@adcp/sdk 16.0.0-beta.5 → 16.0.0-beta.7

package/dist/lib/signing/crypto.d.ts

@@ -15,5 +15,5 @@ export declare function verifySignatureAsync(alg: string, publicKey: KeyObject |
  * path passes the key as a JWK so workerd accepts it (#3243).
  */
 export declare function signWithPrivateJwk(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Uint8Array;
-/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 when available. */
+/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 and RSA-PSS when available (workerd, #3243). */
 export declare function signWithPrivateJwkAsync(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Promise<Uint8Array>;

package/dist/lib/signing/crypto.js

@@ -87,15 +87,36 @@ function privateP256Jwk(jwk) {
 async function verifySignatureAsync(alg, publicKey, data, signature) {
   const subtle = subtleCrypto();
   const keyObject = () => isKeyObject(publicKey) ? publicKey : jwkToPublicKey(publicKey);
-  if (alg !== "ecdsa-p256-sha256" || !subtle) return verifySignature(alg, keyObject(), data, signature);
+  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
+    return verifySignature(alg, keyObject(), data, signature);
   try {
     const jwk = isKeyObject(publicKey) ? publicKey.export({ format: "jwk" }) : publicKey;
+    if (alg === "rsa-pss-sha512") {
+      const key2 = await importRsaPssVerifyKey(subtle, jwk);
+      return await subtle.verify(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(signature), toArrayBuffer(data));
+    }
     const key = await importP256VerifyKey(subtle, jwk);
     return await subtle.verify(P256_SHA256, key, toArrayBuffer(signature), toArrayBuffer(data));
   } catch {
     return false;
   }
 }
+const RSA_PSS_SHA512 = { name: "RSA-PSS", hash: "SHA-512" };
+const RSA_PSS_SHA512_SIGN = { name: "RSA-PSS", saltLength: 64 };
+const rsaPssVerifyKeys = /* @__PURE__ */ new Map();
+function importRsaPssVerifyKey(subtle, jwk) {
+  if (jwk.kty !== "RSA" || typeof jwk.n !== "string" || typeof jwk.e !== "string")
+    return Promise.reject(new TypeError("Not an RSA public key"));
+  const cacheKey = `${jwk.e}.${jwk.n}`;
+  let key = rsaPssVerifyKeys.get(cacheKey);
+  if (!key) {
+    key = subtle.importKey("jwk", { kty: "RSA", n: jwk.n, e: jwk.e }, RSA_PSS_SHA512, false, ["verify"]);
+    key.catch(() => rsaPssVerifyKeys.delete(cacheKey));
+    if (rsaPssVerifyKeys.size >= 256) rsaPssVerifyKeys.delete(rsaPssVerifyKeys.keys().next().value);
+    rsaPssVerifyKeys.set(cacheKey, key);
+  }
+  return key;
+}
 function isKeyObject(value) {
   return typeof value?.export === "function" && "asymmetricKeyType" in value;
 }
@@ -118,11 +139,25 @@ function signWithPrivateJwk(alg, privateJwk, data) {
     return new Uint8Array((0, import_crypto.sign)(null, data, (0, import_crypto.createPrivateKey)({ key: privateJwk, format: "jwk" })));
   if (alg === "ecdsa-p256-sha256")
     return new Uint8Array((0, import_crypto.sign)("sha256", data, { key: privateJwk, format: "jwk", dsaEncoding: "ieee-p1363" }));
+  if (alg === "rsa-pss-sha512")
+    return new Uint8Array(
+      (0, import_crypto.sign)("sha512", data, {
+        key: (0, import_crypto.createPrivateKey)({ key: privateJwk, format: "jwk" }),
+        padding: import_crypto.constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: 64
+      })
+    );
   throw new TypeError(`Unsupported signing algorithm: ${alg}`);
 }
 async function signWithPrivateJwkAsync(alg, privateJwk, data) {
   const subtle = subtleCrypto();
-  if (alg !== "ecdsa-p256-sha256" || !subtle) return signWithPrivateJwk(alg, privateJwk, data);
+  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
+    return signWithPrivateJwk(alg, privateJwk, data);
+  if (alg === "rsa-pss-sha512") {
+    const { kty, n, e, d, p, q, dp, dq, qi } = privateJwk;
+    const key2 = await subtle.importKey("jwk", { kty, n, e, d, p, q, dp, dq, qi }, RSA_PSS_SHA512, false, ["sign"]);
+    return new Uint8Array(await subtle.sign(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(data)));
+  }
   const key = await subtle.importKey("jwk", privateP256Jwk(privateJwk), P256, false, ["sign"]);
   return new Uint8Array(await subtle.sign(P256_SHA256, key, toArrayBuffer(data)));
 }

