@adcp/sdk 16.0.0-beta.1 → 16.0.0-beta.3

package/dist/lib/signing/web-bot-auth.mjs

@@ -1,18 +1,20 @@
 import { toReleasePrecisionVersion } from "../version.mjs";
-import { createHash, createPrivateKey, randomBytes, sign as nodeSign } from "crypto";
+import {
+  constants as cryptoConstants,
+  createHash,
+  createPrivateKey,
+  randomBytes,
+  sign as nodeSign
+} from "crypto";
 import { parseDictionary, parseItem, serializeItem } from "structured-headers";
 import { ssrfSafeFetch } from "../net/index.mjs";
 import { eTldPlusOne } from "./agent-resolver/etld.mjs";
 import { canonicalAgentOrigin } from "./agent-resolver/canonicalize.mjs";
 import { canonicalAgentUrl } from "./agent-resolver/select-agent.mjs";
 import { parseStrictJson } from "./agent-resolver/strict-json.mjs";
-import {
-  canonicalAuthority,
-  canonicalTargetUri,
-  getHeaderValue
-} from "./canonicalize.mjs";
+import { getHeaderValue } from "./canonicalize.mjs";
 import { computeContentDigest, contentDigestMatches, contentDigestUsesEncoding } from "./content-digest.mjs";
-import { jwkToPublicKey, verifySignature } from "./crypto.mjs";
+import { jwkToPublicKey, signWithPrivateJwkAsync, verifySignature, verifySignatureAsync } from "./crypto.mjs";
 import {
   parseSignature,
   parseSignatureInput,
@@ -23,12 +25,14 @@ const WEB_BOT_AUTH_DRAFT_REVISION = "draft-ietf-webbotauth-httpsig-protocol-00";
 const SIGNATURE_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 const SIGNATURE_DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
 const DIRECTORY_TAG = "http-message-signatures-directory";
+const DIRECTORY_CLOCK_SKEW_SECONDS = 60;
 const TEST_KIDS = /* @__PURE__ */ new Set([
   "6WsKMCObba49V3uN0vIENnk1BKAk7c9zjBJcWKyQ9_I",
   "hHurKlVBnPJ4AGiPyl6HWMhxgkIcRBzaC8qWwEtnuVI",
   "ZtaFf5jj-EzorJmZn6mX3YnmK_QyZKVLbbinzIQKOjQ",
   "1XlJ3EIte7bPOEqKQtKrKNTNy5hywTyrwFXWrMbXKqE"
 ]);
+const NO_CHALLENGE_REASONS = /* @__PURE__ */ new Set(["key_revoked", "identity_not_bound", "profile_disabled", "authorization_failed"]);
 class WebBotAuthError extends Error {
   constructor(status, reason) {
     super(
@@ -37,13 +41,7 @@ class WebBotAuthError extends Error {
     this.status = status;
     this.reason = reason;
     this.name = "WebBotAuthError";
-    this.headers = status === 403 && ![
-      "key_revoked",
-      "identity_not_bound",
-      "revocation_unavailable",
-      "revocation_persistence_failed",
-      "profile_disabled"
-    ].includes(reason) ? {
+    this.headers = status === 403 && !NO_CHALLENGE_REASONS.has(reason) ? {
       "Accept-Signature": 'sig1=("@method" "@target-uri" "@authority" "content-type" "content-digest" "signature-agent";key="sig1");created;expires;nonce;keyid;tag="web-bot-auth"'
     } : status === 429 ? { "Retry-After": "60" } : {};
   }
@@ -51,18 +49,29 @@ class WebBotAuthError extends Error {
   reason;
   headers;
   get body() {
-    if (["key_revoked", "identity_not_bound", "revocation_unavailable", "revocation_persistence_failed"].includes(
-      this.reason
-    ))
+    if (this.reason === "authorization_failed" || this.reason === "identity_not_bound")
       return {
-        adcp_error: {
-          code: this.reason.startsWith("revocation_") ? "SERVICE_UNAVAILABLE" : "PERMISSION_DENIED",
-          message: this.message,
-          recovery: this.reason.startsWith("revocation_") ? "transient" : "correctable"
-        }
+        adcp_error: { code: "PERMISSION_DENIED", message: "Agent authorization failed", recovery: "correctable" }
       };
-    return { error: this.message };
+    return { adcp_error: { code: "AUTH_INVALID", message: this.message, recovery: "terminal" } };
+  }
+  /**
+   * The signer's identity could not be established because key discovery
+   * failed (WBA §6.10) or its revocation status is unknown. The request is
+   * unverified; servers apply their unverified-request policy.
