@adcp/sdk 16.0.0-beta.1 → 16.0.0-beta.2

package/dist/lib/server/create-adcp-server.mjs

@@ -12,10 +12,15 @@ import {
   webBotAuthToolFailure,
   selectSignatureProfile,
   verifyWebBotAuth,
+  isWebBotAuthRevocationChecked,
+  webBotAuthUnavailableResponse,
+  WebBotAuthUnavailableError,
+  deferWebBotAuthPrincipalFailure,
+  webBotAuthPrincipalFailureError,
   WebBotAuthError
 } from "../signing/web-bot-auth.mjs";
 import { validateIdentity33Payload } from "../identity-3.3/validation.mjs";
-import { IdentityAuthorizationError } from "../identity-3.3/trust.mjs";
+import { IdentityAuthorizationError, TrustRecordUnavailableError } from "../identity-3.3/trust.mjs";
 import { z } from "zod";
 import {
   COMPATIBLE_ADCP_VERSIONS,
@@ -1516,6 +1521,10 @@ function buildSignedRequestsPreTransport(signedRequests, effectiveRequestSigning
     throw new Error(
       "Web Bot Auth requires an origin-binding migration fence; use createIdentity33PrincipalResolver or supply assertLegacyOriginAllowed"
     );
+  if (signedRequests.webBotAuth && !signedRequests.webBotAuth.isRevoked && !isWebBotAuthRevocationChecked(signedRequests.webBotAuth.resolvePrincipal))
+    throw new Error(
+      "Web Bot Auth requires origin revocation: use createIdentity33PrincipalResolver({ revocation }) or supply isRevoked"
+    );
   const requiredFor = effectiveRequestSigning.required_for ?? [];
   const verifier = createExpressVerifier({
     capability: {
@@ -1545,20 +1554,25 @@ function buildSignedRequestsPreTransport(signedRequests, effectiveRequestSigning
         const signers = await verifyWebBotAuth(
           { method: req.method ?? "POST", url: requestTarget, headers: req.headers, body: req.rawBody ?? "" },
           {
+            // Identity verification needs only key discovery and replay state;
+            // revocation and binding belong to the principal resolver.
             directory: signedRequests.webBotAuth.directory,
-            deferAuthorizationErrors: typeof resolveRequestOperation({ rawBody: req.rawBody, method: req.method, url: req.url }) === "string",
             replayStore: signedRequests.replayStore,
-            isRevoked: signedRequests.webBotAuth.isRevoked,
-            requireFreshRevocation: ![
-              "get_adcp_capabilities",
-              "get_principal",
-              "list_creative_formats",
-              "list_accounts"
-            ].includes(String(resolveRequestOperation({ rawBody: req.rawBody, method: req.method, url: req.url })))
+            ...signedRequests.webBotAuth.isRevoked && { isRevoked: signedRequests.webBotAuth.isRevoked }
           }
         );
         const operation = resolveRequestOperation({ rawBody: req.rawBody, method: req.method, url: req.url });
-        const principal = await signedRequests.webBotAuth.resolvePrincipal(signers, operation);
+        let principal;
+        let deferredFailure;
+        try {
+          principal = await signedRequests.webBotAuth.resolvePrincipal(signers, operation);
+        } catch (error) {
+          if (error instanceof WebBotAuthError || error instanceof WebBotAuthUnavailableError) throw error;
+          if (typeof operation !== "string") throw webBotAuthPrincipalFailureError(error);
+          const deferred = deferWebBotAuthPrincipalFailure(signers, error);
+          principal = { principal: deferred.principal };
+          deferredFailure = deferred.authorizationFailure;
+        }
         const signer = signers[signers.length - 1];
         const failed = signers.find((s) => s.authorizationFailure);
         const guardedPrincipal = {
@@ -1567,7 +1581,9 @@ function buildSignedRequestsPreTransport(signedRequests, effectiveRequestSigning
             ...principal.extra,
             webBotAuthAuthorization: {
               signer: failed ?? signer,
-              ...failed && { authorizationFailure: failed.authorizationFailure }
+              ...(failed?.authorizationFailure ?? deferredFailure) && {
+                authorizationFailure: failed?.authorizationFailure ?? deferredFailure
+              }
             }
           }
         };
@@ -1578,6 +1594,12 @@ function buildSignedRequestsPreTransport(signedRequests, effectiveRequestSigning
         });
         return false;
       } catch (error) {
+        if (error instanceof WebBotAuthUnavailableError) {
+          const outage = webBotAuthUnavailableResponse();
+          res.writeHead(outage.status, { ...outage.headers, "Content-Type": "application/json" });
+          res.end(JSON.stringify(outage.body));
+          return true;
+        }
         const rejected = error instanceof WebBotAuthError ? error : new WebBotAuthError(403, "identity_rejected");
         res.writeHead(rejected.status, { ...rejected.headers, "Content-Type": "application/json" });
         res.end(JSON.stringify(rejected.body));
@@ -3064,6 +3086,8 @@ function createAdcpServer(config) {
           try {
             await config.identity33.authorize(ctx, toolName, params);
           } catch (error) {
+            if (error instanceof TrustRecordUnavailableError)
+              return finalize(adcpError("SERVICE_UNAVAILABLE", { message: error.message, recovery: "transient" }));
             if (error instanceof IdentityAuthorizationError)
               return finalize(
                 adcpError("PERMISSION_DENIED", {
@@ -4687,6 +4711,8 @@ function createAdcpServer(config) {
         params
       );
     } catch (error) {
+      if (error instanceof TrustRecordUnavailableError)
+        return adcpError("SERVICE_UNAVAILABLE", { message: error.message, recovery: "transient" });
       if (error instanceof IdentityAuthorizationError)
         return adcpError("PERMISSION_DENIED", {
           message: error.message,

