@webdecoy/fcaptcha 1.16.0 → 1.18.0

package/detection.js

@@ -97,12 +97,28 @@ async function checkIPReputation(ip) {
 // HTTP Header Analysis
 // =============================================================================
 
-const SUSPICIOUS_HEADERS = new Set([
-  'x-requested-with', 'x-forwarded-for', 'x-real-ip', 'via',
-  'forwarded', 'x-originating-ip', 'cf-connecting-ip',
-  'true-client-ip', 'x-cluster-client-ip'
+// Headers a reverse proxy, CDN or load balancer adds on the way in.
+//
+// These are only anomalous when they arrive from a peer that is NOT a proxy we
+// trust: an ordinary client has no business claiming to forward for someone
+// else. Behind a proxy they are the opposite of suspicious — they are how the
+// request is supposed to arrive, and Cloudflare alone contributes three of
+// them.
+//
+// Scoring them unconditionally meant every visitor to every proxied deployment
+// picked up a bot detection, permanently, including the project's own demo
+// behind Railway. The bench measured it firing on 100% of the human panel *and*
+// 100% of the agent corpus — a signal that fires on everyone distinguishes
+// nobody, it just adds noise to both sides of the comparison.
+const FORWARDING_HEADERS = new Set([
+  'x-forwarded-for', 'x-real-ip', 'via', 'forwarded', 'x-originating-ip',
+  'cf-connecting-ip', 'true-client-ip', 'x-cluster-client-ip'
 ]);
 
+// Suspicious regardless of who the peer is. x-requested-with is set by XHR
+// libraries, not by proxies, so trusting the peer says nothing about it.
+const SUSPICIOUS_HEADERS = new Set(['x-requested-with']);
+
 const EXPECTED_BROWSER_HEADERS = new Set([
   'accept', 'accept-language', 'accept-encoding', 'user-agent'
 ]);
@@ -162,7 +178,16 @@ function checkDeclaredAIAgent(userAgent, headers = {}) {
   return detections;
 }
 
-function analyzeHeaders(headers) {
+/**
+ * @param {object} headers
+ * @param {object} [opts]
+ * @param {boolean} [opts.peerTrusted] whether the immediate peer is a proxy we
+ *   trust. When it is, forwarding headers are expected infrastructure rather
+ *   than an anomaly. Defaults to false, so a caller that does not know keeps
+ *   the stricter behaviour.
+ */
+function analyzeHeaders(headers, opts = {}) {
+  const peerTrusted = opts.peerTrusted === true;
   const detections = [];
   const headersLower = {};
   for (const [key, value] of Object.entries(headers)) {
@@ -185,9 +210,12 @@ function analyzeHeaders(headers) {
     });
   }
 
-  // Check for suspicious headers
+  // Check for suspicious headers. Forwarding headers only count when the peer
+  // is not a proxy we trust — see FORWARDING_HEADERS.
   for (const header of Object.keys(headersLower)) {
-    if (SUSPICIOUS_HEADERS.has(header)) {
+    const isSuspicious =
+      SUSPICIOUS_HEADERS.has(header) || (!peerTrusted && FORWARDING_HEADERS.has(header));
+    if (isSuspicious) {
       detections.push({
         category: 'bot',
         score: 0.3,
@@ -660,9 +688,17 @@ function analyzeKeystrokeCadence(stats) {
 // Form Interaction Analysis (Credential Stuffing & Spam Detection)
 // =============================================================================
 
-function analyzeFormInteraction(formAnalysis) {
+/**
+ * @param {object} formAnalysis
+ * @param {object} [opts]
+ * @param {boolean} [opts.humanPresent] whether the visitor independently showed
+ *   they were there — real pointer or touch movement. Defaults to false so a
+ *   caller that does not know keeps the stricter behaviour.
+ */
+function analyzeFormInteraction(formAnalysis, opts = {}) {
   if (!formAnalysis) return [];
 
+  const humanPresent = opts.humanPresent === true;
   const detections = [];
   const submit = formAnalysis.submit || {};
 
@@ -733,8 +769,18 @@ function analyzeFormInteraction(formAnalysis) {
         });
       }
 
-      // Check for paste-heavy input (spam bots often paste content)
-      if (stats.pasteCount > 0 && stats.keyCount < 5) {
+      // Check for paste-heavy input (spam bots often paste content).
+      //
+      // Standing down when the visitor independently demonstrated they were
+      // present. Pasting is not a bot behaviour — people paste addresses, error
+      // messages, snippets and one-time codes constantly, and a form filled by
+      // paste alone is an ordinary afternoon. The bench human panel caught this
+      // firing on 100% of the paste-by-human persona.
+      //
+      // What actually distinguishes the spam bot is that pasting is ALL it did:
+      // no pointer trajectory, no touch, nothing but the content appearing. So
+      // the check now needs the paste AND the absence of a person.
+      if (stats.pasteCount > 0 && stats.keyCount < 5 && !humanPresent) {
         detections.push({
           category: 'bot',
           score: 0.6,

