renderer looked up an end-user-supplied select value with a bare object index, so a value naming an Object.prototype member (__proto__ / constructor / toString) returned an inherited member and either rendered garbage or threw a render-time DoS; every case lookup is now own-property only. And the webhook verifier accepted any string that Number() maps to the signed timestamp (scientific, trailing .0, hex, leading zero/plus), making the authenticated t= field malleable; it now requires the canonical decimal. **Fixed:** *b.webhook verifier rejects a non-canonical authenticated timestamp* — The verifier parsed the authenticated t= field with Number() and validated only the post-coercion integer, then re-composed the signed string from that integer -- so any string Number() maps to the same value (scientific 1.7e9, a trailing .0, hex 0x..., a leading zero/plus/whitespace) re-canonicalized into the identical signed string and verified, making the authenticated timestamp field malleable. The verifier now also requires the raw bytes to equal the canonical decimal the signer emits, the same strict digits-only parse the Stripe-compatible verifier already applied; the only legitimate producer (b.webhook.signer) emits the canonical form, so there is no interop cost. · *b.i18n.dir honors a custom RTL language configured in any case* — dir() folds the requested locale's primary subtag to lower case before the RTL-membership test, but a custom rtlLanguages list was stored verbatim, so an operator-supplied entry like "AR" or "CKB" never matched the lower-cased lookup and the language rendered left-to-right. The configured list is now folded to lower case the same way the lookup is, so a custom RTL entry matches regardless of case. · *b.i18n.t resolves a leaf shadowed by a namespace in a more-specific locale* — The fallback-chain lookup returned the first locale where the dotted key resolved to any non-undefined value, including a nested namespace object -- so a namespace at that path in the requested locale halted the chain and shadowed a real translation leaf defined in a fallback locale, leaking the raw key into the UI (and has() reported false). The lookup now treats only a renderable leaf (a string or a plural-shaped object) as a hit and keeps walking the chain past a namespace object, so a leaf in a fallback locale resolves. **Security:** *b.mail.scan fails closed on a coalesced infected+clean ClamAV reply* — The ClamAV INSTREAM reply classifier tested the benign `stream: OK` token before the malign `... FOUND` token, so a reply that carried both -- a coalesced or stale-then-fresh reply on a reused connection, or an intermediary that concatenates two responses -- resolved to a clean verdict and delivered an infected message (a scan bypass). The classifier is a security verdict, so it now tests FOUND (infected) first, then ERROR (do-not-deliver), then OK (clean); an unrecognized shape is still an error. A reply containing a FOUND signal can no longer be downgraded to clean by an adjacent OK token. · *b.session.verify fails closed under a strict anomaly threshold when the score can't be computed* — Under the strict maxAnomalyScore device-binding policy, verify() only assigned a fingerprint anomaly score when the supplied scorer returned a finite number. With no scorer (the option is documented as pairing with one but is omittable), or a scorer that threw or returned a non-finite value, the score stayed null and the refusal guard (score present AND above threshold) was false, so verify RETURNED a session bound to one device when presented from another. An uncomputable anomaly score on genuine fingerprint drift now fails closed (verify returns null), matching the fail-closed discipline the unreadable-binding branch already applied; the legitimate path (a finite score at or below the threshold admits, with the score surfaced) is unchanged. · *b.i18n MessageFormat select renderer guards against prototype-chain keys* — The ICU-style MessageFormat select renderer resolved a case with a bare object index on an end-user-supplied select value, so a value naming an Object.prototype member -- __proto__ / constructor / toString / hasOwnProperty / valueOf -- returned a truthy INHERITED member, bypassing the `other` fallback: an inherited value with no length rendered as empty (silent output corruption), and an inherited function threw when rendered as a non-array (a request-level DoS). Every select/plural case lookup is now own-property only, so an attacker-supplied select value that names a prototype member falls through to the `other` case. **Detectors:** *MessageFormat case lookups must be own-property* — A structural check asserts that the MessageFormat renderer resolves a select/plural case through the own-property helper rather than a bare object index, so an end-user-supplied select value can never reach the prototype chain and re-open the corruption/DoS class.