+   */
+  get unverified() {
+    return this.reason.startsWith("directory_") || this.reason === "identity_unverified";
+  }
+}
+class WebBotAuthUnavailableError extends Error {
+  constructor(reason, cause) {
+    super("Web Bot Auth verification dependency is unavailable");
+    this.reason = reason;
+    this.name = "WebBotAuthUnavailableError";
+    if (cause !== void 0) Object.defineProperty(this, "cause", { value: cause });
   }
+  reason;
 }
 function bad(reason) {
   throw new WebBotAuthError(400, reason);
@@ -71,7 +80,8 @@ function denied(reason) {
   throw new WebBotAuthError(403, reason);
 }
 function dictionary(value, field) {
-  if (!value || value.length > 64 * 1024) return bad("headers");
+  if (value === void 0 || value === "") return denied("headers_missing");
+  if (value.length > 64 * 1024) return bad("headers");
   try {
     rejectDuplicateDictionaryKeys(value, field);
     return parseDictionary(value);
@@ -91,12 +101,18 @@ function jwkThumbprint(jwk) {
     fields = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
   else if (jwk.kty === "EC" && typeof jwk.crv === "string" && typeof jwk.x === "string" && typeof jwk.y === "string")
     fields = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+  else if (jwk.kty === "RSA" && typeof jwk.e === "string" && typeof jwk.n === "string")
+    fields = { e: jwk.e, kty: jwk.kty, n: jwk.n };
   else return denied("unsupported_key");
   return createHash("sha256").update(JSON.stringify(fields)).digest("base64url");
 }
 function algorithm(jwk) {
   if (jwk.kty === "OKP" && jwk.crv === "Ed25519") return "ed25519";
   if (jwk.kty === "EC" && jwk.crv === "P-256") return "ecdsa-p256-sha256";
+  if (jwk.kty === "RSA" && typeof jwk.n === "string" && jwk.e === "AQAB") {
+    const bytes = Buffer.from(jwk.n, "base64url").length;
+    if (bytes >= 256 && bytes <= 512) return "rsa-pss-sha512";
+  }
   return denied("unsupported_key");
 }
 function inputs(headers) {
@@ -140,8 +156,8 @@ function buildWebBotAuthSignatureBase(input, request, response) {
       if (params.has("key")) return bad("derived_dictionary");
       if (response && bare !== "@status" && !params.has("req")) return bad("response_component");
       if (bare === "@method") value = request.method.toUpperCase();
-      else if (bare === "@target-uri") value = canonicalTargetUri(request.url, "3.2");
-      else if (bare === "@authority") value = canonicalAuthority(request.url, "3.2");
+      else if (bare === "@target-uri") value = receivedTargetUri(request.url);
+      else if (bare === "@authority") value = receivedAuthority(request.url);
       else if (bare === "@status" && response && !params.has("req")) value = String(response.status);
       else return bad("derived_component");
     } else {
@@ -161,21 +177,49 @@ function buildWebBotAuthSignatureBase(input, request, response) {
   });
   return [...lines, `"@signature-params": ${input.signatureParamsValue}`].join("\n");
 }
+function receivedTargetUri(url) {
+  try {
+    new URL(url);
+  } catch {
+    return bad("target_uri");
+  }
+  return url;
+}
+function receivedAuthority(url) {
+  try {
+    return new URL(url).host.toLowerCase();
+  } catch {
+    return bad("target_uri");
+  }
+}
 function assertDigest(headers, body) {
   const digest = getHeaderValue(headers, "content-digest");
   if (!digest || !contentDigestUsesEncoding(digest, "rfc8941-base64") || !contentDigestMatches(digest, body))
     denied("content_digest");
 }
-function verifyBytes(input, request, jwk, response) {
+function signatureBytes(input, request, jwk, response) {
   const alg = algorithm(jwk);
   if (input.params.alg !== void 0 && input.params.alg !== alg) denied("algorithm");
   const signature = getHeaderValue(response?.headers ?? request.headers, "signature");
-  let bytes;
+  if (signature === void 0 || signature === "") denied("headers_missing");
