@adcp/sdk 16.0.0-beta.9 → 16.0.0

package/README.md

@@ -29,14 +29,14 @@ AdCP operations are **distributed and asynchronous by default**. An agent might:
 ## Installation
 
 ```bash
-npm install @adcp/sdk              # 14.x, AdCP 3.2
+npm install @adcp/sdk              # 16.x, AdCP 3.2
 npm install @adcp/sdk@adcp-3.1     # 13.x, maintained AdCP 3.1 line
 npm install @adcp/sdk@adcp-3.0     # 7.11.x, AdCP 3.0
 ```
 
 AdCP 2 reached end of life on August 1, 2026. This checkout supports AdCP 3 agents only; review the [AdCP 2 retirement guide](./docs/migration-drop-adcp-2.md) before upgrading an integration that still calls AdCP 2 sellers.
 
-Upgrading to SDK 14? Read the [release-bound upgrade worksheet](./docs/migration-14.x-rc-worksheet.md), then use the [13-to-14](./docs/migration-13-to-14.md) or [12-to-14](./docs/migration-12-to-14.md) migration guide. The [prerelease history](./docs/releases/14.0.0-beta.0.md) covers changes made during the 14.0 beta cycle. The npm `latest` tag tracks SDK 14 (AdCP 3.2); SDK 13 stays available on `adcp-3.1` as the maintained AdCP 3.1 line. SDK 14 requires Node.js `^20.19.0 || >=22.12.0`. Older paths: [12-to-13](./docs/migration-12-to-13.md), **[MIGRATION-v8.md](./MIGRATION-v8.md)**, and [8.0-to-8.1](./docs/migration-8.0-to-8.1.md).
+Upgrading to SDK 16? Read the [SDK 16 release notes](./docs/releases/16.0.0.md) and [release-bound upgrade worksheet](./docs/migration-14.x-rc-worksheet.md). The npm `latest` tag tracks SDK 16 (AdCP 3.2); SDK 13 stays available on `adcp-3.1` as the maintained AdCP 3.1 line. SDK 16 requires Node.js `^20.19.0 || >=22.12.0`. Earlier migration guides: [SDK 15 OAuth](./docs/migration-oauth-issuer-bindings.md), [13-to-14](./docs/migration-13-to-14.md), [12-to-14](./docs/migration-12-to-14.md), [12-to-13](./docs/migration-12-to-13.md), **[MIGRATION-v8.md](./MIGRATION-v8.md)**, and [8.0-to-8.1](./docs/migration-8.0-to-8.1.md).
 
 ### Narrow type imports (`@adcp/sdk/types/<tool>`)
 

package/dist/lib/identity-3.3/revocation.js

@@ -225,17 +225,15 @@ class OriginRevocationResolver {
       for (const token of tokens) {
         try {
           const header = (0, import_jose.decodeProtectedHeader)(token);
-          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || // Directory keys are Ed25519 or RSA-PSS under the profile (adcp#7894).
-          header.alg !== "EdDSA" && header.alg !== "PS512")
-            continue;
+          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string") continue;
           await this.options.directory.resolve(header.kid, origin);
           const checked = this.options.directory.getVerifiedDirectory(origin);
           if (!checked || new URL(checked.proof.request.url).origin !== origin || checked.expires <= this.now())
             continue;
           const jwk = checked.keys.find((key) => key.kid === header.kid);
           if (!jwk) continue;
-          const result = await (0, import_jose.compactVerify)(token, await (0, import_jose.importJWK)(jwk, header.alg), {
-            algorithms: [header.alg]
+          const result = await (0, import_jose.compactVerify)(token, await (0, import_jose.importJWK)(jwk, "EdDSA"), {
+            algorithms: ["EdDSA"]
           });
           verifiedPayload = result.payload;
           break;
@@ -296,8 +294,9 @@ async function createSignedOriginRevocationList(snapshot, privateKey) {
   const kid = (0, import_web_bot_auth.jwkThumbprint)(privateKey);
   if (privateKey.kid && privateKey.kid !== kid)
     throw new TypeError("Revocation signing kid must be the JWK thumbprint");
-  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.kty === "RSA" ? "PS512" : void 0;
-  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or RSA key");
+  const alg = "EdDSA";
+  if (privateKey.kty !== "OKP" || privateKey.crv !== "Ed25519" || !privateKey.d)
+    throw new TypeError("Revocations require a private Ed25519 key");
   return new import_jose.CompactSign(Buffer.from(JSON.stringify(snapshot))).setProtectedHeader({ alg, kid, typ: "adcp-gov-revocation+jws" }).sign(await (0, import_jose.importJWK)(privateKey, alg));
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/lib/identity-3.3/revocation.mjs