package/dist/lib/signing/crypto.mjs

@@ -66,15 +66,36 @@ function privateP256Jwk(jwk) {
 async function verifySignatureAsync(alg, publicKey, data, signature) {
   const subtle = subtleCrypto();
   const keyObject = () => isKeyObject(publicKey) ? publicKey : jwkToPublicKey(publicKey);
-  if (alg !== "ecdsa-p256-sha256" || !subtle) return verifySignature(alg, keyObject(), data, signature);
+  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
+    return verifySignature(alg, keyObject(), data, signature);
   try {
     const jwk = isKeyObject(publicKey) ? publicKey.export({ format: "jwk" }) : publicKey;
+    if (alg === "rsa-pss-sha512") {
+      const key2 = await importRsaPssVerifyKey(subtle, jwk);
+      return await subtle.verify(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(signature), toArrayBuffer(data));
+    }
     const key = await importP256VerifyKey(subtle, jwk);
     return await subtle.verify(P256_SHA256, key, toArrayBuffer(signature), toArrayBuffer(data));
   } catch {
     return false;
   }
 }
+const RSA_PSS_SHA512 = { name: "RSA-PSS", hash: "SHA-512" };
+const RSA_PSS_SHA512_SIGN = { name: "RSA-PSS", saltLength: 64 };
+const rsaPssVerifyKeys = /* @__PURE__ */ new Map();
+function importRsaPssVerifyKey(subtle, jwk) {
+  if (jwk.kty !== "RSA" || typeof jwk.n !== "string" || typeof jwk.e !== "string")
+    return Promise.reject(new TypeError("Not an RSA public key"));
+  const cacheKey = `${jwk.e}.${jwk.n}`;
+  let key = rsaPssVerifyKeys.get(cacheKey);
+  if (!key) {
+    key = subtle.importKey("jwk", { kty: "RSA", n: jwk.n, e: jwk.e }, RSA_PSS_SHA512, false, ["verify"]);
+    key.catch(() => rsaPssVerifyKeys.delete(cacheKey));
+    if (rsaPssVerifyKeys.size >= 256) rsaPssVerifyKeys.delete(rsaPssVerifyKeys.keys().next().value);
+    rsaPssVerifyKeys.set(cacheKey, key);
+  }
+  return key;
+}
 function isKeyObject(value) {
   return typeof value?.export === "function" && "asymmetricKeyType" in value;
 }
@@ -97,11 +118,25 @@ function signWithPrivateJwk(alg, privateJwk, data) {
     return new Uint8Array(nodeSign(null, data, createPrivateKey({ key: privateJwk, format: "jwk" })));
   if (alg === "ecdsa-p256-sha256")
     return new Uint8Array(nodeSign("sha256", data, { key: privateJwk, format: "jwk", dsaEncoding: "ieee-p1363" }));
+  if (alg === "rsa-pss-sha512")
+    return new Uint8Array(
+      nodeSign("sha512", data, {
+        key: createPrivateKey({ key: privateJwk, format: "jwk" }),
+        padding: constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: 64
+      })
+    );
   throw new TypeError(`Unsupported signing algorithm: ${alg}`);
 }
 async function signWithPrivateJwkAsync(alg, privateJwk, data) {
   const subtle = subtleCrypto();
-  if (alg !== "ecdsa-p256-sha256" || !subtle) return signWithPrivateJwk(alg, privateJwk, data);
+  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
+    return signWithPrivateJwk(alg, privateJwk, data);
+  if (alg === "rsa-pss-sha512") {
+    const { kty, n, e, d, p, q, dp, dq, qi } = privateJwk;
+    const key2 = await subtle.importKey("jwk", { kty, n, e, d, p, q, dp, dq, qi }, RSA_PSS_SHA512, false, ["sign"]);
+    return new Uint8Array(await subtle.sign(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(data)));
+  }
   const key = await subtle.importKey("jwk", privateP256Jwk(privateJwk), P256, false, ["sign"]);
   return new Uint8Array(await subtle.sign(P256_SHA256, key, toArrayBuffer(data)));
 }