package/lib/audit.js

@@ -218,6 +218,45 @@ async function _insertCheckpoint(values) {
   );
 }
 
+// A concurrent anchor of the SAME tip loses the race to INSERT the
+// atMonotonicCounter (UNIQUE): two anchors of one tip sign the identical
+// payload, so the collision means the counter is ALREADY anchored, not a
+// corruption. Recognize it BACKEND-AGNOSTICALLY so the loser returns null like
+// the skipIfUnchanged "already anchored" path instead of throwing. Each driver
+// surfaces the violation differently: SQLite names the column in the message
+// (`... audit_checkpoints.atMonotonicCounter`); Postgres carries the unique
+// INDEX name (idx_chkpt_counter) in `constraint`/`detail` with SQLSTATE 23505;
+// MySQL reports the key name in `sqlMessage` with errno 1062. Gather every such
+// field, and require BOTH a reference to the counter column OR its unique index
+// AND a uniqueness signal, so no unrelated error is ever swallowed (anything
+// unrecognized rethrows — fail-closed).
+// Tokens that name the counter column (sqlite) or its unique index (pg/mysql).
+var _DUP_COUNTER_REFS = ["atmonotoniccounter", "chkpt_counter"];
+// A uniqueness-violation signal on any backend: sqlite message/code, postgres
+// text/SQLSTATE 23505, mysql text/code-name/errno 1062.
+var _DUP_UNIQUE_SIGNALS = [
+  "unique constraint failed", "sqlite_constraint", "duplicate key",
+  "23505", "duplicate entry", "er_dup_entry", "1062",
+];
+function _errorTextContainsAny(text, needles) {
+  for (var i = 0; i < needles.length; i++) {
+    if (text.indexOf(needles[i]) !== -1) return true;
+  }
+  return false;
+}
+function _isDuplicateCheckpointCounter(e) {
+  if (!e) return false;
+  var parts = [e.message, e.detail, e.constraint, e.sqlMessage, e.table, e.code, e.errno];
+  var text = "";
+  for (var i = 0; i < parts.length; i++) {
+    if (parts[i] != null) text += " " + String(parts[i]);
+  }
+  if (typeof e.toString === "function") text += " " + e.toString();
+  text = text.toLowerCase();
+  return _errorTextContainsAny(text, _DUP_COUNTER_REFS) &&
+         _errorTextContainsAny(text, _DUP_UNIQUE_SIGNALS);
+}
+
 async function _upsertAuditTip(counter, rowHash, signedAt, fencingToken) {
   // Cluster-mode only. Single atomic INSERT … ON CONFLICT … DO UPDATE
   // … WHERE … RETURNING. The WHERE clause is the canonical
@@ -1001,9 +1040,30 @@ async function checkpoint(opts) {
 
   var ckptId = generateToken(TRACE_ID_BYTES);
   var fencingToken = cluster.fencingToken();
-  await _insertCheckpoint(
-    [ckptId, createdAt, counter, tip.rowHash, signature, pubFp, fencingToken]
-  );
+  try {
+    await _insertCheckpoint(
+      [ckptId, createdAt, counter, tip.rowHash, signature, pubFp, fencingToken]
+    );
+  } catch (e) {
+    // Lost the INSERT race to another anchor of this same tip counter: the
+    // counter is already anchored (both anchors sign the identical payload).
+    // In SINGLE-NODE mode that is purely idempotent — return null like the
+    // skipIfUnchanged "already anchored" path and let the winner own the
+    // sidecar write below. In CLUSTER mode the duplicate can instead mean a
+    // NEWER LEADER anchored this tip while we still hold an OLDER fencingToken,
+    // so we must NOT silently swallow it: run the audit-tip fence first, whose
+    // fencing-token WHERE guard throws FENCED_OUT when a higher token has been
+    // stored — surfacing the leadership-loss step-down instead of a benign
+    // null. If the fence passes (a same-node concurrent race), it is idempotent.
+    // Any non-duplicate error rethrows.
+    if (_isDuplicateCheckpointCounter(e)) {
+      if (cluster.isClusterMode()) {
+        await _upsertAuditTip(counter, tip.rowHash, String(createdAt), fencingToken);
+      }
+      return null;
+    }
+    throw e;
+  }
 