@@ -204,17 +204,15 @@ class OriginRevocationResolver {
       for (const token of tokens) {
         try {
           const header = decodeProtectedHeader(token);
-          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || // Directory keys are Ed25519 or RSA-PSS under the profile (adcp#7894).
-          header.alg !== "EdDSA" && header.alg !== "PS512")
-            continue;
+          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string") continue;
           await this.options.directory.resolve(header.kid, origin);
           const checked = this.options.directory.getVerifiedDirectory(origin);
           if (!checked || new URL(checked.proof.request.url).origin !== origin || checked.expires <= this.now())
             continue;
           const jwk = checked.keys.find((key) => key.kid === header.kid);
           if (!jwk) continue;
-          const result = await compactVerify(token, await importJWK(jwk, header.alg), {
-            algorithms: [header.alg]
+          const result = await compactVerify(token, await importJWK(jwk, "EdDSA"), {
+            algorithms: ["EdDSA"]
           });
           verifiedPayload = result.payload;
           break;
@@ -275,8 +273,9 @@ async function createSignedOriginRevocationList(snapshot, privateKey) {
   const kid = jwkThumbprint(privateKey);
   if (privateKey.kid && privateKey.kid !== kid)
     throw new TypeError("Revocation signing kid must be the JWK thumbprint");
-  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.kty === "RSA" ? "PS512" : void 0;
-  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or RSA key");
+  const alg = "EdDSA";
+  if (privateKey.kty !== "OKP" || privateKey.crv !== "Ed25519" || !privateKey.d)
+    throw new TypeError("Revocations require a private Ed25519 key");
   return new CompactSign(Buffer.from(JSON.stringify(snapshot))).setProtectedHeader({ alg, kid, typ: "adcp-gov-revocation+jws" }).sign(await importJWK(privateKey, alg));
 }
 export {

package/dist/lib/server/create-adcp-server.js

@@ -4581,7 +4581,7 @@ function createAdcpServer(config) {
         .../* @__PURE__ */ new Set([
           algorithm,
           // `algorithms` lists AdCP webhook-profile values; a Web Bot Auth key
-          // is Ed25519 or RSA-PSS (adcp#7894), and only Ed25519 has a value here.
+          // is Ed25519 (adcp#7894), which has the value `ed25519` here.
           ...webhooks.webBotAuth && ("privateKey" in webhooks.webBotAuth.key ? webhooks.webBotAuth.key.privateKey.crv : webhooks.webBotAuth.key.publicKey.crv) === "Ed25519" ? ["ed25519"] : []
         ])
       ],

package/dist/lib/server/create-adcp-server.mjs

@@ -4672,7 +4672,7 @@ function createAdcpServer(config) {
         .../* @__PURE__ */ new Set([
           algorithm,
           // `algorithms` lists AdCP webhook-profile values; a Web Bot Auth key
-          // is Ed25519 or RSA-PSS (adcp#7894), and only Ed25519 has a value here.
+          // is Ed25519 (adcp#7894), which has the value `ed25519` here.
           ...webhooks.webBotAuth && ("privateKey" in webhooks.webBotAuth.key ? webhooks.webBotAuth.key.privateKey.crv : webhooks.webBotAuth.key.publicKey.crv) === "Ed25519" ? ["ed25519"] : []
         ])
       ],

package/dist/lib/signing/crypto.d.mts

@@ -15,5 +15,5 @@ export declare function verifySignatureAsync(alg: string, publicKey: KeyObject |
  * path passes the key as a JWK so workerd accepts it (#3243).
  */
 export declare function signWithPrivateJwk(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Uint8Array;
-/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 and RSA-PSS when available (workerd, #3243). */
+/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 when available (workerd, #3243). */
 export declare function signWithPrivateJwkAsync(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Promise<Uint8Array>;

