@adcp/sdk 16.0.0-beta.6 → 16.0.0-beta.8

package/dist/lib/signing/web-bot-auth.mjs

@@ -1,17 +1,13 @@
 import { toReleasePrecisionVersion } from "../version.mjs";
-import {
-  constants as cryptoConstants,
-  createHash,
-  createPrivateKey,
-  randomBytes,
-  sign as nodeSign
-} from "crypto";
-import { parseDictionary, parseItem, serializeItem } from "structured-headers";
+import { createHash, randomBytes } from "crypto";
+import { parseDictionary, parseItem, serializeInnerList, serializeItem } from "structured-headers";
 import {
   component,
   componentIdentity,
   createSignature,
-  isSignatureError
+  isSignatureError,
+  SignatureErrorCode,
+  verifySignature as verifyHttpMessageSignature
 } from "http-message-sig";
 import { ssrfSafeFetch } from "../net/index.mjs";
 import { eTldPlusOne } from "./agent-resolver/etld.mjs";
@@ -20,36 +16,52 @@ import { canonicalAgentUrl } from "./agent-resolver/select-agent.mjs";
 import { parseStrictJson } from "./agent-resolver/strict-json.mjs";
 import { getHeaderValue } from "./canonicalize.mjs";
 import { computeContentDigest, contentDigestMatches, contentDigestUsesEncoding } from "./content-digest.mjs";
-import { jwkToPublicKey, signWithPrivateJwkAsync, verifySignature, verifySignatureAsync } from "./crypto.mjs";
+import { signWithPrivateJwkAsync, verifySignatureAsync } from "./crypto.mjs";
 import {
   parseSignature,
-  parseSignatureInput,
+  parseSignatureInputMember,
   rejectDuplicateDictionaryKeys
 } from "./parser.mjs";
 const WEB_BOT_AUTH_PROFILE = "web-bot-auth";
 const WEB_BOT_AUTH_DRAFT_REVISION = "draft-ietf-webbotauth-httpsig-protocol-00";
 const SIGNATURE_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 const SIGNATURE_DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
+const WEB_BOT_AUTH_ALGORITHMS = Object.freeze(["ed25519", "rsa-pss-sha512"]);
 const DIRECTORY_TAG = "http-message-signatures-directory";
-const DIRECTORY_CLOCK_SKEW_SECONDS = 60;
+const CLOCK_SKEW_SECONDS = 60;
+const MAX_LIFETIME_SECONDS = 300;
+const REQUIRED_PARAMETERS = ["created", "expires", "nonce", "keyid", "alg", "tag"];
 const TEST_KIDS = /* @__PURE__ */ new Set([
   "6WsKMCObba49V3uN0vIENnk1BKAk7c9zjBJcWKyQ9_I",
   "hHurKlVBnPJ4AGiPyl6HWMhxgkIcRBzaC8qWwEtnuVI",
   "ZtaFf5jj-EzorJmZn6mX3YnmK_QyZKVLbbinzIQKOjQ",
   "1XlJ3EIte7bPOEqKQtKrKNTNy5hywTyrwFXWrMbXKqE"
 ]);
+function webBotAuthAcceptSignature(label = "sig1", hasBody = true, nonce) {
+  const body = hasBody ? '"content-type" "content-digest" ' : "";
+  const nonceParam = nonce === void 0 ? "nonce" : `nonce="${nonce}"`;
+  return `${label}=("@method" "@target-uri" "@authority" ${body}"signature-agent";key="${label}");created;expires;${nonceParam};keyid;alg;tag="web-bot-auth"`;
+}
+function freshNonce() {
+  return randomBytes(64).toString("base64url");
+}
+function nonceBytes(nonce) {
+  if (typeof nonce !== "string") return void 0;
+  const encoding = /^[A-Za-z0-9_-]{86}$/.test(nonce) ? "base64url" : /^[A-Za-z0-9+/]{86}==$/.test(nonce) ? "base64" : void 0;
+  if (!encoding) return void 0;
+  const bytes = Buffer.from(nonce, encoding);
+  return bytes.length === 64 && bytes.toString(encoding) === nonce ? bytes : void 0;
+}
 const NO_CHALLENGE_REASONS = /* @__PURE__ */ new Set(["key_revoked", "identity_not_bound", "profile_disabled", "authorization_failed"]);
 class WebBotAuthError extends Error {
   constructor(status, reason) {
     super(
-      status === 400 ? "Malformed Web Bot Auth message" : status === 429 ? "Web Bot Auth rate limit" : "Web Bot Auth verification failed"
+      status === 400 ? "Malformed Web Bot Auth message" : status === 429 ? reason === "replayed" ? "Web Bot Auth signature or nonce reused" : "Web Bot Auth rate limit" : "Web Bot Auth verification failed"
     );
     this.status = status;
     this.reason = reason;
     this.name = "WebBotAuthError";
-    this.headers = status === 403 && !NO_CHALLENGE_REASONS.has(reason) ? {
-      "Accept-Signature": 'sig1=("@method" "@target-uri" "@authority" "content-type" "content-digest" "signature-agent";key="sig1");created;expires;nonce;keyid;tag="web-bot-auth"'
-    } : status === 429 ? { "Retry-After": "60" } : {};
+    this.headers = status === 403 && !NO_CHALLENGE_REASONS.has(reason) ? { "Accept-Signature": webBotAuthAcceptSignature() } : status === 429 && reason === "replayed" ? { "Accept-Signature": webBotAuthAcceptSignature("sig1", true, freshNonce()) } : status === 429 ? { "Retry-After": "60" } : {};
   }
   status;
   reason;
@@ -85,6 +97,20 @@ function bad(reason) {
 function denied(reason) {
   throw new WebBotAuthError(403, reason);
 }
+function challengeFor(error, label, hasBody) {
+  const current = error.headers["Accept-Signature"];
+  if (current) {
+    const nonce = error.status === 429 ? freshNonce() : void 0;
+    error.headers["Accept-Signature"] = webBotAuthAcceptSignature(label, hasBody, nonce);
+  }
+  return error;
+}
+function unsignedWebBotAuthError(hasBody) {
+  return challengeFor(new WebBotAuthError(403, "signature_required"), "sig1", hasBody);
+}
+function advertisesOnlyWebBotAuth(profiles) {
+  return !!profiles?.includes(WEB_BOT_AUTH_PROFILE) && !profiles.includes("adcp/request-signing/v1");