package/inputforensics.js

@@ -0,0 +1,314 @@
+'use strict';
+
+/**
+ * Input forensics v2 — PRD workstream C.
+ *
+ * Four checks on *how* input arrived rather than how much of it there was:
+ * typing cadence, typing modality, the paste-shortcut/platform contradiction,
+ * and scroll morphology.
+ *
+ * ## Every threshold here was measured, not assumed
+ *
+ * The PRD quotes FP-Agent's observations (Manus 1.39ms inter-key, Browser Use
+ * 5.31ms, Skyvern 9.52ms) and then warns, correctly, that they are *not*
+ * constants: the paper found Browser Use programs an 18ms delay yet is observed
+ * at 5.31ms, because the renderer batches events. The numbers are a function of
+ * browser version and machine load. Hardcoding them would be copying someone
+ * else's laboratory conditions.
+ *
+ * So the values below come from the bench corpus (bench/README.md), captured on
+ * real hardware through a real browser:
+ *
+ *   signal                 human                     scripted agent
+ *   ---------------------  ------------------------  --------------------
+ *   inter-key interval     min 114.6ms, med 226.9ms  max 25.9ms, med 7.9ms
+ *   interval variance      4549                      8
+ *   key hold (dwell)       min 41.4ms, med 82.0ms    max 25.5ms, med 7.8ms
+ *   scroll max step        109px                     704px
+ *
+ * The distributions do not overlap, so the thresholds sit in the empty space
+ * between them with a wide margin on both sides rather than hugging either.
+ * Re-derive them with `node bench/run-bench.js` on your own hardware if you
+ * fork this; that is what §7.4 of the PRD is asking for.
+ *
+ * ## What is deliberately NOT here
+ *
+ * Keystroke overlap — the claim that humans press the next key before releasing
+ * the current one and agents never do. An earlier PRD draft attributed it to
+ * FP-Agent; the paper does not say it. It defines a keystroke as "a keydown
+ * event followed by a keyup event" and its only overlap language is about
+ * modifier keys in shortcuts. Rollover typing is real in the keystroke-dynamics
+ * literature, so the hypothesis may well hold — but it has no source and no
+ * measurement here, so it earns no weight.
+ *
+ * ## Weighting
+ *
+ * All of these are contributory, not decisive, per §7.4. The coalesced-events
+ * signal FCaptcha already ships is under active attack from stealth tooling
+ * that synthesises it; behavioural signals have a shelf life, and any one of
+ * them carrying a verdict on its own is a liability. The one exception in
+ * spirit is the platform contradiction, which scores higher because it is not a
+ * threshold at all — it is the client disagreeing with itself.
+ */
+
+// --- measured thresholds ----------------------------------------------------
+
+// 2.9x below the slowest human keystroke observed, 1.5x above the fastest agent one.
+const MAX_MACHINE_INTERKEY_MS = 40;
+// Human variance was 4549; the scripted agent's was 8.
+const MAX_MACHINE_INTERVAL_VARIANCE = 200;
+// Human holds bottomed out at 41ms; the agent never exceeded 25.5ms.
+const MAX_MACHINE_DWELL_MS = 35;
+// Enough keystrokes to be a typing sample at all. A paste registers as one or
+// two keydowns, and at n=2 any cadence statistic is noise.
+const MIN_KEYS_FOR_CADENCE = 10;
+// Human scrolling never stepped more than 109px between events; scrollIntoView
+// covered 704px in one.
+const MAX_HUMAN_SCROLL_STEP_PX = 400;
+
+const MAC_PLATFORMS = /^(mac|iphone|ipad|ipod)/i;
+const WINDOWS_PLATFORMS = /^win/i;
+
+const num = (v, dflt = 0) => (typeof v === 'number' && Number.isFinite(v) ? v : dflt);
+
+/**
+ * Typing cadence: a hand cannot hold a key for 8ms, forty times, with no spread.
+ *
+ * Gated hard, because the failure mode is punishing people who paste. Humans
+ * paste constantly — password managers, copied addresses, one-time codes — and
+ * a paste arrives as one or two keydowns microseconds apart, which is
+ * arithmetically indistinguishable from very fast typing. The bench's
+ * paste-by-human persona is exactly that shape: 2 keys, 0.8ms apart, variance 0.
+ *
+ * Hence three preconditions before the cadence is even looked at: enough keys to
+ * be a sample, no paste anywhere on the page, and no paste into this field.
+ */
+function checkTypingCadence(fields, typing) {
+  const detections = [];
+  if (!fields) return detections;
+
+  const pastedAnywhere = num(typing.pasteEvents) > 0 || num(typing.pasteInputs) > 0;
+  if (pastedAnywhere) return detections;
+
+  for (const [, stats] of Object.entries(fields)) {
+    if (!stats || typeof stats !== 'object') continue;
+    if (num(stats.pasteCount) > 0) continue;
+
+    const keyCount = num(stats.keyCount);
+    if (keyCount < MIN_KEYS_FOR_CADENCE) continue;
+
+    const interval = num(stats.avgKeyInterval, Infinity);
+    const variance = num(stats.keyIntervalVariance, Infinity);
+    const dwells = Array.isArray(stats.dwellTimes) ? stats.dwellTimes : [];
+    const avgDwell = dwells.length
+      ? dwells.reduce((a, b) => a + b, 0) / dwells.length
+      : Infinity;
+
+    // Both the rhythm and the hold have to be inhuman. Either alone is a
+    // machine that happens to be slow, or a fast typist on a bad keyboard.
+    const machineRhythm = interval < MAX_MACHINE_INTERKEY_MS && variance < MAX_MACHINE_INTERVAL_VARIANCE;
+    const machineHold = avgDwell < MAX_MACHINE_DWELL_MS;
+
+    if (machineRhythm && machineHold) {
+      detections.push({
+        category: 'behavioral',
+        score: 0.6,
+        confidence: 0.6,
+        reason: 'Typing cadence is mechanical (inter-key and hold both below human range)',
+      });
+      break; // one detection per request, however many fields were filled
+    }
+  }
+
+  return detections;
+}
+
+/**
+ * The paste shortcut disagrees with the platform the client claims.
+ *
+ * macOS pastes with Meta+V; Windows and Linux paste with Control+V. These are
+ * not conventions a user can be halfway between — the other combination does
+ * nothing at all on that OS. So a client reporting `MacIntel` whose visitor
+ * pasted with Control+V has told us two incompatible things about itself.
+ *
+ * Requiring that the paste *landed* is what makes this safe. A Windows
+ * switcher on a new Mac really does fat-finger Ctrl+V — and on macOS nothing
+ * happens, so no paste event follows. Only a client whose real platform differs
+ * from its claimed one gets both the wrong shortcut and a completed paste.
+ *
+ * No threshold, no calibration, no hardware dependence. Scored higher than the
+ * cadence checks for exactly that reason.
+ */
+function checkPastePlatformCoherence(typing, platform) {
+  if (!platform) return [];
+
+  const pasted = num(typing.pasteEvents) > 0 || num(typing.pasteInputs) > 0;
+  if (!pasted) return [];
+
+  const ctrl = num(typing.pasteShortcutControl);
+  const meta = num(typing.pasteShortcutMeta);
+
+  const claimsMac = MAC_PLATFORMS.test(platform);
+  const claimsWindows = WINDOWS_PLATFORMS.test(platform);
+
+  if (claimsMac && ctrl > 0 && meta === 0) {
+    return [{
+      category: 'automation',
+      score: 0.7,
+      confidence: 0.8,
+      reason: `Paste shortcut contradicts platform (Control+V while claiming ${platform})`,
+    }];
+  }
+  if (claimsWindows && meta > 0 && ctrl === 0) {
+    return [{
+      category: 'automation',
+      score: 0.7,
+      confidence: 0.8,
+      reason: `Paste shortcut contradicts platform (Meta+V while claiming ${platform})`,
+    }];
+  }
+  return [];
+}
+
+/**
+ * Text that appeared without being typed or pasted.
+ *
+ * A genuine `input` event carries an `inputType` describing what the browser
+ * did; a synthetic one dispatched by script does not. Combined with no
+ * keystrokes and no paste, that is a value assigned straight into the DOM.
+ *
+ * Deliberately low confidence: browser autofill and some password managers also
+ * produce input events with no keystrokes behind them, and the whole point of
+ * §7.1's warning is that a check which punishes password-manager users is worse
+ * than no check. It contributes; it never decides.
+ */
+function checkProgrammaticFill(typing) {
+  const noType = num(typing.inputsWithoutInputType);
+  const noKeys = num(typing.inputsWithoutKeys);
+  const pasted = num(typing.pasteEvents) > 0 || num(typing.pasteInputs) > 0;
+
+  if (noType > 0 && noKeys > 0 && !pasted) {
+    return [{
+      category: 'automation',
+      score: 0.5,
+      confidence: 0.4,
+      reason: 'Field populated without keystrokes or paste (synthetic input event)',
+    }];
+  }
+  return [];
+}
+
+/**
+ * Scroll morphology: the page moved further in one event than a hand can move it.
+ *
+ * A wheel notch or trackpad flick advances tens of pixels and emits an event
+ * each time, so covering a long page takes dozens of them. `scrollIntoView()`
+ * covers the same distance in one, because it is aiming at an element rather
+ * than turning a wheel. Measured: human scrolling never exceeded 109px between
+ * consecutive events; the agent's jump was 704px.
+ *
+ * This is an architecture tell as much as a bot tell — DOM-driven agents jump,
+ * vision-driven ones emit short bursts, people produce long variable gestures.
+ *
+ * Gated on there being no keyboard activity, because PageDown, End and Space
+ * are legitimate one-event jumps of roughly a viewport. A visitor using the
+ * keyboard to scroll is doing something a hand does; a DOM agent has no keys.
+ */
+function checkScrollMorphology(behavioral) {
+  const m = behavioral.scrollMorphology;
+  if (!m || typeof m !== 'object') return [];
+
+  if (num(behavioral.keyEvents) > 0) return [];
+  if (num(m.samples) < 2) return [];
+
+  if (num(m.maxStep) > MAX_HUMAN_SCROLL_STEP_PX) {
+    return [{
+      category: 'automation',
+      score: 0.5,
+      confidence: 0.5,
+      reason: 'Page scrolled by API rather than by gesture (single-event jump)',
+    }];
+  }
+  return [];
+}
+
+/**
+ * Font list contradicts the claimed operating system.
+ *
+ * Scores the *contradiction*, never the enumeration. A short font list means a
+ * privacy extension, a minimal Linux install or a locked-down corporate image —
+ * all ordinary. A list full of Windows-only faces under a macOS claim is not
+ * ordinary, it is two different machines' worth of evidence in one payload.
+ *
+ * Validated in both directions by the bench corpus, though the positive case
+ * arrived by accident: the `incoherent-paste` persona spoofs `Win32` in order to
+ * test the paste-shortcut check, and while doing so it presents this machine's
+ * genuine macOS font set under a Windows claim. This check caught that
+ * independently. It stays silent on all 14 human personas.
+ *
+ * Still weighted as contributory. One machine's font set is thin evidence for a
+ * rule about every machine, and the specific shape the PRD describes — ChatGPT
+ * Agent reporting a Calibri-only list under both Linux and MacIntel claims — has
+ * not been captured here.
+ */
+function checkFontPlatformCoherence(fonts, platform) {
+  if (!fonts || fonts.supported === false || !platform) return [];
+
+  // An empty or near-empty list is a blocked enumeration, not a contradiction.
+  if (num(fonts.count) < 3) return [];
+
+  const claimsMac = MAC_PLATFORMS.test(platform);
+  const claimsWindows = WINDOWS_PLATFORMS.test(platform);
+
+  const macFonts = fonts.hasSFPro === true || fonts.hasMenlo === true;
+  const winFonts = fonts.hasSegoeUI === true || fonts.hasCalibri === true;
+
+  if (claimsMac && winFonts && !macFonts) {
+    return [{
+      category: 'automation',
+      score: 0.5,
+      confidence: 0.5,
+      reason: `Font set contradicts platform (Windows faces while claiming ${platform})`,
+    }];
+  }
+  if (claimsWindows && macFonts && !winFonts) {
+    return [{
+      category: 'automation',
+      score: 0.5,
+      confidence: 0.5,
+      reason: `Font set contradicts platform (macOS faces while claiming ${platform})`,
+    }];
+  }
+  return [];
+}
+
+/** Runs every workstream-C check. */
+function detectInputForensics(signals) {
+  const behavioral = signals.behavioral || {};
+  const form = signals.formAnalysis || {};
+  const env = signals.environmental || {};
+  const typing = form.typing || {};
+  const platform = (env.navigator && env.navigator.platform) || null;
+
+  return [
+    ...checkTypingCadence(form.textareaKeyboard, typing),
+    ...checkPastePlatformCoherence(typing, platform),
+    ...checkProgrammaticFill(typing),
+    ...checkScrollMorphology(behavioral),
+    ...checkFontPlatformCoherence(env.fontsInfo, platform),
+  ];
+}
+
+module.exports = {
+  MAX_HUMAN_SCROLL_STEP_PX,
+  MAX_MACHINE_DWELL_MS,
+  MAX_MACHINE_INTERKEY_MS,
+  MAX_MACHINE_INTERVAL_VARIANCE,
+  MIN_KEYS_FOR_CADENCE,
+  checkFontPlatformCoherence,
+  checkPastePlatformCoherence,
+  checkProgrammaticFill,
+  checkScrollMorphology,
+  checkTypingCadence,
+  detectInputForensics,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/fcaptcha",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "description": "Open source CAPTCHA with PoW, bot detection, and Vision AI protection",
   "main": "index.js",
   "exports": {
@@ -12,7 +12,11 @@
     "start": "node server.js",
     "dev": "node --watch server.js",
     "test:webbotauth": "node webbotauth.test.js",
-    "test:clientip": "node clientip.test.js"
+    "test:clientip": "node clientip.test.js",
+    "test:limits": "node limits.test.js",
+    "test:detection": "node detection.test.js",
+    "test": "node clientip.test.js && node limits.test.js && node detection.test.js && node inputforensics.test.js && node webbotauth.test.js",
+    "test:forensics": "node inputforensics.test.js"
   },
   "dependencies": {
     "cors": "^2.8.5",