package/dist/lib/signing/crypto.js

@@ -47,6 +47,14 @@ function verifySignature(alg, publicKey, data, signature) {
     if (alg === "ecdsa-p256-sha256") {
       return (0, import_crypto.verify)("sha256", data, { key: publicKey, dsaEncoding: "ieee-p1363" }, signature);
     }
+    if (alg === "rsa-pss-sha512") {
+      return (0, import_crypto.verify)(
+        "sha512",
+        data,
+        { key: publicKey, padding: import_crypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 64 },
+        signature
+      );
+    }
     return false;
   } catch {
     return false;

package/dist/lib/signing/crypto.mjs

@@ -1,4 +1,4 @@
-import { createPublicKey, verify as nodeVerify } from "crypto";
+import { constants, createPublicKey, verify as nodeVerify } from "crypto";
 import { RequestSignatureError } from "./errors.mjs";
 function jwkToPublicKey(jwk) {
   const publicJwk = { ...jwk };
@@ -23,6 +23,14 @@ function verifySignature(alg, publicKey, data, signature) {
     if (alg === "ecdsa-p256-sha256") {
       return nodeVerify("sha256", data, { key: publicKey, dsaEncoding: "ieee-p1363" }, signature);
     }
+    if (alg === "rsa-pss-sha512") {
+      return nodeVerify(
+        "sha512",
+        data,
+        { key: publicKey, padding: constants.RSA_PKCS1_PSS_PADDING, saltLength: 64 },
+        signature
+      );
+    }
     return false;
   } catch {
     return false;

package/dist/lib/signing/fetch-async.js

@@ -82,7 +82,7 @@ function bodyToString(body) {
 }
 function decodeUtf8Strict(bytes) {
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
   } catch {
     throw new TypeError(
       "createSigningFetchAsync received a Uint8Array/ArrayBuffer body that is not valid UTF-8. Pass a string body, ensure the bytes are UTF-8, or sign the request manually with `signRequestAsync` against the exact wire bytes you intend to send."

