@adcp/sdk 12.0.0 → 12.0.1

package/dist/lib/server/auth-signature.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/auth-signature.ts"],"sourcesContent":["/**\n * Bridge between {@link verifyRequestSignature} and the {@link Authenticator}\n * surface so RFC 9421 signatures compose with bearer / API-key auth via\n * {@link anyOf}.\n *\n * Use when an agent declares the `signed-requests` specialism AND also\n * accepts bearer-authed callers — the composition signals \"either credential\n * type is sufficient\". Unsigned-but-bearered requests fall through to the\n * next authenticator; signed requests with a valid signature short-circuit\n * the chain and surface a principal derived from the signing key.\n *\n * A request with a present-but-invalid signature throws {@link AuthError}\n * so `serve()` can return a 401 — `anyOf` surfaces that as \"credentials\n * rejected\" rather than falling through.\n *\n * ```ts\n * import {\n *   serve,\n *   verifyApiKey,\n *   anyOf,\n *   verifySignatureAsAuthenticator,\n *   mcpToolNameResolver,\n * } from '@adcp/sdk/server';\n *\n * serve(createAgent, {\n *   authenticate: anyOf(\n *     verifyApiKey({ keys: { 'sk_live_abc': { principal: 'acct_42' } } }),\n *     verifySignatureAsAuthenticator({\n *       jwks, replayStore, revocationStore,\n *       capability: { supported: true, required_for: [], covers_content_digest: 'either' },\n *       resolveOperation: mcpToolNameResolver,\n *     }),\n *   ),\n * });\n * ```\n *\n * The returned authenticator is tagged with {@link AUTH_NEEDS_RAW_BODY} so\n * `serve()` buffers `req.rawBody` before authentication runs.\n */\nimport type { IncomingMessage } from 'http';\nimport type { RequestLike } from '../signing/canonicalize';\nimport { RequestSignatureError } from '../signing/errors';\nimport type { JwksResolver } from '../signing/jwks';\nimport { InMemoryReplayStore, type ReplayStore } from '../signing/replay';\nimport { InMemoryRevocationStore, type RevocationStore } from '../signing/revocation';\nimport type { VerifiedSigner, VerifierCapability, VerifyResult } from '../signing/types';\nimport { verifyRequestSignature } from '../signing/verifier';\nimport { markVerifiedHttpSig } from './decisioning/buyer-agent';\nimport {\n  AuthError,\n  type AuthPrincipal,\n  type AuthResult,\n  type Authenticator,\n  authenticatorNeedsRawBody,\n  tagAuthenticatorNeedsRawBody,\n  tagAuthenticatorPresenceGated,\n} from './auth';\n\nexport interface VerifySignatureAsAuthenticatorOptions {\n  /** Verifier capability block. `required_for` is not enforced here — unsigned\n   *  requests fall through to the next authenticator — so set it to whatever\n   *  your `request_signing` capability claim advertises. */\n  capability: VerifierCapability;\n  /** Resolves verification keys by `keyid`. */\n  jwks: JwksResolver;\n  /**\n   * Stores `(keyid, signature-bytes, expires)` tuples for replay detection.\n   * Defaults to a fresh {@link InMemoryReplayStore} — fine for single-process\n   * deployments. Wire a shared store (Redis, Postgres, etc.) for multi-replica\n   * setups where a signature accepted on one replica must be rejected on the\n   * others.\n   */\n  replayStore?: ReplayStore;\n  /**\n   * Consulted for revoked `kid` / `jti` before accepting a signature.\n   * Defaults to a fresh {@link InMemoryRevocationStore}. Most agents don't\n   * revoke at runtime; when you do, swap in a store backed by your secrets\n   * manager or admin tooling.\n   */\n  revocationStore?: RevocationStore;\n  /** Override clock for tests. */\n  now?: () => number;\n  /**\n   * Extract the AdCP operation name from the incoming request. Called with\n   * the raw `IncomingMessage`; `req.rawBody` has been buffered by `serve()`\n   * before this runs. Same semantics as\n   * `ExpressMiddlewareOptions.resolveOperation` on {@link createExpressVerifier}.\n   *\n   * SECURITY: a resolver that always returns `undefined` disables\n   * `capability.required_for` enforcement for this authenticator. Since the\n   * bypass here is intentional (this adapter is for composition with other\n   * authenticators — see the module docstring), the fall-through still\n   * happens when the resolver returns `undefined`, so `required_for`\n   * enforcement should live in a separate `preTransport`-mounted verifier\n   * when composition is active.\n   */\n  resolveOperation: (req: IncomingMessage & { rawBody?: string }) => string | undefined;\n  /**\n   * Override how the request's full URL is reconstructed. Use when the\n   * server sits behind a TLS-terminating or path-rewriting load balancer\n   * and `req.headers.host` / `req.url` don't reflect what the signer signed.\n   */\n  getUrl?: (req: IncomingMessage & { rawBody?: string }) => string;\n  /** Resolve the `agent_url` claim the verifier stamps on verified results. */\n  agentUrlForKeyid?: (keyid: string) => string | undefined;\n  /**\n   * Shape the principal returned on successful signature verification.\n   * Defaults to `{ principal: `signing:${keyid}`, claims: { signature: VerifiedSigner } }`.\n   */\n  makePrincipal?: (signer: VerifiedSigner) => AuthPrincipal;\n}\n\n/**\n * Build an {@link Authenticator} that verifies an RFC 9421 request signature.\n *\n * Behavior matrix:\n * - No `Signature-Input` header → returns `null` (fall through to next authenticator).\n * - Signature present and valid → returns {@link AuthPrincipal}.\n * - Signature present but invalid → throws {@link AuthError} (surfaces as 401).\n *\n * Populates `req.verifiedSigner` on success so downstream handlers see the\n * same side-channel state as the Express-shaped middleware.\n */\nexport function verifySignatureAsAuthenticator(options: VerifySignatureAsAuthenticatorOptions): Authenticator {\n  // Instantiate defaults once at wire-up time so every request on this\n  // authenticator shares the same replay/revocation state — lazy\n  // per-request construction would defeat replay detection entirely.