+}
 function dictionary(value, field) {
   if (value === void 0 || value === "") return denied("headers_missing");
   if (value.length > 64 * 1024) return bad("headers");
@@ -114,18 +140,30 @@ function jwkThumbprint(jwk) {
 }
 function algorithm(jwk) {
   if (jwk.kty === "OKP" && jwk.crv === "Ed25519") return "ed25519";
-  if (jwk.kty === "EC" && jwk.crv === "P-256") return "ecdsa-p256-sha256";
   if (jwk.kty === "RSA" && typeof jwk.n === "string" && jwk.e === "AQAB") {
     const bytes = Buffer.from(jwk.n, "base64url").length;
     if (bytes >= 256 && bytes <= 512) return "rsa-pss-sha512";
   }
   return denied("unsupported_key");
 }
-function inputs(headers) {
-  const value = getHeaderValue(headers, "signature-input");
-  return [...dictionary(value, "Signature-Input").keys()].map((label) => {
+function signingAlgorithm(jwk) {
+  try {
+    return algorithm(jwk);
+  } catch {
+    throw new TypeError(
+      "Web Bot Auth signs with Ed25519 or RSA-PSS-SHA512 (2048-4096 bit, e=65537) keys only; ES256 remains on the AdCP RFC 9421 profile"
+    );
+  }
+}
+function assertWebBotAuthSigningKey(key) {
+  signingAlgorithm("privateKey" in key ? key.privateKey : key.publicKey);
+}
+function inputs(headers, limit) {
+  const members = dictionary(getHeaderValue(headers, "signature-input"), "Signature-Input");
+  if (members.size > limit) bad("signature_input");
+  return [...members].map(([label, member]) => {
     try {
-      return parseSignatureInput(value, label);
+      return parseSignatureInputMember(label, member);
     } catch {
       return bad("signature_input");
     }
@@ -135,10 +173,10 @@ function receivedAgentOrigin(value) {
   try {
     canonicalAgentUrl(value);
     const origin = canonicalAgentOrigin(value);
-    if (value !== origin || /[^\x21-\x7e]/.test(value) || value.includes("%")) return bad("agent_origin");
+    if (value !== origin || /[^\x21-\x7e]/.test(value) || value.includes("%")) return denied("agent_origin");
     return origin;
   } catch {
-    return bad("agent_origin");
+    return denied("agent_origin");
   }
 }
 function buildWebBotAuthSignatureBase(input, request, response) {
@@ -171,10 +209,7 @@ function buildWebBotAuthSignatureBase(input, request, response) {
       if (params.has("key")) {
         const member = dictionary(value, bare).get(params.get("key"));
         if (!member) return denied("missing_member");
-        if (Array.isArray(member[0])) {
-          const selected = parseSignatureInput(value, params.get("key"));
-          value = selected.signatureParamsValue;
-        } else value = serializeItem(member);
+        value = Array.isArray(member[0]) ? serializeInnerList(member) : serializeItem(member);
       }
     }
     if (value === void 0) return denied("missing_component");
@@ -187,7 +222,7 @@ function receivedTargetUri(url) {
   try {
     new URL(url);
   } catch {
-    return bad("target_uri");
+    return denied("target_uri");
   }
   return url;
 }
@@ -195,7 +230,7 @@ function receivedAuthority(url) {
   try {
     return new URL(url).host.toLowerCase();
   } catch {
-    return bad("target_uri");
+    return denied("target_uri");
   }
 }
 function assertDigest(headers, body) {
@@ -203,41 +238,48 @@ function assertDigest(headers, body) {
   if (!digest || !contentDigestUsesEncoding(digest, "rfc8941-base64") || !contentDigestMatches(digest, body))
     denied("content_digest");
 }
-function signatureBytes(input, request, jwk, response) {
+function keyVerifier(jwk) {
   const alg = algorithm(jwk);
-  if (input.params.alg !== void 0 && input.params.alg !== alg) denied("algorithm");
-  const signature = getHeaderValue(response?.headers ?? request.headers, "signature");
-  if (signature === void 0 || signature === "") denied("headers_missing");
-  try {
-    return { alg, bytes: parseSignature(signature ?? "", input.label, "rfc8941-base64").bytes };
-  } catch {
-    return bad("signature");
-  }
+  return { algorithm: alg, verify: (data, signature) => verifySignatureAsync(alg, jwk, data, signature) };
 }
-async function verifyBytesAsync(input, request, jwk) {
-  const { alg, bytes } = signatureBytes(input, request, jwk);
-  let valid = false;
-  try {
-    valid = await verifySignatureAsync(alg, jwk, Buffer.from(buildWebBotAuthSignatureBase(input, request)), bytes);
-  } catch (error) {
-    if (error instanceof WebBotAuthError) throw error;
-  }
-  if (!valid) denied("signature_invalid");
+function componentDescriptor(identifier) {
+  const bare = identifier.split(";", 1)[0];
+  const [, params] = parseItem(`"${bare}"${identifier.slice(bare.length)}`);
+  return component(bare, Object.fromEntries(params));
+}
+function coveredFields(components, headers) {
+  const names = new Set(components.filter((c) => !c.name.startsWith("@")).map((c) => c.name));
+  return [...names].flatMap((name) => {
+    const value = getHeaderValue(headers, name);
+    return value === void 0 ? [] : [{ name, value }];
+  });
 }
-function verifyBytes(input, request, jwk, response) {
-  const { alg, bytes } = signatureBytes(input, request, jwk, response);
-  let valid = false;
+async function verifyWithLibrary(message, label, policy, resolveVerifier) {
   try {