package/dist/lib/signing/fetch-async.mjs

@@ -61,7 +61,7 @@ function bodyToString(body) {
 }
 function decodeUtf8Strict(bytes) {
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
   } catch {
     throw new TypeError(
       "createSigningFetchAsync received a Uint8Array/ArrayBuffer body that is not valid UTF-8. Pass a string body, ensure the bytes are UTF-8, or sign the request manually with `signRequestAsync` against the exact wire bytes you intend to send."

package/dist/lib/signing/fetch.js

@@ -91,7 +91,7 @@ function bodyToString(body) {
 }
 function decodeUtf8Strict(bytes) {
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
   } catch {
     throw new TypeError(
       "createSigningFetch received a Uint8Array/ArrayBuffer body that is not valid UTF-8. Pass a string body, ensure the bytes are UTF-8, or sign the request manually with `signRequest` against the exact wire bytes you intend to send."

package/dist/lib/signing/fetch.mjs

@@ -67,7 +67,7 @@ function bodyToString(body) {
 }
 function decodeUtf8Strict(bytes) {
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
   } catch {
     throw new TypeError(
       "createSigningFetch received a Uint8Array/ArrayBuffer body that is not valid UTF-8. Pass a string body, ensure the bytes are UTF-8, or sign the request manually with `signRequest` against the exact wire bytes you intend to send."

package/dist/lib/signing/middleware.js

@@ -30,6 +30,15 @@ function createExpressVerifier(options) {
   const replayStore = options.replayStore ?? new import_replay.InMemoryReplayStore();
   const revocationStore = options.revocationStore ?? new import_revocation.InMemoryRevocationStore();
   return async function requestSignatureMiddleware(req, res, next) {
+    const { selectSignatureProfile, WebBotAuthError } = require('./web-bot-auth.js');
+    if (selectSignatureProfile({ headers: req.headers }) === "web-bot-auth") {
+      const refused = new WebBotAuthError(403, "profile_disabled");
+      res.status(refused.status).set("Cache-Control", "no-store").json({
+        ...refused.body,
+        message: "Web Bot Auth is not configured on this endpoint; use createAdcpServer signedRequests.webBotAuth or verifySignatureAsAuthenticator({ webBotAuth })"
+      });
+      return;
+    }
     try {
       const url = options.getUrl ? options.getUrl(req) : defaultUrl(req);
       const body = resolveRawBody(req);

package/dist/lib/signing/middleware.mjs

@@ -1,3 +1,8 @@
+import { fileURLToPath as __adcpFileURLToPath } from "node:url";
+import { dirname as __adcpDirname } from "node:path";
+import { createRequire as __adcpCreateRequire } from "node:module";
+const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
+const require2 = __adcpCreateRequire(import.meta.url);
 import { getHeaderValue } from "./canonicalize.mjs";
 import { RequestSignatureError } from "./errors.mjs";
 import { InMemoryReplayStore } from "./replay.mjs";
@@ -7,6 +12,15 @@ function createExpressVerifier(options) {
   const replayStore = options.replayStore ?? new InMemoryReplayStore();
   const revocationStore = options.revocationStore ?? new InMemoryRevocationStore();
   return async function requestSignatureMiddleware(req, res, next) {
+    const { selectSignatureProfile, WebBotAuthError } = require2("./web-bot-auth");
+    if (selectSignatureProfile({ headers: req.headers }) === "web-bot-auth") {
+      const refused = new WebBotAuthError(403, "profile_disabled");
+      res.status(refused.status).set("Cache-Control", "no-store").json({
+        ...refused.body,
+        message: "Web Bot Auth is not configured on this endpoint; use createAdcpServer signedRequests.webBotAuth or verifySignatureAsAuthenticator({ webBotAuth })"
+      });
+      return;
+    }
     try {
       const url = options.getUrl ? options.getUrl(req) : defaultUrl(req);
       const body = resolveRawBody(req);

