@blamejs/core 0.16.21 → 0.16.23

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.23 (2026-07-12) — **Merge an OpenID-Federation trust chain's per-level metadata policies into one combined policy and validate the operator combination, so a subordinate can only narrow a superior's constraint and cannot downgrade it through a different operator.** b.auth.openidFederation.applyMetadataPolicy resolved a chain's metadata_policy by applying each level's block in sequence, anchor-first then leaf-ward, so a leaf-ward level could override a value the anchor pinned -- and even after that was closed, a subordinate could still escape a superior's constraint by expressing the override with a DIFFERENT operator, because the resolution never checked that the combined operator set was consistent. An attacker controlling an intermediate could pin token_endpoint_auth_method with value 'none' against an anchor's one_of ['private_key_jwt'], widen a scope set past an anchor's subset_of ceiling with add, or replace an anchor's superset_of-mandated grant with a weaker one via value -- each resolved to the downgraded metadata with no error. OpenID Federation 1.0 §6.1.3 defines a fixed operator processing order and a set of operator-combination rules (value combines only with essential; add must stay within subset_of and cover superset_of; default must satisfy a co-present one_of / subset_of / superset_of; one_of does not combine with the array operators; superset_of must be within subset_of). applyMetadataPolicy now gathers every superior-signed subordinate statement's policy for the metadata kind, merges them superior-first (value / default equal-or-conflict, one_of / subset_of intersect, add / superset_of union, essential OR), validates the merged operator combination for every claim -- refusing the chain when a subordinate's operator is inconsistent with a superior's -- and applies the combined policy once in the fixed operator order so the value-check operators validate the final value. Consistent narrowings (a subordinate tightening a one_of or subset_of, adding within a subset_of, defaulting within a one_of) are unaffected. **Security:** *b.auth.openidFederation resolves metadata policy by merging every chain level and validating the operator combination, blocking cross-operator trust downgrades* — applyMetadataPolicy walked the chain applying each level's metadata_policy block in turn, so the leaf-ward block won any disagreement -- a subordinate could override a value the anchor pinned. Merging the levels closes the same-operator case, but a subordinate could still escape a superior's constraint expressed with a different operator: an anchor's one_of ['private_key_jwt'] on token_endpoint_auth_method was overridden by a leaf-ward value 'none' (client authentication removed at the token endpoint), an anchor's subset_of scope ceiling was widened by a subordinate add, and an anchor's superset_of-mandated grant was dropped by a subordinate value substituting the implicit flow -- each resolved to the downgraded metadata with no error, because the resolution validated only same-operator value/default conflicts and applied operators in object-key order rather than the OpenID Federation 1.0 §6.1.3 fixed order, so the value-check operators ran before the value they were meant to guard was set. Policy resolution now gathers each superior-signed subordinate statement's policy for the metadata kind (the leaf's own self-published policy is never read), merges them superior-first (value / default must agree across levels or the chain is refused, one_of / subset_of intersect, add / superset_of union, essential OR), and applies the single combined policy in the OpenID Federation 1.0 §6.1.3 fixed operator order (value, add, default, then the one_of / subset_of / superset_of / essential checks) so the merged, most-restrictive constraints validate the final value. A value outside a merged one_of, an add that widens past a merged subset_of, or a value that drops a superset_of-mandated member is therefore refused; a subordinate cannot widen an exact pinned value by adding a value not already in it; and a one_of whose values are disjoint across chain levels leaves no admissible value and is refused. A subordinate can only narrow a superior's constraint, never override it through any operator; a value pinned inside a superior's allowed set, and consistent narrowings generally, are unaffected. Resolution also refuses a prototype-pollution key (__proto__, constructor, prototype) in a policy block's claim names or in the base metadata, since those are never valid metadata parameter names and merging them into the combined policy would write Object.prototype. · *b.auth.openidFederation enforces the array metadata-policy operators on a claim the entity declares as a space-delimited string* — The subset_of metadata-policy operator restricts an array-valued claim (grant_types, response_types, redirect_uris, and similar) to an allow-list, but the check only ran when the claim was already an array. Because an entity fully controls its own self-published metadata, a leaf could declare a subset_of-constrained claim as a single string and the array guard skipped, so the anchor's allow-list was silently not enforced and the entity kept a value the trust anchor forbade. The array operators (subset_of, superset_of, add) now process a space-delimited string as an array of strings, per OpenID Federation 1.0 §6.1.3.1.8 -- so an OAuth scope like "openid email" is checked (and each token in a leaf's string is validated against the allow-list, catching a smuggled value), while a genuine non-array, non-string value is refused. An absent claim under subset_of is still left absent, since subset_of constrains a value that is present rather than requiring presence.
+
+- v0.16.22 (2026-07-12) — **Bind an OpenID-Federation entity's configuration to the keys its superior attests, bind the COSE null-digest signature algorithms (EdDSA / ML-DSA-87) to the key type, make the verifiable-credential COSE media-type header mandatory, and turn two PGP parse crashes into typed refusals.** Covering untested adversarial branches across the federation, COSE, verifiable-credential, and PGP verifiers surfaced a set of fail-open and crash defects, fixed at the root. b.auth.openidFederation.buildTrustChain verified each entity configuration only against its own self-published keys (integrity, not provenance) and never re-verified it against the keys the superior's subordinate statement attests, so an attacker controlling an entity's .well-known endpoint (but not its attested signing key) could serve forged metadata and have the chain accept it; each non-anchor entity's configuration is now bound to its superior-attested keys. b.cose.verify bound only the ECDSA algorithms to their curve and left the null-digest algorithms (EdDSA, ML-DSA-87) with no key binding, so node:crypto -- which dispatches on the key type, not the declared COSE alg -- accepted an EdDSA signature under an ML-DSA-only allowlist against an Ed25519 key (and the reverse); every signable COSE algorithm is now bound to its key type or curve, on both sign and verify. b.vc enforced the vc+cose / vp+cose media-type header only when present, so a COSE credential omitting it was accepted with no media-type binding; the header is now mandatory, symmetric with the JOSE path. And two PGP parsers (an rsa-pss key type that cannot express the module's signatures, and a truncated post-quantum decrypt envelope) crashed with an untyped Error instead of a typed refusal. **Fixed:** *b.mail.crypto.pgp turns an rsa-pss key and a truncated decrypt envelope into typed refusals* — Two adversarial inputs escaped as an untyped Error (which an operator catch keyed on b.mail.crypto.isMailCryptoError never catches) instead of the module's typed refusal. An rsa-pss key type was declared-accepted by sign() and verify() but cannot express the module's PKCS#1-v1.5 signatures and crashes in the shared JWK extraction before any crypto runs; it is now refused as a typed bad-key-type / key-alg-mismatch. And the post-quantum decrypt envelope parser advanced its offset using attacker-controlled length fields without bounds-checking, so a truncated envelope threw a RangeError; every read and slice in the envelope parser is now bounds-checked and a truncated envelope fails closed with a typed refusal. Valid signatures and envelopes are unaffected. · *b.vc rejects a non-XSD validity date* — The validFrom / validUntil parser used Date.parse, which is lenient -- a bare year, a slash-date, a date without a time, and locale strings all parsed to some instant and were given a heuristic validity window, weakening the expiry decision the verifier relies on (Verifiable Credentials Data Model 2.0 §4.9 requires an XSD dateTime). The parser now asserts an XSD dateTime shape before parsing, so a non-conformant validity value fails closed at both issue and verify. · *b.audit.checkpoint is idempotent on an already-anchored tip* — Anchoring a checkpoint read the audit-log tip, optionally skipped if unchanged, then inserted a checkpoint row whose atMonotonicCounter is unique -- but the read and the insert were not atomic, so two checkpoints of the same tip (concurrent anchors, or a second checkpoint() call without skipIfUnchanged) both computed the same counter and the loser threw a raw UNIQUE-constraint error instead of the documented no-op. Because two anchors of one tip sign the identical payload, the collision means the counter is already anchored: checkpoint() now returns null in that case (matching the skipIfUnchanged already-anchored path) and any unrecognized database error still surfaces. **Security:** *b.auth.openidFederation binds each entity configuration to its superior-attested keys* — buildTrustChain verified every entity configuration against its own self-published JWKS (integrity) and separately verified the superior-signed subordinate statement, but never re-verified an entity's own configuration -- the source of the effective metadata resolveLeaf returns -- against the keys the superior attests. An attacker who controls an entity's <entity_id>/.well-known/openid-federation endpoint but not its attested signing key could serve a self-signed configuration carrying forged metadata and attacker keys; the honest superior's subordinate statement pinned the entity's real keys, the chain was accepted, and the forged metadata was returned (OpenID Federation 1.0 §9 requires the leaf/intermediate configuration to be verified with the JWKS the superior pins). Each non-anchor entity's configuration is now verified against its superior-attested JWKS before those keys are adopted, so the operator-pinned trust anchor flows down to gate every entity's own configuration; the anchor is already verified against the operator-pinned keys. · *b.cose binds the null-digest signature algorithms (EdDSA / ML-DSA-87) to the key type* — verify() honored the declared COSE algorithm allowlist but bound only the ECDSA algorithms to their curve; the null-digest algorithms (EdDSA -8, ML-DSA-87 -50) had no key binding at all. node:crypto.verify(null, ...) dispatches on the key type and ignores the declared COSE alg, so an EdDSA signature was accepted and reported as ML-DSA-87 when the verifier's allowlist was PQC-only and it held an Ed25519 key (and the reverse), fully bypassing the algorithm allowlist; sign() had the mirror defect and could emit an EdDSA-labeled token signed with an ML-DSA key. Every signable algorithm is now bound to its key -- ECDSA by curve, EdDSA / ML-DSA-87 by key type -- on both sign and verify. The AEAD and HMAC paths bind the algorithm into the AAD / MAC structure, so no key-dispatch confusion exists there. · *b.vc requires the COSE media-type header on a verifiable credential and presentation* — The COSE verify path enforced the vc+cose / vp+cose type header (RFC 9596) only when it was present, while the JOSE path mandated it -- so an issuer-signed COSE credential or presentation that omitted the header was accepted with no binding to its media type (a cross-media-type-confusion fail-open on the verify seam, where two securing forms diverged on the same should-be-mandatory check). The COSE path now requires the type header unconditionally, symmetric with the JOSE path; b.vc.issue / b.vc.present always emit it, so no round-trip regresses.
+
 - v0.16.21 (2026-07-12) — **Bind the declared JWS/HTTP-signature algorithm to the key's real type across b.auth.jwt and b.crypto.httpSig (closing an algorithm-confusion allowlist bypass), refuse a JWT whose payload is not a JSON object in b.guardJwt, and enforce the SAML InResponseTo replay check on the holder-of-key confirmation.** Covering untested adversarial branches across the token and assertion verifiers surfaced a set of fail-open auth defects, fixed at the root. b.auth.jwt.verify gated its algorithm allowlist on the self-declared JWS alg header while node:crypto verified against the key's intrinsic type, so a token signed by an ML-DSA key but declaring a SLH-DSA alg passed a SLH-only allowlist and verified against the ML-DSA key -- a full algorithm-allowlist bypass (CWE-347). The declared alg is now bound to the key's real type at both sign and verify. The same class existed unenforced in b.crypto.httpSig (a peer could sign with a classical ed25519 key while declaring the PQC alg ml-dsa-65, emitting an authenticated but false PQC-signed label); it now binds the alg to the key's type at sign and verify too. b.guardJwt skipped its entire claim-sanity block (required-claims + exp/nbf/iat) when the payload did not decode to a JSON object, so a token carrying no readable claims set was admitted at strict; a non-object payload is now refused symmetrically with the header. And b.auth.saml validated InResponseTo on the Bearer subject-confirmation but not the holder-of-key one, silently dropping an operator's replay binding on every HoK assertion; the holder-of-key path now applies the identical check. **Security:** *b.auth.jwt binds the declared algorithm to the key's real type (algorithm-confusion bypass)* — verify() constrained the algorithm allowlist against the self-declared JWS `alg` header -- a value the token issuer controls -- while node:crypto.verify(null, ...) selects the actual algorithm from the KeyObject's intrinsic type. The two could diverge: a token signed by an ML-DSA-87 key but declaring alg="SLH-DSA-SHAKE-256f" passed an SLH-only allowlist and was verified against the ML-DSA public key, and sign() could emit a token whose header alg misstated its own signing algorithm -- the exact mislabeled artifact the verify bypass consumes (CWE-347 algorithm confusion). Both sign() and verify() now assert the declared alg matches the resolved key's asymmetricKeyType, so the allowlist genuinely constrains which algorithm authenticated the token; a matched alg/key round-trip is unaffected. · *b.crypto.httpSig binds the declared algorithm to the key's real type* — HTTP Message Signature sign() and verify() validated the declared `alg` against the supported set but never bound it to the key's type -- so a peer could sign with a classical ed25519 key while declaring the post-quantum alg ml-dsa-65 (an authenticated but false PQC-signed label a verifier trusting the label would honor), the same algorithm-confusion class. sign() now refuses to emit a token whose alg misstates the private key's type, and verify() refuses -- before the crypto check -- a resolved key whose type differs from the declared alg. Legitimate ed25519 and ml-dsa-65 round-trips are unaffected. · *b.guardJwt refuses a JWT whose payload is not a JSON object* — The guard skipped its entire payload claim-sanity block -- required-claims and exp/nbf/iat -- whenever the payload segment did not decode to a JSON object (undecodable base64url, non-JSON bytes, a JSON primitive, or a JSON array), so a token carrying no readable claims set was admitted at the strict profile (validate returned ok and gate returned serve), defeating the guard's advertised missing-claim refusals. A non-object payload is now refused with a high-severity payload-decode finding, symmetric with the header-decode path, at every profile. · *b.auth.saml enforces the InResponseTo replay check on holder-of-key confirmations* — verifyResponse validated the SubjectConfirmationData InResponseTo against the expected AuthnRequest ID on the Bearer confirmation path but not the holder-of-key one, so an operator that opted into InResponseTo binding (solicited-response / replay correlation) silently lost it on every holder-of-key assertion -- a HoK assertion with a mismatched or absent InResponseTo was accepted, and the returned value was hardcoded to null. The holder-of-key path now applies the identical constant-time InResponseTo check the Bearer path uses and echoes the validated value, so the replay binding holds on both confirmation methods.
 