\n  const replayStore = options.replayStore ?? new InMemoryReplayStore();\n  const revocationStore = options.revocationStore ?? new InMemoryRevocationStore();\n\n  const authenticator: Authenticator = async req => {\n    if (!hasSignatureHeader(req)) return null;\n\n    const body = (req as IncomingMessage & { rawBody?: string }).rawBody ?? '';\n    const url = options.getUrl ? options.getUrl(req as IncomingMessage & { rawBody?: string }) : defaultUrl(req);\n    const requestLike: RequestLike = {\n      method: req.method ?? 'GET',\n      url,\n      headers: req.headers,\n      body,\n    };\n\n    let result: VerifyResult;\n    try {\n      result = await verifyRequestSignature(requestLike, {\n        capability: options.capability,\n        jwks: options.jwks,\n        replayStore,\n        revocationStore,\n        now: options.now,\n        operation: options.resolveOperation(req as IncomingMessage & { rawBody?: string }),\n        agentUrlForKeyid: options.agentUrlForKeyid,\n      });\n    } catch (err) {\n      if (err instanceof RequestSignatureError) {\n        throw new AuthError(`Signature rejected (${err.code}).`, { cause: err });\n      }\n      throw new AuthError('Signature verification failed.', { cause: err });\n    }\n\n    if (result.status !== 'verified') {\n      // Unreachable: `hasSignatureHeader` already gated entry, so the verifier\n      // either throws (missing-pair / invalid / replayed / etc.) or returns\n      // `status: 'verified'`. Fail loud if the verifier contract changes —\n      // silently returning `null` would fall through to the next authenticator\n      // as if no signature were present, breaking the auth invariant.\n      throw new AuthError('Signature verification returned unexpected status.', {\n        cause: new Error(`verifier returned status=\"${result.status}\"`),\n      });\n    }\n\n    // keyid is buyer-controlled (JWK spec places no charset restriction on\n    // `kid`). Bound it to a URL-safe shape — explicitly excluding `:` — before\n    // interpolating into the principal string, so downstream tenant-isolation\n    // checks that split `signing:<keyid>` on the first `:` can't be confused\n    // by a colon embedded in the signer's key id.\n    if (!SAFE_KEYID.test(result.keyid)) {\n      throw new AuthError('Signature key id contains unsupported characters.', {\n        cause: new Error(`keyid=${JSON.stringify(result.keyid)} fails /^[A-Za-z0-9._-]{1,256}$/`),\n      });\n    }\n\n    const signer: VerifiedSigner = {\n      keyid: result.keyid,\n      verified_at: result.verified_at,\n      ...(result.agent_url !== undefined ? { agent_url: result.agent_url } : {}),\n    };\n\n    // Stamp the kind-discriminated `credential` variant for the framework's\n    // dispatcher and `BuyerAgentRegistry` resolution (Phase 1 Stage 3 of\n    // #1269). Per adcontextprotocol/adcp#3831, `agent_url` here is the\n    // verifier's `agentUrlForKeyid` lookup result — derived from the\n    // `agents[]` entry whose `jwks_uri` resolved the keyid.\n    //\n    // When `agent_url` is unset (verifier wired without a keyid→agent URL\n    // resolver), we OMIT the `credential` rather than synthesize an\n    // `http_sig` variant that would otherwise carry an empty agent_url —\n    // Stage 1's runtime guard rejects malformed http_sig credentials, so\n    // emitting one would just trip the guard and confuse the audit trail.\n    const credential =\n      signer.agent_url !== undefined\n        ? markVerifiedHttpSig({\n            kind: 'http_sig',\n            keyid: signer.keyid,\n            agent_url: signer.agent_url,\n            verified_at: signer.verified_at,\n          })\n        : undefined;\n\n    const principal = options.makePrincipal\n      ? options.makePrincipal(signer)\n      : {\n          principal: `signing:${signer.keyid}`,\n          claims: {\n            signature: {\n              keyid: signer.keyid,\n              verified_at: signer.verified_at,\n              ...(signer.agent_url !== undefined ? { agent_url: signer.agent_url } : {}),\n            },\n          },\n          ...(credential !== undefined && { credential }),\n        };\n\n    // Write the side-channel state only after the principal is fully built so\n    // a throw from `makePrincipal` leaves `req.verifiedSigner` unset — the\n    // request didn't actually authenticate, downstream handlers must not see\n    // a stale \"verified\" marker on a rejected request.\n    (req as IncomingMessage & { verifiedSigner?: VerifiedSigner }).verifiedSigner = signer;\n    return principal;\n  };\n\n  return tagAuthenticatorNeedsRawBody(authenticator);\n}\n\n/**\n * Compose a signature authenticator with a fallback under presence-gated\n * semantics: if the incoming request declares a `Signature-Input` header,\n * the signature authenticator is the ONLY path — its result (principal,\n * `null`, or thrown {@link AuthError}) is the final outcome and the fallback\n * never runs. Without `Signature-Input`, the fallback handles the request.\n *\n * This is the correct composition for the `signed-requests` specialism.\n * {@link anyOf}'s either-or contract incorrectly accepts a bearer-authed\n * request whose signature is present-but-invalid — fine for \"either\n * credential is sufficient\" but wrong for spec conformance, where a\n * declared-but-invalid signature MUST be rejected even when a valid bearer\n * accompanies it (revocation, window expiry, malformed covered-components,\n * etc.).