@adcp/sdk 16.0.0-beta.6 → 16.0.0-beta.7

package/dist/lib/core/TaskExecutor.d.mts

@@ -441,6 +441,7 @@ export declare class TaskExecutor {
      * AJV runs.
      */
     private validateResponseSchema;
+    private validateResponseSchemaAgainst;
     private responseAdcpVersionForValidation;
     private effectiveResponseAdcpVersion;
     /**

package/dist/lib/core/TaskExecutor.d.ts

@@ -441,6 +441,7 @@ export declare class TaskExecutor {
      * AJV runs.
      */
     private validateResponseSchema;
+    private validateResponseSchemaAgainst;
     private responseAdcpVersionForValidation;
     private effectiveResponseAdcpVersion;
     /**

package/dist/lib/core/TaskExecutor.js

@@ -4459,41 +4459,22 @@ class TaskExecutor {
     const mode = this.responseValidationMode;
     const logViolations = this.config.logSchemaViolations !== false;
     try {
-      let validationVersion = (serverVersion ?? this.lastKnownServerVersion) === "v2" ? "v2.5" : this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
-      if (taskName === "get_adcp_capabilities" && validationVersion !== "v2.5") {
-        validationVersion = (0, import_schema_loader.resolveServedValidationVersion)(response, validationVersion);
-      }
-      const normalizedResponse = this.normalizeResponseForValidation(response, taskName, validationVersion === "v2.5");
-      const outcome = (this.config.experimentalIdentity33?.() || this.config.identity33SchemaExperiment && normalizedResponse && typeof normalizedResponse === "object" && (0, import_adcp_version_config.isAdcpVersionAtLeast)(normalizedResponse.adcp_version, "3.3")) && mode !== "off" ? validateIdentity33Payload(taskName, "response", normalizedResponse, validationVersion) : (0, import_client_hooks.validateIncomingResponse)(taskName, normalizedResponse, mode, void 0, validationVersion);
-      if (outcome.valid) return { valid: true, errors: [] };
-      const errorStrings = outcome.issues.map((i) => `${i.pointer}: ${i.message}`);
-      if (logViolations) {
-        debugLogs.push({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          type: mode === "strict" ? "error" : "warning",
-          message: `Schema validation ${mode === "strict" ? "failed" : "warning"} for ${taskName}: ${(0, import_schema_validator.formatIssues)(
-            outcome.issues
-          )}`,
-          errors: errorStrings,
-          issues: outcome.issues,
-          schemaVariant: outcome.variant,
-          schemaVersion: validationVersion,
-          mode
-        });
-      }
-      if (mode === "warn") {
-        if (logViolations) {
-          console.warn(
-            `Schema validation failed for ${taskName} against AdCP ${validationVersion} (non-blocking):`,
-            errorStrings
-          );
-        }
-        return { valid: true, errors: [] };
-      }
-      if (logViolations) {
-        console.error(`Schema validation failed for ${taskName} against AdCP ${validationVersion}:`, errorStrings);
+      const pinnedValidationVersion = (serverVersion ?? this.lastKnownServerVersion) === "v2" ? "v2.5" : this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
+      if (taskName === "get_adcp_capabilities" && pinnedValidationVersion !== "v2.5") {
+        return (0, import_schema_loader.withServedValidationVersion)(
+          response,
+          pinnedValidationVersion,
+          (validationVersion) => this.validateResponseSchemaAgainst(response, taskName, debugLogs, mode, logViolations, validationVersion)
+        );
       }
-      return { valid: false, errors: errorStrings };
+      return this.validateResponseSchemaAgainst(
+        response,
+        taskName,
+        debugLogs,
+        mode,
+        logViolations,
+        pinnedValidationVersion
+      );
     } catch (error) {
       const errorMessage = error instanceof Error ? error.message : "unknown error";
       console.error("Error during schema validation:", errorMessage);
@@ -4503,6 +4484,39 @@ class TaskExecutor {
       };
     }
   }
+  validateResponseSchemaAgainst(response, taskName, debugLogs, mode, logViolations, validationVersion) {
+    const normalizedResponse = this.normalizeResponseForValidation(response, taskName, validationVersion === "v2.5");
+    const outcome = (this.config.experimentalIdentity33?.() || this.config.identity33SchemaExperiment && normalizedResponse && typeof normalizedResponse === "object" && (0, import_adcp_version_config.isAdcpVersionAtLeast)(normalizedResponse.adcp_version, "3.3")) && mode !== "off" ? validateIdentity33Payload(taskName, "response", normalizedResponse, validationVersion) : (0, import_client_hooks.validateIncomingResponse)(taskName, normalizedResponse, mode, void 0, validationVersion);
+    if (outcome.valid) return { valid: true, errors: [] };
+    const errorStrings = outcome.issues.map((i) => `${i.pointer}: ${i.message}`);
+    if (logViolations) {
+      debugLogs.push({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        type: mode === "strict" ? "error" : "warning",
+        message: `Schema validation ${mode === "strict" ? "failed" : "warning"} for ${taskName}: ${(0, import_schema_validator.formatIssues)(
+          outcome.issues
+        )}`,
+        errors: errorStrings,
+        issues: outcome.issues,
+        schemaVariant: outcome.variant,
+        schemaVersion: validationVersion,
+        mode
+      });
+    }
+    if (mode === "warn") {
+      if (logViolations) {
+        console.warn(
+          `Schema validation failed for ${taskName} against AdCP ${validationVersion} (non-blocking):`,
+          errorStrings
+        );
+      }
+      return { valid: true, errors: [] };
+    }
+    if (logViolations) {
+      console.error(`Schema validation failed for ${taskName} against AdCP ${validationVersion}:`, errorStrings);
+    }
+    return { valid: false, errors: errorStrings };
+  }
   responseAdcpVersionForValidation() {
     if (this.config.versionEnvelope === "major-only") return "3.0";
     return void 0;