-    valid = verifySignature(
-      alg,
-      jwkToPublicKey(jwk),
-      Buffer.from(buildWebBotAuthSignatureBase(input, request, response)),
-      bytes
-    );
+    await verifyHttpMessageSignature(message, {
+      label,
+      policy: { algorithms: WEB_BOT_AUTH_ALGORITHMS, clockSkew: CLOCK_SKEW_SECONDS, ...policy },
+      resolveVerifier
+    });
   } catch (error) {
-    if (error instanceof WebBotAuthError) throw error;
+    if (!isSignatureError(error)) throw error;
+    const cause = error.cause;
+    if (cause instanceof WebBotAuthError || cause instanceof WebBotAuthUnavailableError) throw cause;
+    switch (error.code) {
+      case SignatureErrorCode.VerificationFailed:
+        return denied("signature_invalid");
+      case SignatureErrorCode.AlgorithmMismatch:
+        return denied("algorithm");
+      case SignatureErrorCode.PolicyViolation:
+        return denied("policy");
+      case SignatureErrorCode.MissingField:
+        return denied("missing_component");
+      case SignatureErrorCode.ResolverFailed:
+        return denied("verification_unavailable");
+      default:
+        return denied("component");
+    }
   }
-  if (!valid) denied("signature_invalid");
 }
 const legacyOriginGates = /* @__PURE__ */ new WeakMap();
 function registerWebBotAuthLegacyOriginGate(resolver, gate) {
@@ -331,123 +373,127 @@ function isVerifiedWebBotSigner(value) {
   return typeof value === "object" && value !== null && verifiedSigners.has(value);
 }
 async function verifyWebBotAuth(request, options) {
+  const hasBody = request.body !== void 0 && request.body !== "";
+  let label = "sig1";
   try {
     if (!(options.directory instanceof SignatureDirectoryResolver)) denied("directory_unverified");
     const now = Math.floor((options.now ?? (() => Date.now() / 1e3))());
     if (!Number.isFinite(now)) denied("verification_unavailable");
-    const all = inputs(request.headers);
-    const candidates = all.filter((input) => input.params.tag === WEB_BOT_AUTH_PROFILE);
-    const selected = [];
-    const remaining = [...candidates];
-    while (remaining.length) {
-      const index = remaining.findIndex(
-        (input) => candidates.every(
-          (other) => !input.components.some(
-            (c) => c === `signature-input;key="${other.label}"` || c === `signature;key="${other.label}"`
-          ) || selected.some((done) => done.label === other.label)
-        )
-      );
-      if (index < 0) denied("relay_cycle");
-      selected.push(remaining.splice(index, 1)[0]);
+    const inputHeader = getHeaderValue(request.headers, "signature-input");
+    const signatureHeader = getHeaderValue(request.headers, "signature");
+    const agentHeader = getHeaderValue(request.headers, "signature-agent");
+    const present = (value) => value !== void 0 && value !== "";
+    const inputMembers = present(inputHeader) ? dictionary(inputHeader, "Signature-Input") : void 0;
+    const signatureMembers = present(signatureHeader) ? dictionary(signatureHeader, "Signature") : void 0;
+    const agents = present(agentHeader) ? dictionary(agentHeader, "Signature-Agent") : void 0;
+    for (const member2 of inputMembers?.values() ?? [])
+      if (!Array.isArray(member2[0]) || member2[0].some((item) => typeof item[0] !== "string")) bad("signature_input");
+    for (const member2 of signatureMembers?.values() ?? [])
+      if (!(member2[0] instanceof ArrayBuffer) || member2[1].size !== 0) bad("signature");
+    for (const member2 of agents?.values() ?? []) if (typeof member2[0] !== "string") bad("signature_agent");
+    if (!inputMembers || !signatureMembers) return denied("headers_missing");
+    if (inputMembers.size !== 1 || signatureMembers.size !== 1) denied("signature_count");
+    label = inputMembers.keys().next().value;
+    if (!signatureMembers.has(label)) denied("signature_label");
+    try {
+      parseSignature(signatureHeader, label, "rfc8941-base64");
+    } catch {
+      return bad("signature");
     }
-    if (!selected.length || selected.length > 8) denied("profile");
-    const agents = dictionary(getHeaderValue(request.headers, "signature-agent"), "Signature-Agent");
-    const verified = [];
-    const nonces = /* @__PURE__ */ new Set();
-    for (const input of selected) {
-      const { created, expires, nonce, keyid } = input.params;
-      if ([created, expires, nonce, keyid].some((value) => value === void 0)) denied("parameters_missing");
-      if (!Number.isInteger(created) || !Number.isInteger(expires) || typeof nonce !== "string" || !/^[A-Za-z0-9_+\/-]{22,256}={0,2}$/.test(nonce) || typeof keyid !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(keyid))
-        bad("parameters");
-      if (expires <= created || expires - created > 300 || created > now + 60 || expires < now - 60) denied("window");
-      const agentComponents = input.components.filter(
-        (c) => c.startsWith("signature-agent;key=") && !verified.some((s) => selected.find((i) => i.label === s.label).components.includes(c))
-      );
-      if (agentComponents.length !== 1) denied("agent_not_covered");
-      const component2 = parseItem(`"${agentComponents[0].replace("signature-agent;", 'signature-agent";')}`);