   try {
-    bytes = parseSignature(signature ?? "", input.label, "rfc8941-base64").bytes;
+    return { alg, bytes: parseSignature(signature ?? "", input.label, "rfc8941-base64").bytes };
   } catch {
     return bad("signature");
   }
+}
+async function verifyBytesAsync(input, request, jwk) {
+  const { alg, bytes } = signatureBytes(input, request, jwk);
+  let valid = false;
+  try {
+    valid = await verifySignatureAsync(alg, jwk, Buffer.from(buildWebBotAuthSignatureBase(input, request)), bytes);
+  } catch (error) {
+    if (error instanceof WebBotAuthError) throw error;
+  }
+  if (!valid) denied("signature_invalid");
+}
+function verifyBytes(input, request, jwk, response) {
+  const { alg, bytes } = signatureBytes(input, request, jwk, response);
   let valid = false;
   try {
     valid = verifySignature(
@@ -196,16 +240,63 @@ function registerWebBotAuthLegacyOriginGate(resolver, gate) {
 function getWebBotAuthLegacyOriginGate(resolver) {
   return resolver && legacyOriginGates.get(resolver);
 }
+const revocationCheckingResolvers = /* @__PURE__ */ new WeakSet();
+function registerWebBotAuthRevocationCheck(resolver) {
+  revocationCheckingResolvers.add(resolver);
+}
+function isWebBotAuthRevocationChecked(resolver) {
+  return !!resolver && revocationCheckingResolvers.has(resolver);
+}
+function webBotAuthUnavailableResponse() {
+  return {
+    status: 503,
+    headers: { "Retry-After": "60" },
+    body: {
+      adcp_error: {
+        code: "SERVICE_UNAVAILABLE",
+        message: "Agent identity verification is temporarily unavailable",
+        recovery: "transient"
+      }
+    }
+  };
+}
 const authorizationFailures = /* @__PURE__ */ new WeakSet();
+const AUTHORIZATION_FAILURE_MESSAGES = {
+  key_revoked: "Agent identity key is revoked",
+  identity_not_bound: "Agent identity is not onboarded for this operation",
+  revocation_unavailable: "Identity revocation information is unavailable",
+  authorization_failed: "Agent authorization failed",
+  authorization_unavailable: "Agent authorization is temporarily unavailable"
+};
 function createWebBotAuthAuthorizationFailure(reason) {
+  const transient = reason === "revocation_unavailable" || reason === "authorization_unavailable";
   const failure = Object.freeze({
-    code: reason === "revocation_unavailable" ? "SERVICE_UNAVAILABLE" : "PERMISSION_DENIED",
-    message: reason === "revocation_unavailable" ? "Identity revocation information is unavailable" : reason === "key_revoked" ? "Agent identity key is revoked" : "Agent identity is not onboarded for this operation",
-    recovery: reason === "revocation_unavailable" ? "transient" : "correctable"
+    code: transient ? "SERVICE_UNAVAILABLE" : "PERMISSION_DENIED",
+    message: AUTHORIZATION_FAILURE_MESSAGES[reason],
+    recovery: transient ? "transient" : "correctable"
   });
   authorizationFailures.add(failure);
   return failure;
 }
+function principalFailureIsTransient(error) {
+  const value = error;
+  if (value?.transient === true || value?.recovery === "transient" || value?.code === "SERVICE_UNAVAILABLE")
+    return true;
+  return typeof value?.code !== "string";
+}
+function webBotAuthPrincipalFailureError(error) {
+  return principalFailureIsTransient(error) ? new WebBotAuthUnavailableError("authorization_unavailable", error) : new WebBotAuthError(403, "authorization_failed");
+}
+function deferWebBotAuthPrincipalFailure(signers, error) {
+  const signer = signers[signers.length - 1];
+  const authorizationFailure = createWebBotAuthAuthorizationFailure(
+    principalFailureIsTransient(error) ? "authorization_unavailable" : "authorization_failed"
+  );
+  return {
+    principal: `anonymous:${createHash("sha256").update(signer.origin).digest("hex")}`,
+    authorizationFailure
+  };
+}