 - v0.16.20 (2026-07-12) — **Make the ClamAV scan-verdict classifier fail closed on a coalesced infected+clean reply, refuse a session under a strict device-binding threshold when the anomaly score can't be computed, guard the MessageFormat select renderer against prototype-chain keys, and reject a non-canonical webhook timestamp.** Covering untested adversarial branches across the mail scanner, the session device-binding verifier, the i18n message renderer, and the webhook verifier surfaced a set of fail-open and correctness defects, fixed at the root. The mail scanner's ClamAV INSTREAM reply classifier tested the benign OK token before the malign FOUND token, so a reply carrying both (a coalesced or stale-then-fresh reply on a reused connection) resolved to clean and delivered an infected message; the classifier now tests FOUND, then ERROR, then OK, so a malign signal always dominates and only an OK with no FOUND/ERROR is clean. Session verification under a strict maxAnomalyScore device-binding policy admitted a relocated device whenever no decisive anomaly score could be produced (no scorer supplied, or a scorer that threw or returned a non-finite value) -- it now fails closed, matching the unreadable-binding discipline. The ICU-style MessageFormat select renderer looked up an end-user-supplied select value with a bare object index, so a value naming an Object.prototype member (__proto__ / constructor / toString) returned an inherited member and either rendered garbage or threw a render-time DoS; every case lookup is now own-property only. And the webhook verifier accepted any string that Number() maps to the signed timestamp (scientific, trailing .0, hex, leading zero/plus), making the authenticated t= field malleable; it now requires the canonical decimal. **Fixed:** *b.webhook verifier rejects a non-canonical authenticated timestamp* — The verifier parsed the authenticated t= field with Number() and validated only the post-coercion integer, then re-composed the signed string from that integer -- so any string Number() maps to the same value (scientific 1.7e9, a trailing .0, hex 0x..., a leading zero/plus/whitespace) re-canonicalized into the identical signed string and verified, making the authenticated timestamp field malleable. The verifier now also requires the raw bytes to equal the canonical decimal the signer emits, the same strict digits-only parse the Stripe-compatible verifier already applied; the only legitimate producer (b.webhook.signer) emits the canonical form, so there is no interop cost. · *b.i18n.dir honors a custom RTL language configured in any case* — dir() folds the requested locale's primary subtag to lower case before the RTL-membership test, but a custom rtlLanguages list was stored verbatim, so an operator-supplied entry like "AR" or "CKB" never matched the lower-cased lookup and the language rendered left-to-right. The configured list is now folded to lower case the same way the lookup is, so a custom RTL entry matches regardless of case. · *b.i18n.t resolves a leaf shadowed by a namespace in a more-specific locale* — The fallback-chain lookup returned the first locale where the dotted key resolved to any non-undefined value, including a nested namespace object -- so a namespace at that path in the requested locale halted the chain and shadowed a real translation leaf defined in a fallback locale, leaking the raw key into the UI (and has() reported false). The lookup now treats only a renderable leaf (a string or a plural-shaped object) as a hit and keeps walking the chain past a namespace object, so a leaf in a fallback locale resolves. **Security:** *b.mail.scan fails closed on a coalesced infected+clean ClamAV reply* — The ClamAV INSTREAM reply classifier tested the benign `stream: OK` token before the malign `... FOUND` token, so a reply that carried both -- a coalesced or stale-then-fresh reply on a reused connection, or an intermediary that concatenates two responses -- resolved to a clean verdict and delivered an infected message (a scan bypass). The classifier is a security verdict, so it now tests FOUND (infected) first, then ERROR (do-not-deliver), then OK (clean); an unrecognized shape is still an error. A reply containing a FOUND signal can no longer be downgraded to clean by an adjacent OK token. · *b.session.verify fails closed under a strict anomaly threshold when the score can't be computed* — Under the strict maxAnomalyScore device-binding policy, verify() only assigned a fingerprint anomaly score when the supplied scorer returned a finite number. With no scorer (the option is documented as pairing with one but is omittable), or a scorer that threw or returned a non-finite value, the score stayed null and the refusal guard (score present AND above threshold) was false, so verify RETURNED a session bound to one device when presented from another. An uncomputable anomaly score on genuine fingerprint drift now fails closed (verify returns null), matching the fail-closed discipline the unreadable-binding branch already applied; the legitimate path (a finite score at or below the threshold admits, with the score surfaced) is unchanged. · *b.i18n MessageFormat select renderer guards against prototype-chain keys* — The ICU-style MessageFormat select renderer resolved a case with a bare object index on an end-user-supplied select value, so a value naming an Object.prototype member -- __proto__ / constructor / toString / hasOwnProperty / valueOf -- returned a truthy INHERITED member, bypassing the `other` fallback: an inherited value with no length rendered as empty (silent output corruption), and an inherited function threw when rendered as a non-array (a request-level DoS). Every select/plural case lookup is now own-property only, so an attacker-supplied select value that names a prototype member falls through to the `other` case. **Detectors:** *MessageFormat case lookups must be own-property* — A structural check asserts that the MessageFormat renderer resolves a select/plural case through the own-property helper rather than a bare object index, so an end-user-supplied select value can never reach the prototype chain and re-open the corruption/DoS class.