package/server.js

@@ -11,6 +11,8 @@ const path = require('path');
 const detection = require('./detection');
 const webbotauth = require('./webbotauth');
 const { ProxyTrust } = require('./clientip');
+const { BoundedMap, BoundedSet, SiteKeyGuard } = require('./limits');
+const { detectInputForensics } = require('./inputforensics');
 
 const app = express();
 app.use(cors());
@@ -24,6 +26,12 @@ const TRUSTED_JA4_HEADERS = detection.getTrustedJA4HeaderNames();
 // the TLS-fingerprint headers. See clientip.js.
 const PROXY_TRUST = ProxyTrust.fromEnv();
 
+// siteKey is client-supplied and validated against no registry, yet it is the
+// first component of every rate-limit, fingerprint and challenge partition key.
+// SITE_KEYS bounds how many distinct values one IP may allocate state for. See
+// limits.js — the cap is unconditional; FCAPTCHA_SITE_KEYS adds an allowlist.
+const SITE_KEYS = SiteKeyGuard.fromEnv();
+
 // Express's own `trust proxy` would re-derive req.ip from the same headers on
 // its own terms; IP resolution goes through PROXY_TRUST.clientIP exclusively.
 app.set('trust proxy', false);
@@ -85,8 +93,8 @@ if (process.env.FCAPTCHA_SERVE_CLIENT !== 'false') {
 
 // PoW Challenge Store
 const powChallengeStore = {
-  challenges: new Map(),
-  usedSolutions: new Set(),
+  challenges: new BoundedMap(),
+  usedSolutions: new BoundedSet(),
 
   // Generate a new challenge
   generate(siteKey, ip, difficulty = 4) {
@@ -177,20 +185,15 @@ const powChallengeStore = {
 