package/dist/lib/signing/parser.d.mts

@@ -24,6 +24,12 @@ export interface ParsedSignature {
     bytes: Uint8Array;
 }
 export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
+/**
+ * {@link parseSignatureInput} for one member of an already parsed (and
+ * duplicate-checked) `Signature-Input` dictionary, so a caller that needs
+ * every label parses the field once.
+ */
+export declare function parseSignatureInputMember(label: string, entry: unknown): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
  * RFC 8941 / RFC 9651 parsers deduplicate dictionary keys and parameter keys

package/dist/lib/signing/parser.d.ts

@@ -24,6 +24,12 @@ export interface ParsedSignature {
     bytes: Uint8Array;
 }
 export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
+/**
+ * {@link parseSignatureInput} for one member of an already parsed (and
+ * duplicate-checked) `Signature-Input` dictionary, so a caller that needs
+ * every label parses the field once.
+ */
+export declare function parseSignatureInputMember(label: string, entry: unknown): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
  * RFC 8941 / RFC 9651 parsers deduplicate dictionary keys and parameter keys

package/dist/lib/signing/parser.js

@@ -20,6 +20,7 @@ var parser_exports = {};
 __export(parser_exports, {
   parseSignature: () => parseSignature,
   parseSignatureInput: () => parseSignatureInput,
+  parseSignatureInputMember: () => parseSignatureInputMember,
   rejectDuplicateDictionaryKeys: () => rejectDuplicateDictionaryKeys
 });
 module.exports = __toCommonJS(parser_exports);
@@ -43,7 +44,9 @@ function parseSignatureInput(headerValue, expectedLabel) {
   if (dict.size === 0) malformed("Signature-Input header is empty");
   const label = expectedLabel ?? (dict.has("sig1") ? "sig1" : dict.keys().next().value);
   if (!dict.has(label)) malformed("Signature-Input label is missing");
-  const entry = dict.get(label);
+  return parseSignatureInputMember(label, dict.get(label));
+}
+function parseSignatureInputMember(label, entry) {
   if (!isInnerList(entry)) {
     malformed("Signature-Input value must be a parenthesized component list");
   }
@@ -255,5 +258,6 @@ function normalizeByteSequenceBase64(input) {
 0 && (module.exports = {
   parseSignature,
   parseSignatureInput,
+  parseSignatureInputMember,
   rejectDuplicateDictionaryKeys
 });

package/dist/lib/signing/parser.mjs

@@ -18,7 +18,9 @@ function parseSignatureInput(headerValue, expectedLabel) {
   if (dict.size === 0) malformed("Signature-Input header is empty");
   const label = expectedLabel ?? (dict.has("sig1") ? "sig1" : dict.keys().next().value);
   if (!dict.has(label)) malformed("Signature-Input label is missing");
-  const entry = dict.get(label);
+  return parseSignatureInputMember(label, dict.get(label));
+}
+function parseSignatureInputMember(label, entry) {
   if (!isInnerList(entry)) {
     malformed("Signature-Input value must be a parenthesized component list");
   }
@@ -229,5 +231,6 @@ function normalizeByteSequenceBase64(input) {
 export {
   parseSignature,
   parseSignatureInput,
+  parseSignatureInputMember,
   rejectDuplicateDictionaryKeys
 };