package/lib/audit.js

@@ -218,6 +218,45 @@ async function _insertCheckpoint(values) {
   );
 }
 
+// A concurrent anchor of the SAME tip loses the race to INSERT the
+// atMonotonicCounter (UNIQUE): two anchors of one tip sign the identical
+// payload, so the collision means the counter is ALREADY anchored, not a
+// corruption. Recognize it BACKEND-AGNOSTICALLY so the loser returns null like
+// the skipIfUnchanged "already anchored" path instead of throwing. Each driver
+// surfaces the violation differently: SQLite names the column in the message
+// (`... audit_checkpoints.atMonotonicCounter`); Postgres carries the unique
+// INDEX name (idx_chkpt_counter) in `constraint`/`detail` with SQLSTATE 23505;
+// MySQL reports the key name in `sqlMessage` with errno 1062. Gather every such
+// field, and require BOTH a reference to the counter column OR its unique index
+// AND a uniqueness signal, so no unrelated error is ever swallowed (anything
+// unrecognized rethrows — fail-closed).
+// Tokens that name the counter column (sqlite) or its unique index (pg/mysql).
+var _DUP_COUNTER_REFS = ["atmonotoniccounter", "chkpt_counter"];
+// A uniqueness-violation signal on any backend: sqlite message/code, postgres
+// text/SQLSTATE 23505, mysql text/code-name/errno 1062.
+var _DUP_UNIQUE_SIGNALS = [
+  "unique constraint failed", "sqlite_constraint", "duplicate key",
+  "23505", "duplicate entry", "er_dup_entry", "1062",
+];
+function _errorTextContainsAny(text, needles) {
+  for (var i = 0; i < needles.length; i++) {
+    if (text.indexOf(needles[i]) !== -1) return true;
+  }
+  return false;
+}
+function _isDuplicateCheckpointCounter(e) {
+  if (!e) return false;
+  var parts = [e.message, e.detail, e.constraint, e.sqlMessage, e.table, e.code, e.errno];
+  var text = "";
+  for (var i = 0; i < parts.length; i++) {
+    if (parts[i] != null) text += " " + String(parts[i]);
+  }
+  if (typeof e.toString === "function") text += " " + e.toString();
+  text = text.toLowerCase();
+  return _errorTextContainsAny(text, _DUP_COUNTER_REFS) &&
+         _errorTextContainsAny(text, _DUP_UNIQUE_SIGNALS);
+}
+
 async function _upsertAuditTip(counter, rowHash, signedAt, fencingToken) {
   // Cluster-mode only. Single atomic INSERT … ON CONFLICT … DO UPDATE
   // … WHERE … RETURNING. The WHERE clause is the canonical
@@ -1001,9 +1040,30 @@ async function checkpoint(opts) {
 
   var ckptId = generateToken(TRACE_ID_BYTES);
   var fencingToken = cluster.fencingToken();
-  await _insertCheckpoint(
-    [ckptId, createdAt, counter, tip.rowHash, signature, pubFp, fencingToken]
-  );
+  try {
+    await _insertCheckpoint(
+      [ckptId, createdAt, counter, tip.rowHash, signature, pubFp, fencingToken]
+    );
+  } catch (e) {
+    // Lost the INSERT race to another anchor of this same tip counter: the
+    // counter is already anchored (both anchors sign the identical payload).
+    // In SINGLE-NODE mode that is purely idempotent — return null like the
+    // skipIfUnchanged "already anchored" path and let the winner own the
+    // sidecar write below. In CLUSTER mode the duplicate can instead mean a
+    // NEWER LEADER anchored this tip while we still hold an OLDER fencingToken,
+    // so we must NOT silently swallow it: run the audit-tip fence first, whose
+    // fencing-token WHERE guard throws FENCED_OUT when a higher token has been
+    // stored — surfacing the leadership-loss step-down instead of a benign
+    // null. If the fence passes (a same-node concurrent race), it is idempotent.
+    // Any non-duplicate error rethrows.
+    if (_isDuplicateCheckpointCounter(e)) {
+      if (cluster.isClusterMode()) {
+        await _upsertAuditTip(counter, tip.rowHash, String(createdAt), fencingToken);
+      }
+      return null;
+    }
+    throw e;
+  }
 
   // Update rollback-detection sidecar (single-node) or audit-tip row
   // (cluster mode).
@@ -1919,4 +1979,5 @@ module.exports = {
   CHECKPOINT_FORMAT:    CHECKPOINT_FORMAT,
   FRAMEWORK_NAMESPACES: FRAMEWORK_NAMESPACES,
   _resetForTest:        _resetForTest,
+  _isDuplicateCheckpointCounter: _isDuplicateCheckpointCounter,   // test seam: cross-backend dup-counter recognition
 };

package/lib/auth/openid-federation.js

@@ -59,6 +59,7 @@
 var lazyRequire  = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 var safeJson     = require("../safe-json");
+var pick         = require("../pick");
 var nodeCrypto   = require("node:crypto");
 var bCrypto      = require("../crypto");
 var C            = require("../constants");
@@ -240,11 +241,151 @@ function verifyEntityStatement(jwt, jwks, vopts) {
   return parsed.claims;
 }
 