package/dist/lib/core/TaskExecutor.mjs

@@ -26,7 +26,7 @@ import {
   resolveValidationModes
 } from "../validation/client-hooks.mjs";
 import { formatIssues } from "../validation/schema-validator.mjs";
-import { resolveServedValidationVersion } from "../validation/schema-loader.mjs";
+import { withServedValidationVersion } from "../validation/schema-loader.mjs";
 import { ADCP_VERSION } from "../version.mjs";
 import { unwrapProtocolResponse, isAdcpOperationSuccess } from "../utils/response-unwrapper.mjs";
 import { extractAdcpErrorInfo, extractCorrelationId } from "../utils/error-extraction.mjs";
@@ -4437,41 +4437,22 @@ class TaskExecutor {
     const mode = this.responseValidationMode;
     const logViolations = this.config.logSchemaViolations !== false;
     try {
-      let validationVersion = (serverVersion ?? this.lastKnownServerVersion) === "v2" ? "v2.5" : this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? ADCP_VERSION;
-      if (taskName === "get_adcp_capabilities" && validationVersion !== "v2.5") {
-        validationVersion = resolveServedValidationVersion(response, validationVersion);
-      }
-      const normalizedResponse = this.normalizeResponseForValidation(response, taskName, validationVersion === "v2.5");
-      const outcome = (this.config.experimentalIdentity33?.() || this.config.identity33SchemaExperiment && normalizedResponse && typeof normalizedResponse === "object" && isAdcpVersionAtLeast(normalizedResponse.adcp_version, "3.3")) && mode !== "off" ? validateIdentity33Payload(taskName, "response", normalizedResponse, validationVersion) : validateIncomingResponse(taskName, normalizedResponse, mode, void 0, validationVersion);
-      if (outcome.valid) return { valid: true, errors: [] };
-      const errorStrings = outcome.issues.map((i) => `${i.pointer}: ${i.message}`);
-      if (logViolations) {
-        debugLogs.push({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          type: mode === "strict" ? "error" : "warning",
-          message: `Schema validation ${mode === "strict" ? "failed" : "warning"} for ${taskName}: ${formatIssues(
-            outcome.issues
-          )}`,
-          errors: errorStrings,
-          issues: outcome.issues,
-          schemaVariant: outcome.variant,
-          schemaVersion: validationVersion,
-          mode
-        });
-      }
-      if (mode === "warn") {
-        if (logViolations) {
-          console.warn(
-            `Schema validation failed for ${taskName} against AdCP ${validationVersion} (non-blocking):`,
-            errorStrings
-          );
-        }
-        return { valid: true, errors: [] };
-      }
-      if (logViolations) {
-        console.error(`Schema validation failed for ${taskName} against AdCP ${validationVersion}:`, errorStrings);
+      const pinnedValidationVersion = (serverVersion ?? this.lastKnownServerVersion) === "v2" ? "v2.5" : this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? ADCP_VERSION;
+      if (taskName === "get_adcp_capabilities" && pinnedValidationVersion !== "v2.5") {
+        return withServedValidationVersion(
+          response,
+          pinnedValidationVersion,
+          (validationVersion) => this.validateResponseSchemaAgainst(response, taskName, debugLogs, mode, logViolations, validationVersion)
+        );
       }
-      return { valid: false, errors: errorStrings };
+      return this.validateResponseSchemaAgainst(
+        response,
+        taskName,
+        debugLogs,
+        mode,
+        logViolations,
+        pinnedValidationVersion
+      );
     } catch (error) {
       const errorMessage = error instanceof Error ? error.message : "unknown error";
       console.error("Error during schema validation:", errorMessage);
@@ -4481,6 +4462,39 @@ class TaskExecutor {
       };
     }
   }
+  validateResponseSchemaAgainst(response, taskName, debugLogs, mode, logViolations, validationVersion) {
+    const normalizedResponse = this.normalizeResponseForValidation(response, taskName, validationVersion === "v2.5");
+    const outcome = (this.config.experimentalIdentity33?.() || this.config.identity33SchemaExperiment && normalizedResponse && typeof normalizedResponse === "object" && isAdcpVersionAtLeast(normalizedResponse.adcp_version, "3.3")) && mode !== "off" ? validateIdentity33Payload(taskName, "response", normalizedResponse, validationVersion) : validateIncomingResponse(taskName, normalizedResponse, mode, void 0, validationVersion);
+    if (outcome.valid) return { valid: true, errors: [] };
+    const errorStrings = outcome.issues.map((i) => `${i.pointer}: ${i.message}`);
+    if (logViolations) {
+      debugLogs.push({
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        type: mode === "strict" ? "error" : "warning",
+        message: `Schema validation ${mode === "strict" ? "failed" : "warning"} for ${taskName}: ${formatIssues(
+          outcome.issues
+        )}`,
+        errors: errorStrings,
+        issues: outcome.issues,
+        schemaVariant: outcome.variant,
+        schemaVersion: validationVersion,
+        mode
+      });
+    }
+    if (mode === "warn") {
+      if (logViolations) {
+        console.warn(
+          `Schema validation failed for ${taskName} against AdCP ${validationVersion} (non-blocking):`,
+          errorStrings
+        );
+      }
+      return { valid: true, errors: [] };
+    }
+    if (logViolations) {
+      console.error(`Schema validation failed for ${taskName} against AdCP ${validationVersion}:`, errorStrings);
+    }
+    return { valid: false, errors: errorStrings };
+  }
   responseAdcpVersionForValidation() {
     if (this.config.versionEnvelope === "major-only") return "3.0";
     return void 0;