   // Update rollback-detection sidecar (single-node) or audit-tip row
   // (cluster mode).
@@ -1919,4 +1979,5 @@ module.exports = {
   CHECKPOINT_FORMAT:    CHECKPOINT_FORMAT,
   FRAMEWORK_NAMESPACES: FRAMEWORK_NAMESPACES,
   _resetForTest:        _resetForTest,
+  _isDuplicateCheckpointCounter: _isDuplicateCheckpointCounter,   // test seam: cross-backend dup-counter recognition
 };

package/lib/auth/openid-federation.js

@@ -593,6 +593,21 @@ async function buildTrustChain(opts) {
     // The subordinate statement pins this entity's jwks — adopt the
     // attested keys for the next link down, and reflect them on the node.
     if (node.subordinate.jwks && Array.isArray(node.subordinate.jwks.keys)) {
+      // Bind the entity's OWN self-configuration to the superior-attested
+      // keys. resolveLeaf reads the effective metadata from the entity's
+      // self-config (chain[i].claims.metadata), and Phase 1 verified that
+      // config only against its OWN self-published jwks — which proves the
+      // document isn't garbled, NOT that a federation-attested key signed
+      // it. An attacker who controls the entity's .well-known endpoint (but
+      // not its attested signing key) can serve a self-signed config that
+      // carries forged metadata + attacker jwks and sails through the Phase 1
+      // self-verify; without this check the pinned keys never gate the very
+      // document whose metadata is trusted. Re-verify the config against the
+      // pinned keys so a config not signed by an attested key fails the whole
+      // chain (OIDF 1.0 §9 — the leaf/intermediate Entity Configuration is
+      // verified with the jwks pinned by its superior's Subordinate
+      // Statement, never with the config's self-declared jwks).
+      verifyEntityStatement(node.jwt, node.subordinate.jwks);
       node.claims.jwks = node.subordinate.jwks;
       attestedJwks = node.subordinate.jwks;
     } else {

package/lib/cose.js

@@ -112,21 +112,36 @@ function _algParamsFor(algId) {
   }
 }
 
-// RFC 9053 §2 binds each ECDSA alg to ONE curve. node:crypto will happily
-// verify a sha512 (ES512-shape) signature against a P-256 key as
-// self-consistent, so without this check a COSE_Sign1 declaring ES512 but
-// carrying a P-256 key passes when ES512 is allowlisted — an alg/curve
-// confusion (the COSE sibling of jwt-external._assertAlgKtyMatch). EdDSA /
-// ML-DSA carry their parameters in the KeyObject and need no binding.
+// RFC 9053 §2 binds each COSE signature alg to ONE key shape. node:crypto
+// dispatches sign()/verify() on the KEY, never on the declared COSE alg —
+// for ECDSA it will happily verify a sha512 (ES512-shape) signature against
+// a P-256 key as self-consistent, and for the null-digest algorithms
+// (EdDSA, ML-DSA-87) it selects the primitive purely from the key type.
+// Without an alg→key binding a COSE_Sign1 declaring one algorithm but
+// carrying/using another key type verifies — an alg/key confusion (the COSE
+// sibling of jwt-external._assertAlgKtyMatch). Two live seams: a COSE_Sign1
+// declaring ES512 but carrying a P-256 key passes when ES512 is allowlisted;
+// and — because EdDSA/ML-DSA-87 both sign with a null digest — an EdDSA
+// signature passes a PQC-only ("ML-DSA-87") allowlist against an Ed25519 key
+// (and the reverse). EdDSA / ML-DSA carry no curve, so they are bound by
+// key TYPE, not curve. Every SIGNABLE alg is bound here.
 var _ES_ALG_CURVE = { ES256: "prime256v1", ES384: "secp384r1", ES512: "secp521r1" };
-function _assertEcAlgCurve(algName, key) {
-  var want = _ES_ALG_CURVE[algName];
-  if (want === undefined) return;                                                       // not an ECDSA alg — nothing to bind
-  var got = (key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve) || null;
-  if (key.asymmetricKeyType !== "ec" || got !== want) {
-    throw new CoseError("cose/alg-curve-mismatch",
-      "cose: alg '" + algName + "' requires an EC key on " + want +
-      ", got " + (key.asymmetricKeyType === "ec" ? got : key.asymmetricKeyType));
+var _ALG_KEY_TYPE = { EdDSA: "ed25519", "ML-DSA-87": "ml-dsa-87" };                    // null-digest algs → required key type
+function _assertAlgKeyMatch(algName, key) {
+  var wantCurve = _ES_ALG_CURVE[algName];
+  if (wantCurve !== undefined) {
+    var got = (key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve) || null;
+    if (!key || key.asymmetricKeyType !== "ec" || got !== wantCurve) {
+      throw new CoseError("cose/alg-curve-mismatch",
+        "cose: alg '" + algName + "' requires an EC key on " + wantCurve +
+        ", got " + (key && key.asymmetricKeyType === "ec" ? got : (key && key.asymmetricKeyType)));
+    }
+    return;
+  }
+  var wantType = _ALG_KEY_TYPE[algName];
+  if (wantType !== undefined && (!key || key.asymmetricKeyType !== wantType)) {
+    throw new CoseError("cose/alg-key-mismatch",
+      "cose: alg '" + algName + "' requires a " + wantType + " key, got " + (key && key.asymmetricKeyType));
   }
 }
 