package/dist/lib/signing/crypto.d.ts

@@ -15,5 +15,5 @@ export declare function verifySignatureAsync(alg: string, publicKey: KeyObject |
  * path passes the key as a JWK so workerd accepts it (#3243).
  */
 export declare function signWithPrivateJwk(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Uint8Array;
-/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 and RSA-PSS when available (workerd, #3243). */
+/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 when available (workerd, #3243). */
 export declare function signWithPrivateJwkAsync(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Promise<Uint8Array>;

package/dist/lib/signing/crypto.js

@@ -59,14 +59,6 @@ function verifySignature(alg, publicKey, data, signature) {
         );
       }
     }
-    if (alg === "rsa-pss-sha512") {
-      return (0, import_crypto.verify)(
-        "sha512",
-        data,
-        { key: publicKey, padding: import_crypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 64 },
-        signature
-      );
-    }
     return false;
   } catch {
     return false;
@@ -87,36 +79,15 @@ function privateP256Jwk(jwk) {
 async function verifySignatureAsync(alg, publicKey, data, signature) {
   const subtle = subtleCrypto();
   const keyObject = () => isKeyObject(publicKey) ? publicKey : jwkToPublicKey(publicKey);
-  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
-    return verifySignature(alg, keyObject(), data, signature);
+  if (alg !== "ecdsa-p256-sha256" || !subtle) return verifySignature(alg, keyObject(), data, signature);
   try {
     const jwk = isKeyObject(publicKey) ? publicKey.export({ format: "jwk" }) : publicKey;
-    if (alg === "rsa-pss-sha512") {
-      const key2 = await importRsaPssVerifyKey(subtle, jwk);
-      return await subtle.verify(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(signature), toArrayBuffer(data));
-    }
     const key = await importP256VerifyKey(subtle, jwk);
     return await subtle.verify(P256_SHA256, key, toArrayBuffer(signature), toArrayBuffer(data));
   } catch {
     return false;
   }
 }
-const RSA_PSS_SHA512 = { name: "RSA-PSS", hash: "SHA-512" };
-const RSA_PSS_SHA512_SIGN = { name: "RSA-PSS", saltLength: 64 };
-const rsaPssVerifyKeys = /* @__PURE__ */ new Map();
-function importRsaPssVerifyKey(subtle, jwk) {
-  if (jwk.kty !== "RSA" || typeof jwk.n !== "string" || typeof jwk.e !== "string")
-    return Promise.reject(new TypeError("Not an RSA public key"));
-  const cacheKey = `${jwk.e}.${jwk.n}`;
-  let key = rsaPssVerifyKeys.get(cacheKey);
-  if (!key) {
-    key = subtle.importKey("jwk", { kty: "RSA", n: jwk.n, e: jwk.e }, RSA_PSS_SHA512, false, ["verify"]);
-    key.catch(() => rsaPssVerifyKeys.delete(cacheKey));
-    if (rsaPssVerifyKeys.size >= 256) rsaPssVerifyKeys.delete(rsaPssVerifyKeys.keys().next().value);
-    rsaPssVerifyKeys.set(cacheKey, key);
-  }
-  return key;
-}
 function isKeyObject(value) {
   return typeof value?.export === "function" && "asymmetricKeyType" in value;
 }
@@ -139,25 +110,11 @@ function signWithPrivateJwk(alg, privateJwk, data) {
     return new Uint8Array((0, import_crypto.sign)(null, data, (0, import_crypto.createPrivateKey)({ key: privateJwk, format: "jwk" })));
   if (alg === "ecdsa-p256-sha256")
     return new Uint8Array((0, import_crypto.sign)("sha256", data, { key: privateJwk, format: "jwk", dsaEncoding: "ieee-p1363" }));
-  if (alg === "rsa-pss-sha512")
-    return new Uint8Array(
-      (0, import_crypto.sign)("sha512", data, {
-        key: (0, import_crypto.createPrivateKey)({ key: privateJwk, format: "jwk" }),
-        padding: import_crypto.constants.RSA_PKCS1_PSS_PADDING,
-        saltLength: 64
-      })
-    );
   throw new TypeError(`Unsupported signing algorithm: ${alg}`);
 }
 async function signWithPrivateJwkAsync(alg, privateJwk, data) {
   const subtle = subtleCrypto();
-  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
-    return signWithPrivateJwk(alg, privateJwk, data);
-  if (alg === "rsa-pss-sha512") {
-    const { kty, n, e, d, p, q, dp, dq, qi } = privateJwk;
-    const key2 = await subtle.importKey("jwk", { kty, n, e, d, p, q, dp, dq, qi }, RSA_PSS_SHA512, false, ["sign"]);
-    return new Uint8Array(await subtle.sign(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(data)));
-  }
+  if (alg !== "ecdsa-p256-sha256" || !subtle) return signWithPrivateJwk(alg, privateJwk, data);
   const key = await subtle.importKey("jwk", privateP256Jwk(privateJwk), P256, false, ["sign"]);
   return new Uint8Array(await subtle.sign(P256_SHA256, key, toArrayBuffer(data)));
 }