+// ---- Metadata-policy set-ops + cross-level merge (OIDF 1.0 section 6.1.5) ----
+
+// Union of two arrays (dedupe, first-seen order). The single array set-op the
+// `add` / `superset_of` operators and the cross-level merge both compose,
+// rather than hand-rolling the shape per call site.
+function _arrayUnion(a, b) {
+  var out = Array.isArray(a) ? a.slice() : [];
+  if (Array.isArray(b)) {
+    b.forEach(function (v) { if (out.indexOf(v) === -1) out.push(v); });
+  }
+  return out;
+}
+
+// Intersection of two arrays (values in both, a's order). The narrowing op the
+// merge uses for `one_of` / `subset_of`: a subordinate can only narrow.
+function _arrayIntersect(a, b) {
+  if (!Array.isArray(a) || !Array.isArray(b)) return [];
+  return a.filter(function (v) { return b.indexOf(v) !== -1; });
+}
+
+// a is a subset of b: every element of `a` is present in `b`. The set-op the
+// OIDF 1.0 section 6.1.3 combination-consistency rules compose (add within
+// subset_of, default within subset_of, superset_of within subset_of, ...).
+function _arraySubset(a, b) {
+  if (!Array.isArray(a) || !Array.isArray(b)) return false;
+  return a.every(function (v) { return b.indexOf(v) !== -1; });
+}
+
+// View a metadata value as an array for the array policy operators. OAuth
+// `scope` (and similar parameters) is a space-delimited string that OIDF 1.0
+// section 6.1.3.1.8 processes as a string array, so a string is split on
+// whitespace; an array is returned as-is; anything else yields null (the
+// caller decides whether an absent / malformed value is a violation).
+function _coerceOperandArray(val) {
+  if (Array.isArray(val)) return val;
+  if (typeof val === "string") return val.split(/\s+/).filter(Boolean);
+  return null;
+}
+
+// OIDF 1.0 section 6.1.3 fixed operator processing order: the value-MODIFICATION
+// operators (value, add, default) run first to produce the value, then the
+// value-CHECK operators (one_of, subset_of, superset_of, essential) validate it.
+var _OP_ORDER = ["value", "add", "default", "one_of", "subset_of", "superset_of", "essential"];
+
+// Validate a merged claim's operator set for the two cross-level cases the
+// fixed-order apply step cannot catch on its own. The apply step already runs
+// every merged CHECK operator (one_of / subset_of / superset_of / essential)
+// against the FINAL value the MODIFIER operators (value / add / default)
+// produced -- coercing a space-delimited scope string to an array -- so a
+// value, add, or default inconsistent with a co-present constraint is refused
+// there against the merged (most-restrictive) constraint. This adds only what
+// apply cannot see:
+//   (1) `value` + `add` where `add` would WIDEN the exact pin -- the union
+//       escapes `value`, and with no constraint operator present the apply step
+//       has nothing to reject it. `add` already within `value` is a no-op,
+//       allowed (OIDF 1.0 section 6.1.3.1.1).
+//   (2) a `one_of` whose cross-level intersection is EMPTY -- no value can ever
+//       satisfy the chain, a policy error per section 6.1.3.1.4 rather than a
+//       silent accept-when-absent.
+// Same-operator value/default equality is checked during the merge itself.
+function _assertPolicyCombination(claim, acc) {
+  function has(op) { return Object.prototype.hasOwnProperty.call(acc, op); }
+  function conflict(why) {
+    throw new AuthError("auth-openid-federation/policy-merge-conflict",
+      "metadata_policy['" + claim + "']: " + why +
+      " (a subordinate cannot widen a superior's constraint)");
+  }
+  if (has("value") && has("add")) {
+    var pinned = _coerceOperandArray(acc.value) || [acc.value];
+    if (!_arraySubset(acc.add, pinned)) {
+      conflict("`add` would widen the pinned `value`");
+    }
+  }
+  if (has("one_of") && acc.one_of.length === 0) {
+    conflict("`one_of` values are disjoint across the chain (no allowed value remains)");
+  }
+}
+
+// Combine the metadata_policy blocks from EVERY chain level into ONE policy per
+// OIDF 1.0 section 6.1.5.3, so a subordinate can only NARROW a superior's
+// constraint, never override it, and the combined policy is applied ONCE. Two
+// levels pinning a DIFFERENT `value` (or `default`) is a cross-level conflict
+// that makes the chain invalid and throws -- the pre-merge sequential apply let
+// a leaf-ward `value` silently OVERWRITE the anchor's pinned value, a trust
+// downgrade (e.g. token_endpoint_auth_method private_key_jwt -> none) the anchor
+// forbade. `blocks` are ordered superior-first (anchor policy first).
+function _mergeMetadataPolicies(blocks) {
+  var merged = Object.create(null);
+  blocks.forEach(function (block) {
+    Object.keys(block).forEach(function (claim) {
+      if (pick.isPoisonedKey(claim)) {
+        throw new AuthError("auth-openid-federation/poisoned-policy-key",
+          "metadata_policy claim name \"" + claim + "\" is a prototype-pollution vector");
+      }
+      var rules = block[claim];
+      if (!rules || typeof rules !== "object") {
+        throw new AuthError("auth-openid-federation/bad-policy-rules",
+          "metadata_policy['" + claim + "'] must be an object");
+      }
+      var acc = merged[claim] || (merged[claim] = {});
+      Object.keys(rules).forEach(function (op) {
+        var v = rules[op];
+        if (op === "value" || op === "default") {
+          if (Object.prototype.hasOwnProperty.call(acc, op) &&
+              JSON.stringify(acc[op]) !== JSON.stringify(v)) {
+            throw new AuthError("auth-openid-federation/policy-merge-conflict",
+              "metadata_policy['" + claim + "']." + op + " conflicts across the chain (" +
+              JSON.stringify(acc[op]) + " vs " + JSON.stringify(v) +
+              "): a subordinate cannot override a superior's pinned " + op);
+          }
+          acc[op] = v;
+        } else if (op === "add" || op === "superset_of") {
+          if (!Array.isArray(v)) {
+            throw new AuthError("auth-openid-federation/bad-policy-" + (op === "add" ? "add" : "superset-of"),
+              "metadata_policy['" + claim + "']." + op + " requires an array");
+          }
+          acc[op] = _arrayUnion(acc[op], v);
+        } else if (op === "one_of" || op === "subset_of") {
+          if (!Array.isArray(v)) {
+            throw new AuthError("auth-openid-federation/bad-policy-" + (op === "one_of" ? "one-of" : "subset-of"),
+              "metadata_policy['" + claim + "']." + op + " requires an array");
+          }
+          acc[op] = Object.prototype.hasOwnProperty.call(acc, op) ? _arrayIntersect(acc[op], v) : v.slice();
+        } else if (op === "essential") {
+          acc[op] = acc[op] === true || v === true;
+        } else {
+          throw new AuthError("auth-openid-federation/unknown-policy-op",
+            "metadata_policy['" + claim + "'] unknown operator \"" + op + "\"");
+        }
+      });
+    });
+  });
+  Object.keys(merged).forEach(function (claim) { _assertPolicyCombination(claim, merged[claim]); });
+  return merged;
+}
+
 /**
- * Apply a single metadata_policy block to a metadata object and
- * return the resulting object. Pure — never mutates input.
+ * Apply an already-merged metadata_policy block to a metadata object and
+ * return the resulting object. Pure — never mutates input. Operators are
+ * applied in the OIDF 1.0 §6.1.3 fixed order (value, add, default, one_of,
+ * subset_of, superset_of, essential) so the value-CHECK operators validate the