@@ -189,7 +204,7 @@ async function sign(payload, opts) {
   var algId = ALG_NAME_TO_ID[opts.alg];
   var params = _algParamsFor(algId);
   var key = _toKeyObject(opts.privateKey, "private");
-  _assertEcAlgCurve(opts.alg, key);                                                      // RFC 9053 alg↔curve binding — refuse e.g. ES512 over a P-256 key
+  _assertAlgKeyMatch(opts.alg, key);                                                     // RFC 9053 alg↔key binding — refuse e.g. ES512 over a P-256 key, or EdDSA over an ML-DSA key
 
   var protMap = new Map();
   protMap.set(HDR_ALG, algId);
@@ -373,7 +388,7 @@ async function verify(coseSign1, opts) {
   var key = opts.publicKey
     ? _toKeyObject(opts.publicKey, "public")
     : _toKeyObject(opts.keyResolver(protMap, unprotected), "public");
-  _assertEcAlgCurve(algName, key);                                                      // RFC 9053 alg↔curve binding
+  _assertAlgKeyMatch(algName, key);                                                     // RFC 9053 alg↔key binding — refuse alg/key-type confusion (EdDSA vs ML-DSA-87, ES* vs wrong curve)
 
   var externalAad = opts.externalAad == null ? Buffer.alloc(0) : _bstr(opts.externalAad);
   var toBeSigned = _toBeSigned(protectedBstr, externalAad, payload);

package/lib/mail-crypto-pgp.js

@@ -456,7 +456,12 @@ function sign(opts) {
     hashAlg = HASH_ALG_SHA512;
     var rawPub = _extractEd25519PublicRaw(publicKey);
     publicPacketBody = _ed25519PublicPacketBody(rawPub, creationTime);
-  } else if (keyType === "rsa" || keyType === "rsa-pss") {
+  } else if (keyType === "rsa") {
+    // Only rsaEncryption (keyType "rsa") keys sign here. An id-RSASSA-PSS
+    // key (keyType "rsa-pss") is padding-restricted to PSS by OpenSSL and
+    // cannot express the PKCS#1-v1.5 signature this module emits, so it is
+    // refused with a typed error below rather than crashing on the JWK
+    // export path (which refuses rsa-pss keys).
     pubAlg  = PUB_ALG_RSA;
     hashAlg = HASH_ALG_SHA256;
     var rsaPub = _extractRsaPublicComponents(publicKey);
@@ -811,7 +816,12 @@ function verify(opts) {
     "publicKeyPem could not be parsed: " + ((e && e.message) || String(e))); }
 