 function getWebBotAuthAuthorizationFailure(extra) {
   for (const value of [extra?.webBotAuthAuthorization, extra?.identity33]) {
     const claim = value;
@@ -271,7 +362,8 @@ async function verifyWebBotAuth(request, options) {
       const memberKey = component[1].get("key");
       if (typeof memberKey !== "string" || memberKey !== input.label) bad("agent_member");
       const member = agents.get(memberKey);
-      if (!member || typeof member[0] !== "string") bad("signature_agent");
+      if (!member) denied("agent_not_covered");
+      if (typeof member[0] !== "string") bad("signature_agent");
       const type = member[1].get("type");
       if (type !== void 0 && type !== "directory") denied("agent_type");
       const origin = receivedAgentOrigin(member[0]);
@@ -291,27 +383,16 @@ async function verifyWebBotAuth(request, options) {
         assertDigest(request.headers, request.body);
       }
       await options.directory.resolve(keyid, origin);
-      const proof = options.directory.getAuditProof(origin);
-      if (!proof || new URL(proof.request.url).origin !== origin) denied("directory_origin");
-      const checkedDirectory = verifySignatureDirectory(
-        proof,
-        now,
-        options.allowTestKeys ?? options.directory.allowsTestKeys
-      );
+      const checkedDirectory = options.directory.getVerifiedDirectory(origin);
+      if (!checkedDirectory || new URL(checkedDirectory.proof.request.url).origin !== origin)
+        denied("directory_origin");
+      if (checkedDirectory.expires <= now) denied("directory_expired");
+      if (!testKeysAllowed(options.allowTestKeys ?? options.directory.allowsTestKeys) && checkedDirectory.keys.some((key2) => TEST_KIDS.has(key2.kid)))
+        denied("directory_key");
       const key = checkedDirectory.keys.find((key2) => key2.kid === keyid);
       if (!key || jwkThumbprint(key) !== keyid) denied("key");
-      verifyBytes(input, request, key);
-      let authorizationFailure;
-      try {
-        if (await options.isRevoked(origin, keyid)) denied("key_revoked");
-      } catch (error) {
-        if (options.requireFreshRevocation === false && error instanceof WebBotAuthError && error.reason === "revocation_unavailable") {
-        } else if (options.deferAuthorizationErrors && error instanceof WebBotAuthError && ["key_revoked", "revocation_unavailable", "revocation_persistence_failed"].includes(error.reason))
-          authorizationFailure = createWebBotAuthAuthorizationFailure(
-            error.reason === "revocation_persistence_failed" ? "revocation_unavailable" : error.reason
-          );
-        else throw error;
-      }
+      await verifyBytesAsync(input, request, key);
+      if (options.isRevoked) await legacyRevocationCheck(options, origin, keyid);
       const nonceTuple = JSON.stringify([origin, nonce]);
       if (nonces.has(nonceTuple)) throw new WebBotAuthError(options.replayStatus ?? 429, "nonce_replayed");
       nonces.add(nonceTuple);
@@ -320,20 +401,25 @@ async function verifyWebBotAuth(request, options) {
         origin,
         keyid,
         label: input.label,
-        verified_at: now,
-        ...authorizationFailure && { authorizationFailure }
+        verified_at: now
       });
       verified.push(signer);
     }
     for (const signer of verified) {
       const input = selected.find((i) => i.label === signer.label);
-      const result = await options.replayStore.insert(
-        signer.origin,
-        WEB_BOT_AUTH_PROFILE,
-        input.params.nonce,
-        Math.max(1, input.params.expires + 60 - now),
-        now
-      );
+      let result;
+      try {
+        result = await options.replayStore.insert(
+          signer.origin,
+          WEB_BOT_AUTH_PROFILE,
+          input.params.nonce,
+          // Acceptance is inclusive of expires + 60, so the nonce must outlive it.