   _cleanup() {
     const now = Date.now();
-    for (const [id, challenge] of this.challenges) {
-      if (now > challenge.expiresAt) {
-        this.challenges.delete(id);
-      }
-    }
-    // Cleanup old solutions (keep last hour)
-    if (this.usedSolutions.size > 10000) {
-      this.usedSolutions.clear();
-    }
+    this.challenges.prune((challenge) => now <= challenge.expiresAt);
+    // usedSolutions is a BoundedSet: it evicts its own oldest entries as it
+    // fills. The previous code cleared the whole replay guard once it passed a
+    // threshold, which an attacker could force in order to replay a solution.
   }
 };
 
 const rateLimiter = {
-  requests: new Map(),
+  requests: new BoundedMap(),
 
   check(key, windowSeconds = 60, maxRequests = 10) {
     const now = Date.now();
@@ -211,8 +214,8 @@ const rateLimiter = {
 };
 
 const fingerprintStore = {
-  fingerprints: new Map(),
-  ipFingerprints: new Map(),
+  fingerprints: new BoundedMap(),
+  ipFingerprints: new BoundedMap(),
 
   record(fp, ip, siteKey) {
     const key = `${siteKey}:${fp}`;
@@ -242,7 +245,7 @@ const fingerprintStore = {
 
 // Token Store - prevents token replay attacks
 const tokenStore = {
-  usedTokens: new Set(),
+  usedTokens: new BoundedSet(),
 
   // Mark a token as used (returns false if already used)
   markUsed(tokenSig) {
@@ -261,11 +264,9 @@ const tokenStore = {
   },
 
   _cleanup() {
-    // In production with Redis, use TTL instead
-    // For in-memory, just clear if too large (tokens expire in 5 min)
-    if (this.usedTokens.size > 50000) {
-      this.usedTokens.clear();
-    }
+    // In production with Redis, use TTL instead. In memory usedTokens is a
+    // BoundedSet, so it evicts its oldest entries rather than clearing wholesale
+    // — clearing would let an attacker who forced the threshold replay a token.
   }
 };
 
@@ -297,6 +298,57 @@ const WEIGHTS = {
 // Detection Functions
 // =============================================================================
 
+/**
+ * Whether this visitor is using a touch or pen device, and so should be exempt
+ * from the mouse-trajectory detections.
+ *
+ * The old rule was `touchEvents >= 3`, which a mobile user who simply taps the
+ * checkbox does not meet: the client records touchstart and touchmove, and a
+ * clean tap on a page short enough not to need scrolling produces exactly one
+ * event. The bench human panel captured precisely that — `touchEvents: 1` — and
+ * the visitor collected three agent detections for it, including
+ * "Zero mouse, touch, or keyboard events recorded" at confidence 0.9.
+ *
+ * One touch event is enough to establish modality. Corroborating it with the
+ * pointer type keeps a bare forged count from claiming the exemption on its
+ * own — though note this is a soft check either way, since every input here is
+ * client-supplied and an agent willing to claim `touchEvents: 1` was equally
+ * willing to claim 3.
+ */
+/**
+ * Movement that carries independent evidence of a human hand.
+ *
+ * A slow pointer is the thing two of these checks look for, and it is also
+ * exactly what an elderly or motor-impaired visitor produces. The bench human
+ * panel caught both firing on them: "Mouse event rate abnormally low" on the
+ * elderly and motor-slow personas, "Mouse velocity too consistent" on
+ * motor-slow.
+ *
+ * Slowness alone cannot separate those users from an agent, but it does not
+ * have to. The same captures carry markers no low-effort automation produces:
+ * saturated micro-tremor, dozens of direction changes, corrective overshoots.
+ * On the bench corpus the split is total - every human persona clears this bar
+ * (tremor 1.00, 22-49 direction changes, 1-4 corrections) and every agent
+ * misses it (tremor 0.04-0.16, 0-1 direction changes, 0 corrections).
+ *
+ * So: do not read slowness as automation when the movement independently looks
+ * like a hand. An agent can of course fake all three, but faking three
+ * correlated properties of human motion is a materially harder job than
+ * running slowly, which is the point.
+ */
+function hasHumanMovementMarkers(b) {
+  const tremor = b.microTremorScore ?? 0.5;
+  const corrections = b.overshootCorrections ?? 0;
+  const changes = b.directionChanges ?? 0;
+  return tremor >= 0.5 && (corrections >= 1 || changes >= 10);
+}
+
+function isTouchModality(b) {
+  const touchEvents = b.touchEvents ?? 0;
+  const touchPoints = b.touchTotalPoints ?? 0;
+  return touchEvents >= 3 || ((touchEvents >= 1 || touchPoints >= 1) && b.pointerHasNonMouseType === true);
+}
+
 function getNestedValue(obj, ...keys) {
   return keys.reduce((o, k) => (o && o[k] !== undefined) ? o[k] : null, obj);
 }
@@ -313,7 +365,7 @@ function detectVisionAI(signals) {
   const approachPts = b.approachPoints ?? 0;
   const touchEvents = b.touchEvents ?? 0;
   const keyEvents = b.keyEvents ?? 0;
-  const isTouchUser = touchEvents >= 3;
+  const isTouchUser = isTouchModality(b);
   const isKeyboardUser = keyEvents >= 2 && totalPoints === 0;
 
   if (totalPoints < 5 && trajectory < 10 && !isTouchUser && !isKeyboardUser) {
@@ -350,16 +402,39 @@ function detectVisionAI(signals) {
   }
 
   // Micro-tremor
+  // Micro-tremor.
+  //
+  // Two things were wrong here. Go defaulted a missing microTremorScore to 0
+  // (maximally suspicious) while Node and Python defaulted to 0.5, so a client
+  // that omitted the field was flagged by one server and not the others. And
+  // like the approach-directness check above, this fires on a measurement that
+  // does not exist for someone who never moved a mouse — the client itself
+  // reports 0.5 as its "no mouse data" sentinel.
+  //
+  // Require real mouse movement before judging its texture, and apply the same
+  // exemptions as the surrounding checks.
   const microTremor = b.microTremorScore ?? 0.5;
-  if (microTremor < 0.15) {
+  const hasMouseMovement = totalPoints >= 5;
+  if (hasMouseMovement && !isTouchUser && !isKeyboardUser && microTremor < 0.15) {
     detections.push({
       category: 'vision_ai', score: 0.7, confidence: 0.6,
       reason: 'Mouse movement lacks natural micro-tremor'
     });
   }
 
-  // Approach directness
-  if ((b.approachDirectness ?? 0) > 0.95) {
+  // Approach directness.
+  //
+  // The client reports directness 1 (perfectly straight) when there is no
+  // approach path to measure at all, so this check used to fire on every
+  // keyboard-only, screen-reader and touch user — the populations the
+  // surrounding checks go out of their way to exempt. Found by the bench
+  // human panel: keyboard-only, screen-reader and touch all reported
+  // approachPoints 0 with approachDirectness 1.
+  //
+  // Require an actual path before judging its shape, and apply the same
+  // exemptions as its neighbours.
+  const hasApproachPath = approachPts >= 5;
+  if (hasApproachPath && !isTouchUser && !isKeyboardUser && (b.approachDirectness ?? 0) > 0.95) {
     detections.push({
       category: 'vision_ai', score: 0.5, confidence: 0.5,
       reason: 'Mouse path to target is unnaturally direct'
@@ -422,6 +497,7 @@ function detectHeadless(signals, userAgent) {
   if (env.webdriver) {
     detections.push({
       category: 'headless', score: 0.95, confidence: 0.95,
+      dispositive: true, // navigator.webdriver === true — see DISPOSITIVE_FLOOR
       reason: 'WebDriver detected'
     });
   }
@@ -631,6 +707,7 @@ function detectCDP(signals) {
         category: 'cdp',
         score: 0.9,
         confidence: 0.95,
+        dispositive: true, // driver-injected globals — see DISPOSITIVE_FLOOR
         reason: `CDP automation detected: ${signalList.join(', ')}`
       });
     } else if (signalCount >= 2) {
@@ -664,7 +741,7 @@ function detectBehavioral(signals) {
   const trajectory = b.trajectoryLength ?? 0;
   const touchEvts = b.touchEvents ?? 0;
   const keyEvts = b.keyEvents ?? 0;
-  const isTouchUsr = touchEvts >= 3;
+  const isTouchUsr = isTouchModality(b);
   const isKbdUser = keyEvts >= 2 && totalPoints === 0;
 
   if (totalPoints === 0 && !isTouchUsr && !isKbdUser) {
@@ -681,7 +758,7 @@ function detectBehavioral(signals) {
 