package/dist/lib/identity-3.3/revocation.js

@@ -225,7 +225,8 @@ class OriginRevocationResolver {
       for (const token of tokens) {
         try {
           const header = (0, import_jose.decodeProtectedHeader)(token);
-          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || typeof header.alg !== "string" || !["EdDSA", "ES256"].includes(header.alg))
+          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || // Directory keys are Ed25519 or RSA-PSS under the profile (adcp#7894).
+          header.alg !== "EdDSA" && header.alg !== "PS512")
             continue;
           await this.options.directory.resolve(header.kid, origin);
           const checked = this.options.directory.getVerifiedDirectory(origin);
@@ -234,7 +235,7 @@ class OriginRevocationResolver {
           const jwk = checked.keys.find((key) => key.kid === header.kid);
           if (!jwk) continue;
           const result = await (0, import_jose.compactVerify)(token, await (0, import_jose.importJWK)(jwk, header.alg), {
-            algorithms: ["EdDSA", "ES256"]
+            algorithms: [header.alg]
           });
           verifiedPayload = result.payload;
           break;
@@ -295,8 +296,8 @@ async function createSignedOriginRevocationList(snapshot, privateKey) {
   const kid = (0, import_web_bot_auth.jwkThumbprint)(privateKey);
   if (privateKey.kid && privateKey.kid !== kid)
     throw new TypeError("Revocation signing kid must be the JWK thumbprint");
-  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.crv === "P-256" ? "ES256" : void 0;
-  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or P-256 key");
+  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.kty === "RSA" ? "PS512" : void 0;
+  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or RSA key");
   return new import_jose.CompactSign(Buffer.from(JSON.stringify(snapshot))).setProtectedHeader({ alg, kid, typ: "adcp-gov-revocation+jws" }).sign(await (0, import_jose.importJWK)(privateKey, alg));
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/lib/identity-3.3/revocation.mjs