-      const memberKey = component2[1].get("key");
-      if (typeof memberKey !== "string" || memberKey !== input.label) bad("agent_member");
-      const member = agents.get(memberKey);
-      if (!member) denied("agent_not_covered");
-      if (typeof member[0] !== "string") bad("signature_agent");
-      const type = member[1].get("type");
-      if (type !== void 0 && type !== "directory") denied("agent_type");
-      const origin = receivedAgentOrigin(member[0]);
-      for (const earlier of verified) {
-        const inner = selected.find((i) => i.label === earlier.label);
-        const required = [
-          ...inner.components,
-          `signature-input;key="${inner.label}"`,
-          `signature;key="${inner.label}"`
-        ];
-        if (required.some((c) => !input.components.includes(c))) denied("relay_coverage");
-      }
-      if (new Set(input.components).size !== input.components.length || ["@method", "@target-uri", "@authority"].some((c) => !input.components.includes(c)))
-        denied("coverage");
-      if (request.body !== void 0 && request.body !== "") {
-        if (["content-type", "content-digest"].some((c) => !input.components.includes(c))) denied("body_coverage");
-        assertDigest(request.headers, request.body);
-      }
-      await options.directory.resolve(keyid, origin);
-      const checkedDirectory = options.directory.getVerifiedDirectory(origin);
-      if (!checkedDirectory || new URL(checkedDirectory.proof.request.url).origin !== origin)
-        denied("directory_origin");
-      if (checkedDirectory.expires <= now) denied("directory_expired");
-      if (!testKeysAllowed(options.allowTestKeys ?? options.directory.allowsTestKeys) && checkedDirectory.keys.some((key2) => TEST_KIDS.has(key2.kid)))
-        denied("directory_key");
-      const key = checkedDirectory.keys.find((key2) => key2.kid === keyid);
-      if (!key || jwkThumbprint(key) !== keyid) denied("key");
-      await verifyBytesAsync(input, request, key);
-      if (options.isRevoked) await legacyRevocationCheck(options, origin, keyid);
-      const nonceTuple = JSON.stringify([origin, nonce]);
-      if (nonces.has(nonceTuple)) throw new WebBotAuthError(options.replayStatus ?? 429, "nonce_replayed");
-      nonces.add(nonceTuple);
-      const signer = Object.freeze({
-        profile: WEB_BOT_AUTH_PROFILE,
-        origin,
-        keyid,
-        label: input.label,
-        verified_at: now
-      });
-      verified.push(signer);
+    let input;
+    try {
+      input = parseSignatureInputMember(label, inputMembers.get(label));
+    } catch {
+      return denied("parameters");
     }
-    for (const signer of verified) {
-      const input = selected.find((i) => i.label === signer.label);
-      let result;
-      try {
-        result = await options.replayStore.insert(
-          signer.origin,
-          WEB_BOT_AUTH_PROFILE,
-          input.params.nonce,
-          // Acceptance is inclusive of expires + 60, so the nonce must outlive it.
-          input.params.expires + 60 - now + 1,
-          now
-        );
-      } catch (cause) {
-        throw new WebBotAuthUnavailableError("replay_unavailable", cause);
-      }
-      if (result !== "ok")
-        throw new WebBotAuthError(result === "replayed" ? options.replayStatus ?? 429 : 429, result);
+    if (input.params.tag !== WEB_BOT_AUTH_PROFILE) denied("profile");
+    if (!agents || agents.size !== 1) denied(agents ? "agent_count" : "agent_missing");
+    const agentMember = `signature-agent;key="${label}"`;
+    const agentComponents = input.components.filter((c) => c.startsWith("signature-agent;"));
+    if (agentComponents.length !== 1 || agentComponents[0] !== agentMember) denied("agent_not_covered");
+    const member = agents.get(label);
+    if (!member) denied("agent_not_covered");
+    const type = member[1].get("type");
+    if (type !== void 0 && type !== "directory") denied("agent_type");
+    const origin = receivedAgentOrigin(member[0]);
+    const { created, expires, nonce, keyid, alg } = input.params;
+    if ([created, expires, nonce, keyid, alg].some((value) => value === void 0)) denied("parameters_missing");
+    const nonceKey = nonceBytes(nonce)?.toString("base64url");
+    if (!nonceKey || !Number.isSafeInteger(created) || !Number.isSafeInteger(expires) || typeof keyid !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(keyid) || !WEB_BOT_AUTH_ALGORITHMS.includes(alg))
+      denied("parameters");
+    if (expires <= created || expires - created > MAX_LIFETIME_SECONDS || created > now + CLOCK_SKEW_SECONDS || expires < now - CLOCK_SKEW_SECONDS)
+      denied("window");
+    if (new Set(input.components).size !== input.components.length) denied("coverage");
+    const required = [component("@method"), component("@target-uri"), component("@authority")];
+    if (hasBody) required.push(component("content-type"), component("content-digest"));
+    required.push(component("signature-agent", { key: label }));
+    const covered = new Set(input.components);
+    if (required.some((c) => !covered.has(componentIdentity(c).replace(/^"([^"]*)"/, "$1")))) denied("coverage");