   // Velocity variance
   const velVar = b.velocityVariance ?? 1;
-  if (velVar < 0.02 && trajectory > 50) {
+  if (velVar < 0.02 && trajectory > 50 && !hasHumanMovementMarkers(b)) {
     detections.push({
       category: 'behavioral', score: 0.6, confidence: 0.6,
       reason: 'Mouse velocity too consistent'
@@ -727,7 +804,7 @@ function detectBehavioral(signals) {
       category: 'behavioral', score: 0.6, confidence: 0.5,
       reason: 'Mouse event rate abnormally high'
     });
-  } else if (eventRate > 0 && eventRate < 10) {
+  } else if (eventRate > 0 && eventRate < 10 && !hasHumanMovementMarkers(b)) {
     detections.push({
       category: 'behavioral', score: 0.4, confidence: 0.4,
       reason: 'Mouse event rate abnormally low'
@@ -953,6 +1030,36 @@ function detectRateAbuse(ip, siteKey) {
 // Scoring
 // =============================================================================
 
+/**
+ * Combines the detections within each category into a category score.
+ *
+ * ## Why this is not a mean
+ *
+ * It used to be a confidence-weighted mean, which had a property nobody
+ * intended: corroborating evidence *lowered* the verdict. A visitor whose
+ * browser reported `navigator.webdriver === true` and nothing else scored 0.95
+ * in the headless category. The same visitor, additionally caught with no
+ * plugins, a software renderer, a viewport equal to its window and three more
+ * automation tells, scored 0.686 — because each additional signal, being
+ * individually weaker than the first, pulled the average down. Seven pieces of
+ * corroboration made the case weaker than one.
+ *
+ * Noisy-OR fixes that. Each detection is treated as independent evidence of
+ * strength `score × confidence`, and the category is the probability that at
+ * least one of them is right:
+ *
+ *     category = 1 - ∏(1 - scoreᵢ × confidenceᵢ)
+ *
+ * Evidence now accumulates: adding a signal can only raise a category, never
+ * lower it. And it is *more* forgiving of isolated weak evidence than the mean
+ * was — one detection at score 0.4, confidence 0.5 contributes 0.20 rather than
+ * setting the whole category to 0.40 — which is the right treatment for a
+ * lone low-confidence hit on a real user.
+ *
+ * Measured on the bench corpus (bench/tools/compare-aggregation.js): human
+ * median 0.182 → 0.097 and human max 0.260 → 0.171, while agent median rose
+ * 0.517 → 0.570. Both populations moved in the direction they should.
+ */
 function calculateCategoryScores(detections) {
   const categoryData = {};
 
@@ -966,11 +1073,12 @@ function calculateCategoryScores(detections) {
   const result = {};
   for (const [cat, scores] of Object.entries(categoryData)) {
     if (scores.length > 0) {
-      const totalWeight = scores.reduce((sum, [, conf]) => sum + conf, 0);
-      if (totalWeight > 0) {
-        const weightedSum = scores.reduce((sum, [score, conf]) => sum + score * conf, 0);
-        result[cat] = Math.min(1.0, weightedSum / totalWeight);
+      let survives = 1;
+      for (const [score, conf] of scores) {
+        const strength = Math.max(0, Math.min(1, score * conf));
+        survives *= 1 - strength;
       }
+      result[cat] = Math.min(1.0, 1 - survives);
     }
   }
 
@@ -992,6 +1100,57 @@ function calculateFinalScore(categoryScores) {
   return Math.min(1.0, total);
 }
 
+/**
+ * Score below which a self-declared automated browser cannot fall.
+ *
+ * ## Why a floor exists at all
+ *
+ * The final score is a weighted sum across all eleven categories, so a category
+ * can contribute at most its own weight no matter how certain it is. A local
+ * automated browser trips at most the six categories reachable without a
+ * datacenter IP, a reused fingerprint or a rate-limit hit — about 0.81 of the
+ * weight — and in practice lands near 0.5. The bench measured exactly that: a
+ * Playwright browser reporting `navigator.webdriver === true`, no plugins, a
+ * software renderer and four more automation tells scored 0.549, i.e.
+ * "challenge", not "block".
+ *
+ * That is the weighted sum working as designed. It expresses "what fraction of
+ * the total suspicion budget did this visitor consume", and no single fact can
+ * consume most of that budget. The trouble is that some facts are not
+ * probabilistic evidence at all — they are the browser saying so.
+ *
+ * ## What qualifies
+ *
+ * Only detections marked `dispositive`, and the bar for that mark is that a
+ * browser cannot produce the signal without being automated:
+ *
+ *   - `navigator.webdriver === true` — a W3C-specified flag whose sole purpose
+ *     is to tell the page it is under automation.
+ *   - ChromeDriver / Puppeteer injected globals (`chromedriver_cdc`,
+ *     `puppeteer_eval`, `cdp_script_injection`), which exist in no ordinary
+ *     browsing session.
+ *
+ * Deliberately excluded, though both look tempting: the "console consumer
+ * attached" CDP check, because the bench human panel proves it fires on a
+ * developer with DevTools open; and the Playwright `webdriver_configurable`
+ * artifact, which relies on a property-descriptor detail no specification
+ * guarantees.
+ *
+ * ## What this does not do
+ *
+ * It does not catch a stealth agent, which patches `navigator.webdriver` before
+ * the page ever sees it. That is not a regression — such an agent scores the
+ * same as it did before — and it is the reason the behavioural workstreams
+ * still matter. The floor closes the case where an agent is not even trying to
+ * hide, which was previously being waved through with a "challenge".
+ */
+const DISPOSITIVE_FLOOR = 0.9;
+
+function applyDispositiveFloor(score, detections) {
+  const selfDeclared = detections.some((d) => d.dispositive === true);
+  return selfDeclared ? Math.max(score, DISPOSITIVE_FLOOR) : score;
+}
+
 function generateToken(ip, siteKey, score) {
   const ipHash = crypto.createHash('sha256').update(ip).digest('hex').slice(0, 8);
   const data = {
@@ -1070,7 +1229,7 @@ async function verifyWebBotAuth(req) {
 // require the raw request — currently Web Bot Auth signature verification, which
 // needs the accurately-reconstructed signed request. They are seeded into the
 // detection set so they participate in scoring like any other detection.
-function runVerification(signals, ip, siteKey, userAgent, headers = {}, ja3Hash = null, powSolution = null, signalsJson = null, powTiming = null, preDetections = []) {
+function runVerification(signals, ip, siteKey, userAgent, headers = {}, ja3Hash = null, powSolution = null, signalsJson = null, powTiming = null, preDetections = [], opts = {}) {
   const detections = Array.isArray(preDetections) ? [...preDetections] : [];
 