@@ -204,7 +204,8 @@ class OriginRevocationResolver {
       for (const token of tokens) {
         try {
           const header = decodeProtectedHeader(token);
-          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || typeof header.alg !== "string" || !["EdDSA", "ES256"].includes(header.alg))
+          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || // Directory keys are Ed25519 or RSA-PSS under the profile (adcp#7894).
+          header.alg !== "EdDSA" && header.alg !== "PS512")
             continue;
           await this.options.directory.resolve(header.kid, origin);
           const checked = this.options.directory.getVerifiedDirectory(origin);
@@ -213,7 +214,7 @@ class OriginRevocationResolver {
           const jwk = checked.keys.find((key) => key.kid === header.kid);
           if (!jwk) continue;
           const result = await compactVerify(token, await importJWK(jwk, header.alg), {
-            algorithms: ["EdDSA", "ES256"]
+            algorithms: [header.alg]
           });
           verifiedPayload = result.payload;
           break;
@@ -274,8 +275,8 @@ async function createSignedOriginRevocationList(snapshot, privateKey) {
   const kid = jwkThumbprint(privateKey);
   if (privateKey.kid && privateKey.kid !== kid)
     throw new TypeError("Revocation signing kid must be the JWK thumbprint");
-  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.crv === "P-256" ? "ES256" : void 0;
-  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or P-256 key");
+  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.kty === "RSA" ? "PS512" : void 0;
+  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or RSA key");
   return new CompactSign(Buffer.from(JSON.stringify(snapshot))).setProtectedHeader({ alg, kid, typ: "adcp-gov-revocation+jws" }).sign(await importJWK(privateKey, alg));
 }
 export {

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-10-16T23:30:06.203Z"
+  "synced_at": "2026-10-17T14:29:51.574Z"
 }

package/dist/lib/server/auth-signature.js

@@ -149,8 +149,29 @@ function verifySignatureAsAuthenticator(options) {
     return principal;
   };
   const tagged = (0, import_auth.tagAuthenticatorNeedsRawBody)(authenticator);
+  if (options.webBotAuth) webBotAuthProfiles.set(tagged, options.capability.profiles ?? []);
   return options.webBotAuth ? (0, import_auth.tagAuthenticatorPresenceGated)(tagged) : tagged;
 }
+const webBotAuthProfiles = /* @__PURE__ */ new WeakMap();
+function unsignedRequiredError(err, signatureAuth, body) {
+  const profiles = webBotAuthProfiles.get(signatureAuth);
+  if (!profiles?.includes("web-bot-auth") || !(err instanceof import_errors.RequestSignatureError) || err.code !== "request_signature_required")
+    return asSignatureAuthError(err);
+  const hasBody = body !== void 0 && body !== "";
+  if ((0, import_web_bot_auth2.advertisesOnlyWebBotAuth)(profiles)) {
+    const refused = (0, import_web_bot_auth2.unsignedWebBotAuthError)(hasBody);
+    return new import_auth.AuthError(refused.message, {
+      cause: refused,
+      status: refused.status,
+      headers: refused.headers,
+      body: refused.body
+    });
+  }
+  return new import_auth.AuthError(`Signature rejected (${err.code}).`, {
+    cause: err,
+    headers: { "Accept-Signature": (0, import_web_bot_auth2.webBotAuthAcceptSignature)("sig1", hasBody) }
+  });
+}
 function principalForVerifiedSigner(signer, makePrincipal) {
   if (!SAFE_KEYID.test(signer.keyid)) {
     throw new import_auth.AuthError("Signature key id contains unsupported characters.", {
@@ -207,7 +228,7 @@ function requireSignatureWhenPresent(signatureAuth, fallbackAuth, options = {})
     try {
       (0, import_verifier.assertUnsignedWebhookAuthenticationAbsent)(body);
     } catch (err) {
-      throw asSignatureAuthError(err);
+      throw unsignedRequiredError(err, signatureAuth, body);
     }
     let fallbackResult = null;
     let fallbackError;
@@ -223,7 +244,7 @@ function requireSignatureWhenPresent(signatureAuth, fallbackAuth, options = {})
       (0, import_verifier.assertUnsignedOperationNotRequired)(operation, unsignedCapability);
       (0, import_verifier.assertUnsignedProtocolMethodNotRequired)(body, unsignedCapability);
     } catch (err) {
-      throw asSignatureAuthError(err);
+      throw unsignedRequiredError(err, signatureAuth, body);
     }
     if (fallbackThrew) throw fallbackError;
     return null;