package/dist/lib/signing/web-bot-auth.d.mts

@@ -1,6 +1,5 @@
 import { type SsrfFetchOptions } from '../net/index.mjs';
 import { type RequestLike, type ResponseLike } from './canonicalize.mjs';
-import { type ParsedSignatureInput } from './parser.mjs';
 import type { JwksResolver } from './jwks.mjs';
 import type { ReplayStore } from './replay.mjs';
 import type { AdcpJsonWebKey } from './types.mjs';
@@ -9,11 +8,21 @@ export declare const WEB_BOT_AUTH_PROFILE: "web-bot-auth";
 export declare const WEB_BOT_AUTH_DRAFT_REVISION: "draft-ietf-webbotauth-httpsig-protocol-00";
 export declare const SIGNATURE_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 export declare const SIGNATURE_DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
+/** The profile's signature algorithms (wba-profile.mdx "Profile rules"). ES256 is RFC 9421 profile only. */
+export declare const WEB_BOT_AUTH_ALGORITHMS: readonly ["ed25519", "rsa-pss-sha512"];
 /**
- * Signature-path outcome (WBA §4, DR-0023): 400 for a field that does not
- * parse, 403 for a signature that does not verify (with `Accept-Signature`
- * unless the key is revoked), 429 for a replay. Any AdCP body is the generic
- * authentication error; signature-specific detail stays in `reason` (logs).
+ * The profile's `Accept-Signature` member (RFC 9421 §5.1): the label, the
+ * components the profile requires, and its parameters. A replay challenge
+ * carries the fresh `nonce` the signer uses on its next attempt.
+ */
+export declare function webBotAuthAcceptSignature(label?: string, hasBody?: boolean, nonce?: string): string;
+/**
+ * Signature-path outcome (wba-profile.mdx "Error responses"): 400 when the
+ * signature fields do not parse; 403 with `Accept-Signature` when a signature
+ * fails verification or the profile rules (without it for a revoked key); 429
+ * with `Accept-Signature` carrying a fresh `nonce` for a reused signature or
+ * nonce. A 429 for local load shedding carries `Retry-After` instead. Any AdCP
+ * body is the generic authentication error; detail stays in `reason` (logs).
  * Infrastructure the verifier depends on is reported separately by
  * {@link WebBotAuthUnavailableError}.
  */
@@ -40,6 +49,16 @@ export declare class WebBotAuthUnavailableError extends Error {
     readonly reason: string;
     constructor(reason: string, cause?: unknown);
 }
+/**
+ * The answer to an unsigned request to an operation in `required_for` from a
+ * caller with no other credential the verifier accepts, when the verifier
+ * advertises only `web-bot-auth`: 403 with `Accept-Signature`. A verifier that
+ * also advertises the AdCP RFC 9421 profile answers as that profile does (401
+ * `request_signature_required`) and adds {@link webBotAuthAcceptSignature}.
+ */
+export declare function unsignedWebBotAuthError(hasBody: boolean): WebBotAuthError;
+/** Whether a `request_signing.profiles` advertisement names Web Bot Auth and not the AdCP RFC 9421 profile. */
+export declare function advertisesOnlyWebBotAuth(profiles: readonly string[] | undefined): boolean;
 export declare function selectSignatureProfile(request: Pick<RequestLike, 'headers'>): 'web-bot-auth' | 'rfc9421';
 /**