\n *\n * ```ts\n * import {\n *   serve,\n *   anyOf,\n *   verifyApiKey,\n *   verifySignatureAsAuthenticator,\n *   requireSignatureWhenPresent,\n * } from '@adcp/sdk/server';\n *\n * serve(createAgent, {\n *   authenticate: requireSignatureWhenPresent(\n *     verifySignatureAsAuthenticator({ jwks, replayStore, revocationStore, capability, resolveOperation }),\n *     anyOf(verifyApiKey({ keys }), verifyBearer({ jwksUri, issuer, audience })),\n *   ),\n * });\n * ```\n *\n * Presence is detected from RFC 9421 signature headers: either\n * `Signature-Input` or the paired `Signature`. A request carrying only one of\n * the two is malformed but still treated as \"signed intent\" — the signature\n * authenticator runs and throws, which is what AdCP's negative conformance\n * vectors expect.\n *\n * Behavior matrix:\n *\n * | RFC 9421 signature header present? | Signature result          | Outcome                      |\n * |------------------------------------|---------------------------|------------------------------|\n * | yes                                | verified                  | signature principal          |\n * | yes                                | throws {@link AuthError}  | 401 (does NOT fall through)  |\n * | yes                                | returns `null`            | 401 via re-thrown `AuthError` (does NOT fall through) |\n * | no                                 | —                         | fallback runs verbatim       |\n *\n * The returned authenticator is tagged with {@link AUTH_NEEDS_RAW_BODY} when\n * either branch needs the raw body, so `serve()` buffers `req.rawBody` ahead\n * of authentication.\n *\n * **Do not nest this helper inside {@link anyOf}.** `anyOf` catches thrown\n * `AuthError`s and tries the next authenticator, which re-introduces the\n * bypass this helper exists to prevent. `anyOf` refuses such composition at\n * wire-up time (throws synchronously) — invert the order instead:\n * `requireSignatureWhenPresent(sig, anyOf(bearer, apiKey))`.\n */\nexport interface RequireSignatureWhenPresentOptions {\n  /**\n   * Operations that MUST be signed. When the incoming request carries no\n   * RFC 9421 signature header AND the fallback authenticator returns\n   * `null` (no credentials at all), the gate throws an {@link AuthError}\n   * whose `cause` is {@link RequestSignatureError} with\n   * `request_signature_required` — `serve()` maps that into a 401 with\n   * `WWW-Authenticate: Signature error=\"request_signature_required\"`.\n   *\n   * \"Fallback bypass\" is deliberately allowed: if the caller presents a\n   * valid bearer (or API key) on a `requiredFor` operation, the fallback\n   * succeeds and the request is accepted without a signature. This\n   * matches the consensus on\n   * [adcp#2586](https://github.com/adcontextprotocol/adcp/issues/2586):\n   * `required_for` signals \"signatures are the mandatory mechanism for\n   * unauthenticated callers\" — not \"signatures are mandatory on top of\n   * every other credential.\"\n   *\n   * When the request IS signed, `required_for` enforcement happens inside\n   * the signature verifier itself (via `capability.required_for`), not\n   * here — this pre-check is only for the no-signature path.\n   */\n  requiredFor?: readonly string[];\n  /**\n   * Extract the AdCP operation name (or any identifier that can be\n   * matched against `requiredFor`) from the incoming request.\n   *\n   * For MCP agents, pass the exported {@link mcpToolNameResolver} — it\n   * implements the standard `tools/call` → `params.name` parse. For A2A\n   * agents (or other non-JSON-RPC envelopes), supply a bespoke resolver.\n   *\n   * When `requiredFor` is set but `resolveOperation` is omitted OR\n   * returns `undefined`, the pre-check is skipped — better to let the\n   * downstream handler produce a precise `INVALID_REQUEST` than to\n   * reject every unsigned call as signature-required.\n   */\n  resolveOperation?: (req: IncomingMessage & { rawBody?: string }) => string | undefined;\n}\n\n/**\n * Compose a signature authenticator with a fallback under presence-gated\n * semantics: if the incoming request declares a `Signature-Input` header,\n * the signature authenticator is the ONLY path — its result (principal,\n * `null`, or thrown {@link AuthError}) is the final outcome and the fallback\n * never runs. Without `Signature-Input`, the fallback handles the request.\n *\n * Pass {@link RequireSignatureWhenPresentOptions.requiredFor} to enforce\n * `required_for` for the no-signature path: when the fallback produces no\n * principal on an operation that MUST be signed, the gate throws an\n * {@link AuthError} whose cause is a {@link RequestSignatureError} with\n * code `request_signature_required` — `serve()` maps that into a 401\n * with the RFC 9421 `WWW-Authenticate: Signature` challenge.\n */\nexport function requireSignatureWhenPresent(\n  signatureAuth: Authenticator,\n  fallbackAuth: Authenticator,\n  options: RequireSignatureWhenPresentOptions = {}\n): Authenticator {\n  const requiredFor = new Set(options.requiredFor ?? []);\n  const resolveOperation = options.resolveOperation;\n  const combined: Authenticator = async req => {\n    if (hasSignatureHeader(req)) {\n      const result = await signatureAuth(req);\n      if (result === null) {\n        // A signature was declared but the sig authenticator didn't recognize\n        // it. Falling through to the fallback would re-open the bypass the\n        // presence gate exists to prevent — fail closed.\n        throw new AuthError('Signature declared but not recognized.');\n      }\n      return result;\n    }\n    // Catch the fallback's throw so the `requiredFor` pre-check can run\n    // regardless of fallback outcome. Without this, a caller presenting\n    // a bad bearer on a required-for op triggers `anyOf` to throw an\n    // `AuthError` with Bearer semantics, propagating past the pre-check\n    // and producing `WWW-Authenticate: Bearer` — the conformance grader\n    // reads the wrong error code on the exact vector this helper\n    // exists to close.