+          input.params.expires + 60 - now + 1,
+          now
+        );
+      } catch (cause) {
+        throw new WebBotAuthUnavailableError("replay_unavailable", cause);
+      }
       if (result !== "ok")
         throw new WebBotAuthError(result === "replayed" ? options.replayStatus ?? 429 : 429, result);
     }
@@ -342,48 +428,109 @@ async function verifyWebBotAuth(request, options) {
   } catch (error) {
     if (error instanceof WebBotAuthError) {
       if (error.headers["Accept-Signature"]) {
-        const label = inputs(request.headers)[0]?.label ?? "sig1";
+        let label = "sig1";
+        try {
+          label = inputs(request.headers)[0]?.label ?? "sig1";
+        } catch {
+        }
         const bodyComponents = request.body ? '"content-type" "content-digest" ' : "";
         error.headers["Accept-Signature"] = `${label}=("@method" "@target-uri" "@authority" ${bodyComponents}"signature-agent";key="${label}");created;expires;nonce;keyid;tag="web-bot-auth"`;
       }
       throw error;
     }
+    if (error instanceof WebBotAuthUnavailableError) throw error;
     return denied("verification_unavailable");
   }
 }
-function verifySignatureDirectory(response, now = Date.now() / 1e3, allowTestKeys = false) {
+async function legacyRevocationCheck(options, origin, keyid) {
+  let revoked;
+  try {
+    revoked = await options.isRevoked(origin, keyid);
+  } catch (error) {
+    if (error instanceof WebBotAuthUnavailableError) throw error;
+    if (error instanceof WebBotAuthError && error.reason === "revocation_persistence_failed")
+      throw new WebBotAuthUnavailableError("revocation_persistence_failed", error);
+    if (error instanceof WebBotAuthError && error.reason === "key_revoked") return denied("key_revoked");
+    if (options.requireFreshRevocation === false && error instanceof WebBotAuthError && (error.reason === "revocation_unavailable" || error.reason === "revocation_absent"))
+      return;
+    return denied("identity_unverified");
+  }
+  if (revoked) denied("key_revoked");
+}
+function testKeysAllowed(allowTestKeys) {
+  return allowTestKeys === true && ["test", "development"].includes(process.env.NODE_ENV ?? "");
+}
+const UNSIGNED_DIRECTORY_MEDIA_TYPES = /* @__PURE__ */ new Set([
+  SIGNATURE_DIRECTORY_MEDIA_TYPE,
+  "application/jwk-set+json",
+  "application/json"
+]);
+function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}) {
   try {
     if (!Number.isFinite(now)) denied("directory_invalid");
     const origin = canonicalAgentOrigin(response.request.url);
-    if (response.request.url !== origin + SIGNATURE_DIRECTORY_PATH || response.status !== 200 || getHeaderValue(response.headers, "content-type")?.split(";")[0]?.trim().toLowerCase() !== SIGNATURE_DIRECTORY_MEDIA_TYPE)
+    if (response.request.url !== origin + SIGNATURE_DIRECTORY_PATH || response.status !== 200)
+      denied("directory_response");
+    const signed = getHeaderValue(response.headers, "signature-input") !== void 0;
+    if (!signed && options.requireSigned) denied("directory_unsigned");
+    const mediaType = getHeaderValue(response.headers, "content-type")?.split(";")[0]?.trim().toLowerCase();
+    if (signed ? mediaType !== SIGNATURE_DIRECTORY_MEDIA_TYPE : !UNSIGNED_DIRECTORY_MEDIA_TYPES.has(mediaType ?? ""))
       denied("directory_response");
     const body = response.body ?? "";
     if (Buffer.byteLength(body) > 256 * 1024) denied("directory_size");
-    assertDigest(response.headers, body);
+    if (signed || getHeaderValue(response.headers, "content-digest") !== void 0)
+      assertDirectoryDigest(response.headers, body);
     const document = parseStrictJson(body, 32);
     if (!Array.isArray(document.keys) || !document.keys.length || document.keys.length > 64) denied("directory_keys");
-    const signatures = inputs(response.headers);
-    const keys = /* @__PURE__ */ new Set();
+    const signatures = signed ? inputs(response.headers) : [];
+    const kids = /* @__PURE__ */ new Set();
+    const keys = [];
     let expires = Infinity;
-    for (const key of document.keys) {
-      if (!key || typeof key !== "object" || typeof key.kid !== "string" || key.kid !== jwkThumbprint(key) || keys.has(key.kid) || key.d !== void 0 || Object.keys(key).some((k) => k.startsWith("_private")) || key.adcp_use !== void 0 || (!allowTestKeys || !["test", "development"].includes(process.env.NODE_ENV ?? "")) && TEST_KIDS.has(key.kid))