  * RFC 7638 JWK SHA-256 thumbprint, synchronous. Byte-identical to jose's
@@ -49,10 +68,13 @@ export declare function jwkThumbprint(jwk: Partial<Pick<AdcpJsonWebKey, 'kty' |
     n?: unknown;
     e?: unknown;
 }): string;
+/**
+ * Refuse a Web Bot Auth signing key the profile does not allow, at wire-up
+ * time rather than on the first request.
+ */
+export declare function assertWebBotAuthSigningKey(key: WebBotSigningKey): void;
 /** Reject authority normalization differentials on received identifiers. */
 export declare function receivedAgentOrigin(value: string): string;
-/** RFC 9421 dictionary-member extraction, including relay member coverage. */
-export declare function buildWebBotAuthSignatureBase(input: ParsedSignatureInput, request: RequestLike, response?: ResponseLike): string;
 export declare function getWebBotAuthLegacyOriginGate(resolver: Function | undefined): ((origin: string) => Promise<void>) | undefined;
 export interface WebBotAuthAuthorizationFailure {
     code: 'PERMISSION_DENIED' | 'SERVICE_UNAVAILABLE';
@@ -92,7 +114,10 @@ export interface VerifyWebBotAuthOptions {
     /** Atomic, shared across endpoints and replicas. Nonce scope is the identity origin, not the rotating kid. */
     replayStore: ReplayStore;
     now?: () => number;
-    /** Older #7894 vector draft expects 403; ratified R2 defaults to 429. */
+    /**
+     * @deprecated No effect. A reused signature or nonce is always 429 with
+     * `Accept-Signature` carrying a fresh nonce (adcp#7894, `negative/002`).
+     */
     replayStatus?: 403 | 429;
     /**
      * @deprecated Revocation is an identity and authorization check, not part of
@@ -108,30 +133,39 @@ export interface VerifyWebBotAuthOptions {
     /** @deprecated No effect; revocation outcomes are no longer deferred into tool errors. */
     deferAuthorizationErrors?: boolean;
 }
+/**
+ * Verify a Web Bot Auth request (wba-profile.mdx "Verification"). Resolves to
+ * exactly one verified signer: the profile takes one `web-bot-auth` signature
+ * and one `Signature-Agent` member per request. The array shape is kept for
+ * principal resolvers written against earlier drafts.
+ */
 export declare function verifyWebBotAuth(request: RequestLike, options: VerifyWebBotAuthOptions): Promise<VerifiedWebBotSigner[]>;
 export interface VerifiedSignatureDirectory {
     keys: AdcpJsonWebKey[];
-    /** Signed: the earliest proof expiry. Unsigned: verification time plus the unsigned-age bound. */
+    /** The earliest proof expiry. */
     expires: number;
-    /** Whether every key carried an Appendix B signature. */
-    signed: boolean;
+    /** @deprecated Always `true`: the profile accepts only signed directories (WBA Appendix B.1). */
+    signed: true;
     /** Preserve exact bytes and response headers for auditing. */
     proof: ResponseLike;
 }
 /**
- * Verify a key directory response (draft-meunier-http-message-signatures-directory).
- * Appendix B signatures are a SHOULD there: a directory without
- * `Signature-Input` is accepted as a plain JWKS unless `requireSigned`, with
- * every key checked against its RFC 7638 thumbprint. When signatures are
- * present, every key must carry a valid one.