+    if (hasBody) assertDigest(request.headers, request.body);
+    let components;
+    try {
+      components = input.components.map(componentDescriptor);
+    } catch {
+      return denied("component");
     }
-    for (const signer of verified) verifiedSigners.add(signer);
-    return verified;
-  } catch (error) {
-    if (error instanceof WebBotAuthError) {
-      if (error.headers["Accept-Signature"]) {
-        let label = "sig1";
-        try {
-          label = inputs(request.headers)[0]?.label ?? "sig1";
-        } catch {
-        }
-        const bodyComponents = request.body ? '"content-type" "content-digest" ' : "";
-        error.headers["Accept-Signature"] = `${label}=("@method" "@target-uri" "@authority" ${bodyComponents}"signature-agent";key="${label}");created;expires;nonce;keyid;tag="web-bot-auth"`;
-      }
-      throw error;
+    const fields = [
+      ...coveredFields(components, request.headers),
+      { name: "signature-input", value: inputHeader },
+      { name: "signature", value: signatureHeader }
+    ];
+    await verifyWithLibrary(
+      {
+        kind: "request",
+        method: request.method.toUpperCase(),
+        targetUri: receivedTargetUri(request.url),
+        fields
+      },
+      label,
+      { requiredComponents: required, requiredParameters: REQUIRED_PARAMETERS, maxAge: MAX_LIFETIME_SECONDS, now },
+      async () => keyVerifier(await directoryKey(options, origin, keyid, now))
+    );
+    let result;
+    try {
+      result = await options.replayStore.insert(
+        origin,
+        WEB_BOT_AUTH_PROFILE,
+        nonceKey,
+        // Acceptance is inclusive of expires + skew, so the nonce must outlive it.
+        expires + CLOCK_SKEW_SECONDS - now + 1,
+        now
+      );
+    } catch (cause) {
+      throw new WebBotAuthUnavailableError("replay_unavailable", cause);
     }
+    if (result === "replayed") throw new WebBotAuthError(429, "replayed");
+    if (result !== "ok") throw new WebBotAuthError(429, result);
+    if (options.isRevoked) await legacyRevocationCheck(options, origin, keyid);
+    const signer = Object.freeze({
+      profile: WEB_BOT_AUTH_PROFILE,
+      origin,
+      keyid,
+      label,
+      verified_at: now
+    });
+    verifiedSigners.add(signer);
+    return [signer];
+  } catch (error) {
+    if (error instanceof WebBotAuthError) throw challengeFor(error, label, hasBody);
     if (error instanceof WebBotAuthUnavailableError) throw error;
-    return denied("verification_unavailable");
+    throw challengeFor(new WebBotAuthError(403, "verification_unavailable"), label, hasBody);
   }
 }
+async function directoryKey(options, origin, keyid, now) {
+  await options.directory.resolve(keyid, origin);
+  const checkedDirectory = options.directory.getVerifiedDirectory(origin);
+  if (!checkedDirectory || new URL(checkedDirectory.proof.request.url).origin !== origin) denied("directory_origin");
+  if (checkedDirectory.expires <= now) denied("directory_expired");
+  if (!testKeysAllowed(options.allowTestKeys ?? options.directory.allowsTestKeys) && checkedDirectory.keys.some((key2) => TEST_KIDS.has(key2.kid)))
+    denied("directory_key");
+  const key = checkedDirectory.keys.find((key2) => key2.kid === keyid);
+  if (!key || jwkThumbprint(key) !== keyid) denied("key");
+  return key;
+}
 async function legacyRevocationCheck(options, origin, keyid) {
   let revoked;
   try {
@@ -466,29 +512,27 @@ async function legacyRevocationCheck(options, origin, keyid) {
 function testKeysAllowed(allowTestKeys) {
   return allowTestKeys === true && ["test", "development"].includes(process.env.NODE_ENV ?? "");
 }
-const UNSIGNED_DIRECTORY_MEDIA_TYPES = /* @__PURE__ */ new Set([
-  SIGNATURE_DIRECTORY_MEDIA_TYPE,
-  "application/jwk-set+json",
-  "application/json"
-]);
-function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}) {
+async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}) {
   try {
     if (!Number.isFinite(now)) denied("directory_invalid");
     const origin = canonicalAgentOrigin(response.request.url);
     if (response.request.url !== origin + SIGNATURE_DIRECTORY_PATH || response.status !== 200)
       denied("directory_response");
-    const signed = getHeaderValue(response.headers, "signature-input") !== void 0;
-    if (!signed && options.requireSigned) denied("directory_unsigned");
+    const inputHeader = getHeaderValue(response.headers, "signature-input");
+    const signatureHeader = getHeaderValue(response.headers, "signature");
+    if (!inputHeader || !signatureHeader) denied("directory_unsigned");
     const mediaType = getHeaderValue(response.headers, "content-type")?.split(";")[0]?.trim().toLowerCase();
-    if (signed ? mediaType !== SIGNATURE_DIRECTORY_MEDIA_TYPE : !UNSIGNED_DIRECTORY_MEDIA_TYPES.has(mediaType ?? ""))
-      denied("directory_response");
+    if (mediaType !== SIGNATURE_DIRECTORY_MEDIA_TYPE) denied("directory_response");
     const body = response.body ?? "";
     if (Buffer.byteLength(body) > 256 * 1024) denied("directory_size");
-    if (signed || getHeaderValue(response.headers, "content-digest") !== void 0)
-      assertDirectoryDigest(response.headers, body);