\n    let fallbackResult: AuthResult | null = null;\n    let fallbackError: unknown;\n    let fallbackThrew = false;\n    try {\n      fallbackResult = await fallbackAuth(req);\n    } catch (err) {\n      fallbackThrew = true;\n      fallbackError = err;\n    }\n    // Valid fallback principal short-circuits everything: this is the\n    // documented \"bearer bypass on required_for\" semantic (per adcp#2586 —\n    // a valid credential is sufficient even when signing is required for\n    // unauthenticated callers). Return before the pre-check so the\n    // control flow below only runs on `fallbackResult === null`.\n    if (fallbackResult !== null) return fallbackResult;\n    // `requiredFor` pre-check: when the op requires a signature AND no\n    // signature was presented AND no valid fallback credential,\n    // surface `request_signature_required` regardless of whether the\n    // fallback threw (bad bearer) or returned null (no creds).\n    if (requiredFor.size > 0 && resolveOperation) {\n      const operation = resolveOperation(req as IncomingMessage & { rawBody?: string });\n      if (operation && requiredFor.has(operation)) {\n        throw new AuthError(`Signature required for ${operation}.`, {\n          cause: new RequestSignatureError(\n            'request_signature_required',\n            0,\n            `Operation ${operation} requires an RFC 9421 request signature when no other credentials are presented.`\n          ),\n        });\n      }\n    }\n    // Op not in requiredFor (or no resolver): rethrow the fallback's\n    // original error so the 401 carries the fallback's challenge\n    // (Bearer for bad-bearer, invalid_token for no-creds).\n    if (fallbackThrew) throw fallbackError;\n    return null;\n  };\n  const anyChildNeedsRawBody = authenticatorNeedsRawBody(signatureAuth) || authenticatorNeedsRawBody(fallbackAuth);\n  // When `resolveOperation` is wired, it almost always reads\n  // `req.rawBody` to parse the JSON-RPC body — the SDK's documented\n  // pattern. If no child is tagged (test stubs, agents whose signature\n  // path is non-SDK), `serve()` won't buffer the body and\n  // `resolveOperation` silently sees `undefined`, bypassing\n  // `requiredFor`. Tag the combined authenticator whenever a resolver\n  // is present so buffering happens regardless of the child shapes.\n  if (anyChildNeedsRawBody || resolveOperation) {\n    tagAuthenticatorNeedsRawBody(combined);\n  }\n  tagAuthenticatorPresenceGated(combined);\n  return combined;\n}\n\nexport interface RequireAuthenticatedOrSignedOptions {\n  /** RFC 9421 request-signature authenticator. Usually built with {@link verifySignatureAsAuthenticator}. */\n  signature: Authenticator;\n  /**\n   * Credential authenticator that runs when no signature is present.\n   * Usually {@link anyOf} of `verifyApiKey` / `verifyBearer` — whatever\n   * credential types the agent accepts on unsigned calls.\n   */\n  fallback: Authenticator;\n  /**\n   * Operations that MUST be authenticated with a signature when no other\n   * credential is presented. See\n   * {@link RequireSignatureWhenPresentOptions.requiredFor}.\n   *\n   * Pass `MUTATING_TASKS` (exported from `@adcp/sdk`) to require\n   * signatures on every mutating AdCP operation — matches the common\n   * declaration in `capabilities.request_signing.required_for`.\n   */\n  requiredFor?: readonly string[];\n  /** See {@link RequireSignatureWhenPresentOptions.resolveOperation}. */\n  resolveOperation?: (req: IncomingMessage & { rawBody?: string }) => string | undefined;\n}\n\n/**\n * Bundled composition of {@link requireSignatureWhenPresent} with an\n * operation resolver — one call produces an authenticator that:\n *\n *   1. Prefers the RFC 9421 signature path when a `Signature-Input`\n *      header is present, with no bearer fall-through on invalid\n *      signatures (matches the `signed-requests` specialism contract).\n *   2. Accepts bearer / API key when no signature is present, including\n *      on `requiredFor` operations — valid credentials bypass the\n *      signature requirement.\n *   3. Rejects unsigned calls with no credentials on `requiredFor`\n *      operations with a `WWW-Authenticate: Signature` challenge whose\n *      error is `request_signature_required`.\n *\n * ```ts\n * import {\n *   serve,\n *   verifyApiKey,\n *   verifyBearer,\n *   anyOf,\n *   verifySignatureAsAuthenticator,\n *   requireAuthenticatedOrSigned,\n *   mcpToolNameResolver,\n *   MUTATING_TASKS,\n * } from '@adcp/sdk/server';\n *\n * serve(createAgent, {\n *   authenticate: requireAuthenticatedOrSigned({\n *     signature: verifySignatureAsAuthenticator({\n *       jwks, replayStore, revocationStore, capability,\n *       resolveOperation: mcpToolNameResolver,\n *     }),\n *     fallback: anyOf(verifyApiKey({ keys }), verifyBearer({ jwksUri, issuer, audience })),\n *     requiredFor: [...MUTATING_TASKS],\n *     resolveOperation: mcpToolNameResolver,\n *   }),\n * });\n * ```\n */\nexport function requireAuthenticatedOrSigned(options: RequireAuthenticatedOrSignedOptions): Authenticator {\n  return requireSignatureWhenPresent(options.signature, options.fallback, {\n    requiredFor: options.requiredFor,\n    resolveOperation: options.resolveOperation,\n  });\n}\n\n/**\n * Default `resolveOperation` for MCP agents. Parses the buffered JSON-RPC\n * body on `req.rawBody` and returns `params.name` when `method === 'tools/call'`.\n * Returns `undefined` for non-`tools/call` methods, a missing body, or\n * malformed JSON — the same \"skip the pre-check and let the handler produce\n * a precise error\" semantics every other `resolveOperation` in the SDK\n * uses.\n *\n * Pass directly as `resolveOperation` on {@link verifySignatureAsAuthenticator},\n * {@link requireSignatureWhenPresent}, {@link requireAuthenticatedOrSigned},\n * or `createExpressVerifier` from `@adcp/sdk/signing`:\n *\n * ```ts\n * serve(createAgent, {\n *   authenticate: requireAuthenticatedOrSigned({\n *     signature: verifySignatureAsAuthenticator({\n *       jwks, replayStore, revocationStore, capability,\n *       resolveOperation: mcpToolNameResolver,\n *     }),\n *     fallback: anyOf(verifyApiKey({ keys }), verifyBearer({ jwksUri, issuer, audience })),\n *     requiredFor: [...MUTATING_TASKS],\n *     resolveOperation: mcpToolNameResolver,\n *   }),\n * });\n * ```\n *\n * A2A agents use a different envelope — write a bespoke resolver there.