+ * Verify a key directory response (wba-profile.mdx "Key directories", WBA
+ * Appendix B.1). The response must be signed once per key, each signature
+ * covering `"@authority";req` and `content-digest` with `created`, `expires`,
+ * the key's thumbprint as `keyid` and `tag="http-message-signatures-directory"`,
+ * and verifying under the key the directory itself provides. An unsigned
+ * directory is a discovery failure.
  */
 export declare function verifyKeyDirectory(response: ResponseLike, now?: number, options?: {
     allowTestKeys?: boolean;
+    /** @deprecated No effect: directories must always be signed. */
     requireSigned?: boolean;
+    /** @deprecated No effect: unsigned directories are refused. */
     maxUnsignedAgeSeconds?: number;
-}): VerifiedSignatureDirectory;
-/** Signed directories only (Appendix B). Prefer {@link verifyKeyDirectory}. */
-export declare function verifySignatureDirectory(response: ResponseLike, now?: number, allowTestKeys?: boolean): VerifiedSignatureDirectory;
+}): Promise<VerifiedSignatureDirectory>;
+/** @deprecated Same as {@link verifyKeyDirectory}: every directory must be signed. */
+export declare function verifySignatureDirectory(response: ResponseLike, now?: number, allowTestKeys?: boolean): Promise<VerifiedSignatureDirectory>;
 export interface SignatureDirectoryResolverOptions {
     now?: () => number;
     fetchOptions?: Pick<SsrfFetchOptions, 'lookup' | 'trustedFetchFn'>;
@@ -139,9 +173,9 @@ export interface SignatureDirectoryResolverOptions {
     maxOrigins?: number;
     /** Globally bound concurrency across attacker-selected origins. */
     maxConcurrentFetches?: number;
-    /** Refuse plain JWKS directories without Appendix B signatures. Default false. */
+    /** @deprecated No effect: signed directories (WBA Appendix B.1) are always required. */
     requireSignedDirectories?: boolean;
-    /** How long an unsigned directory may keep verifying after a failed refresh (seconds). Default 86400. */
+    /** @deprecated No effect: unsigned directories are refused. */
     maxUnsignedDirectoryAgeSeconds?: number;
 }
 /**
@@ -168,9 +202,9 @@ export interface WebBotSigningOptions {
     origin: string;
     label?: string;
     now?: () => number;
+    /** 64 bytes, unpadded Base64URL or canonical Base64. Defaults to 64 fresh random bytes. */
     nonce?: string;
     windowSeconds?: number;
-    relay?: boolean;
 }
 export type WebBotSigningKey = {
     privateKey: AdcpJsonWebKey;
@@ -178,6 +212,11 @@ export type WebBotSigningKey = {
     publicKey: AdcpJsonWebKey;
     provider: SigningProvider;
 };
+/**
+ * Sign a request under the profile: one `web-bot-auth` signature labelled
+ * `label`, one covered `Signature-Agent` member naming `origin`, a 64-byte
+ * nonce, and a lifetime of at most 300 seconds.
+ */
 export declare function signWebBotAuth(request: RequestLike, key: WebBotSigningKey, options: WebBotSigningOptions): Promise<Record<string, string>>;
 /** Regenerate after rotation and periodically before proofs expire. No private material is published. */
 export declare function createSignedSignatureDirectory(originUrl: string, signingKeys: WebBotSigningKey[], options?: {