   // Verify signal commitment (signalsJson hash must match powSolution.signalsHash)
@@ -1161,6 +1320,9 @@ function runVerification(signals, ip, siteKey, userAgent, headers = {}, ja3Hash
     ...detectAutomation(signals),
     ...detectCDP(signals),
     ...detectBehavioral(signals),
+    // Input forensics v2 (PRD workstream C): typing cadence and modality, the
+    // paste-shortcut/platform contradiction, scroll morphology, font coherence.
+    ...detectInputForensics(signals),
     ...detectTouchAuthenticity(signals, userAgent),
     ...detectSensorEntropy(signals, userAgent),
     ...detectTouchKinematics(signals),
@@ -1179,7 +1341,7 @@ function runVerification(signals, ip, siteKey, userAgent, headers = {}, ja3Hash
   }
 
   // Add header analysis
-  const headerDetections = detection.analyzeHeaders(headers);
+  const headerDetections = detection.analyzeHeaders(headers, { peerTrusted: opts.peerTrusted === true });
   detections.push(...headerDetections);
 
   // Add browser consistency checks
@@ -1206,7 +1368,11 @@ function runVerification(signals, ip, siteKey, userAgent, headers = {}, ja3Hash
   // Add form interaction analysis (credential stuffing & spam detection)
   const formAnalysis = signals.formAnalysis;
   if (formAnalysis) {
-    const formDetections = detection.analyzeFormInteraction(formAnalysis);
+    // A visitor who moved a pointer or touched the screen has shown they are
+    // there; that changes how a paste-only form fill should be read.
+    const beh = signals.behavioral || {};
+    const humanPresent = (beh.totalPoints ?? 0) >= 5 || (beh.touchEvents ?? 0) >= 1;
+    const formDetections = detection.analyzeFormInteraction(formAnalysis, { humanPresent });
     detections.push(...formDetections);
   }
 
@@ -1215,7 +1381,7 @@ function runVerification(signals, ip, siteKey, userAgent, headers = {}, ja3Hash
   detections.push(...advancedDetections);
 
   const categoryScores = calculateCategoryScores(detections);
-  const finalScore = calculateFinalScore(categoryScores);
+  const finalScore = applyDispositiveFloor(calculateFinalScore(categoryScores), detections);
 
   let recommendation;
   if (finalScore < 0.3) recommendation = 'allow';
@@ -1260,8 +1426,10 @@ function collectHeaders(req) {
 }
 
 app.post('/api/verify', async (req, res) => {
-  const { siteKey, signals, powSolution, signalsJson, powTiming } = req.body;
+  const { siteKey: rawSiteKey, signals, powSolution, signalsJson, powTiming } = req.body;
   const ip = PROXY_TRUST.clientIP(req);
+  // Bound the state an unvalidated siteKey can allocate (limits.js).
+  const siteKey = SITE_KEYS.normalize(rawSiteKey, ip);
   const userAgent = req.headers['user-agent'] || '';
   // Only honoured from a trusted proxy: a client that can state its own TLS
   // fingerprint would just claim a stock Chrome one.
@@ -1269,30 +1437,33 @@ app.post('/api/verify', async (req, res) => {
 
   // Collect headers for analysis
   const headers = collectHeaders(req);
+  const peerTrusted = PROXY_TRUST.peerTrusted(req);
 
   // Web Bot Auth verification needs the raw request; its verdict is scored.
   const webBotAuth = await verifyWebBotAuth(req);
 
-  const result = runVerification(signals, ip, siteKey, userAgent, headers, ja3Hash, powSolution, signalsJson, powTiming, webBotAuth);
+  const result = runVerification(signals, ip, siteKey, userAgent, headers, ja3Hash, powSolution, signalsJson, powTiming, webBotAuth, { peerTrusted });
   logVerdict('verify', siteKey, result);
   res.json(result);
 });
 
 app.post('/api/score', async (req, res) => {
-  const { siteKey, signals, action, powSolution, signalsJson, powTiming } = req.body;
+  const { siteKey: rawSiteKey, signals, action, powSolution, signalsJson, powTiming } = req.body;
   const ip = PROXY_TRUST.clientIP(req);
+  const siteKey = SITE_KEYS.normalize(rawSiteKey, ip);
   const userAgent = req.headers['user-agent'] || '';
   const ja3Hash = PROXY_TRUST.trustedHeader(req, 'x-ja3-hash') || null;
 
-  const headers = {};
-  for (const [key, value] of Object.entries(req.headers)) {
-    headers[key.toLowerCase()] = Array.isArray(value) ? value[0] : value;
-  }
+  // Use collectHeaders, not a bare copy of req.headers: this endpoint used to
+  // build its own map, which skipped the trust gate on the TLS-fingerprint
+  // header names and let an untrusted client present its own JA4.
+  const headers = collectHeaders(req);
+  const peerTrusted = PROXY_TRUST.peerTrusted(req);
 
   // Web Bot Auth verification needs the raw request; its verdict is scored.
   const webBotAuth = await verifyWebBotAuth(req);
 
-  const result = runVerification(signals, ip, siteKey, userAgent, headers, ja3Hash, powSolution, signalsJson, powTiming, webBotAuth);
+  const result = runVerification(signals, ip, siteKey, userAgent, headers, ja3Hash, powSolution, signalsJson, powTiming, webBotAuth, { peerTrusted });
   logVerdict('score', siteKey, result);
   res.json({
     success: result.success,
@@ -1314,9 +1485,8 @@ app.post('/api/token/verify', (req, res) => {
 
 // PoW Challenge endpoint - client fetches this on page load
 app.get('/api/pow/challenge', (req, res) => {
-  const siteKey = req.query.siteKey || 'default';
-
   const ip = PROXY_TRUST.clientIP(req);
+  const siteKey = SITE_KEYS.normalize(req.query.siteKey, ip);
 
   // Difficulty scaling based on IP reputation
   let difficulty = 4; // Default: ~100-500ms on average hardware
@@ -1365,4 +1535,5 @@ app.get('/api/challenge', (req, res) => {
 app.listen(PORT, () => {
   console.log(`FCaptcha server running on port ${PORT}`);
   console.log(`Trusted proxies: ${PROXY_TRUST.describe()}`);
+  console.log(`Site keys: ${SITE_KEYS.describe()}`);
 });