package/dist/lib/signing/parser.d.mts

@@ -26,10 +26,13 @@ export interface ParsedSignature {
 export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
- * RFC 8941 §3.2 parsers deduplicate by keeping the last value. The AdCP
- * profile (step 1) overrides that: duplicate keys are a downgrade vector —
- * a proxy could smuggle a weaker component set past a verifier that reads
- * the first. Detect duplicates at the raw-header level before the library
- * silently drops them.
+ * RFC 8941 / RFC 9651 parsers deduplicate dictionary keys and parameter keys
+ * by keeping the last value. The AdCP profile (step 1) overrides that:
+ * duplicates are a cross-implementation differential and a downgrade vector
+ * (a proxy could smuggle a weaker component set or a different `created`,
+ * `keyid` or `tag` past a verifier that reads the first). Detect them at the
+ * raw-header level before the library silently drops them: top-level
+ * dictionary keys, parameters on members and inner lists, and parameters on
+ * each inner-list item.
  */
 export declare function rejectDuplicateDictionaryKeys(headerValue: string, headerName: string): void;

package/dist/lib/signing/parser.d.ts

@@ -26,10 +26,13 @@ export interface ParsedSignature {
 export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
- * RFC 8941 §3.2 parsers deduplicate by keeping the last value. The AdCP
- * profile (step 1) overrides that: duplicate keys are a downgrade vector —
- * a proxy could smuggle a weaker component set past a verifier that reads
- * the first. Detect duplicates at the raw-header level before the library
- * silently drops them.
+ * RFC 8941 / RFC 9651 parsers deduplicate dictionary keys and parameter keys
+ * by keeping the last value. The AdCP profile (step 1) overrides that:
+ * duplicates are a cross-implementation differential and a downgrade vector
+ * (a proxy could smuggle a weaker component set or a different `created`,
+ * `keyid` or `tag` past a verifier that reads the first). Detect them at the
+ * raw-header level before the library silently drops them: top-level
+ * dictionary keys, parameters on members and inner lists, and parameters on
+ * each inner-list item.
  */
 export declare function rejectDuplicateDictionaryKeys(headerValue: string, headerName: string): void;