package/dist/lib/signing/crypto.mjs

@@ -1,5 +1,4 @@
 import {
-  constants,
   createPrivateKey,
   createPublicKey,
   sign as nodeSign,
@@ -38,14 +37,6 @@ function verifySignature(alg, publicKey, data, signature) {
         );
       }
     }
-    if (alg === "rsa-pss-sha512") {
-      return nodeVerify(
-        "sha512",
-        data,
-        { key: publicKey, padding: constants.RSA_PKCS1_PSS_PADDING, saltLength: 64 },
-        signature
-      );
-    }
     return false;
   } catch {
     return false;
@@ -66,36 +57,15 @@ function privateP256Jwk(jwk) {
 async function verifySignatureAsync(alg, publicKey, data, signature) {
   const subtle = subtleCrypto();
   const keyObject = () => isKeyObject(publicKey) ? publicKey : jwkToPublicKey(publicKey);
-  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
-    return verifySignature(alg, keyObject(), data, signature);
+  if (alg !== "ecdsa-p256-sha256" || !subtle) return verifySignature(alg, keyObject(), data, signature);
   try {
     const jwk = isKeyObject(publicKey) ? publicKey.export({ format: "jwk" }) : publicKey;
-    if (alg === "rsa-pss-sha512") {
-      const key2 = await importRsaPssVerifyKey(subtle, jwk);
-      return await subtle.verify(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(signature), toArrayBuffer(data));
-    }
     const key = await importP256VerifyKey(subtle, jwk);
     return await subtle.verify(P256_SHA256, key, toArrayBuffer(signature), toArrayBuffer(data));
   } catch {
     return false;
   }
 }
-const RSA_PSS_SHA512 = { name: "RSA-PSS", hash: "SHA-512" };
-const RSA_PSS_SHA512_SIGN = { name: "RSA-PSS", saltLength: 64 };
-const rsaPssVerifyKeys = /* @__PURE__ */ new Map();
-function importRsaPssVerifyKey(subtle, jwk) {
-  if (jwk.kty !== "RSA" || typeof jwk.n !== "string" || typeof jwk.e !== "string")
-    return Promise.reject(new TypeError("Not an RSA public key"));
-  const cacheKey = `${jwk.e}.${jwk.n}`;
-  let key = rsaPssVerifyKeys.get(cacheKey);
-  if (!key) {
-    key = subtle.importKey("jwk", { kty: "RSA", n: jwk.n, e: jwk.e }, RSA_PSS_SHA512, false, ["verify"]);
-    key.catch(() => rsaPssVerifyKeys.delete(cacheKey));
-    if (rsaPssVerifyKeys.size >= 256) rsaPssVerifyKeys.delete(rsaPssVerifyKeys.keys().next().value);
-    rsaPssVerifyKeys.set(cacheKey, key);
-  }
-  return key;
-}
 function isKeyObject(value) {
   return typeof value?.export === "function" && "asymmetricKeyType" in value;
 }
@@ -118,25 +88,11 @@ function signWithPrivateJwk(alg, privateJwk, data) {
     return new Uint8Array(nodeSign(null, data, createPrivateKey({ key: privateJwk, format: "jwk" })));
   if (alg === "ecdsa-p256-sha256")
     return new Uint8Array(nodeSign("sha256", data, { key: privateJwk, format: "jwk", dsaEncoding: "ieee-p1363" }));
-  if (alg === "rsa-pss-sha512")
-    return new Uint8Array(
-      nodeSign("sha512", data, {
-        key: createPrivateKey({ key: privateJwk, format: "jwk" }),
-        padding: constants.RSA_PKCS1_PSS_PADDING,
-        saltLength: 64
-      })
-    );
   throw new TypeError(`Unsupported signing algorithm: ${alg}`);
 }
 async function signWithPrivateJwkAsync(alg, privateJwk, data) {
   const subtle = subtleCrypto();
-  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
-    return signWithPrivateJwk(alg, privateJwk, data);
-  if (alg === "rsa-pss-sha512") {
-    const { kty, n, e, d, p, q, dp, dq, qi } = privateJwk;
-    const key2 = await subtle.importKey("jwk", { kty, n, e, d, p, q, dp, dq, qi }, RSA_PSS_SHA512, false, ["sign"]);
-    return new Uint8Array(await subtle.sign(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(data)));
-  }
+  if (alg !== "ecdsa-p256-sha256" || !subtle) return signWithPrivateJwk(alg, privateJwk, data);
   const key = await subtle.importKey("jwk", privateP256Jwk(privateJwk), P256, false, ["sign"]);
   return new Uint8Array(await subtle.sign(P256_SHA256, key, toArrayBuffer(data)));
 }