   var keyType = publicKey.asymmetricKeyType;
-  if (parsed.pubAlg === PUB_ALG_RSA && !(keyType === "rsa" || keyType === "rsa-pss")) {
+  // Only rsaEncryption (keyType "rsa") keys verify a PKCS#1-v1.5 signature.
+  // An id-RSASSA-PSS key (keyType "rsa-pss") is PSS-padding-restricted and
+  // cannot JWK-export for component extraction; treat it as a key/algorithm
+  // mismatch and return a typed verdict rather than letting the extraction
+  // throw a raw Error out of verify().
+  if (parsed.pubAlg === PUB_ALG_RSA && keyType !== "rsa") {
     return _fail("mail-crypto/pgp/key-alg-mismatch",
       "signature claims RSA but provided key is " + keyType);
   }
@@ -1028,6 +1038,18 @@ function experimentalEncrypt(opts) {
   return { armored: armored, envelope: envelope };
 }
 
+// Envelope length fields (recipientId / KEM-ciphertext / wrapped-key /
+// body lengths) are attacker-controlled: every multi-byte read and every
+// slice below must confirm the bytes exist before advancing `off`, or a
+// truncated envelope escapes as a raw RangeError instead of the typed
+// refusal decrypt() promises. Fail closed with mail-crypto/pgp/truncated.
+function _envNeed(buf, off, n) {
+  if (off + n > buf.length) {
+    throw new MailCryptoError("mail-crypto/pgp/truncated",
+      "decrypt: envelope truncated (need " + n + " byte(s) at offset " + off + ")");
+  }
+}
+
 function experimentalDecrypt(opts) {
   opts = validateOpts.requireObject(opts, "mail.crypto.pgp.experimental.decrypt",
     MailCryptoError, "mail-crypto/pgp/bad-opts");
@@ -1064,15 +1086,17 @@ function experimentalDecrypt(opts) {
   var nRecips = envelope[off]; off += 1;
   var matchedSessionKey = null;
   for (var i = 0; i < nRecips; i += 1) {
-    if (off >= envelope.length) {
-      throw new MailCryptoError("mail-crypto/pgp/truncated",
-        "decrypt: envelope truncated at recipient " + i);
-    }
+    _envNeed(envelope, off, 1);
     var ridLen = envelope[off]; off += 1;
+    _envNeed(envelope, off, ridLen);
     var rid = envelope.slice(off, off + ridLen); off += ridLen;
+    _envNeed(envelope, off, 2);
     var ctLen = envelope.readUInt16BE(off); off += 2;                                                 // u16-be width
+    _envNeed(envelope, off, ctLen);
     var ct = envelope.slice(off, off + ctLen); off += ctLen;
+    _envNeed(envelope, off, 2);
     var wkLen = envelope.readUInt16BE(off); off += 2;                                                 // u16-be width
+    _envNeed(envelope, off, wkLen);
     var wrappedKey = envelope.slice(off, off + wkLen); off += wkLen;
     if (matchedSessionKey) continue;
     if (!rid.equals(opts.recipientId)) continue;
@@ -1096,7 +1120,9 @@ function experimentalDecrypt(opts) {
     throw new MailCryptoError("mail-crypto/pgp/no-matching-recipient",
       "decrypt: no recipient in envelope matches opts.recipientId");
   }
+  _envNeed(envelope, off, 4);
   var bodyLen = envelope.readUInt32BE(off); off += 4;                                                 // u32-be width
+  _envNeed(envelope, off, bodyLen);
   var body = envelope.slice(off, off + bodyLen);
   var plaintext;
   try { plaintext = bCrypto.decryptPacked(body, matchedSessionKey); }