+ * value the value-MODIFICATION operators produced; the combined policy's
+ * operator combination was validated during the merge (_assertPolicyCombination).
  *
- * Operators per OIDF §6.2.1:
+ * Operators per OIDF 1.0 §6.1.3:
  *   value      — set claim to a fixed value (overrides subordinate)
  *   add        — array claim: append values not already present
  *   default    — provide a default if the claim is absent
@@ -254,14 +395,34 @@ function verifyEntityStatement(jwt, jwks, vopts) {
  *   essential  — claim must be present (else throw)
  */
 function _applyOnePolicy(metadata, policy) {
-  var out = Object.assign({}, metadata);
+  // Build the working copy from own, non-prototype-polluting keys only -- a
+  // metadata object carrying a "__proto__" / "constructor" / "prototype" own
+  // key (e.g. from JSON.parse) would otherwise set out's prototype via
+  // assignment; the merged policy's claim names are already poison-guarded.
+  var out = {};
+  Object.keys(metadata).forEach(function (mk) {
+    if (!pick.isPoisonedKey(mk)) out[mk] = metadata[mk];
+  });
   Object.keys(policy).forEach(function (claimName) {
+    if (pick.isPoisonedKey(claimName)) return;
     var rules = policy[claimName];
     if (!rules || typeof rules !== "object") {
       throw new AuthError("auth-openid-federation/bad-policy-rules",
         "metadata_policy['" + claimName + "'] must be an object");
     }
+    // Apply operators in the OIDF 1.0 section 6.1.3 fixed order so the
+    // value-CHECK operators (one_of/subset_of/superset_of/essential) validate
+    // the value AFTER the value-MODIFICATION operators (value/add/default) have
+    // produced it -- Object.keys order let a check run before the value it must
+    // guard was set. Any operator outside the fixed set is refused first.
     Object.keys(rules).forEach(function (op) {
+      if (_OP_ORDER.indexOf(op) === -1) {
+        throw new AuthError("auth-openid-federation/unknown-policy-op",
+          "metadata_policy['" + claimName + "'] unknown operator \"" + op + "\"");
+      }
+    });
+    _OP_ORDER.forEach(function (op) {
+      if (!Object.prototype.hasOwnProperty.call(rules, op)) return;
       var v = rules[op];
       switch (op) {
         case "value":
@@ -275,8 +436,8 @@ function _applyOnePolicy(metadata, policy) {
             throw new AuthError("auth-openid-federation/bad-policy-add",
               "metadata_policy['" + claimName + "'].add requires an array");
           }
-          if (!Array.isArray(out[claimName])) out[claimName] = [];
-          v.forEach(function (val) { if (out[claimName].indexOf(val) === -1) out[claimName].push(val); });
+          var _addResult = _arrayUnion(_coerceOperandArray(out[claimName]) || [], v);
+          out[claimName] = typeof out[claimName] === "string" ? _addResult.join(" ") : _addResult;
           break;
         case "one_of":
           if (!Array.isArray(v)) {
@@ -294,8 +455,14 @@ function _applyOnePolicy(metadata, policy) {
             throw new AuthError("auth-openid-federation/bad-policy-subset-of",
               "metadata_policy['" + claimName + "'].subset_of requires an array");
           }
-          if (Array.isArray(out[claimName])) {
-            out[claimName].forEach(function (val) {
+          if (out[claimName] !== undefined && out[claimName] !== null) {
+            var _subArr = _coerceOperandArray(out[claimName]);
+            if (_subArr === null) {
+              throw new AuthError("auth-openid-federation/policy-subset-of-failed",
+                "metadata_policy['" + claimName + "']: value " + JSON.stringify(out[claimName]) +
+                " is neither an array nor a space-delimited string; subset_of constrains an array-valued claim");
+            }
+            _subArr.forEach(function (val) {
               if (v.indexOf(val) === -1) {
                 throw new AuthError("auth-openid-federation/policy-subset-of-failed",
                   "metadata_policy['" + claimName + "']: value \"" + JSON.stringify(val) +
@@ -309,8 +476,9 @@ function _applyOnePolicy(metadata, policy) {
             throw new AuthError("auth-openid-federation/bad-policy-superset-of",
               "metadata_policy['" + claimName + "'].superset_of requires an array");
           }
+          var _supArr = _coerceOperandArray(out[claimName]) || [];
           v.forEach(function (req) {
-            if (!Array.isArray(out[claimName]) || out[claimName].indexOf(req) === -1) {
+            if (_supArr.indexOf(req) === -1) {
               throw new AuthError("auth-openid-federation/policy-superset-of-failed",
                 "metadata_policy['" + claimName + "']: missing required value \"" + req + "\"");
             }
@@ -350,9 +518,11 @@ function _applyOnePolicy(metadata, policy) {
  * own self-config metadata_policy is therefore ignored.
  *
  * The chain is leaf-first; each `chain[i].subordinate` is the statement
- * signed by the superior directly above entity `i`, so walking high
- * index → low index applies the anchor's policy first, then each
- * intermediate's, narrowing down to the leaf (§6.2 narrow-only merge).
+ * signed by the superior directly above entity `i`; every level's policy
+ * is merged into ONE combined policy so a subordinate can only NARROW a
+ * superior's constraint (a leaf-ward level pinning a different
+ * value/default refuses the chain as a trust downgrade), then applied
+ * once (OIDF 1.0 §6.1.5.3).
  *
  * @example
  *   var effective = b.auth.openidFederation.applyMetadataPolicy(
@@ -371,21 +541,27 @@ function applyMetadataPolicy(metadata, chain, kind) {
     throw new AuthError("auth-openid-federation/bad-chain",
       "applyMetadataPolicy: chain must be an array");
   }
-  var out = Object.assign({}, metadata);
-  // Walk top-down (anchor last in leaf-first array). Read the policy
-  // from each node's SUPERIOR-SIGNED subordinate statement — never from
-  // the entity's own self-config — so the anchor/intermediate
-  // constraints can't be dropped by a self-declared policy. The anchor
-  // node carries no `.subordinate` (it terminates the chain) and is
-  // skipped; the leaf's self-config policy is never read.
+  Object.keys(metadata).forEach(function (mk) {
+    if (pick.isPoisonedKey(mk)) {
+      throw new AuthError("auth-openid-federation/poisoned-metadata-key",
+        "applyMetadataPolicy: metadata key \"" + mk + "\" is a prototype-pollution vector");
+    }
+  });
+  // Gather each SUPERIOR-SIGNED subordinate statement's policy for this kind,
+  // superior-first (anchor policy first; the anchor node terminates the chain
+  // with no .subordinate, and the leaf's own self-config policy is never read),
+  // then MERGE every level into ONE combined policy so a subordinate can only
+  // NARROW a superior's constraint (OIDF 1.0 section 6.1.5.3) -- a leaf-ward
+  // level pinning a different value/default is a conflict that refuses the
+  // chain -- and apply the merged policy ONCE.
+  var blocks = [];
   for (var i = chain.length - 1; i >= 0; i--) {
     var stmt = chain[i];
     if (!stmt || !stmt.subordinate) continue;
-    if (stmt.subordinate.metadata_policy && stmt.subordinate.metadata_policy[kind]) {
-      out = _applyOnePolicy(out, stmt.subordinate.metadata_policy[kind]);
-    }
+    var mp = stmt.subordinate.metadata_policy;
+    if (mp && mp[kind]) blocks.push(mp[kind]);
   }
-  return out;
+  return _applyOnePolicy(Object.assign({}, metadata), _mergeMetadataPolicies(blocks));
 }
 