+    try {
+      assertDigest(response.headers, body);
+    } catch {
+      denied("directory_digest");
+    }
     const document = parseStrictJson(body, 32);
     if (!Array.isArray(document.keys) || !document.keys.length || document.keys.length > 64) denied("directory_keys");
-    const signatures = signed ? inputs(response.headers) : [];
+    const signatures = inputs(response.headers, 64);
     const kids = /* @__PURE__ */ new Set();
     const keys = [];
     let expires = Infinity;
@@ -501,15 +545,47 @@ function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}) {
       algorithm(key);
       kids.add(key.kid);
       keys.push(key);
-      if (!signed) continue;
       const proof = signatures.find((input) => input.params.keyid === key.kid && input.params.tag === DIRECTORY_TAG);
-      if (!proof || !proof.components.includes("@authority;req") || !proof.components.includes("content-digest") || !Number.isInteger(proof.params.created) || !Number.isInteger(proof.params.expires) || proof.params.created > now + DIRECTORY_CLOCK_SKEW_SECONDS || proof.params.expires <= now || proof.params.expires <= proof.params.created)
+      if (!proof || !proof.components.includes("@authority;req") || !proof.components.includes("content-digest") || !Number.isSafeInteger(proof.params.created) || !Number.isSafeInteger(proof.params.expires) || proof.params.expires <= now || proof.params.expires <= proof.params.created)
         denied("directory_proof");
-      verifyBytes(proof, { ...response.request, headers: response.request.headers ?? {} }, key, response);
+      const proofComponents = [component("@authority", { req: true }), component("content-digest")];
+      let covered;
+      try {
+        covered = proof.components.map(componentDescriptor);
+      } catch {
+        return denied("directory_proof");
+      }
+      const requestHeaders = response.request.headers ?? {};
+      await verifyWithLibrary(
+        {
+          kind: "response",
+          status: response.status,
+          fields: [
+            ...coveredFields(
+              covered.filter((c) => c.parameters.req === void 0),
+              response.headers
+            ),
+            { name: "signature-input", value: inputHeader },
+            { name: "signature", value: signatureHeader }
+          ],
+          request: {
+            kind: "request",
+            method: response.request.method,
+            targetUri: response.request.url,
+            fields: coveredFields(
+              covered.filter((c) => c.parameters.req !== void 0),
+              requestHeaders
+            )
+          }
+        },
+        proof.label,
+        // The library rejects a proof whose `created` is in the future (beyond skew).
+        { requiredComponents: proofComponents, requiredParameters: ["created", "expires", "keyid", "tag"], now },
+        async () => keyVerifier(key)
+      );
       expires = Math.min(expires, proof.params.expires);
     }
-    if (!signed) expires = now + unsignedAge(options.maxUnsignedAgeSeconds);
-    return { keys, expires, signed, proof: response };
+    return { keys, expires, signed: true, proof: response };
   } catch (error) {
     if (error instanceof WebBotAuthError) {
       throw error.reason.startsWith("directory_") ? error : new WebBotAuthError(403, `directory_${error.reason}`);
@@ -517,26 +593,12 @@ function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}) {
     return denied("directory_invalid");
   }
 }
-function unsignedAge(seconds) {
-  const value = seconds ?? 86400;
-  if (!Number.isFinite(value) || value < 60)
-    throw new TypeError("Unsigned directory age must be a finite number of seconds, at least 60");
-  return value;
-}
 function verifySignatureDirectory(response, now = Date.now() / 1e3, allowTestKeys = false) {
-  return verifyKeyDirectory(response, now, { allowTestKeys, requireSigned: true });
-}
-function assertDirectoryDigest(headers, body) {
-  try {
-    assertDigest(headers, body);
-  } catch {
-    denied("directory_digest");
-  }
+  return verifyKeyDirectory(response, now, { allowTestKeys });
 }
 class SignatureDirectoryResolver {
   constructor(options = {}) {
     this.options = options;
-    unsignedAge(options.maxUnsignedDirectoryAgeSeconds);
   }
   options;
   cache = /* @__PURE__ */ new Map();
@@ -583,22 +645,16 @@ class SignatureDirectoryResolver {
       const url = origin + SIGNATURE_DIRECTORY_PATH;
       const result = await ssrfSafeFetch(url, {
         ...this.options.fetchOptions,
-        headers: {
-          accept: `${SIGNATURE_DIRECTORY_MEDIA_TYPE}, application/jwk-set+json;q=0.9, application/json;q=0.8`
-        },
+        headers: { accept: SIGNATURE_DIRECTORY_MEDIA_TYPE },
         timeoutMs: 1e4,
         maxBodyBytes: 256 * 1024
       });
       if (result.status !== 200) denied("directory_unavailable");
       const body = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(result.body);
-      const directory = verifyKeyDirectory(
+      const directory = await verifyKeyDirectory(
         { status: result.status, headers: result.headers, body, request: { method: "GET", url } },
         now,
-        {