\n */\nexport function mcpToolNameResolver(req: { rawBody?: string }): string | undefined {\n  const raw = req.rawBody;\n  if (!raw) return undefined;\n  try {\n    const body = JSON.parse(raw) as { method?: unknown; params?: unknown };\n    if (body?.method !== 'tools/call') return undefined;\n    const params = body.params as { name?: unknown } | undefined;\n    return typeof params?.name === 'string' ? params.name : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nconst SAFE_KEYID = /^[A-Za-z0-9._-]{1,256}$/;\n\nfunction hasSignatureHeader(req: IncomingMessage): boolean {\n  // RFC 9421 pairs `Signature-Input` with `Signature`. Either is sufficient\n  // \"signed intent\" — a request carrying only one is malformed, but routing\n  // it to the fallback would mean a half-formed signing attempt (e.g., client\n  // bug that dropped the Signature-Input header) silently auths via bearer.\n  // Fail closed: send it to the signature authenticator, which will throw.\n  return nonEmptyHeader(req.headers['signature-input']) || nonEmptyHeader(req.headers['signature']);\n}\n\nfunction nonEmptyHeader(v: string | string[] | undefined): boolean {\n  if (typeof v === 'string') return v.length > 0;\n  if (Array.isArray(v)) return v.length > 0;\n  return false;\n}\n\nfunction defaultUrl(req: IncomingMessage): string {\n  const forwardedProto = firstHeader(req.headers['x-forwarded-proto']);\n  const encrypted = (req.socket as { encrypted?: boolean } | undefined)?.encrypted === true;\n  const proto = forwardedProto ?? (encrypted ? 'https' : 'http');\n  const host = firstHeader(req.headers['host']);\n  if (!host) {\n    throw new Error(\n      'verifySignatureAsAuthenticator: missing Host header. Pass `getUrl` to reconstruct the canonical URL explicitly.'\n    );\n  }\n  return `${proto}://${host}${req.url ?? '/'}`;\n}\n\nfunction firstHeader(value: string | string[] | undefined): string | undefined {\n  if (typeof value === 'string') return value;\n  if (Array.isArray(value) && value.length > 0) return value[0];\n  return undefined;\n}\n"],"mappings":";;;;;;AAyCA,SAAS,6BAA6B;AAEtC,SAAS,2BAA6C;AACtD,SAAS,+BAAqD;AAE9D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmEA,SAAS,+BAA+B,SAA+D;AAI5G,QAAM,cAAc,QAAQ,eAAe,IAAI,oBAAoB;AACnE,QAAM,kBAAkB,QAAQ,mBAAmB,IAAI,wBAAwB;AAE/E,QAAM,gBAA+B,OAAM,QAAO;AAChD,QAAI,CAAC,mBAAmB,GAAG,EAAG,QAAO;AAErC,UAAM,OAAQ,IAA+C,WAAW;AACxE,UAAM,MAAM,QAAQ,SAAS,QAAQ,OAAO,GAA6C,IAAI,WAAW,GAAG;AAC3G,UAAM,cAA2B;AAAA,MAC/B,QAAQ,IAAI,UAAU;AAAA,MACtB;AAAA,MACA,SAAS,IAAI;AAAA,MACb;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,uBAAuB,aAAa;AAAA,QACjD,YAAY,QAAQ;AAAA,QACpB,MAAM,QAAQ;AAAA,QACd;AAAA,QACA;AAAA,QACA,KAAK,QAAQ;AAAA,QACb,WAAW,QAAQ,iBAAiB,GAA6C;AAAA,QACjF,kBAAkB,QAAQ;AAAA,MAC5B,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,eAAe,uBAAuB;AACxC,cAAM,IAAI,UAAU,uBAAuB,IAAI,IAAI,MAAM,EAAE,OAAO,IAAI,CAAC;AAAA,MACzE;AACA,YAAM,IAAI,UAAU,kCAAkC,EAAE,OAAO,IAAI,CAAC;AAAA,IACtE;AAEA,QAAI,OAAO,WAAW,YAAY;AAMhC,YAAM,IAAI,UAAU,sDAAsD;AAAA,QACxE,OAAO,IAAI,MAAM,6BAA6B,OAAO,MAAM,GAAG;AAAA,MAChE,CAAC;AAAA,IACH;AAOA,QAAI,CAAC,WAAW,KAAK,OAAO,KAAK,GAAG;AAClC,YAAM,IAAI,UAAU,qDAAqD;AAAA,QACvE,OAAO,IAAI,MAAM,SAAS,KAAK,UAAU,OAAO,KAAK,CAAC,kCAAkC;AAAA,MAC1F,CAAC;AAAA,IACH;AAEA,UAAM,SAAyB;AAAA,MAC7B,OAAO,OAAO;AAAA,MACd,aAAa,OAAO;AAAA,MACpB,GAAI,OAAO,cAAc,SAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAC1E;AAaA,UAAM,aACJ,OAAO,cAAc,SACjB,oBAAoB;AAAA,MAClB,MAAM;AAAA,MACN,OAAO,OAAO;AAAA,MACd,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,IACtB,CAAC,IACD;AAEN,UAAM,YAAY,QAAQ,gBACtB,QAAQ,cAAc,MAAM,IAC5B;AAAA,MACE,WAAW,WAAW,OAAO,KAAK;AAAA,MAClC,QAAQ;AAAA,QACN,WAAW;AAAA,UACT,OAAO,OAAO;AAAA,UACd,aAAa,OAAO;AAAA,UACpB,GAAI,OAAO,cAAc,SAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,QAC1E;AAAA,MACF;AAAA,MACA,GAAI,eAAe,UAAa,EAAE,WAAW;AAAA,IAC/C;AAMJ,IAAC,IAA8D,iBAAiB;AAChF,WAAO;AAAA,EACT;AAEA,SAAO,6BAA6B,aAAa;AACnD;AAgHO,SAAS,4BACd,eACA,cACA,UAA8C,CAAC,GAChC;AACf,QAAM,cAAc,IAAI,IAAI,QAAQ,eAAe,CAAC,CAAC;AACrD,QAAM,mBAAmB,QAAQ;AACjC,QAAM,WAA0B,OAAM,QAAO;AAC3C,QAAI,mBAAmB,GAAG,GAAG;AAC3B,YAAM,SAAS,MAAM,cAAc,GAAG;AACtC,UAAI,WAAW,MAAM;AAInB,cAAM,IAAI,UAAU,wCAAwC;AAAA,MAC9D;AACA,aAAO;AAAA,IACT;AAQA,QAAI,iBAAoC;AACxC,QAAI;AACJ,QAAI,gBAAgB;AACpB,QAAI;AACF,uBAAiB,MAAM,aAAa,GAAG;AAAA,IACzC,SAAS,KAAK;AACZ,sBAAgB;AAChB,sBAAgB;AAAA,IAClB;AAMA,QAAI,mBAAmB,KAAM,QAAO;AAKpC,QAAI,YAAY,OAAO,KAAK,kBAAkB;AAC5C,YAAM,YAAY,iBAAiB,GAA6C;AAChF,UAAI,aAAa,YAAY,IAAI,SAAS,GAAG;AAC3C,cAAM,IAAI,UAAU,0BAA0B,SAAS,KAAK;AAAA,UAC1D,OAAO,IAAI;AAAA,YACT;AAAA,YACA;AAAA,YACA,aAAa,SAAS;AAAA,UACxB;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAIA,QAAI,cAAe,OAAM;AACzB,WAAO;AAAA,EACT;AACA,QAAM,uBAAuB,0BAA0B,aAAa,KAAK,0BAA0B,YAAY;AAQ/G,MAAI,wBAAwB,kBAAkB;AAC5C,iCAA6B,QAAQ;AAAA,EACvC;AACA,gCAA8B,QAAQ;AACtC,SAAO;AACT;AAgEO,SAAS,6BAA6B,SAA6D;AACxG,SAAO,4BAA4B,QAAQ,WAAW,QAAQ,UAAU;AAAA,IACtE,aAAa,QAAQ;AAAA,IACrB,kBAAkB,QAAQ;AAAA,EAC5B,CAAC;AACH;AA8BO,SAAS,oBAAoB,KAA+C;AACjF,QAAM,MAAM,IAAI;AAChB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,GAAG;AAC3B,QAAI,MAAM,WAAW,aAAc,QAAO;AAC1C,UAAM,SAAS,KAAK;AACpB,WAAO,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,aAAa;AAEnB,SAAS,mBAAmB,KAA+B;AAMzD,SAAO,eAAe,IAAI,QAAQ,iBAAiB,CAAC,KAAK,eAAe,IAAI,QAAQ,WAAW,CAAC;AAClG;AAEA,SAAS,eAAe,GAA2C;AACjE,MAAI,OAAO,MAAM,SAAU,QAAO,EAAE,SAAS;AAC7C,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,SAAS;AACxC,SAAO;AACT;AAEA,SAAS,WAAW,KAA8B;AAChD,QAAM,iBAAiB,YAAY,IAAI,QAAQ,mBAAmB,CAAC;AACnE,QAAM,YAAa,IAAI,QAAgD,cAAc;AACrF,QAAM,QAAQ,mBAAmB,YAAY,UAAU;AACvD,QAAM,OAAO,YAAY,IAAI,QAAQ,MAAM,CAAC;AAC5C,MAAI,CAAC,MAAM;AACT,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG;AAC5C;AAEA,SAAS,YAAY,OAA0D;AAC7E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/auth-signature.ts"],"sourcesContent":["/**\n * Bridge between {@link verifyRequestSignature} and the {@link Authenticator}\n * surface so RFC 9421 signatures compose with bearer / API-key auth via\n * {@link anyOf}.