package/dist/lib/server/auth-signature.mjs

@@ -1,8 +1,11 @@
 import { getWebBotAuthLegacyOriginGate } from "../signing/web-bot-auth.mjs";
 import { RequestSignatureError } from "../signing/errors.mjs";
 import {
+  advertisesOnlyWebBotAuth,
   selectSignatureProfile,
+  unsignedWebBotAuthError,
   verifyWebBotAuth,
+  webBotAuthAcceptSignature,
   isWebBotAuthRevocationChecked,
   webBotAuthUnavailableResponse,
   WebBotAuthUnavailableError,
@@ -146,8 +149,29 @@ function verifySignatureAsAuthenticator(options) {
     return principal;
   };
   const tagged = tagAuthenticatorNeedsRawBody(authenticator);
+  if (options.webBotAuth) webBotAuthProfiles.set(tagged, options.capability.profiles ?? []);
   return options.webBotAuth ? tagAuthenticatorPresenceGated(tagged) : tagged;
 }
+const webBotAuthProfiles = /* @__PURE__ */ new WeakMap();
+function unsignedRequiredError(err, signatureAuth, body) {
+  const profiles = webBotAuthProfiles.get(signatureAuth);
+  if (!profiles?.includes("web-bot-auth") || !(err instanceof RequestSignatureError) || err.code !== "request_signature_required")
+    return asSignatureAuthError(err);
+  const hasBody = body !== void 0 && body !== "";
+  if (advertisesOnlyWebBotAuth(profiles)) {
+    const refused = unsignedWebBotAuthError(hasBody);
+    return new AuthError(refused.message, {
+      cause: refused,
+      status: refused.status,
+      headers: refused.headers,
+      body: refused.body
+    });
+  }
+  return new AuthError(`Signature rejected (${err.code}).`, {
+    cause: err,
+    headers: { "Accept-Signature": webBotAuthAcceptSignature("sig1", hasBody) }
+  });
+}
 function principalForVerifiedSigner(signer, makePrincipal) {
   if (!SAFE_KEYID.test(signer.keyid)) {
     throw new AuthError("Signature key id contains unsupported characters.", {
@@ -204,7 +228,7 @@ function requireSignatureWhenPresent(signatureAuth, fallbackAuth, options = {})
     try {
       assertUnsignedWebhookAuthenticationAbsent(body);
     } catch (err) {
-      throw asSignatureAuthError(err);
+      throw unsignedRequiredError(err, signatureAuth, body);
     }
     let fallbackResult = null;
     let fallbackError;
@@ -220,7 +244,7 @@ function requireSignatureWhenPresent(signatureAuth, fallbackAuth, options = {})
       assertUnsignedOperationNotRequired(operation, unsignedCapability);
       assertUnsignedProtocolMethodNotRequired(body, unsignedCapability);
     } catch (err) {
-      throw asSignatureAuthError(err);
+      throw unsignedRequiredError(err, signatureAuth, body);
     }
     if (fallbackThrew) throw fallbackError;
     return null;

package/dist/lib/server/auth.d.mts

@@ -346,6 +346,12 @@ export interface RespondUnauthorizedOptions {
      * directly.
      */
     signatureError?: RequestSignatureErrorCode;
+    /**
+     * Additional response headers, such as the Web Bot Auth `Accept-Signature`
+     * challenge added to an AdCP RFC 9421 `request_signature_required` answer.
+     * Cannot replace `WWW-Authenticate` or `Content-Type`.
+     */
+    headers?: Record<string, string>;
 }
 /**
  * Send an RFC 6750-compliant 401/403 response with the `WWW-Authenticate`

package/dist/lib/server/auth.d.ts

@@ -346,6 +346,12 @@ export interface RespondUnauthorizedOptions {
      * directly.
      */
     signatureError?: RequestSignatureErrorCode;
+    /**
+     * Additional response headers, such as the Web Bot Auth `Accept-Signature`
+     * challenge added to an AdCP RFC 9421 `request_signature_required` answer.
+     * Cannot replace `WWW-Authenticate` or `Content-Type`.
+     */
+    headers?: Record<string, string>;
 }
 /**
  * Send an RFC 6750-compliant 401/403 response with the `WWW-Authenticate`