 async function _defaultFetcher(url) {
@@ -593,6 +769,21 @@ async function buildTrustChain(opts) {
     // The subordinate statement pins this entity's jwks — adopt the
     // attested keys for the next link down, and reflect them on the node.
     if (node.subordinate.jwks && Array.isArray(node.subordinate.jwks.keys)) {
+      // Bind the entity's OWN self-configuration to the superior-attested
+      // keys. resolveLeaf reads the effective metadata from the entity's
+      // self-config (chain[i].claims.metadata), and Phase 1 verified that
+      // config only against its OWN self-published jwks — which proves the
+      // document isn't garbled, NOT that a federation-attested key signed
+      // it. An attacker who controls the entity's .well-known endpoint (but
+      // not its attested signing key) can serve a self-signed config that
+      // carries forged metadata + attacker jwks and sails through the Phase 1
+      // self-verify; without this check the pinned keys never gate the very
+      // document whose metadata is trusted. Re-verify the config against the
+      // pinned keys so a config not signed by an attested key fails the whole
+      // chain (OIDF 1.0 §9 — the leaf/intermediate Entity Configuration is
+      // verified with the jwks pinned by its superior's Subordinate
+      // Statement, never with the config's self-declared jwks).
+      verifyEntityStatement(node.jwt, node.subordinate.jwks);
       node.claims.jwks = node.subordinate.jwks;
       attestedJwks = node.subordinate.jwks;
     } else {

