fix(relay-auth): close 5 pre-production security findings (F1–F5)

F1 (HIGH): bind step-up freshness to the required method (stepUpMethod) so a
  login-time or weaker (TOTP) factor can no longer satisfy a passkey requirement.
F2 (HIGH): make the step-up gate host-driven and fail-closed on connect+reattach
  (deny when policy.required and the principal is missing/stale/wrong-method).
F3 (MED): bind the WebAuthn assertion to the stored credential (credentialId
  cross-check + forward publicKey/credentialId to the verifier).
F4 (LOW): make verifyDpopProof totally fail-safe (no unhandled throw), wrap the
  authz boundary into a clean audited 401, and validate cnfJkt format at issue.
F5 (LOW): return newSignCount from finishAuthentication so the caller can persist
  the advanced counter (WebAuthn clone detection).

All fixes ship regression tests. relay-auth: 122 tests green, tsc clean.

relay-auth/src/human/stepup/stepup.ts

@@ -14,14 +14,22 @@ import type { AuthMethod, AuthenticatedPrincipal, StepUpPolicy } from '../../typ
 
 export const DEFAULT_STEPUP_MAX_AGE_SECONDS = 300 as const
 
-/** Per-host step-up freshness requirement (default: recent passkey step-up). */
+/** Per-host step-up freshness requirement (default: recent passkey step-up REQUIRED). */
 export function policyForHost(_host: HostRecord): StepUpPolicy {
-  return { maxAgeSeconds: DEFAULT_STEPUP_MAX_AGE_SECONDS, requiredMethod: 'passkey' }
+  return { required: true, maxAgeSeconds: DEFAULT_STEPUP_MAX_AGE_SECONDS, requiredMethod: 'passkey' }
+}
+
+/** v0.9 "never required" default: step-up gate is off (used until per-host tiers exist). */
+export const NO_STEPUP_POLICY: StepUpPolicy = {
+  required: false,
+  maxAgeSeconds: DEFAULT_STEPUP_MAX_AGE_SECONDS,
+  requiredMethod: 'passkey',
 }
 
 /**
- * true when step-up is required: never stepped up, OR the last step-up is stale, OR the required
- * method is not present in `amr` — i.e. a fresh login alone does NOT satisfy it.
+ * true when step-up is required: never stepped up, OR the last step-up is stale, OR the LAST step-up
+ * was not performed with the required method (method-binding, F1) — i.e. neither a fresh login nor a
+ * weaker (e.g. TOTP) step-up satisfies a passkey requirement.
  */
 export function needsStepUp(
   principal: AuthenticatedPrincipal,
@@ -30,16 +38,19 @@ export function needsStepUp(
 ): boolean {
   if (principal.stepUpAt === null) return true
   if (now - principal.stepUpAt > policy.maxAgeSeconds) return true
-  if (!principal.amr.includes(policy.requiredMethod)) return true
+  if ((principal.stepUpMethod ?? null) !== policy.requiredMethod) return true
   return false
 }
 
-/** Returns a NEW principal with `stepUpAt = now` and `method` added to `amr` (immutable). */
+/**
+ * Returns a NEW principal recording a fresh step-up: `stepUpAt = now`, `stepUpMethod = method`, and
+ * `method` appended to `amr` (audit trail). Immutable — the original is untouched.
+ */
 export function recordStepUp(
   principal: AuthenticatedPrincipal,
   method: AuthMethod,
   now: number,
 ): AuthenticatedPrincipal {
   const amr = principal.amr.includes(method) ? principal.amr : [...principal.amr, method]
-  return { ...principal, amr, stepUpAt: now }
+  return { ...principal, amr, stepUpAt: now, stepUpMethod: method }
 }

relay-auth/src/human/webauthn/authenticate.ts

@@ -32,16 +32,19 @@ export async function finishAuthentication(
   origin: string,
   verifier: WebAuthnVerifier,
   now: number,
-): Promise<AuthenticatedPrincipal> {
+): Promise<{ principal: AuthenticatedPrincipal; newSignCount: number }> {
   if (resp.clientChallenge !== expectedChallenge) throw new WebAuthnError('challenge mismatch')
   if (resp.origin !== origin) throw new WebAuthnError('origin mismatch')
   if (resp.rpId !== rpId) throw new WebAuthnError('rpId mismatch')
+  if (resp.credentialId !== cred.credentialId) throw new WebAuthnError('credential id mismatch')
 
   const result = await verifier.verifyAuthentication(
     resp,
     expectedChallenge,
     rpId,
     origin,
+    cred.publicKey,
+    cred.credentialId,
     cred.signCount,
   )
   if (!result.verified) throw new WebAuthnError('assertion not verified')
@@ -49,7 +52,7 @@ export async function finishAuthentication(
     throw new WebAuthnError('signCount regression (cloned authenticator)')
   }
 
-  return {
+  const principal: AuthenticatedPrincipal = {
     kind: 'human',
     accountId: cred.accountId,
     principalId: cred.credentialId,
@@ -57,4 +60,5 @@ export async function finishAuthentication(
     authAt: now,
     stepUpAt: null,
   }
+  return { principal, newSignCount: result.newSignCount }
 }

relay-auth/src/human/webauthn/verifier.ts

@@ -28,6 +28,7 @@ export interface AuthenticationResponse {
   readonly clientChallenge: string
   readonly origin: string
   readonly rpId: string
+  readonly credentialId: string
 }
 
 export interface RegistrationVerification {
@@ -54,6 +55,8 @@ export interface WebAuthnVerifier {
     expectedChallenge: string,
     rpId: string,
     origin: string,
+    credentialPublicKey: Uint8Array,
+    expectedCredentialId: string,
     storedSignCount: number,
   ): Promise<AuthenticationVerification>
 }