package/dist/lib/server/auth.js

@@ -247,7 +247,13 @@ function respondUnauthorized(_req, res, options = {}) {
   if (options.errorDescription) parts.push(`error_description="${escapeQuotes(options.errorDescription)}"`);
   if (options.resourceMetadata) parts.push(`resource_metadata="${escapeQuotes(options.resourceMetadata)}"`);
   const scheme = useSignatureChallenge ? "Signature" : "Bearer";
+  const extra = Object.fromEntries(
+    Object.entries(options.headers ?? {}).filter(
+      ([name]) => !["content-type", "www-authenticate"].includes(name.toLowerCase())
+    )
+  );
   res.writeHead(options.status ?? 401, {
+    ...extra,
     "Content-Type": "application/json",
     "WWW-Authenticate": `${scheme} ${parts.join(", ")}`
   });

package/dist/lib/server/auth.mjs

@@ -208,7 +208,13 @@ function respondUnauthorized(_req, res, options = {}) {
   if (options.errorDescription) parts.push(`error_description="${escapeQuotes(options.errorDescription)}"`);
   if (options.resourceMetadata) parts.push(`resource_metadata="${escapeQuotes(options.resourceMetadata)}"`);
   const scheme = useSignatureChallenge ? "Signature" : "Bearer";
+  const extra = Object.fromEntries(
+    Object.entries(options.headers ?? {}).filter(
+      ([name]) => !["content-type", "www-authenticate"].includes(name.toLowerCase())
+    )
+  );
   res.writeHead(options.status ?? 401, {
+    ...extra,
     "Content-Type": "application/json",
     "WWW-Authenticate": `${scheme} ${parts.join(", ")}`
   });

package/dist/lib/server/create-adcp-server.js

@@ -1438,6 +1438,8 @@ function buildSignedRequestsPreTransport(signedRequests, effectiveRequestSigning
       "Web Bot Auth requires origin revocation: use createIdentity33PrincipalResolver({ revocation }) or supply isRevoked"
     );
   const requiredFor = effectiveRequestSigning.required_for ?? [];
+  const advertisedProfiles = effectiveRequestSigning.profiles;
+  const webBotAuthAdvertised = !!signedRequests.webBotAuth && !!advertisedProfiles?.includes("web-bot-auth");
   const verifier = (0, import_middleware.createExpressVerifier)({
     capability: {
       supported: true,
@@ -1543,6 +1545,19 @@ function buildSignedRequestsPreTransport(signedRequests, effectiveRequestSigning
             res.setHeader(k, v);
             return {
               json(body) {
+                if (webBotAuthAdvertised && code === 401 && body?.error === "request_signature_required") {
+                  const hasBody = !!req.rawBody;
+                  if ((0, import_web_bot_auth2.advertisesOnlyWebBotAuth)(advertisedProfiles)) {
+                    const refused = (0, import_web_bot_auth2.unsignedWebBotAuthError)(hasBody);
+                    res.removeHeader("WWW-Authenticate");
+                    res.statusCode = refused.status;
+                    for (const [name, value] of Object.entries(refused.headers)) res.setHeader(name, value);
+                    res.setHeader("Content-Type", "application/json");
+                    res.end(JSON.stringify(refused.body));
+                    return;
+                  }
+                  res.setHeader("Accept-Signature", (0, import_web_bot_auth2.webBotAuthAcceptSignature)("sig1", hasBody));
+                }
                 res.setHeader("Content-Type", "application/json");
                 res.end(JSON.stringify(body));
               }
@@ -2127,6 +2142,7 @@ function createAdcpServer(config) {
     throw new Error("Select Web Bot Auth on each trusted webhook registration, not as a server-wide default");
   if (config.webhooks?.webBotAuth && !config.identity33)
     throw new Error("Web Bot Auth webhook signing requires the identity33 experiment");
+  if (config.webhooks?.webBotAuth?.key) (0, import_web_bot_auth.assertWebBotAuthSigningKey)(config.webhooks.webBotAuth.key);
   const toolsWithErrorArm = (0, import_error_arm_tools.getToolsWithErrorArm)(adcpVersion);
   const isProduction = process.env.NODE_ENV === "production";
   const requestValidationMode = validationConfig?.requests ?? (isProduction ? "off" : "strict");
@@ -4558,9 +4574,9 @@ function createAdcpServer(config) {
       algorithms: [
         .../* @__PURE__ */ new Set([
           algorithm,
-          ...webhooks.webBotAuth ? [
-            ("privateKey" in webhooks.webBotAuth.key ? webhooks.webBotAuth.key.privateKey.crv : webhooks.webBotAuth.key.publicKey.crv) === "P-256" ? "ecdsa-p256-sha256" : "ed25519"
-          ] : []
+          // `algorithms` lists AdCP webhook-profile values; a Web Bot Auth key
+          // is Ed25519 or RSA-PSS (adcp#7894), and only Ed25519 has a value here.
+          ...webhooks.webBotAuth && ("privateKey" in webhooks.webBotAuth.key ? webhooks.webBotAuth.key.privateKey.crv : webhooks.webBotAuth.key.publicKey.crv) === "Ed25519" ? ["ed25519"] : []
         ])
       ],
       ...webhooks.webBotAuth && { profiles: ["adcp/webhook-signing/v1", "web-bot-auth"] },