package/dist/lib/signing/web-bot-auth.d.ts

@@ -1,6 +1,5 @@
 import { type SsrfFetchOptions } from '../net';
 import { type RequestLike, type ResponseLike } from './canonicalize';
-import { type ParsedSignatureInput } from './parser';
 import type { JwksResolver } from './jwks';
 import type { ReplayStore } from './replay';
 import type { AdcpJsonWebKey } from './types';
@@ -9,11 +8,21 @@ export declare const WEB_BOT_AUTH_PROFILE: "web-bot-auth";
 export declare const WEB_BOT_AUTH_DRAFT_REVISION: "draft-ietf-webbotauth-httpsig-protocol-00";
 export declare const SIGNATURE_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 export declare const SIGNATURE_DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
+/** The profile's signature algorithms (wba-profile.mdx "Profile rules"). ES256 is RFC 9421 profile only. */
+export declare const WEB_BOT_AUTH_ALGORITHMS: readonly ["ed25519", "rsa-pss-sha512"];
 /**
- * Signature-path outcome (WBA §4, DR-0023): 400 for a field that does not
- * parse, 403 for a signature that does not verify (with `Accept-Signature`
- * unless the key is revoked), 429 for a replay. Any AdCP body is the generic
- * authentication error; signature-specific detail stays in `reason` (logs).
+ * The profile's `Accept-Signature` member (RFC 9421 §5.1): the label, the
+ * components the profile requires, and its parameters. A replay challenge
+ * carries the fresh `nonce` the signer uses on its next attempt.
+ */
+export declare function webBotAuthAcceptSignature(label?: string, hasBody?: boolean, nonce?: string): string;
+/**
+ * Signature-path outcome (wba-profile.mdx "Error responses"): 400 when the
+ * signature fields do not parse; 403 with `Accept-Signature` when a signature
+ * fails verification or the profile rules (without it for a revoked key); 429
+ * with `Accept-Signature` carrying a fresh `nonce` for a reused signature or
+ * nonce. A 429 for local load shedding carries `Retry-After` instead. Any AdCP
+ * body is the generic authentication error; detail stays in `reason` (logs).
  * Infrastructure the verifier depends on is reported separately by
  * {@link WebBotAuthUnavailableError}.
  */
@@ -40,6 +49,16 @@ export declare class WebBotAuthUnavailableError extends Error {
     readonly reason: string;
     constructor(reason: string, cause?: unknown);
 }
+/**
+ * The answer to an unsigned request to an operation in `required_for` from a
+ * caller with no other credential the verifier accepts, when the verifier
+ * advertises only `web-bot-auth`: 403 with `Accept-Signature`. A verifier that
+ * also advertises the AdCP RFC 9421 profile answers as that profile does (401
+ * `request_signature_required`) and adds {@link webBotAuthAcceptSignature}.
+ */
+export declare function unsignedWebBotAuthError(hasBody: boolean): WebBotAuthError;
+/** Whether a `request_signing.profiles` advertisement names Web Bot Auth and not the AdCP RFC 9421 profile. */
+export declare function advertisesOnlyWebBotAuth(profiles: readonly string[] | undefined): boolean;
 export declare function selectSignatureProfile(request: Pick<RequestLike, 'headers'>): 'web-bot-auth' | 'rfc9421';
 /**
  * RFC 7638 JWK SHA-256 thumbprint, synchronous. Byte-identical to jose's
@@ -49,10 +68,13 @@ export declare function jwkThumbprint(jwk: Partial<Pick<AdcpJsonWebKey, 'kty' |
     n?: unknown;
     e?: unknown;
 }): string;
+/**
+ * Refuse a Web Bot Auth signing key the profile does not allow, at wire-up
+ * time rather than on the first request.
+ */
+export declare function assertWebBotAuthSigningKey(key: WebBotSigningKey): void;
 /** Reject authority normalization differentials on received identifiers. */
 export declare function receivedAgentOrigin(value: string): string;
-/** RFC 9421 dictionary-member extraction, including relay member coverage. */
-export declare function buildWebBotAuthSignatureBase(input: ParsedSignatureInput, request: RequestLike, response?: ResponseLike): string;
 export declare function getWebBotAuthLegacyOriginGate(resolver: Function | undefined): ((origin: string) => Promise<void>) | undefined;
 export interface WebBotAuthAuthorizationFailure {
     code: 'PERMISSION_DENIED' | 'SERVICE_UNAVAILABLE';
@@ -92,7 +114,10 @@ export interface VerifyWebBotAuthOptions {
     /** Atomic, shared across endpoints and replicas. Nonce scope is the identity origin, not the rotating kid. */
     replayStore: ReplayStore;
     now?: () => number;
-    /** Older #7894 vector draft expects 403; ratified R2 defaults to 429. */
+    /**
+     * @deprecated No effect. A reused signature or nonce is always 429 with
+     * `Accept-Signature` carrying a fresh nonce (adcp#7894, `negative/002`).
+     */
     replayStatus?: 403 | 429;
     /**
      * @deprecated Revocation is an identity and authorization check, not part of