package/dist/lib/signing/web-bot-auth.d.mts

@@ -8,8 +8,8 @@ export declare const WEB_BOT_AUTH_PROFILE: "web-bot-auth";
 export declare const WEB_BOT_AUTH_DRAFT_REVISION: "draft-ietf-webbotauth-httpsig-protocol-00";
 export declare const SIGNATURE_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 export declare const SIGNATURE_DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
-/** The profile's signature algorithms (wba-profile.mdx "Profile rules"). ES256 is RFC 9421 profile only. */
-export declare const WEB_BOT_AUTH_ALGORITHMS: readonly ["ed25519", "rsa-pss-sha512"];
+/** The profile's signature algorithm: Ed25519 only. ES256 is RFC 9421 profile only. */
+export declare const WEB_BOT_AUTH_ALGORITHMS: readonly ["ed25519"];
 /**
  * The profile's `Accept-Signature` member (RFC 9421 §5.1): the label, the
  * components the profile requires, and its parameters. A replay challenge
@@ -73,7 +73,12 @@ export declare function jwkThumbprint(jwk: Partial<Pick<AdcpJsonWebKey, 'kty' |
  * time rather than on the first request.
  */
 export declare function assertWebBotAuthSigningKey(key: WebBotSigningKey): void;
-/** Reject authority normalization differentials on received identifiers. */
+/**
+ * A received identity origin, which must be exactly the canonical https
+ * origin string (WBA §5.2.1): lowercase host, no default port, and no path,
+ * trailing `/`, query, fragment, or userinfo. The string is compared as
+ * received, never normalized first.
+ */
 export declare function receivedAgentOrigin(value: string): string;
 export declare function getWebBotAuthLegacyOriginGate(resolver: Function | undefined): ((origin: string) => Promise<void>) | undefined;
 export interface WebBotAuthAuthorizationFailure {
@@ -136,8 +141,9 @@ export interface VerifyWebBotAuthOptions {
 /**
  * Verify a Web Bot Auth request (wba-profile.mdx "Verification"). Resolves to
  * exactly one verified signer: the profile takes one `web-bot-auth` signature
- * and one `Signature-Agent` member per request. The array shape is kept for
- * principal resolvers written against earlier drafts.
+ * and one `Signature-Agent` member per request, and does not read signatures
+ * with other tags. The array shape is kept for principal resolvers written
+ * against earlier drafts.
  */
 export declare function verifyWebBotAuth(request: RequestLike, options: VerifyWebBotAuthOptions): Promise<VerifiedWebBotSigner[]>;
 export interface VerifiedSignatureDirectory {
@@ -151,11 +157,13 @@ export interface VerifiedSignatureDirectory {
 }
 /**
  * Verify a key directory response (wba-profile.mdx "Key directories", WBA
- * Appendix B.1). The response must be signed once per key, each signature
- * covering `"@authority";req` and `content-digest` with `created`, `expires`,
- * the key's thumbprint as `keyid` and `tag="http-message-signatures-directory"`,
- * and verifying under the key the directory itself provides. An unsigned
- * directory is a discovery failure.
+ * Appendix B.1). The response must be signed once per usable key, each
+ * signature covering `"@authority";req` and `content-digest` with `created`,
+ * `expires`, the key's thumbprint as `keyid` and
+ * `tag="http-message-signatures-directory"`, and verifying under the key the
+ * directory itself provides. Keys the profile cannot use, and their
+ * signatures, are ignored. An unsigned directory, or one without a usable
+ * key, is a discovery failure.
  */
 export declare function verifyKeyDirectory(response: ResponseLike, now?: number, options?: {
     allowTestKeys?: boolean;