package/dist/lib/server/create-adcp-server.mjs

@@ -1,4 +1,4 @@
-import { getWebBotAuthLegacyOriginGate } from "../signing/web-bot-auth.mjs";
+import { assertWebBotAuthSigningKey, getWebBotAuthLegacyOriginGate } from "../signing/web-bot-auth.mjs";
 import {
   isIdentity33SchemaScope,
   withIdentity33SchemaScope,
@@ -12,6 +12,9 @@ import {
   webBotAuthToolFailure,
   selectSignatureProfile,
   verifyWebBotAuth,
+  advertisesOnlyWebBotAuth,
+  unsignedWebBotAuthError,
+  webBotAuthAcceptSignature,
   isWebBotAuthRevocationChecked,
   webBotAuthUnavailableResponse,
   WebBotAuthUnavailableError,
@@ -1526,6 +1529,8 @@ function buildSignedRequestsPreTransport(signedRequests, effectiveRequestSigning
       "Web Bot Auth requires origin revocation: use createIdentity33PrincipalResolver({ revocation }) or supply isRevoked"
     );
   const requiredFor = effectiveRequestSigning.required_for ?? [];
+  const advertisedProfiles = effectiveRequestSigning.profiles;
+  const webBotAuthAdvertised = !!signedRequests.webBotAuth && !!advertisedProfiles?.includes("web-bot-auth");
   const verifier = createExpressVerifier({
     capability: {
       supported: true,
@@ -1631,6 +1636,19 @@ function buildSignedRequestsPreTransport(signedRequests, effectiveRequestSigning
             res.setHeader(k, v);
             return {
               json(body) {
+                if (webBotAuthAdvertised && code === 401 && body?.error === "request_signature_required") {
+                  const hasBody = !!req.rawBody;
+                  if (advertisesOnlyWebBotAuth(advertisedProfiles)) {
+                    const refused = unsignedWebBotAuthError(hasBody);
+                    res.removeHeader("WWW-Authenticate");
+                    res.statusCode = refused.status;
+                    for (const [name, value] of Object.entries(refused.headers)) res.setHeader(name, value);
+                    res.setHeader("Content-Type", "application/json");
+                    res.end(JSON.stringify(refused.body));
+                    return;
+                  }
+                  res.setHeader("Accept-Signature", webBotAuthAcceptSignature("sig1", hasBody));
+                }
                 res.setHeader("Content-Type", "application/json");
                 res.end(JSON.stringify(body));
               }
@@ -2215,6 +2233,7 @@ function createAdcpServer(config) {
     throw new Error("Select Web Bot Auth on each trusted webhook registration, not as a server-wide default");
   if (config.webhooks?.webBotAuth && !config.identity33)
     throw new Error("Web Bot Auth webhook signing requires the identity33 experiment");
+  if (config.webhooks?.webBotAuth?.key) assertWebBotAuthSigningKey(config.webhooks.webBotAuth.key);
   const toolsWithErrorArm = getToolsWithErrorArm(adcpVersion);
   const isProduction = process.env.NODE_ENV === "production";
   const requestValidationMode = validationConfig?.requests ?? (isProduction ? "off" : "strict");
@@ -4646,9 +4665,9 @@ function createAdcpServer(config) {
       algorithms: [
         .../* @__PURE__ */ new Set([
           algorithm,
-          ...webhooks.webBotAuth ? [
-            ("privateKey" in webhooks.webBotAuth.key ? webhooks.webBotAuth.key.privateKey.crv : webhooks.webBotAuth.key.publicKey.crv) === "P-256" ? "ecdsa-p256-sha256" : "ed25519"
-          ] : []
+          // `algorithms` lists AdCP webhook-profile values; a Web Bot Auth key
+          // is Ed25519 or RSA-PSS (adcp#7894), and only Ed25519 has a value here.
+          ...webhooks.webBotAuth && ("privateKey" in webhooks.webBotAuth.key ? webhooks.webBotAuth.key.privateKey.crv : webhooks.webBotAuth.key.publicKey.crv) === "Ed25519" ? ["ed25519"] : []
         ])
       ],
       ...webhooks.webBotAuth && { profiles: ["adcp/webhook-signing/v1", "web-bot-auth"] },