\n *\n * Use when an agent declares the `signed-requests` specialism AND also\n * accepts bearer-authed callers — the composition signals \"either credential\n * type is sufficient\". Unsigned-but-bearered requests fall through to the\n * next authenticator; signed requests with a valid signature short-circuit\n * the chain and surface a principal derived from the signing key.\n *\n * A request with a present-but-invalid signature throws {@link AuthError}\n * so `serve()` can return a 401 — `anyOf` surfaces that as \"credentials\n * rejected\" rather than falling through.\n *\n * ```ts\n * import {\n *   serve,\n *   verifyApiKey,\n *   anyOf,\n *   verifySignatureAsAuthenticator,\n *   mcpToolNameResolver,\n * } from '@adcp/sdk/server';\n *\n * serve(createAgent, {\n *   authenticate: anyOf(\n *     verifyApiKey({ keys: { 'sk_live_abc': { principal: 'acct_42' } } }),\n *     verifySignatureAsAuthenticator({\n *       jwks, replayStore, revocationStore,\n *       capability: { supported: true, required_for: [], covers_content_digest: 'either' },\n *       resolveOperation: mcpToolNameResolver,\n *     }),\n *   ),\n * });\n * ```\n *\n * The returned authenticator is tagged with {@link AUTH_NEEDS_RAW_BODY} so\n * `serve()` buffers `req.rawBody` before authentication runs.\n */\nimport type { IncomingMessage } from 'http';\nimport type { RequestLike } from '../signing/canonicalize';\nimport { RequestSignatureError } from '../signing/errors';\nimport type { JwksResolver } from '../signing/jwks';\nimport { InMemoryReplayStore, type ReplayStore } from '../signing/replay';\nimport { InMemoryRevocationStore, type RevocationStore } from '../signing/revocation';\nimport type { VerifiedSigner, VerifierCapability, VerifyResult } from '../signing/types';\nimport { verifyRequestSignature } from '../signing/verifier';\nimport { markVerifiedHttpSig } from './decisioning/buyer-agent';\nimport {\n  AuthError,\n  type AuthPrincipal,\n  type AuthResult,\n  type Authenticator,\n  authenticatorNeedsRawBody,\n  tagAuthenticatorNeedsRawBody,\n  tagAuthenticatorPresenceGated,\n} from './auth';\n\nexport interface VerifySignatureAsAuthenticatorOptions {\n  /** Verifier capability block. `required_for` is not enforced here — unsigned\n   *  requests fall through to the next authenticator — so set it to whatever\n   *  your `request_signing` capability claim advertises. */\n  capability: VerifierCapability;\n  /** Resolves verification keys by `keyid`. */\n  jwks: JwksResolver;\n  /**\n   * Stores `(keyid, signature-bytes, expires)` tuples for replay detection.\n   * Defaults to a fresh {@link InMemoryReplayStore} — fine for single-process\n   * deployments. Wire a shared store (Redis, Postgres, etc.) for multi-replica\n   * setups where a signature accepted on one replica must be rejected on the\n   * others.\n   */\n  replayStore?: ReplayStore;\n  /**\n   * Consulted for revoked `kid` / `jti` before accepting a signature.\n   * Defaults to a fresh {@link InMemoryRevocationStore}. Most agents don't\n   * revoke at runtime; when you do, swap in a store backed by your secrets\n   * manager or admin tooling.\n   */\n  revocationStore?: RevocationStore;\n  /** Override clock for tests. */\n  now?: () => number;\n  /**\n   * Extract the AdCP operation name from the incoming request. Called with\n   * the raw `IncomingMessage`; `req.rawBody` has been buffered by `serve()`\n   * before this runs. Same semantics as\n   * `ExpressMiddlewareOptions.resolveOperation` on {@link createExpressVerifier}.\n   *\n   * SECURITY: a resolver that always returns `undefined` disables\n   * `capability.required_for` enforcement for this authenticator. Since the\n   * bypass here is intentional (this adapter is for composition with other\n   * authenticators — see the module docstring), the fall-through still\n   * happens when the resolver returns `undefined`, so `required_for`\n   * enforcement should live in a separate `preTransport`-mounted verifier\n   * when composition is active.\n   */\n  resolveOperation: (req: IncomingMessage & { rawBody?: string }) => string | undefined;\n  /**\n   * Override how the request's full URL is reconstructed. Use when the\n   * server sits behind a TLS-terminating or path-rewriting load balancer\n   * and `req.headers.host` / `req.url` don't reflect what the signer signed.\n   */\n  getUrl?: (req: IncomingMessage & { rawBody?: string }) => string;\n  /** Resolve the `agent_url` claim the verifier stamps on verified results. */\n  agentUrlForKeyid?: (keyid: string) => string | undefined;\n  /**\n   * Shape the principal returned on successful signature verification.\n   * Defaults to `{ principal: `signing:${keyid}`, claims: { signature: VerifiedSigner } }`.\n   */\n  makePrincipal?: (signer: VerifiedSigner) => AuthPrincipal;\n}\n\n/**\n * Build an {@link Authenticator} that verifies an RFC 9421 request signature.\n *\n * Behavior matrix:\n * - No `Signature-Input` header → returns `null` (fall through to next authenticator).\n * - Signature present and valid → returns {@link AuthPrincipal}.\n * - Signature present but invalid → throws {@link AuthError} (surfaces as 401).\n *\n * Populates `req.verifiedSigner` on success so downstream handlers see the\n * same side-channel state as the Express-shaped middleware.\n */\nexport function verifySignatureAsAuthenticator(options: VerifySignatureAsAuthenticatorOptions): Authenticator {\n  // Instantiate defaults once at wire-up time so every request on this\n  // authenticator shares the same replay/revocation state — lazy\n  // per-request construction would defeat replay detection entirely.