package/dist/lib/signing/web-bot-auth.d.ts

@@ -8,8 +8,8 @@ export declare const WEB_BOT_AUTH_PROFILE: "web-bot-auth";
 export declare const WEB_BOT_AUTH_DRAFT_REVISION: "draft-ietf-webbotauth-httpsig-protocol-00";
 export declare const SIGNATURE_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 export declare const SIGNATURE_DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
-/** The profile's signature algorithms (wba-profile.mdx "Profile rules"). ES256 is RFC 9421 profile only. */
-export declare const WEB_BOT_AUTH_ALGORITHMS: readonly ["ed25519", "rsa-pss-sha512"];
+/** The profile's signature algorithm: Ed25519 only. ES256 is RFC 9421 profile only. */
+export declare const WEB_BOT_AUTH_ALGORITHMS: readonly ["ed25519"];
 /**
  * The profile's `Accept-Signature` member (RFC 9421 §5.1): the label, the
  * components the profile requires, and its parameters. A replay challenge
@@ -73,7 +73,12 @@ export declare function jwkThumbprint(jwk: Partial<Pick<AdcpJsonWebKey, 'kty' |
  * time rather than on the first request.
  */
 export declare function assertWebBotAuthSigningKey(key: WebBotSigningKey): void;
-/** Reject authority normalization differentials on received identifiers. */
+/**
+ * A received identity origin, which must be exactly the canonical https
+ * origin string (WBA §5.2.1): lowercase host, no default port, and no path,
+ * trailing `/`, query, fragment, or userinfo. The string is compared as
+ * received, never normalized first.
+ */
 export declare function receivedAgentOrigin(value: string): string;
 export declare function getWebBotAuthLegacyOriginGate(resolver: Function | undefined): ((origin: string) => Promise<void>) | undefined;
 export interface WebBotAuthAuthorizationFailure {
@@ -136,8 +141,9 @@ export interface VerifyWebBotAuthOptions {
 /**
  * Verify a Web Bot Auth request (wba-profile.mdx "Verification"). Resolves to
  * exactly one verified signer: the profile takes one `web-bot-auth` signature
- * and one `Signature-Agent` member per request. The array shape is kept for
- * principal resolvers written against earlier drafts.
+ * and one `Signature-Agent` member per request, and does not read signatures
+ * with other tags. The array shape is kept for principal resolvers written
+ * against earlier drafts.
  */
 export declare function verifyWebBotAuth(request: RequestLike, options: VerifyWebBotAuthOptions): Promise<VerifiedWebBotSigner[]>;
 export interface VerifiedSignatureDirectory {
@@ -151,11 +157,13 @@ export interface VerifiedSignatureDirectory {
 }
 /**
  * Verify a key directory response (wba-profile.mdx "Key directories", WBA
- * Appendix B.1). The response must be signed once per key, each signature
- * covering `"@authority";req` and `content-digest` with `created`, `expires`,
- * the key's thumbprint as `keyid` and `tag="http-message-signatures-directory"`,
- * and verifying under the key the directory itself provides. An unsigned
- * directory is a discovery failure.
+ * Appendix B.1). The response must be signed once per usable key, each
+ * signature covering `"@authority";req` and `content-digest` with `created`,
+ * `expires`, the key's thumbprint as `keyid` and
+ * `tag="http-message-signatures-directory"`, and verifying under the key the
+ * directory itself provides. Keys the profile cannot use, and their
+ * signatures, are ignored. An unsigned directory, or one without a usable
+ * key, is a discovery failure.
  */
 export declare function verifyKeyDirectory(response: ResponseLike, now?: number, options?: {
     allowTestKeys?: boolean;