-          allowTestKeys: this.options.allowTestKeys,
-          requireSigned: this.options.requireSignedDirectories,
-          maxUnsignedAgeSeconds: this.options.maxUnsignedDirectoryAgeSeconds
-        }
+        { allowTestKeys: this.options.allowTestKeys }
       );
       const cacheControl = result.headers["cache-control"] ?? "";
       const maxAge = /(?:^|,)\s*(?:no-cache|no-store)(?:,|$)/i.test(cacheControl) ? 0 : Number(cacheControl.match(/(?:^|,)\s*max-age=(\d+)/i)?.[1] ?? 300);
@@ -635,7 +691,7 @@ class SignatureDirectoryResolver {
 }
 function webBotSigner(key) {
   const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
-  const alg = algorithm(jwk);
+  const alg = signingAlgorithm(jwk);
   if (!["test", "development"].includes(process.env.NODE_ENV ?? "") && TEST_KIDS.has(jwkThumbprint(jwk)))
     throw new TypeError("Published Web Bot Auth test keys cannot sign in production");
   if ("provider" in key) {
@@ -643,17 +699,6 @@ function webBotSigner(key) {
       throw new TypeError("Web Bot Auth provider identity does not match its public key");
     return { algorithm: alg, sign: async (data) => Buffer.from(await key.provider.sign(Buffer.from(data))) };
   }
-  if (alg === "rsa-pss-sha512") {
-    const privateKey = createPrivateKey({ key: jwk, format: "jwk" });
-    return {
-      algorithm: alg,
-      sign: (data) => nodeSign("sha512", Buffer.from(data), {
-        key: privateKey,
-        padding: cryptoConstants.RSA_PKCS1_PSS_PADDING,
-        saltLength: 64
-      })
-    };
-  }
   return { algorithm: alg, sign: (data) => signWithPrivateJwkAsync(alg, jwk, Buffer.from(data)) };
 }
 async function createWebBotSignature(...args) {
@@ -664,38 +709,28 @@ async function createWebBotSignature(...args) {
     throw error;
   }
 }
-function componentDescriptor(identifier) {
-  const bare = identifier.split(";", 1)[0];
-  const [, params] = parseItem(`"${bare}"${identifier.slice(bare.length)}`);
-  return component(bare, Object.fromEntries(params));
-}
-function coveredFields(components, headers) {
-  const names = new Set(components.filter((c) => !c.name.startsWith("@")).map((c) => c.name));
-  return [...names].flatMap((name) => {
-    const value = getHeaderValue(headers, name);
-    return value === void 0 ? [] : [{ name, value }];
-  });
-}
 async function signWebBotAuth(request, key, options) {
+  if (options.relay)
+    throw new TypeError(
+      "Web Bot Auth relays were removed from the profile (adcp#7894): an intermediary signs as itself with one signature"
+    );
   const origin = canonicalAgentOrigin(options.origin);
   const label = options.label ?? "sig1";
   if (!/^[a-z][a-z0-9_.*-]*$/.test(label)) throw new TypeError("Invalid signature label");
   const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
   const now = Math.floor((options.now ?? (() => Date.now() / 1e3))());
-  const window = options.windowSeconds ?? 300;
-  const nonce = options.nonce ?? randomBytes(64).toString("base64url");
+  const window = options.windowSeconds ?? MAX_LIFETIME_SECONDS;
+  const nonce = options.nonce ?? freshNonce();
   if (!Number.isSafeInteger(now)) throw new TypeError("Invalid Web Bot Auth clock");
-  if (!Number.isInteger(window) || window < 1 || window > 300 || !/^[A-Za-z0-9_+\/-]{22,256}={0,2}$/.test(nonce))
-    throw new TypeError("Invalid Web Bot Auth lifetime or nonce");
-  if (!options.relay && ["signature", "signature-input", "signature-agent"].some(
+  if (!Number.isInteger(window) || window < 1 || window > MAX_LIFETIME_SECONDS || !nonceBytes(nonce))
+    throw new TypeError("Invalid Web Bot Auth lifetime or nonce (the nonce is 64 bytes, Base64URL or Base64)");
+  if (["signature", "signature-input", "signature-agent"].some(
     (name) => getHeaderValue(request.headers, name) !== void 0
   ))
-    throw new TypeError(
-      "Request already carries signature fields; pass relay: true to add a covering signature instead of replacing them"
-    );
+    throw new TypeError("Request already carries signature fields; the profile takes exactly one signature");
   const headers = {};
   for (const [name, value] of Object.entries(request.headers))
-    if (value !== void 0 && !["signature", "signature-input", "signature-agent", "content-digest"].includes(name.toLowerCase()))
+    if (value !== void 0 && name.toLowerCase() !== "content-digest")
       headers[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
   const components = [component("@method"), component("@target-uri"), component("@authority")];
   if (request.body !== void 0 && request.body !== "") {
@@ -704,37 +739,8 @@ async function signWebBotAuth(request, key, options) {
     headers["content-digest"] = computeContentDigest(request.body, "rfc8941-base64");
     components.push(component("content-type"), component("content-digest"));
   }
-  if (options.relay && ["signature", "signature-input", "signature-agent"].some((name) => !getHeaderValue(request.headers, name)))
-    throw new TypeError("Relay requires the existing signature fields");
-  const earlier = options.relay ? inputs(request.headers) : [];
-  if (earlier.some((input) => input.label === label || input.params.tag !== WEB_BOT_AUTH_PROFILE))