+    for (const raw of document.keys) {
+      if (!raw || typeof raw !== "object") denied("directory_key");
+      const thumbprint = jwkThumbprint(raw);
+      const key = { ...raw, kid: raw.kid ?? thumbprint };
+      if (key.kid !== thumbprint || kids.has(key.kid) || key.d !== void 0 || Object.keys(key).some((k) => k.startsWith("_private")) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
         denied("directory_key");
-      keys.add(key.kid);
+      algorithm(key);
+      kids.add(key.kid);
+      keys.push(key);
+      if (!signed) continue;
       const proof = signatures.find((input) => input.params.keyid === key.kid && input.params.tag === DIRECTORY_TAG);
-      if (!proof || !proof.components.includes("@authority;req") || !proof.components.includes("content-digest") || !Number.isInteger(proof.params.created) || !Number.isInteger(proof.params.expires) || proof.params.created > now || proof.params.expires <= now || proof.params.expires <= proof.params.created)
+      if (!proof || !proof.components.includes("@authority;req") || !proof.components.includes("content-digest") || !Number.isInteger(proof.params.created) || !Number.isInteger(proof.params.expires) || proof.params.created > now + DIRECTORY_CLOCK_SKEW_SECONDS || proof.params.expires <= now || proof.params.expires <= proof.params.created)
         denied("directory_proof");
       verifyBytes(proof, { ...response.request, headers: response.request.headers ?? {} }, key, response);
       expires = Math.min(expires, proof.params.expires);
     }
-    return { keys: document.keys, expires, proof: response };
+    if (!signed) expires = now + unsignedAge(options.maxUnsignedAgeSeconds);
+    return { keys, expires, signed, proof: response };
   } catch (error) {
-    if (error instanceof WebBotAuthError) throw error;
+    if (error instanceof WebBotAuthError) {
+      throw error.reason.startsWith("directory_") ? error : new WebBotAuthError(403, `directory_${error.reason}`);
+    }
     return denied("directory_invalid");
   }
 }
+function unsignedAge(seconds) {
+  const value = seconds ?? 86400;
+  if (!Number.isFinite(value) || value < 60)
+    throw new TypeError("Unsigned directory age must be a finite number of seconds, at least 60");
+  return value;
+}
+function verifySignatureDirectory(response, now = Date.now() / 1e3, allowTestKeys = false) {
+  return verifyKeyDirectory(response, now, { allowTestKeys, requireSigned: true });
+}
+function assertDirectoryDigest(headers, body) {
+  try {
+    assertDigest(headers, body);
+  } catch {
+    denied("directory_digest");
+  }
+}
 class SignatureDirectoryResolver {
   constructor(options = {}) {
     this.options = options;
+    unsignedAge(options.maxUnsignedDirectoryAgeSeconds);
   }
   options;
   cache = /* @__PURE__ */ new Map();
@@ -395,19 +542,22 @@ class SignatureDirectoryResolver {
     const origin = receivedAgentOrigin(signerOrigin);
     const now = (this.options.now ?? (() => Date.now() / 1e3))();
     const cached = this.cache.get(origin);
+    const usable = () => cached && cached.directory.expires > now ? cached.directory : void 0;
     if (cached && cached.freshUntil > now && cached.directory.expires > now) {
       const key = cached.directory.keys.find((k) => k.kid === keyid);
       if (key || (this.keyMissCooldown.get(origin) ?? 0) > now) return key ?? null;
       this.keyMissCooldown.set(origin, now + 60);
     }
-    if ((this.failures.get(origin) ?? 0) > now) {
-      if (cached && cached.directory.expires > now) return cached.directory.keys.find((k) => k.kid === keyid) ?? null;
-      return denied("directory_unavailable");
-    }
+    const fromFallback = () => {
+      const key = usable()?.keys.find((k) => k.kid === keyid);
+      return key ?? denied("directory_unavailable");
+    };
+    if ((this.failures.get(origin) ?? 0) > now) return fromFallback();
     let pending = this.pending.get(origin);
     if (!pending) {
       if ([...this.pending.keys()].filter((pendingOrigin) => eTldPlusOne(pendingOrigin) === eTldPlusOne(origin)).length >= 2 || this.pending.size >= (this.options.maxConcurrentFetches ?? 16)) {
-        if (cached && cached.directory.expires > now) return cached.directory.keys.find((k) => k.kid === keyid) ?? null;
+        const key = usable()?.keys.find((k) => k.kid === keyid);