package/dist/lib/server/decisioning/runtime/from-platform.js

@@ -311,7 +311,10 @@ function projectResponseCreativeIdentities(value, operation, legacyFormatConvert
   let projected = dataRecord;
   if ((0, import_types2.isProjectionProductInput)(projected)) {
     if (wireMode === "canonical") {
-      const canonical = (0, import_augment_response.toCanonicalOnlyResponse)({ products: [projected] }, { legacyFormatConverter });
+      const canonical = (0, import_augment_response.toCanonicalOnlyResponse)(
+        { products: [projected] },
+        { legacyFormatConverter, _inferDualEmissionLegacyRefs: false }
+      );
       if (canonical.diagnostics.length > 0 || canonical.response.products.length !== 1) {
         throw new import_creative_delivery.CreativeFormatProjectionError(
           operation,
@@ -550,7 +553,8 @@ function asCanonicalProductResponse(response, legacyFormatConverter) {
   assertSafeGetProductsResponse(response);
   validateDualProductFormatDeclarations(response, legacyFormatConverter);
   const projected = (0, import_augment_response.toCanonicalOnlyResponse)(response, {
-    legacyFormatConverter
+    legacyFormatConverter,
+    _inferDualEmissionLegacyRefs: false
   });
   const blockingDiagnostics = projected.diagnostics.filter(
     (diagnostic) => diagnostic.code !== "LEGACY_FORMAT_ID_DROPPED_UNMAPPED"

package/dist/lib/server/decisioning/runtime/from-platform.mjs

@@ -343,7 +343,10 @@ function projectResponseCreativeIdentities(value, operation, legacyFormatConvert
   let projected = dataRecord;
   if (isProjectionProductInput(projected)) {
     if (wireMode === "canonical") {
-      const canonical = toCanonicalOnlyResponse({ products: [projected] }, { legacyFormatConverter });
+      const canonical = toCanonicalOnlyResponse(
+        { products: [projected] },
+        { legacyFormatConverter, _inferDualEmissionLegacyRefs: false }
+      );
       if (canonical.diagnostics.length > 0 || canonical.response.products.length !== 1) {
         throw new CreativeFormatProjectionError(
           operation,
@@ -582,7 +585,8 @@ function asCanonicalProductResponse(response, legacyFormatConverter) {
   assertSafeGetProductsResponse(response);
   validateDualProductFormatDeclarations(response, legacyFormatConverter);
   const projected = toCanonicalOnlyResponse(response, {
-    legacyFormatConverter
+    legacyFormatConverter,
+    _inferDualEmissionLegacyRefs: false
   });
   const blockingDiagnostics = projected.diagnostics.filter(
     (diagnostic) => diagnostic.code !== "LEGACY_FORMAT_ID_DROPPED_UNMAPPED"

package/dist/lib/server/serve.js

@@ -322,7 +322,8 @@ function serve(createAgent, options) {
             (0, import_auth.respondUnauthorized)(req, res, {
               signatureError: signatureCode,
               errorDescription: publicMessage,
-              resourceMetadata: resourceMetadataUrl
+              resourceMetadata: resourceMetadataUrl,
+              ...err instanceof import_auth.AuthError && err.headers && { headers: err.headers }
             });
             return;
           }

package/dist/lib/server/serve.mjs

@@ -305,7 +305,8 @@ function serve(createAgent, options) {
             respondUnauthorized(req, res, {
               signatureError: signatureCode,
               errorDescription: publicMessage,
-              resourceMetadata: resourceMetadataUrl
+              resourceMetadata: resourceMetadataUrl,
+              ...err instanceof AuthError && err.headers && { headers: err.headers }
             });
             return;
           }