-    throw new TypeError("Relay requires existing Web Bot Auth signatures and a fresh label");
-  const priorAgent = options.relay ? getHeaderValue(request.headers, "signature-agent") : void 0;
-  if (priorAgent) dictionary(priorAgent, "Signature-Agent");
-  headers["signature-agent"] = `${priorAgent ? priorAgent + ", " : ""}${label}="${origin}"`;
-  if (priorAgent) dictionary(headers["signature-agent"], "Signature-Agent");
+  headers["signature-agent"] = `${label}="${origin}"`;
   components.push(component("signature-agent", { key: label }));
-  const covered = new Set(components.map(componentIdentity));
-  const cover = (descriptor) => {
-    const identity = componentIdentity(descriptor);
-    if (!covered.has(identity)) {
-      covered.add(identity);
-      components.push(descriptor);
-    }
-  };
-  for (const inner of earlier) {
-    for (const identifier of inner.components) cover(componentDescriptor(identifier));
-    cover(component("signature-input", { key: inner.label }));
-    cover(component("signature", { key: inner.label }));
-  }
-  const priorInput = options.relay ? getHeaderValue(request.headers, "signature-input") : void 0;
-  const priorSignature = options.relay ? getHeaderValue(request.headers, "signature") : void 0;
-  if (options.relay && (!priorInput || !priorSignature || !priorAgent))
-    throw new TypeError("Relay requires the existing signature fields");
-  if (priorInput) headers["signature-input"] = priorInput;
-  if (priorSignature) headers.signature = priorSignature;
-  for (const inner of earlier)
-    buildWebBotAuthSignatureBase(inner, { ...request, url: new URL(request.url).href, headers });
   const targetUri = new URL(request.url);
   targetUri.hash = "";
   const signed = await createWebBotSignature(
@@ -752,14 +758,14 @@ async function signWebBotAuth(request, key, options) {
         expires: now + window,
         nonce,
         keyid: jwkThumbprint(jwk),
-        alg: algorithm(jwk),
+        alg: signingAlgorithm(jwk),
         tag: WEB_BOT_AUTH_PROFILE
       },
       signer: webBotSigner(key)
     }
   );
-  headers["signature-input"] = `${priorInput ? priorInput + ", " : ""}${signed.signatureInput}`;
-  headers.signature = `${priorSignature ? priorSignature + ", " : ""}${signed.signature}`;
+  headers["signature-input"] = signed.signatureInput;
+  headers.signature = signed.signature;
   return headers;
 }
 async function createSignedSignatureDirectory(originUrl, signingKeys, options = {}) {
@@ -768,14 +774,13 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
   const lifetime = options.lifetimeSeconds ?? 86400;
   if (!Number.isFinite(now) || !Number.isSafeInteger(lifetime) || lifetime < 1 || !Number.isSafeInteger(now + lifetime))
     throw new TypeError("Invalid directory proof clock or lifetime");
-  if (!signingKeys.length || signingKeys.length > 64 || !Number.isInteger(lifetime) || lifetime < 1)
-    throw new TypeError("Invalid directory keys or lifetime");
+  if (!signingKeys.length || signingKeys.length > 64) throw new TypeError("Invalid directory keys or lifetime");
   const keys = signingKeys.map((key) => {
     const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
+    signingAlgorithm(jwk);
     return {
       kty: jwk.kty,
       ...jwk.kty === "RSA" ? { n: jwk.n, e: jwk.e } : { crv: jwk.crv, x: jwk.x },
-      ...jwk.y ? { y: jwk.y } : {},
       kid: jwkThumbprint(jwk),
       use: "sig"
     };
@@ -806,10 +811,10 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
         components: [component("@authority", { req: true }), component("content-digest")],
         parameters: {
           // Backdate created so verifiers whose clocks run slightly behind accept a fresh proof.
-          created: now - DIRECTORY_CLOCK_SKEW_SECONDS,
+          created: now - CLOCK_SKEW_SECONDS,
           expires: now + lifetime,
           keyid: keys[i].kid,
-          alg: algorithm(keys[i]),
+          alg: signingAlgorithm(keys[i]),
           tag: DIRECTORY_TAG
         },
         signer: webBotSigner(signingKeys[i])
@@ -823,6 +828,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
   return response;
 }
 function createWebBotAuthFetch(upstream, key, options) {
+  assertWebBotAuthSigningKey(key);
   return async (input, init) => {
     const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
     if (options.shouldSign && !options.shouldSign(url, init)) return upstream(input, init);
@@ -852,10 +858,13 @@ export {
   SIGNATURE_DIRECTORY_MEDIA_TYPE,
   SIGNATURE_DIRECTORY_PATH,
   SignatureDirectoryResolver,
+  WEB_BOT_AUTH_ALGORITHMS,
   WEB_BOT_AUTH_DRAFT_REVISION,
   WEB_BOT_AUTH_PROFILE,
   WebBotAuthError,
   WebBotAuthUnavailableError,
+  advertisesOnlyWebBotAuth,
+  assertWebBotAuthSigningKey,
   buildWebBotAuthSignatureBase,
   createSignedSignatureDirectory,
   createWebBotAuthAuthorizationFailure,
@@ -871,9 +880,11 @@ export {
   registerWebBotAuthRevocationCheck,
   selectSignatureProfile,
   signWebBotAuth,
+  unsignedWebBotAuthError,
   verifyKeyDirectory,
   verifySignatureDirectory,
   verifyWebBotAuth,
+  webBotAuthAcceptSignature,
   webBotAuthPrincipalFailureError,
   webBotAuthToolFailure,
   webBotAuthUnavailableResponse