package/dist/lib/signing/web-bot-auth.js

@@ -70,8 +70,9 @@ const WEB_BOT_AUTH_PROFILE = "web-bot-auth";
 const WEB_BOT_AUTH_DRAFT_REVISION = "draft-ietf-webbotauth-httpsig-protocol-00";
 const SIGNATURE_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 const SIGNATURE_DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
-const WEB_BOT_AUTH_ALGORITHMS = Object.freeze(["ed25519", "rsa-pss-sha512"]);
+const WEB_BOT_AUTH_ALGORITHMS = Object.freeze(["ed25519"]);
 const DIRECTORY_TAG = "http-message-signatures-directory";
+const PRIVATE_JWK_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth", "k"]);
 const CLOCK_SKEW_SECONDS = 60;
 const MAX_LIFETIME_SECONDS = 300;
 const REQUIRED_PARAMETERS = ["created", "expires", "nonce", "keyid", "alg", "tag"];
@@ -182,26 +183,29 @@ function jwkThumbprint(jwk) {
   else return denied("unsupported_key");
   return (0, import_crypto.createHash)("sha256").update(JSON.stringify(fields)).digest("base64url");
 }
+function keyAlgorithm(jwk) {
+  return jwk.kty === "OKP" && jwk.crv === "Ed25519" ? "ed25519" : void 0;
+}
 function algorithm(jwk) {
-  if (jwk.kty === "OKP" && jwk.crv === "Ed25519") return "ed25519";
-  if (jwk.kty === "RSA" && typeof jwk.n === "string" && jwk.e === "AQAB") {
-    const bytes = Buffer.from(jwk.n, "base64url").length;
-    if (bytes >= 256 && bytes <= 512) return "rsa-pss-sha512";
-  }
-  return denied("unsupported_key");
+  return keyAlgorithm(jwk) ?? denied("unsupported_key");
 }
 function signingAlgorithm(jwk) {
   try {
     return algorithm(jwk);
   } catch {
-    throw new TypeError(
-      "Web Bot Auth signs with Ed25519 or RSA-PSS-SHA512 (2048-4096 bit, e=65537) keys only; ES256 remains on the AdCP RFC 9421 profile"
-    );
+    throw new TypeError("Web Bot Auth signs with Ed25519 keys only; ES256 remains on the AdCP RFC 9421 profile");
   }
 }
 function assertWebBotAuthSigningKey(key) {
   signingAlgorithm("privateKey" in key ? key.privateKey : key.publicKey);
 }
+function signingOrigin(value) {
+  try {
+    return receivedAgentOrigin((0, import_canonicalize.canonicalAgentOrigin)(value));
+  } catch {
+    throw new TypeError("Web Bot Auth signs as an https origin only (WBA section 5.2.1)");
+  }
+}
 function inputs(headers, limit) {
   const members = dictionary((0, import_canonicalize2.getHeaderValue)(headers, "signature-input"), "Signature-Input");
   if (members.size > limit) bad("signature_input");
@@ -214,6 +218,7 @@ function inputs(headers, limit) {
   });
 }
 function receivedAgentOrigin(value) {
+  if (!value.startsWith("https://")) return denied("agent_origin");
   try {
     (0, import_select_agent.canonicalAgentUrl)(value);
     const origin = (0, import_canonicalize.canonicalAgentOrigin)(value);
@@ -436,8 +441,10 @@ async function verifyWebBotAuth(request, options) {
       if (!(member2[0] instanceof ArrayBuffer) || member2[1].size !== 0) bad("signature");
     for (const member2 of agents?.values() ?? []) if (typeof member2[0] !== "string") bad("signature_agent");
     if (!inputMembers || !signatureMembers) return denied("headers_missing");
-    if (inputMembers.size !== 1 || signatureMembers.size !== 1) denied("signature_count");
-    label = inputMembers.keys().next().value;
+    const tagged = [...inputMembers].filter(([, member2]) => member2[1].get("tag") === WEB_BOT_AUTH_PROFILE);
+    if (tagged.length === 0) denied("profile");
+    if (tagged.length > 1) denied("signature_count");
+    label = tagged[0][0];
     if (!signatureMembers.has(label)) denied("signature_label");
     try {
       (0, import_parser.parseSignature)(signatureHeader, label, "rfc8941-base64");
@@ -450,7 +457,6 @@ async function verifyWebBotAuth(request, options) {
     } catch {
       return denied("parameters");
     }
-    if (input.params.tag !== WEB_BOT_AUTH_PROFILE) denied("profile");
     if (!agents || agents.size !== 1) denied(agents ? "agent_count" : "agent_missing");
     const agentMember = `signature-agent;key="${label}"`;
     const agentComponents = input.components.filter((c) => c.startsWith("signature-agent;"));