+        if (key) return key;
         throw new WebBotAuthError(429, "directory_fetch_limit");
       }
       pending = this.fetch(origin, now);
@@ -416,7 +566,7 @@ class SignatureDirectoryResolver {
     try {
       return (await pending).keys.find((k) => k.kid === keyid) ?? null;
     } catch (error) {
-      if (cached && cached.directory.expires > now) return cached.directory.keys.find((k) => k.kid === keyid) ?? null;
+      if (usable()) return fromFallback();
       throw error;
     } finally {
       if (this.pending.get(origin) === pending) this.pending.delete(origin);
@@ -427,15 +577,22 @@ class SignatureDirectoryResolver {
       const url = origin + SIGNATURE_DIRECTORY_PATH;
       const result = await ssrfSafeFetch(url, {
         ...this.options.fetchOptions,
-        headers: { accept: SIGNATURE_DIRECTORY_MEDIA_TYPE },
+        headers: {
+          accept: `${SIGNATURE_DIRECTORY_MEDIA_TYPE}, application/jwk-set+json;q=0.9, application/json;q=0.8`
+        },
         timeoutMs: 1e4,
         maxBodyBytes: 256 * 1024
       });
-      const body = new TextDecoder("utf-8", { fatal: true }).decode(result.body);
-      const directory = verifySignatureDirectory(
+      if (result.status !== 200) denied("directory_unavailable");
+      const body = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(result.body);
+      const directory = verifyKeyDirectory(
         { status: result.status, headers: result.headers, body, request: { method: "GET", url } },
         now,
-        this.options.allowTestKeys
+        {
+          allowTestKeys: this.options.allowTestKeys,
+          requireSigned: this.options.requireSignedDirectories,
+          maxUnsignedAgeSeconds: this.options.maxUnsignedDirectoryAgeSeconds
+        }
       );
       const cacheControl = result.headers["cache-control"] ?? "";
       const maxAge = /(?:^|,)\s*(?:no-cache|no-store)(?:,|$)/i.test(cacheControl) ? 0 : Number(cacheControl.match(/(?:^|,)\s*max-age=(\d+)/i)?.[1] ?? 300);
@@ -460,10 +617,14 @@ class SignatureDirectoryResolver {
     }
   }
   get allowsTestKeys() {
-    return this.options.allowTestKeys === true && ["test", "development"].includes(process.env.NODE_ENV ?? "");
+    return testKeysAllowed(this.options.allowTestKeys);
+  }
+  /** The directory currently used to verify `origin`, including one kept through a failed refresh. */
+  getVerifiedDirectory(origin) {
+    return this.cache.get(receivedAgentOrigin(origin))?.directory;
   }
   getAuditProof(origin) {
-    return this.cache.get(receivedAgentOrigin(origin))?.directory.proof;
+    return this.getVerifiedDirectory(origin)?.proof;
   }
 }
 async function signBase(base, key) {
@@ -476,8 +637,15 @@ async function signBase(base, key) {
       throw new TypeError("Web Bot Auth provider identity does not match its public key");
     return key.provider.sign(Buffer.from(base));
   }
-  const privateKey = createPrivateKey({ key: jwk, format: "jwk" });
-  return alg === "ed25519" ? nodeSign(null, Buffer.from(base), privateKey) : nodeSign("sha256", Buffer.from(base), { key: privateKey, dsaEncoding: "ieee-p1363" });
+  if (alg === "rsa-pss-sha512") {
+    const privateKey = createPrivateKey({ key: jwk, format: "jwk" });
+    return nodeSign("sha512", Buffer.from(base), {
+      key: privateKey,
+      padding: cryptoConstants.RSA_PKCS1_PSS_PADDING,
+      saltLength: 64
+    });
+  }
+  return signWithPrivateJwkAsync(alg, jwk, Buffer.from(base));
 }
 async function signWebBotAuth(request, key, options) {
   const origin = canonicalAgentOrigin(options.origin);
@@ -486,9 +654,15 @@ async function signWebBotAuth(request, key, options) {
   const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
   const now = Math.floor((options.now ?? (() => Date.now() / 1e3))());
   const window = options.windowSeconds ?? 300;
-  const nonce = options.nonce ?? randomBytes(32).toString("base64url");
+  const nonce = options.nonce ?? randomBytes(64).toString("base64url");
   if (!Number.isInteger(window) || window < 1 || window > 300 || !/^[A-Za-z0-9_+\/-]{22,256}={0,2}$/.test(nonce))
     throw new TypeError("Invalid Web Bot Auth lifetime or nonce");
+  if (!options.relay && ["signature", "signature-input", "signature-agent"].some(
+    (name) => getHeaderValue(request.headers, name) !== void 0
+  ))
+    throw new TypeError(