\n  const replayStore = options.replayStore ?? new InMemoryReplayStore();\n  const revocationStore = options.revocationStore ?? new InMemoryRevocationStore();\n\n  const authenticator: Authenticator = async req => {\n    if (!hasSignatureHeader(req)) return null;\n\n    const body = (req as IncomingMessage & { rawBody?: string }).rawBody ?? '';\n    const url = options.getUrl ? options.getUrl(req as IncomingMessage & { rawBody?: string }) : defaultUrl(req);\n    const requestLike: RequestLike = {\n      method: req.method ?? 'GET',\n      url,\n      headers: req.headers,\n      body,\n    };\n\n    let result: VerifyResult;\n    try {\n      result = await verifyRequestSignature(requestLike, {\n        capability: options.capability,\n        jwks: options.jwks,\n        replayStore,\n        revocationStore,\n        now: options.now,\n        operation: options.resolveOperation(req as IncomingMessage & { rawBody?: string }),\n        agentUrlForKeyid: options.agentUrlForKeyid,\n      });\n    } catch (err) {\n      if (err instanceof RequestSignatureError) {\n        throw new AuthError(`Signature rejected (${err.code}).`, { cause: err });\n      }\n      throw new AuthError('Signature verification failed.', { cause: err });\n    }\n\n    if (result.status !== 'verified') {\n      // Unreachable: `hasSignatureHeader` already gated entry, so the verifier\n      // either throws (missing-pair / invalid / replayed / etc.) or returns\n      // `status: 'verified'`. Fail loud if the verifier contract changes —\n      // silently returning `null` would fall through to the next authenticator\n      // as if no signature were present, breaking the auth invariant.\n      throw new AuthError('Signature verification returned unexpected status.', {\n        cause: new Error(`verifier returned status=\"${result.status}\"`),\n      });\n    }\n\n    // keyid is buyer-controlled (JWK spec places no charset restriction on\n    // `kid`). Bound it to a URL-safe shape — explicitly excluding `:` — before\n    // interpolating into the principal string, so downstream tenant-isolation\n    // checks that split `signing:<keyid>` on the first `:` can't be confused\n    // by a colon embedded in the signer's key id.\n    if (!SAFE_KEYID.test(result.keyid)) {\n      throw new AuthError('Signature key id contains unsupported characters.', {\n        cause: new Error(`keyid=${JSON.stringify(result.keyid)} fails /^[A-Za-z0-9._-]{1,256}$/`),\n      });\n    }\n\n    const signer: VerifiedSigner = {\n      keyid: result.keyid,\n      verified_at: result.verified_at,\n      ...(result.agent_url !== undefined ? { agent_url: result.agent_url } : {}),\n    };\n\n    // Stamp the kind-discriminated `credential` variant for the framework's\n    // dispatcher and `BuyerAgentRegistry` resolution (Phase 1 Stage 3 of\n    // #1269). Per adcontextprotocol/adcp#3831, `agent_url` here is the\n    // verifier's `agentUrlForKeyid` lookup result — derived from the\n    // `agents[]` entry whose `jwks_uri` resolved the keyid.\n    //\n    // When `agent_url` is unset (verifier wired without a keyid→agent URL\n    // resolver), we OMIT the `credential` rather than synthesize an\n    // `http_sig` variant that would otherwise carry an empty agent_url —\n    // Stage 1's runtime guard rejects malformed http_sig credentials, so\n    // emitting one would just trip the guard and confuse the audit trail.\n    const credential =\n      signer.agent_url !== undefined\n        ? markVerifiedHttpSig({\n            kind: 'http_sig',\n            keyid: signer.keyid,\n            agent_url: signer.agent_url,\n            verified_at: signer.verified_at,\n          })\n        : undefined;\n\n    const principal = options.makePrincipal\n      ? options.makePrincipal(signer)\n      : {\n          principal: `signing:${signer.keyid}`,\n          claims: {\n            signature: {\n              keyid: signer.keyid,\n              verified_at: signer.verified_at,\n              ...(signer.agent_url !== undefined ? { agent_url: signer.agent_url } : {}),\n            },\n          },\n          ...(credential !== undefined && { credential }),\n        };\n\n    // Write the side-channel state only after the principal is fully built so\n    // a throw from `makePrincipal` leaves `req.verifiedSigner` unset — the\n    // request didn't actually authenticate, downstream handlers must not see\n    // a stale \"verified\" marker on a rejected request.\n    (req as IncomingMessage & { verifiedSigner?: VerifiedSigner }).verifiedSigner = signer;\n    return principal;\n  };\n\n  return tagAuthenticatorNeedsRawBody(authenticator);\n}\n\n/**\n * Compose a signature authenticator with a fallback under presence-gated\n * semantics: if the incoming request declares a `Signature-Input` header,\n * the signature authenticator is the ONLY path — its result (principal,\n * `null`, or thrown {@link AuthError}) is the final outcome and the fallback\n * never runs. Without `Signature-Input`, the fallback handles the request.\n *\n * This is the correct composition for the `signed-requests` specialism.\n * {@link anyOf}'s either-or contract incorrectly accepts a bearer-authed\n * request whose signature is present-but-invalid — fine for \"either\n * credential is sufficient\" but wrong for spec conformance, where a\n * declared-but-invalid signature MUST be rejected even when a valid bearer\n * accompanies it (revocation, window expiry, malformed covered-components,\n * etc.).