package/lib/cose.js

@@ -112,21 +112,36 @@ function _algParamsFor(algId) {
   }
 }
 
-// RFC 9053 §2 binds each ECDSA alg to ONE curve. node:crypto will happily
-// verify a sha512 (ES512-shape) signature against a P-256 key as
-// self-consistent, so without this check a COSE_Sign1 declaring ES512 but
-// carrying a P-256 key passes when ES512 is allowlisted — an alg/curve
-// confusion (the COSE sibling of jwt-external._assertAlgKtyMatch). EdDSA /
-// ML-DSA carry their parameters in the KeyObject and need no binding.
+// RFC 9053 §2 binds each COSE signature alg to ONE key shape. node:crypto
+// dispatches sign()/verify() on the KEY, never on the declared COSE alg —
+// for ECDSA it will happily verify a sha512 (ES512-shape) signature against
+// a P-256 key as self-consistent, and for the null-digest algorithms
+// (EdDSA, ML-DSA-87) it selects the primitive purely from the key type.
+// Without an alg→key binding a COSE_Sign1 declaring one algorithm but
+// carrying/using another key type verifies — an alg/key confusion (the COSE
+// sibling of jwt-external._assertAlgKtyMatch). Two live seams: a COSE_Sign1
+// declaring ES512 but carrying a P-256 key passes when ES512 is allowlisted;
+// and — because EdDSA/ML-DSA-87 both sign with a null digest — an EdDSA
+// signature passes a PQC-only ("ML-DSA-87") allowlist against an Ed25519 key
+// (and the reverse). EdDSA / ML-DSA carry no curve, so they are bound by
+// key TYPE, not curve. Every SIGNABLE alg is bound here.
 var _ES_ALG_CURVE = { ES256: "prime256v1", ES384: "secp384r1", ES512: "secp521r1" };
-function _assertEcAlgCurve(algName, key) {
-  var want = _ES_ALG_CURVE[algName];
-  if (want === undefined) return;                                                       // not an ECDSA alg — nothing to bind
-  var got = (key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve) || null;
-  if (key.asymmetricKeyType !== "ec" || got !== want) {
-    throw new CoseError("cose/alg-curve-mismatch",
-      "cose: alg '" + algName + "' requires an EC key on " + want +
-      ", got " + (key.asymmetricKeyType === "ec" ? got : key.asymmetricKeyType));
+var _ALG_KEY_TYPE = { EdDSA: "ed25519", "ML-DSA-87": "ml-dsa-87" };                    // null-digest algs → required key type
+function _assertAlgKeyMatch(algName, key) {
+  var wantCurve = _ES_ALG_CURVE[algName];
+  if (wantCurve !== undefined) {
+    var got = (key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve) || null;
+    if (!key || key.asymmetricKeyType !== "ec" || got !== wantCurve) {
+      throw new CoseError("cose/alg-curve-mismatch",
+        "cose: alg '" + algName + "' requires an EC key on " + wantCurve +
+        ", got " + (key && key.asymmetricKeyType === "ec" ? got : (key && key.asymmetricKeyType)));
+    }
+    return;
+  }
+  var wantType = _ALG_KEY_TYPE[algName];
+  if (wantType !== undefined && (!key || key.asymmetricKeyType !== wantType)) {
+    throw new CoseError("cose/alg-key-mismatch",
+      "cose: alg '" + algName + "' requires a " + wantType + " key, got " + (key && key.asymmetricKeyType));
   }
 }
 
@@ -189,7 +204,7 @@ async function sign(payload, opts) {
   var algId = ALG_NAME_TO_ID[opts.alg];
   var params = _algParamsFor(algId);
   var key = _toKeyObject(opts.privateKey, "private");
-  _assertEcAlgCurve(opts.alg, key);                                                      // RFC 9053 alg↔curve binding — refuse e.g. ES512 over a P-256 key
+  _assertAlgKeyMatch(opts.alg, key);                                                     // RFC 9053 alg↔key binding — refuse e.g. ES512 over a P-256 key, or EdDSA over an ML-DSA key
 
   var protMap = new Map();
   protMap.set(HDR_ALG, algId);
@@ -373,7 +388,7 @@ async function verify(coseSign1, opts) {
   var key = opts.publicKey
     ? _toKeyObject(opts.publicKey, "public")
     : _toKeyObject(opts.keyResolver(protMap, unprotected), "public");
-  _assertEcAlgCurve(algName, key);                                                      // RFC 9053 alg↔curve binding
+  _assertAlgKeyMatch(algName, key);                                                     // RFC 9053 alg↔key binding — refuse alg/key-type confusion (EdDSA vs ML-DSA-87, ES* vs wrong curve)
 
   var externalAad = opts.externalAad == null ? Buffer.alloc(0) : _bstr(opts.externalAad);
   var toBeSigned = _toBeSigned(protectedBstr, externalAad, payload);

package/lib/mail-crypto-pgp.js

@@ -456,7 +456,12 @@ function sign(opts) {
     hashAlg = HASH_ALG_SHA512;
     var rawPub = _extractEd25519PublicRaw(publicKey);
     publicPacketBody = _ed25519PublicPacketBody(rawPub, creationTime);
-  } else if (keyType === "rsa" || keyType === "rsa-pss") {
+  } else if (keyType === "rsa") {
+    // Only rsaEncryption (keyType "rsa") keys sign here. An id-RSASSA-PSS
+    // key (keyType "rsa-pss") is padding-restricted to PSS by OpenSSL and
+    // cannot express the PKCS#1-v1.5 signature this module emits, so it is
+    // refused with a typed error below rather than crashing on the JWK
+    // export path (which refuses rsa-pss keys).
     pubAlg  = PUB_ALG_RSA;
     hashAlg = HASH_ALG_SHA256;
     var rsaPub = _extractRsaPublicComponents(publicKey);
@@ -811,7 +816,12 @@ function verify(opts) {
     "publicKeyPem could not be parsed: " + ((e && e.message) || String(e))); }
 
   var keyType = publicKey.asymmetricKeyType;
-  if (parsed.pubAlg === PUB_ALG_RSA && !(keyType === "rsa" || keyType === "rsa-pss")) {
+  // Only rsaEncryption (keyType "rsa") keys verify a PKCS#1-v1.5 signature.
+  // An id-RSASSA-PSS key (keyType "rsa-pss") is PSS-padding-restricted and
+  // cannot JWK-export for component extraction; treat it as a key/algorithm
+  // mismatch and return a typed verdict rather than letting the extraction
+  // throw a raw Error out of verify().
+  if (parsed.pubAlg === PUB_ALG_RSA && keyType !== "rsa") {
     return _fail("mail-crypto/pgp/key-alg-mismatch",
       "signature claims RSA but provided key is " + keyType);
   }
@@ -1028,6 +1038,18 @@ function experimentalEncrypt(opts) {
   return { armored: armored, envelope: envelope };
 }
 