package/dist/lib/signing/parser.js

@@ -111,85 +111,101 @@ function isInnerList(entry) {
   return Array.isArray(entry) && Array.isArray(entry[0]);
 }
 function rejectDuplicateDictionaryKeys(headerValue, headerName) {
-  const keys = extractTopLevelDictKeys(headerValue);
-  const seen = /* @__PURE__ */ new Set();
-  for (const key of keys) {
-    if (seen.has(key)) {
-      malformed(`${headerName} header declares key "${key}" more than once`);
-    }
-    seen.add(key);
-  }
+  const duplicate = findDuplicateStructuredKey(headerValue);
+  if (duplicate?.kind === "member") malformed(`${headerName} header declares key "${duplicate.key}" more than once`);
+  if (duplicate) malformed(`${headerName} header declares parameter "${duplicate.key}" more than once`);
 }
-function extractTopLevelDictKeys(input) {
-  const keys = [];
+function findDuplicateStructuredKey(input) {
   let i = 0;
-  const len = input.length;
-  let atEntryStart = true;
-  while (i < len) {
-    if (atEntryStart) {
-      while (i < len && (input[i] === " " || input[i] === "	")) i++;
-      const keyStart = i;
-      while (i < len && /[A-Za-z0-9_*-]/.test(input[i])) i++;
-      if (i > keyStart) keys.push(input.slice(keyStart, i).toLowerCase());
-      atEntryStart = false;
-      continue;
+  const n = input.length;
+  const ows = () => {
+    while (i < n && (input[i] === " " || input[i] === "	")) i++;
+  };
+  const key = () => {
+    const start = i;
+    while (i < n && /[A-Za-z0-9_.*-]/.test(input[i])) i++;
+    return input.slice(start, i).toLowerCase();
+  };
+  const bareItem = () => {
+    if (input[i] === "%" && input[i + 1] === '"') {
+      i += 2;
+      while (i < n && input[i] !== '"') i++;
+      i++;
+      return;
     }
-    const ch = input[i];
-    if (ch === '"') {
+    if (input[i] === '"') {
       i++;
-      while (i < len) {
-        if (input[i] === "\\" && i + 1 < len) {
+      while (i < n) {
+        if (input[i] === "\\") {
           i += 2;
           continue;
         }
-        if (input[i] === '"') {
-          i++;
-          break;
-        }
-        i++;
+        if (input[i++] === '"') return;
       }
-      continue;
+      return;
     }
-    if (ch === ":") {
+    if (input[i] === ":") {
       i++;
-      while (i < len && input[i] !== ":") i++;
-      if (i < len) i++;
-      continue;
+      while (i < n && input[i] !== ":") i++;
+      i++;
+      return;
     }
-    if (ch === "(") {
+    while (i < n && !/[;,()\s"]/.test(input[i])) i++;
+  };
+  const parameters = () => {
+    const seen = /* @__PURE__ */ new Set();
+    while (i < n && input[i] === ";") {
       i++;
-      let depth = 1;
-      while (i < len && depth > 0) {
-        const c = input[i];
-        if (c === '"') {
-          i++;
-          while (i < len) {
-            if (input[i] === "\\" && i + 1 < len) {
-              i += 2;
-              continue;
-            }
-            if (input[i] === '"') {
-              i++;
-              break;
-            }
-            i++;
-          }
-          continue;
-        }
-        if (c === "(") depth++;
-        else if (c === ")") depth--;
+      ows();
+      const k = key();
+      if (!k) return void 0;
+      if (seen.has(k)) return k;
+      seen.add(k);
+      if (input[i] === "=") {
         i++;
+        bareItem();
       }
-      continue;
     }
-    if (ch === ",") {
-      atEntryStart = true;
+    return void 0;
+  };
+  const members = /* @__PURE__ */ new Set();
+  while (i < n) {
+    ows();
+    const k = key();
+    if (!k) return void 0;
+    if (members.has(k)) return { kind: "member", key: k };
+    members.add(k);
+    let duplicate;
+    if (input[i] === "=") {
       i++;
-      continue;
-    }
+      if (input[i] === "(") {
+        i++;
+        for (; ; ) {
+          while (i < n && input[i] === " ") i++;
+          if (i >= n) return void 0;
+          if (input[i] === ")") {
+            i++;
+            break;
+          }
+          const before = i;
+          bareItem();
+          duplicate = parameters();
+          if (duplicate) return { kind: "parameter", key: `${k}: ${duplicate}` };
+          if (i === before) return void 0;
+        }
+        duplicate = parameters();
+      } else {
+        bareItem();
+        duplicate = parameters();
+      }
+    } else duplicate = parameters();
+    if (duplicate) return { kind: "parameter", key: `${k}: ${duplicate}` };
+    ows();
+    if (i >= n) return void 0;
+    if (input[i] !== ",") return void 0;
     i++;
   }
-  return keys;
+  return void 0;
 }
 function normalizeByteSequenceBase64(input) {
   let out = "";