@@ -108,30 +133,39 @@ export interface VerifyWebBotAuthOptions {
     /** @deprecated No effect; revocation outcomes are no longer deferred into tool errors. */
     deferAuthorizationErrors?: boolean;
 }
+/**
+ * Verify a Web Bot Auth request (wba-profile.mdx "Verification"). Resolves to
+ * exactly one verified signer: the profile takes one `web-bot-auth` signature
+ * and one `Signature-Agent` member per request. The array shape is kept for
+ * principal resolvers written against earlier drafts.
+ */
 export declare function verifyWebBotAuth(request: RequestLike, options: VerifyWebBotAuthOptions): Promise<VerifiedWebBotSigner[]>;
 export interface VerifiedSignatureDirectory {
     keys: AdcpJsonWebKey[];
-    /** Signed: the earliest proof expiry. Unsigned: verification time plus the unsigned-age bound. */
+    /** The earliest proof expiry. */
     expires: number;
-    /** Whether every key carried an Appendix B signature. */
-    signed: boolean;
+    /** @deprecated Always `true`: the profile accepts only signed directories (WBA Appendix B.1). */
+    signed: true;
     /** Preserve exact bytes and response headers for auditing. */
     proof: ResponseLike;
 }
 /**
- * Verify a key directory response (draft-meunier-http-message-signatures-directory).
- * Appendix B signatures are a SHOULD there: a directory without
- * `Signature-Input` is accepted as a plain JWKS unless `requireSigned`, with
- * every key checked against its RFC 7638 thumbprint. When signatures are
- * present, every key must carry a valid one.
+ * Verify a key directory response (wba-profile.mdx "Key directories", WBA
+ * Appendix B.1). The response must be signed once per key, each signature
+ * covering `"@authority";req` and `content-digest` with `created`, `expires`,
+ * the key's thumbprint as `keyid` and `tag="http-message-signatures-directory"`,
+ * and verifying under the key the directory itself provides. An unsigned
+ * directory is a discovery failure.
  */
 export declare function verifyKeyDirectory(response: ResponseLike, now?: number, options?: {
     allowTestKeys?: boolean;
+    /** @deprecated No effect: directories must always be signed. */
     requireSigned?: boolean;
+    /** @deprecated No effect: unsigned directories are refused. */
     maxUnsignedAgeSeconds?: number;
-}): VerifiedSignatureDirectory;
-/** Signed directories only (Appendix B). Prefer {@link verifyKeyDirectory}. */
-export declare function verifySignatureDirectory(response: ResponseLike, now?: number, allowTestKeys?: boolean): VerifiedSignatureDirectory;
+}): Promise<VerifiedSignatureDirectory>;
+/** @deprecated Same as {@link verifyKeyDirectory}: every directory must be signed. */
+export declare function verifySignatureDirectory(response: ResponseLike, now?: number, allowTestKeys?: boolean): Promise<VerifiedSignatureDirectory>;
 export interface SignatureDirectoryResolverOptions {
     now?: () => number;
     fetchOptions?: Pick<SsrfFetchOptions, 'lookup' | 'trustedFetchFn'>;
@@ -139,9 +173,9 @@ export interface SignatureDirectoryResolverOptions {
     maxOrigins?: number;
     /** Globally bound concurrency across attacker-selected origins. */
     maxConcurrentFetches?: number;
-    /** Refuse plain JWKS directories without Appendix B signatures. Default false. */
+    /** @deprecated No effect: signed directories (WBA Appendix B.1) are always required. */
     requireSignedDirectories?: boolean;
-    /** How long an unsigned directory may keep verifying after a failed refresh (seconds). Default 86400. */
+    /** @deprecated No effect: unsigned directories are refused. */
     maxUnsignedDirectoryAgeSeconds?: number;
 }
 /**
@@ -168,9 +202,9 @@ export interface WebBotSigningOptions {
     origin: string;
     label?: string;
     now?: () => number;
+    /** 64 bytes, unpadded Base64URL or canonical Base64. Defaults to 64 fresh random bytes. */
     nonce?: string;
     windowSeconds?: number;
-    relay?: boolean;
 }
 export type WebBotSigningKey = {
     privateKey: AdcpJsonWebKey;
@@ -178,6 +212,11 @@ export type WebBotSigningKey = {
     publicKey: AdcpJsonWebKey;
     provider: SigningProvider;
 };
+/**
+ * Sign a request under the profile: one `web-bot-auth` signature labelled
+ * `label`, one covered `Signature-Agent` member naming `origin`, a 64-byte
+ * nonce, and a lifetime of at most 300 seconds.
+ */
 export declare function signWebBotAuth(request: RequestLike, key: WebBotSigningKey, options: WebBotSigningOptions): Promise<Record<string, string>>;
 /** Regenerate after rotation and periodically before proofs expire. No private material is published. */
 export declare function createSignedSignatureDirectory(originUrl: string, signingKeys: WebBotSigningKey[], options?: {