+      "Request already carries signature fields; pass relay: true to add a covering signature instead of replacing them"
+    );
   const headers = {};
   for (const [name, value] of Object.entries(request.headers))
     if (value !== void 0 && !["signature", "signature-input", "signature-agent", "content-digest"].includes(name.toLowerCase()))
@@ -500,6 +674,8 @@ async function signWebBotAuth(request, key, options) {
     headers["content-digest"] = computeContentDigest(request.body, "rfc8941-base64");
     components.push('"content-type"', '"content-digest"');
   }
+  if (options.relay && ["signature", "signature-input", "signature-agent"].some((name) => !getHeaderValue(request.headers, name)))
+    throw new TypeError("Relay requires the existing signature fields");
   const earlier = options.relay ? inputs(request.headers) : [];
   if (earlier.some((input2) => input2.label === label || input2.params.tag !== WEB_BOT_AUTH_PROFILE))
     throw new TypeError("Relay requires existing Web Bot Auth signatures and a fresh label");
@@ -522,7 +698,10 @@ async function signWebBotAuth(request, key, options) {
   headers["signature-input"] = `${priorInput ? priorInput + ", " : ""}${label}=(${components.join(" ")});created=${now};expires=${now + window};nonce="${nonce}";keyid="${jwkThumbprint(jwk)}";alg="${algorithm(jwk)}";tag="web-bot-auth"`;
   const input = parseSignatureInput(headers["signature-input"], label);
   if (priorSignature) headers.signature = priorSignature;
-  const bytes = await signBase(buildWebBotAuthSignatureBase(input, { ...request, headers }), key);
+  const bytes = await signBase(
+    buildWebBotAuthSignatureBase(input, { ...request, url: new URL(request.url).href, headers }),
+    key
+  );
   headers.signature = `${priorSignature ? priorSignature + ", " : ""}${label}=:${Buffer.from(bytes).toString("base64")}:`;
   return headers;
 }
@@ -538,8 +717,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
     const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
     return {
       kty: jwk.kty,
-      crv: jwk.crv,
-      x: jwk.x,
+      ...jwk.kty === "RSA" ? { n: jwk.n, e: jwk.e } : { crv: jwk.crv, x: jwk.x },
       ...jwk.y ? { y: jwk.y } : {},
       kid: jwkThumbprint(jwk),
       use: "sig"
@@ -560,7 +738,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
   const signatureInputs = [], signatures = [];
   for (let i = 0; i < keys.length; i++) {
     const label = `key${i + 1}`;
-    const value = `${label}=("@authority";req "content-digest");created=${now};expires=${now + lifetime};keyid="${keys[i].kid}";alg="${algorithm(keys[i])}";tag="${DIRECTORY_TAG}"`;
+    const value = `${label}=("@authority";req "content-digest");created=${now - DIRECTORY_CLOCK_SKEW_SECONDS};expires=${now + lifetime};keyid="${keys[i].kid}";alg="${algorithm(keys[i])}";tag="${DIRECTORY_TAG}"`;
     const input = parseSignatureInput(value, label);
     const bytes = await signBase(
       buildWebBotAuthSignatureBase(input, { method: "GET", url: response.request.url, headers: {} }, response),
@@ -586,7 +764,7 @@ function createWebBotAuthFetch(upstream, key, options) {
     if (init?.body != null) {
       if (typeof init.body === "string") body = init.body;
       else if (init.body instanceof Uint8Array || init.body instanceof ArrayBuffer)
-        body = new TextDecoder("utf-8", { fatal: true }).decode(init.body);
+        body = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(init.body);
       else throw new TypeError("Web Bot Auth fetch requires a UTF-8 string or byte body");
     }
     const headers = {};
@@ -606,19 +784,26 @@ export {
   WEB_BOT_AUTH_DRAFT_REVISION,
   WEB_BOT_AUTH_PROFILE,
   WebBotAuthError,
+  WebBotAuthUnavailableError,
   buildWebBotAuthSignatureBase,
   createSignedSignatureDirectory,
   createWebBotAuthAuthorizationFailure,
   createWebBotAuthFetch,
+  deferWebBotAuthPrincipalFailure,
   getWebBotAuthAuthorizationFailure,
   getWebBotAuthLegacyOriginGate,
   isVerifiedWebBotSigner,
+  isWebBotAuthRevocationChecked,
   jwkThumbprint,
   receivedAgentOrigin,
   registerWebBotAuthLegacyOriginGate,
+  registerWebBotAuthRevocationCheck,
   selectSignatureProfile,
   signWebBotAuth,
+  verifyKeyDirectory,
   verifySignatureDirectory,
   verifyWebBotAuth,
-  webBotAuthToolFailure
+  webBotAuthPrincipalFailureError,
+  webBotAuthToolFailure,
+  webBotAuthUnavailableResponse
 };