package/dist/lib/signing/parser.mjs

@@ -86,85 +86,101 @@ function isInnerList(entry) {
   return Array.isArray(entry) && Array.isArray(entry[0]);
 }
 function rejectDuplicateDictionaryKeys(headerValue, headerName) {
-  const keys = extractTopLevelDictKeys(headerValue);
-  const seen = /* @__PURE__ */ new Set();
-  for (const key of keys) {
-    if (seen.has(key)) {
-      malformed(`${headerName} header declares key "${key}" more than once`);
-    }
-    seen.add(key);
-  }
+  const duplicate = findDuplicateStructuredKey(headerValue);
+  if (duplicate?.kind === "member") malformed(`${headerName} header declares key "${duplicate.key}" more than once`);
+  if (duplicate) malformed(`${headerName} header declares parameter "${duplicate.key}" more than once`);
 }
-function extractTopLevelDictKeys(input) {
-  const keys = [];
+function findDuplicateStructuredKey(input) {
   let i = 0;
-  const len = input.length;
-  let atEntryStart = true;
-  while (i < len) {
-    if (atEntryStart) {
-      while (i < len && (input[i] === " " || input[i] === "	")) i++;
-      const keyStart = i;
-      while (i < len && /[A-Za-z0-9_*-]/.test(input[i])) i++;
-      if (i > keyStart) keys.push(input.slice(keyStart, i).toLowerCase());
-      atEntryStart = false;
-      continue;
+  const n = input.length;
+  const ows = () => {
+    while (i < n && (input[i] === " " || input[i] === "	")) i++;
+  };
+  const key = () => {
+    const start = i;
+    while (i < n && /[A-Za-z0-9_.*-]/.test(input[i])) i++;
+    return input.slice(start, i).toLowerCase();
+  };
+  const bareItem = () => {
+    if (input[i] === "%" && input[i + 1] === '"') {
+      i += 2;
+      while (i < n && input[i] !== '"') i++;
+      i++;
+      return;
     }
-    const ch = input[i];
-    if (ch === '"') {
+    if (input[i] === '"') {
       i++;
-      while (i < len) {
-        if (input[i] === "\\" && i + 1 < len) {
+      while (i < n) {
+        if (input[i] === "\\") {
           i += 2;
           continue;
         }
-        if (input[i] === '"') {
-          i++;
-          break;
-        }
-        i++;
+        if (input[i++] === '"') return;
       }
-      continue;
+      return;
     }
-    if (ch === ":") {
+    if (input[i] === ":") {
       i++;
-      while (i < len && input[i] !== ":") i++;
-      if (i < len) i++;
-      continue;
+      while (i < n && input[i] !== ":") i++;
+      i++;
+      return;
     }
-    if (ch === "(") {
+    while (i < n && !/[;,()\s"]/.test(input[i])) i++;
+  };
+  const parameters = () => {
+    const seen = /* @__PURE__ */ new Set();
+    while (i < n && input[i] === ";") {
       i++;
-      let depth = 1;
-      while (i < len && depth > 0) {
-        const c = input[i];
-        if (c === '"') {
-          i++;
-          while (i < len) {
-            if (input[i] === "\\" && i + 1 < len) {
-              i += 2;
-              continue;
-            }
-            if (input[i] === '"') {
-              i++;
-              break;
-            }
-            i++;
-          }
-          continue;
-        }
-        if (c === "(") depth++;
-        else if (c === ")") depth--;
+      ows();
+      const k = key();
+      if (!k) return void 0;
+      if (seen.has(k)) return k;
+      seen.add(k);
+      if (input[i] === "=") {
         i++;
+        bareItem();
       }
-      continue;
     }
-    if (ch === ",") {
-      atEntryStart = true;
+    return void 0;
+  };
+  const members = /* @__PURE__ */ new Set();
+  while (i < n) {
+    ows();
+    const k = key();
+    if (!k) return void 0;
+    if (members.has(k)) return { kind: "member", key: k };
+    members.add(k);
+    let duplicate;
+    if (input[i] === "=") {
       i++;
-      continue;
-    }
+      if (input[i] === "(") {
+        i++;
+        for (; ; ) {
+          while (i < n && input[i] === " ") i++;
+          if (i >= n) return void 0;
+          if (input[i] === ")") {
+            i++;
+            break;
+          }
+          const before = i;
+          bareItem();
+          duplicate = parameters();
+          if (duplicate) return { kind: "parameter", key: `${k}: ${duplicate}` };
+          if (i === before) return void 0;
+        }
+        duplicate = parameters();
+      } else {
+        bareItem();
+        duplicate = parameters();
+      }
+    } else duplicate = parameters();
+    if (duplicate) return { kind: "parameter", key: `${k}: ${duplicate}` };
+    ows();
+    if (i >= n) return void 0;
+    if (input[i] !== ",") return void 0;
     i++;
   }
-  return keys;
+  return void 0;
 }
 function normalizeByteSequenceBase64(input) {
   let out = "";