package/lib/vc.js

@@ -151,11 +151,41 @@ function _validateVcdm(cred, opts) {
   }
 }
 
+// XSD dateTime (VCDM 2.0 section 4.9): [-]CCYY-MM-DDThh:mm:ss with an optional
+// fractional second and an optional timezone (Z or +/-hh:mm). Date.parse alone
+// is far too lenient in TWO ways: it accepts non-XSD shapes (a bare year, a
+// slash date, a date with no time, locale forms), AND for an in-shape but
+// IMPOSSIBLE calendar date it NORMALIZES rather than rejects (2024-02-31 ->
+// 2024-03-02, a non-leap 2023-02-29 -> 2023-03-01, 2024-04-31 -> 2024-05-01),
+// silently shifting the validity window. So the shape is asserted with a
+// capturing regex AND the calendar fields are range-checked (month 1..12, day
+// within the real length of that month, leap years honoured) BEFORE Date.parse.
+var _XSD_DATETIME = /^(-?\d{4,})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})?$/;
+
+function _daysInMonth(year, month) {
+  if (month === 2) {
+    var leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+    return leap ? 29 : 28;
+  }
+  return (month === 4 || month === 6 || month === 9 || month === 11) ? 30 : 31;
+}
+
 function _parseValidityField(cred, name) {
   if (cred[name] === undefined) return null;
-  if (typeof cred[name] !== "string") {
+  var m = typeof cred[name] === "string" ? _XSD_DATETIME.exec(cred[name]) : null;
+  if (!m) {
     throw new VcError("vc/bad-validity", "vc: " + name + " must be an XSD dateTime string");
   }
+  var year = Number(m[1]), month = Number(m[2]), day = Number(m[3]);
+  // Reject an in-shape but impossible calendar DATE before Date.parse can
+  // normalize a day overflow into a different valid instant (2024-02-31 ->
+  // 2024-03-02, a non-leap 2023-02-29 -> 2023-03-01). Time-field overflow
+  // (hour/minute/second) is already rejected by Date.parse below (NaN), and
+  // 24:00:00 is the valid XSD end-of-day, so only the day-of-month needs a guard.
+  if (month < 1 || month > 12 || day < 1 || day > _daysInMonth(year, month)) {
+    throw new VcError("vc/bad-validity",
+      "vc: " + name + " is not a real calendar date: " + cred[name]);
+  }
   var ms = Date.parse(cred[name]);
   if (!isFinite(ms)) {
     throw new VcError("vc/bad-validity", "vc: " + name + " is not a valid dateTime: " + cred[name]);
@@ -287,9 +317,18 @@ async function _verifyCose(bytes, opts, expectedTyp) {
     publicKey:   opts.publicKey,
     keyResolver: opts.keyResolver,
   });
+  // The typ header (RFC 9596 label 16) binds the COSE_Sign1 to the
+  // vc+cose / vp+cose media type. The JOSE path MANDATES its typ; the COSE
+  // path must too — an absent typ is not "unspecified, therefore ok" but an
+  // unbound statement that could be a signature made for another purpose
+  // (or the sibling securing form). Require it, symmetric with _verifyJose,
+  // rather than only checking it when present (which let an issuer-signed
+  // but typ-less COSE_Sign1 be accepted under a weaker contract).
   var typ = out.protectedHeaders.get(HDR_COSE_TYP);
-  if (typ !== undefined && typ !== expectedTyp) {
-    throw new VcError("vc/bad-typ", "vc.verify: COSE typ header is '" + typ + "', expected '" + expectedTyp + "'");
+  if (typ !== expectedTyp) {
+    throw new VcError("vc/bad-typ",
+      "vc.verify: COSE typ header is " + (typ === undefined ? "absent" : "'" + typ + "'") +
+      ", expected '" + expectedTyp + "'");
   }
   var payload;
   try { payload = safeJson.parse(out.payload.toString("utf8")); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.21",
+  "version": "0.16.22",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:96b6222d-f898-4aa7-beb8-1b0c830965bd",
+  "serialNumber": "urn:uuid:8f653935-1cc6-4bc7-a5a6-a9916e85dd27",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T14:22:26.336Z",
+    "timestamp": "2026-07-12T18:42:40.587Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.21",
+      "bom-ref": "@blamejs/core@0.16.22",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.21",
+      "version": "0.16.22",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.21",
+      "purl": "pkg:npm/%40blamejs/core@0.16.22",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.21",
+      "ref": "@blamejs/core@0.16.22",
       "dependsOn": []
     }
   ]