+// Envelope length fields (recipientId / KEM-ciphertext / wrapped-key /
+// body lengths) are attacker-controlled: every multi-byte read and every
+// slice below must confirm the bytes exist before advancing `off`, or a
+// truncated envelope escapes as a raw RangeError instead of the typed
+// refusal decrypt() promises. Fail closed with mail-crypto/pgp/truncated.
+function _envNeed(buf, off, n) {
+  if (off + n > buf.length) {
+    throw new MailCryptoError("mail-crypto/pgp/truncated",
+      "decrypt: envelope truncated (need " + n + " byte(s) at offset " + off + ")");
+  }
+}
+
 function experimentalDecrypt(opts) {
   opts = validateOpts.requireObject(opts, "mail.crypto.pgp.experimental.decrypt",
     MailCryptoError, "mail-crypto/pgp/bad-opts");
@@ -1064,15 +1086,17 @@ function experimentalDecrypt(opts) {
   var nRecips = envelope[off]; off += 1;
   var matchedSessionKey = null;
   for (var i = 0; i < nRecips; i += 1) {
-    if (off >= envelope.length) {
-      throw new MailCryptoError("mail-crypto/pgp/truncated",
-        "decrypt: envelope truncated at recipient " + i);
-    }
+    _envNeed(envelope, off, 1);
     var ridLen = envelope[off]; off += 1;
+    _envNeed(envelope, off, ridLen);
     var rid = envelope.slice(off, off + ridLen); off += ridLen;
+    _envNeed(envelope, off, 2);
     var ctLen = envelope.readUInt16BE(off); off += 2;                                                 // u16-be width
+    _envNeed(envelope, off, ctLen);
     var ct = envelope.slice(off, off + ctLen); off += ctLen;
+    _envNeed(envelope, off, 2);
     var wkLen = envelope.readUInt16BE(off); off += 2;                                                 // u16-be width
+    _envNeed(envelope, off, wkLen);
     var wrappedKey = envelope.slice(off, off + wkLen); off += wkLen;
     if (matchedSessionKey) continue;
     if (!rid.equals(opts.recipientId)) continue;
@@ -1096,7 +1120,9 @@ function experimentalDecrypt(opts) {
     throw new MailCryptoError("mail-crypto/pgp/no-matching-recipient",
       "decrypt: no recipient in envelope matches opts.recipientId");
   }
+  _envNeed(envelope, off, 4);
   var bodyLen = envelope.readUInt32BE(off); off += 4;                                                 // u32-be width
+  _envNeed(envelope, off, bodyLen);
   var body = envelope.slice(off, off + bodyLen);
   var plaintext;
   try { plaintext = bCrypto.decryptPacked(body, matchedSessionKey); }

package/lib/vc.js

@@ -151,11 +151,41 @@ function _validateVcdm(cred, opts) {
   }
 }
 
+// XSD dateTime (VCDM 2.0 section 4.9): [-]CCYY-MM-DDThh:mm:ss with an optional
+// fractional second and an optional timezone (Z or +/-hh:mm). Date.parse alone
+// is far too lenient in TWO ways: it accepts non-XSD shapes (a bare year, a
+// slash date, a date with no time, locale forms), AND for an in-shape but
+// IMPOSSIBLE calendar date it NORMALIZES rather than rejects (2024-02-31 ->
+// 2024-03-02, a non-leap 2023-02-29 -> 2023-03-01, 2024-04-31 -> 2024-05-01),
+// silently shifting the validity window. So the shape is asserted with a
+// capturing regex AND the calendar fields are range-checked (month 1..12, day
+// within the real length of that month, leap years honoured) BEFORE Date.parse.
+var _XSD_DATETIME = /^(-?\d{4,})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})?$/;
+
+function _daysInMonth(year, month) {
+  if (month === 2) {
+    var leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+    return leap ? 29 : 28;
+  }
+  return (month === 4 || month === 6 || month === 9 || month === 11) ? 30 : 31;
+}
+
 function _parseValidityField(cred, name) {
   if (cred[name] === undefined) return null;
-  if (typeof cred[name] !== "string") {
+  var m = typeof cred[name] === "string" ? _XSD_DATETIME.exec(cred[name]) : null;
+  if (!m) {
     throw new VcError("vc/bad-validity", "vc: " + name + " must be an XSD dateTime string");
   }
+  var year = Number(m[1]), month = Number(m[2]), day = Number(m[3]);
+  // Reject an in-shape but impossible calendar DATE before Date.parse can
+  // normalize a day overflow into a different valid instant (2024-02-31 ->
+  // 2024-03-02, a non-leap 2023-02-29 -> 2023-03-01). Time-field overflow
+  // (hour/minute/second) is already rejected by Date.parse below (NaN), and
+  // 24:00:00 is the valid XSD end-of-day, so only the day-of-month needs a guard.
+  if (month < 1 || month > 12 || day < 1 || day > _daysInMonth(year, month)) {
+    throw new VcError("vc/bad-validity",
+      "vc: " + name + " is not a real calendar date: " + cred[name]);
+  }
   var ms = Date.parse(cred[name]);
   if (!isFinite(ms)) {
     throw new VcError("vc/bad-validity", "vc: " + name + " is not a valid dateTime: " + cred[name]);
@@ -287,9 +317,18 @@ async function _verifyCose(bytes, opts, expectedTyp) {
     publicKey:   opts.publicKey,
     keyResolver: opts.keyResolver,
   });
+  // The typ header (RFC 9596 label 16) binds the COSE_Sign1 to the
+  // vc+cose / vp+cose media type. The JOSE path MANDATES its typ; the COSE
+  // path must too — an absent typ is not "unspecified, therefore ok" but an
+  // unbound statement that could be a signature made for another purpose
+  // (or the sibling securing form). Require it, symmetric with _verifyJose,
+  // rather than only checking it when present (which let an issuer-signed
+  // but typ-less COSE_Sign1 be accepted under a weaker contract).
   var typ = out.protectedHeaders.get(HDR_COSE_TYP);
-  if (typ !== undefined && typ !== expectedTyp) {
-    throw new VcError("vc/bad-typ", "vc.verify: COSE typ header is '" + typ + "', expected '" + expectedTyp + "'");
+  if (typ !== expectedTyp) {
+    throw new VcError("vc/bad-typ",
+      "vc.verify: COSE typ header is " + (typ === undefined ? "absent" : "'" + typ + "'") +
+      ", expected '" + expectedTyp + "'");
   }
   var payload;
   try { payload = safeJson.parse(out.payload.toString("utf8")); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.21",
+  "version": "0.16.23",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:96b6222d-f898-4aa7-beb8-1b0c830965bd",
+  "serialNumber": "urn:uuid:45b7028c-dc33-4f08-92b5-8735beeb8354",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T14:22:26.336Z",
+    "timestamp": "2026-07-12T22:51:20.079Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.21",
+      "bom-ref": "@blamejs/core@0.16.23",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.21",
+      "version": "0.16.23",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.21",
+      "purl": "pkg:npm/%40blamejs/core@0.16.23",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.21",
+      "ref": "@blamejs/core@0.16.23",
       "dependsOn": []
     }
   ]