@@ -458,7 +464,7 @@ async function verifyWebBotAuth(request, options) {
     const member = agents.get(label);
     if (!member) denied("agent_not_covered");
     const type = member[1].get("type");
-    if (type !== void 0 && type !== "directory") denied("agent_type");
+    if (type !== void 0 && String(type) !== "directory") denied("agent_type");
     const origin = receivedAgentOrigin(member[0]);
     const { created, expires, nonce, keyid, alg } = input.params;
     if ([created, expires, nonce, keyid, alg].some((value) => value === void 0)) denied("parameters_missing");
@@ -582,11 +588,13 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
     let expires = Infinity;
     for (const raw of document.keys) {
       if (!raw || typeof raw !== "object") denied("directory_key");
+      if (Object.keys(raw).some((k) => PRIVATE_JWK_MEMBERS.has(k.toLowerCase()) || k.startsWith("_private")))
+        denied("directory_key");
+      if (!keyAlgorithm(raw)) continue;
       const thumbprint = jwkThumbprint(raw);
       const key = { ...raw, kid: raw.kid ?? thumbprint };
-      if (key.kid !== thumbprint || kids.has(key.kid) || key.d !== void 0 || Object.keys(key).some((k) => k.startsWith("_private")) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
+      if (key.kid !== thumbprint || kids.has(key.kid) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
         denied("directory_key");
-      algorithm(key);
       kids.add(key.kid);
       keys.push(key);
       const proof = signatures.find((input) => input.params.keyid === key.kid && input.params.tag === DIRECTORY_TAG);
@@ -629,6 +637,7 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
       );
       expires = Math.min(expires, proof.params.expires);
     }
+    if (!keys.length) denied("directory_keys");
     return { keys, expires, signed: true, proof: response };
   } catch (error) {
     if (error instanceof WebBotAuthError) {
@@ -758,7 +767,7 @@ async function signWebBotAuth(request, key, options) {
     throw new TypeError(
       "Web Bot Auth relays were removed from the profile (adcp#7894): an intermediary signs as itself with one signature"
     );
-  const origin = (0, import_canonicalize.canonicalAgentOrigin)(options.origin);
+  const origin = signingOrigin(options.origin);
   const label = options.label ?? "sig1";
   if (!/^[a-z][a-z0-9_.*-]*$/.test(label)) throw new TypeError("Invalid signature label");
   const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
@@ -813,7 +822,7 @@ async function signWebBotAuth(request, key, options) {
   return headers;
 }
 async function createSignedSignatureDirectory(originUrl, signingKeys, options = {}) {
-  const origin = (0, import_canonicalize.canonicalAgentOrigin)(originUrl);
+  const origin = signingOrigin(originUrl);
   const now = Math.floor((options.now ?? (() => Date.now() / 1e3))());
   const lifetime = options.lifetimeSeconds ?? 86400;
   if (!Number.isFinite(now) || !Number.isSafeInteger(lifetime) || lifetime < 1 || !Number.isSafeInteger(now + lifetime))
@@ -822,12 +831,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
   const keys = signingKeys.map((key) => {
     const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
     signingAlgorithm(jwk);
-    return {
-      kty: jwk.kty,
-      ...jwk.kty === "RSA" ? { n: jwk.n, e: jwk.e } : { crv: jwk.crv, x: jwk.x },
-      kid: jwkThumbprint(jwk),
-      use: "sig"
-    };
+    return { kty: jwk.kty, crv: jwk.crv, x: jwk.x, kid: jwkThumbprint(jwk), use: "sig" };
   });
   if (new Set(keys.map((k) => k.kid)).size !== keys.length) throw new TypeError("Duplicate directory key");
   const body = JSON.stringify({ keys });
@@ -873,6 +877,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
 }
 function createWebBotAuthFetch(upstream, key, options) {
   assertWebBotAuthSigningKey(key);
+  signingOrigin(options.origin);
   return async (input, init) => {
     const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
     if (options.shouldSign && !options.shouldSign(url, init)) return upstream(input, init);