package/webbotauth.js

@@ -23,8 +23,33 @@
 //
 // The upstream package (cloudflare/web-bot-auth) is the reference implementation
 // the Go module (WebDecoy/web-bot-auth) is cross-validated against, so the two
-// servers agree on verdicts. Python has no maintained equivalent and stays
-// presence-only.
+// servers agree on verdicts. Python stays presence-only for now, though a
+// maintained RFC 9421 implementation (pyauth/http-message-signatures) now exists
+// and would close that gap.
+//
+// Wire format — draft-meunier-webbotauth-httpsig-protocol-00 (2026-06-26):
+// Signature-Agent is a Structured Fields Dictionary whose member value is the
+// discovery URL and whose optional `type` parameter selects how to resolve keys:
+//
+//   sig1="https://a.test"                          → directory (default)
+//   sig1="https://a.test/jwks.json";type=jwks_uri  → the URL *is* a JWK Set
+//   sig1="https://a.test/card";type=cimd           → Client ID Metadata Document
+//
+// The pre-00 bare-String form ("https://a.test") is still emitted by signers
+// that have not migrated and stays supported. A parser that only understood the
+// bare form silently lost the *verified* verdict for any signer using the two
+// new discovery types, degrading them to presence-only.
+//
+// DOCUMENTED DIVERGENCE — `cimd`. This implementation resolves a Client ID
+// Metadata Document (embedded `jwks`, or a nested `jwks_uri` re-fetched through
+// the same guard). The Go module (WebDecoy/web-bot-auth v0.2.0) parses the type
+// but returns "not resolvable", so Go fails open to presence-only where Node
+// reaches verified. Go is otherwise fully protocol-00 compliant — it honors
+// `directory` and `jwks_uri` and enforces the tag — so this is the single
+// verdict difference. It is currently theoretical: no observed signer uses
+// `cimd` (chatgpt.com and agent.bot.goog both serve `directory`). Parity
+// requires a change in the Go module, not here. Tracked rather than silent, per
+// the CLAUDE.md sync rule.
 
 const https = require('https');
 const dns = require('dns');
@@ -48,6 +73,23 @@ const DIRECTORY_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 // signature. Everything else (fetch failure, expiry, missing key) fails open.
 const CRYPTO_FAILURE_MESSAGE = 'invalid signature';
 
+// Discovery types from protocol-00. `directory` is the default when the header
+// carries no `type` parameter.
+const DISCOVERY_DIRECTORY = 'directory';
+const DISCOVERY_JWKS_URI = 'jwks_uri';
+const DISCOVERY_CIMD = 'cimd';
+
+// protocol-00: `tag` MUST be "web-bot-auth". A signature tagged for some other
+// protocol is not a web-bot-auth signature, so it earns no verified credit.
+const REQUIRED_TAG = 'web-bot-auth';
+
+// protocol-00 RECOMMENDS an expiry no more than 24h out. Because that is a
+// RECOMMENDED and not a MUST, an over-long window is not treated as forgery or
+// as a hard rejection — it just does not earn the *verified* verdict, and the
+// request falls back to presence-only. That bounds the replay window a stolen
+// signature buys without false-positiving a signer who picked a longer TTL.
+const MAX_SIGNATURE_LIFETIME_S = 24 * 60 * 60;
+
 // origin (https://host[:port]) → { keys: JsonWebKey[], fetchedAt: number }
 const directoryCache = new Map();
 
@@ -96,11 +138,14 @@ function guardedLookup(hostname, options, callback) {
 
 // --- directory fetching -------------------------------------------------------
 
-function fetchDirectory(directoryUrl) {
+// fetchJSON retrieves and parses one https document under the SSRF guard, the
+// size cap and the timeout. Shared by directory, jwks_uri and cimd fetches so a
+// new discovery type cannot accidentally bypass the guard.
+function fetchJSON(documentUrl) {
   return new Promise((resolve, reject) => {
     let url;
     try {
-      url = new URL(directoryUrl);
+      url = new URL(documentUrl);
     } catch {
       reject(new FetchFailure('invalid directory URL'));
       return;
@@ -111,7 +156,7 @@ function fetchDirectory(directoryUrl) {
     }
 
     const req = https.get(
-      directoryUrl,
+      documentUrl,
       {
         lookup: guardedLookup,
         timeout: VERIFY_TIMEOUT_MS,
@@ -138,8 +183,7 @@ function fetchDirectory(directoryUrl) {
         });
         res.on('end', () => {
           try {
-            const doc = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-            resolve(Array.isArray(doc.keys) ? doc.keys : []);
+            resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')));
           } catch {
             reject(new FetchFailure('directory is not valid JSON'));
           }
@@ -156,14 +200,46 @@ function fetchDirectory(directoryUrl) {
   });
 }
 
-async function getDirectory(directoryUrl) {
+// fetchKeySet pulls a JWK Set — the shape served by both the well-known
+// directory and a jwks_uri.
+async function fetchKeySet(url) {
+  const doc = await fetchJSON(url);
+  return doc && Array.isArray(doc.keys) ? doc.keys : [];
+}
+
+// fetchViaCIMD resolves a Client ID Metadata Document, which either embeds the
+// JWK Set inline or points at one. The nested jwks_uri is re-validated and
+// re-fetched through the same guard rather than trusted.
+async function fetchViaCIMD(cimdUrl) {
+  const doc = await fetchJSON(cimdUrl);
+  if (doc && doc.jwks && Array.isArray(doc.jwks.keys)) {
+    return doc.jwks.keys;
+  }
+  if (doc && typeof doc.jwks_uri === 'string') {
+    let nested;
+    try {
+      nested = new URL(doc.jwks_uri);
+    } catch {
+      throw new FetchFailure('cimd jwks_uri is not a URL');
+    }
+    if (nested.protocol !== 'https:') {
+      throw new FetchFailure('cimd jwks_uri is not https');
+    }
+    return fetchKeySet(nested.toString());
+  }
+  throw new FetchFailure('cimd document has no jwks or jwks_uri');
+}
+
+// getKeys caches by resolved URL, so the three discovery types share one cache
+// without colliding.
+async function getKeys(url, type) {
   const now = Date.now();
-  const cached = directoryCache.get(directoryUrl);
+  const cached = directoryCache.get(url);
   if (cached && now - cached.fetchedAt < DIRECTORY_CACHE_TTL_MS) {
     return cached.keys;
   }
-  const keys = await fetchDirectory(directoryUrl);
-  directoryCache.set(directoryUrl, { keys, fetchedAt: now });
+  const keys = type === DISCOVERY_CIMD ? await fetchViaCIMD(url) : await fetchKeySet(url);
+  directoryCache.set(url, { keys, fetchedAt: now });
   return keys;
 }
 
@@ -173,11 +249,11 @@ async function getDirectory(directoryUrl) {
 // lacks the key throws a FetchFailure — treated as fail-open, matching the Go
 // engine, which counts only a crypto failure as forgery.
 async function resolveKey(signatureAgentHeader, keyid) {
-  const origin = directoryOriginFromHeader(signatureAgentHeader);
-  if (!origin) {
-    throw new FetchFailure('no resolvable Signature-Agent directory');
+  const source = keySourceFromHeader(signatureAgentHeader);
+  if (!source) {
+    throw new FetchFailure('no resolvable Signature-Agent key source');
   }
-  const keys = await getDirectory(origin + HTTP_MESSAGE_SIGNATURES_DIRECTORY);
+  const keys = await getKeys(source.url, source.type);
   for (const jwk of keys) {
     let thumbprint;
     try {
@@ -194,31 +270,63 @@ async function resolveKey(signatureAgentHeader, keyid) {
 
 // --- header + request helpers -------------------------------------------------
 