package/dist/lib/signing/revocation.js

@@ -59,6 +59,9 @@ const REASONS = [
 ];
 function mergeRevocationDetails(prior, detail) {
   const reason = REASONS.indexOf(detail.reason ?? "unspecified") > REASONS.indexOf(prior?.reason ?? "unspecified") ? detail.reason : prior?.reason ?? detail.reason;
+  const hasValidDate = (entry) => !!entry?.invalidity_date && Number.isFinite(Date.parse(entry.invalidity_date));
+  if (reason === "keyCompromise" && [prior, detail].some((entry) => entry?.reason === "keyCompromise" && !hasValidDate(entry)))
+    return { reason };
   const dates = [prior?.invalidity_date, detail.invalidity_date].filter((s) => !!s && Number.isFinite(Date.parse(s))).sort((a, b) => Date.parse(a) - Date.parse(b));
   return { ...reason ? { reason } : {}, ...dates[0] ? { invalidity_date: dates[0] } : {} };
 }

package/dist/lib/signing/revocation.mjs

@@ -35,6 +35,9 @@ const REASONS = [
 ];
 function mergeRevocationDetails(prior, detail) {
   const reason = REASONS.indexOf(detail.reason ?? "unspecified") > REASONS.indexOf(prior?.reason ?? "unspecified") ? detail.reason : prior?.reason ?? detail.reason;
+  const hasValidDate = (entry) => !!entry?.invalidity_date && Number.isFinite(Date.parse(entry.invalidity_date));
+  if (reason === "keyCompromise" && [prior, detail].some((entry) => entry?.reason === "keyCompromise" && !hasValidDate(entry)))
+    return { reason };
   const dates = [prior?.invalidity_date, detail.invalidity_date].filter((s) => !!s && Number.isFinite(Date.parse(s))).sort((a, b) => Date.parse(a) - Date.parse(b));
   return { ...reason ? { reason } : {}, ...dates[0] ? { invalidity_date: dates[0] } : {} };
 }

package/dist/lib/signing/verifier.js

@@ -239,7 +239,7 @@ async function verifyRequestSignature(request, options) {
       "Delegated operator authorization expired during verification"
     );
   }
-  const remaining = parsedInput.params.expires - now + import_types.CLOCK_SKEW_TOLERANCE_SECONDS;
+  const remaining = parsedInput.params.expires - now + import_types.CLOCK_SKEW_TOLERANCE_SECONDS + 1;
   const ttl = Math.max(remaining, import_types.MAX_SIGNATURE_WINDOW_SECONDS + import_types.CLOCK_SKEW_TOLERANCE_SECONDS);
   const insertResult = await options.replayStore.insert(jwk.kid, replayScope, parsedInput.params.nonce, ttl, now);
   if (insertResult === "replayed") {

package/dist/lib/signing/verifier.mjs

@@ -228,7 +228,7 @@ async function verifyRequestSignature(request, options) {
       "Delegated operator authorization expired during verification"
     );
   }
-  const remaining = parsedInput.params.expires - now + CLOCK_SKEW_TOLERANCE_SECONDS;
+  const remaining = parsedInput.params.expires - now + CLOCK_SKEW_TOLERANCE_SECONDS + 1;
   const ttl = Math.max(remaining, MAX_SIGNATURE_WINDOW_SECONDS + CLOCK_SKEW_TOLERANCE_SECONDS);
   const insertResult = await options.replayStore.insert(jwk.kid, replayScope, parsedInput.params.nonce, ttl, now);
   if (insertResult === "replayed") {