-// unwrapSfString extracts the value from a Signature-Agent header, which is an
-// RFC 8941 String — bare (`"https://a"`) or a dictionary member
-// (`sig1="https://a"`) as some signers emit.
-function unwrapSfString(raw) {
-  if (!raw) return '';
+// parseSignatureAgent reads the first member of the Signature-Agent Structured
+// Fields Dictionary, returning its URL and discovery type. Accepts, in order of
+// how signers actually emit them:
+//
+//   sig1="https://a.test/jwks.json";type=jwks_uri   protocol-00, typed
+//   sig1="https://a.test"                           protocol-00, default type
+//   "https://a.test"                                pre-00 bare String
+//
+// The previous implementation anchored on a closing quote at end-of-string, so
+// any trailing parameter fell through to the raw header text and failed to
+// parse as a URL. That silently cost the *verified* verdict.
+function parseSignatureAgent(raw) {
+  if (!raw) return null;
   const s = String(raw).trim();
-  const m = s.match(/^(?:[A-Za-z0-9_-]+=)?"(.*)"$/);
-  return (m ? m[1] : s).trim();
+  if (!s) return null;
+  // Optional `key=` prefix, a quoted SF String, then optional ;params up to the
+  // next dictionary member.
+  const m = s.match(/^(?:[A-Za-z0-9_*-]+\s*=\s*)?"([^"]*)"((?:\s*;[^,]*)?)/);
+  if (!m) return null;
+  const url = m[1].trim();
+  if (!url) return null;
+  const typeMatch = (m[2] || '').match(/;\s*type\s*=\s*"?([A-Za-z0-9_-]+)"?/i);
+  const type = typeMatch ? typeMatch[1].toLowerCase() : DISCOVERY_DIRECTORY;
+  return { url, type };
 }
 
 function displayAgent(raw) {
-  return unwrapSfString(raw) || 'unknown';
+  const parsed = parseSignatureAgent(raw);
+  return (parsed && parsed.url) || 'unknown';
 }
 
-function directoryOriginFromHeader(raw) {
-  const val = unwrapSfString(raw);
-  if (!val) return null;
+// keySourceFromHeader resolves the header to the concrete https URL keys are
+// fetched from, plus the discovery type that says how to interpret it. Returns
+// null for anything unusable — a non-https URL, or a discovery type this build
+// does not implement (guessing would be worse than failing open).
+function keySourceFromHeader(raw) {
+  const parsed = parseSignatureAgent(raw);
+  if (!parsed) return null;
   let u;
   try {
-    u = new URL(val);
+    u = new URL(parsed.url);
   } catch {
     return null;
   }
   if (u.protocol !== 'https:') return null;
-  return u.origin;
+
+  switch (parsed.type) {
+    case DISCOVERY_DIRECTORY:
+      // The member names the signer's origin; keys live at the well-known path.
+      return { url: u.origin + HTTP_MESSAGE_SIGNATURES_DIRECTORY, type: DISCOVERY_DIRECTORY };
+    case DISCOVERY_JWKS_URI:
+    case DISCOVERY_CIMD:
+      // The member names the document itself — path and query are significant.
+      return { url: u.toString(), type: parsed.type };
+    default:
+      return null;
+  }
 }
 
 function forwardedScheme(req) {
@@ -298,6 +406,7 @@ async function checkWebBotAuth(req) {
         if (!sigAgentRaw) {
           throw new FetchFailure('no Signature-Agent to resolve key');
         }
+        assertWebBotAuthParams(params);
         const jwk = await resolveKey(sigAgentRaw, params.keyid);
         resolvedKeyId = params.keyid;
         resolvedAlg = jwk.alg || (jwk.crv === 'Ed25519' ? 'ed25519' : '');
@@ -323,6 +432,51 @@ async function checkWebBotAuth(req) {
   }
 }
 
+// toEpochSeconds normalizes a signature timestamp to epoch seconds. RFC 9421
+// puts integer seconds on the wire, but web-bot-auth hands the verifier callback
+// `Date` objects — so a naive Number() yields milliseconds and any duration
+// comparison is off by 1000×. Accepts Date, seconds, or milliseconds.
+function toEpochSeconds(value) {
+  if (value instanceof Date) return Math.floor(value.getTime() / 1000);
+  const n = Number(value);
+  if (!Number.isFinite(n)) return NaN;
+  // Epoch seconds are ~1.8e9 today; epoch milliseconds ~1.8e12.
+  return n > 1e11 ? Math.floor(n / 1000) : n;
+}
+
+// assertWebBotAuthParams enforces the protocol-00 signature-parameter rules that
+// the underlying library does not.
+//
+// web-bot-auth's own verify() already rejects a wrong `tag`, a `created` in the
+// future, an expired `expires`, and a missing `keyid`. The tag check below is
+// therefore belt-and-braces — kept because it is free and because it documents a
+// MUST that our verdict depends on. What is genuinely additive is the lifetime
+// ceiling: nothing upstream bounds how far out `expires` may sit, and a
+// long-lived signature is a long-lived replay token.
+//
+// Throwing FetchFailure means "not a verifiable web-bot-auth signature", which
+// the caller renders as presence-only — never as forgery, since neither a wrong
+// tag nor a generous TTL is cryptographic proof that anyone spoofed anything.
+function assertWebBotAuthParams(params) {
+  const p = params || {};
+
+  if (p.tag !== REQUIRED_TAG) {
+    throw new FetchFailure(`signature tag is not ${REQUIRED_TAG}`);
+  }
+
+  // `expires` is what bounds replay; a signature without one is unbounded.
+  const expires = toEpochSeconds(p.expires);
+  if (!Number.isFinite(expires)) {
+    throw new FetchFailure('signature has no expires parameter');
+  }
+  const created = Number.isFinite(toEpochSeconds(p.created))
+    ? toEpochSeconds(p.created)
+    : Math.floor(Date.now() / 1000);
+  if (expires - created > MAX_SIGNATURE_LIFETIME_S) {
+    throw new FetchFailure('signature lifetime exceeds 24h');
+  }
+}
+
 // withTimeout bounds the whole verification, a backstop over the per-fetch
 // timeout so a stalled directory can never hold the scoring path open.
 function withTimeout(promise, ms) {
@@ -346,19 +500,24 @@ module.exports = {
   // Exported for unit tests only.
   _internal: {
     isPublicUnicast,
-    directoryOriginFromHeader,
+    parseSignatureAgent,
+    keySourceFromHeader,
+    assertWebBotAuthParams,
     displayAgent,
     verifiedDetection,
     forgedDetection,
     presenceDetection,
-    // Seeds the directory cache so an end-to-end verify can exercise resolveKey
+    REQUIRED_TAG,
+    MAX_SIGNATURE_LIFETIME_S,
+    // Seeds the key cache so an end-to-end verify can exercise resolveKey
     // without a network fetch (the SSRF guard refuses the loopback address a
     // local test server would listen on). Test-only.
-    seedDirectoryCache(origin, keys) {
-      directoryCache.set(origin + HTTP_MESSAGE_SIGNATURES_DIRECTORY, {
-        keys,
-        fetchedAt: Date.now(),
-      });
+    //
+    // Seeds by *origin* for the default directory discovery. Pass a full URL as
+    // `exactUrl` to seed a jwks_uri/cimd source instead.
+    seedDirectoryCache(origin, keys, exactUrl) {
+      const url = exactUrl || origin + HTTP_MESSAGE_SIGNATURES_DIRECTORY;
+      directoryCache.set(url, { keys, fetchedAt: Date.now() });
     },
   },
 };