\n *\n * ```ts\n * import {\n *   serve,\n *   anyOf,\n *   verifyApiKey,\n *   verifySignatureAsAuthenticator,\n *   requireSignatureWhenPresent,\n * } from '@adcp/sdk/server';\n *\n * serve(createAgent, {\n *   authenticate: requireSignatureWhenPresent(\n *     verifySignatureAsAuthenticator({ jwks, replayStore, revocationStore, capability, resolveOperation }),\n *     anyOf(verifyApiKey({ keys }), verifyBearer({ jwksUri, issuer, audience })),\n *   ),\n * });\n * ```\n *\n * Presence is detected from RFC 9421 signature headers: either\n * `Signature-Input` or the paired `Signature`. A request carrying only one of\n * the two is malformed but still treated as \"signed intent\" — the signature\n * authenticator runs and throws, which is what AdCP's negative conformance\n * vectors expect.\n *\n * Behavior matrix:\n *\n * | RFC 9421 signature header present? | Signature result          | Outcome                      |\n * |------------------------------------|---------------------------|------------------------------|\n * | yes                                | verified                  | signature principal          |\n * | yes                                | throws {@link AuthError}  | 401 (does NOT fall through)  |\n * | yes                                | returns `null`            | 401 via re-thrown `AuthError` (does NOT fall through) |\n * | no                                 | —                         | fallback runs verbatim       |\n *\n * The returned authenticator is tagged with {@link AUTH_NEEDS_RAW_BODY} when\n * either branch needs the raw body, so `serve()` buffers `req.rawBody` ahead\n * of authentication.\n *\n * **Do not nest this helper inside {@link anyOf}.** `anyOf` catches thrown\n * `AuthError`s and tries the next authenticator, which re-introduces the\n * bypass this helper exists to prevent. `anyOf` refuses such composition at\n * wire-up time (throws synchronously) — invert the order instead:\n * `requireSignatureWhenPresent(sig, anyOf(bearer, apiKey))`.\n */\nexport interface RequireSignatureWhenPresentOptions {\n  /**\n   * Operations that MUST be signed. When the incoming request carries no\n   * RFC 9421 signature header AND the fallback authenticator returns\n   * `null` (no credentials at all), the gate throws an {@link AuthError}\n   * whose `cause` is {@link RequestSignatureError} with\n   * `request_signature_required` — `serve()` maps that into a 401 with\n   * `WWW-Authenticate: Signature error=\"request_signature_required\"`.\n   *\n   * \"Fallback bypass\" is deliberately allowed: if the caller presents a\n   * valid bearer (or API key) on a `requiredFor` operation, the fallback\n   * succeeds and the request is accepted without a signature. This\n   * matches the consensus on\n   * [adcp#2586](https://github.com/adcontextprotocol/adcp/issues/2586):\n   * `required_for` signals \"signatures are the mandatory mechanism for\n   * unauthenticated callers\" — not \"signatures are mandatory on top of\n   * every other credential.\"\n   *\n   * When the request IS signed, `required_for` enforcement happens inside\n   * the signature verifier itself (via `capability.required_for`), not\n   * here — this pre-check is only for the no-signature path.\n   */\n  requiredFor?: readonly string[];\n  /**\n   * Extract the AdCP operation name (or any identifier that can be\n   * matched against `requiredFor`) from the incoming request.\n   *\n   * For MCP agents, pass the exported {@link mcpToolNameResolver} — it\n   * implements the standard `tools/call` → `params.name` parse. For A2A\n   * agents (or other non-JSON-RPC envelopes), supply a bespoke resolver.\n   *\n   * When `requiredFor` is set but `resolveOperation` is omitted OR\n   * returns `undefined`, the pre-check is skipped — better to let the\n   * downstream handler produce a precise `INVALID_REQUEST` than to\n   * reject every unsigned call as signature-required.\n   */\n  resolveOperation?: (req: IncomingMessage & { rawBody?: string }) => string | undefined;\n}\n\n/**\n * Compose a signature authenticator with a fallback under presence-gated\n * semantics: if the incoming request declares a `Signature-Input` header,\n * the signature authenticator is the ONLY path — its result (principal,\n * `null`, or thrown {@link AuthError}) is the final outcome and the fallback\n * never runs. Without `Signature-Input`, the fallback handles the request.\n *\n * Pass {@link RequireSignatureWhenPresentOptions.requiredFor} to enforce\n * `required_for` for the no-signature path: when the fallback produces no\n * principal on an operation that MUST be signed, the gate throws an\n * {@link AuthError} whose cause is a {@link RequestSignatureError} with\n * code `request_signature_required` — `serve()` maps that into a 401\n * with the RFC 9421 `WWW-Authenticate: Signature` challenge.\n */\nexport function requireSignatureWhenPresent(\n  signatureAuth: Authenticator,\n  fallbackAuth: Authenticator,\n  options: RequireSignatureWhenPresentOptions = {}\n): Authenticator {\n  const requiredFor = new Set(options.requiredFor ?? []);\n  const resolveOperation = options.resolveOperation;\n  const combined: Authenticator = async req => {\n    if (hasSignatureHeader(req)) {\n      const result = await signatureAuth(req);\n      if (result === null) {\n        // A signature was declared but the sig authenticator didn't recognize\n        // it. Falling through to the fallback would re-open the bypass the\n        // presence gate exists to prevent — fail closed.\n        throw new AuthError('Signature declared but not recognized.');\n      }\n      return result;\n    }\n    // Catch the fallback's throw so the `requiredFor` pre-check can run\n    // regardless of fallback outcome. Without this, a caller presenting\n    // a bad bearer on a required-for op triggers `anyOf` to throw an\n    // `AuthError` with Bearer semantics, propagating past the pre-check\n    // and producing `WWW-Authenticate: Bearer` — the conformance grader\n    // reads the wrong error code on the exact vector this helper\n    // exists to close.\n    let fallbackResult: AuthResult | null = null;\n    let fallbackError: unknown;\n    let fallbackThrew = false;\n    try {\n      fallbackResult = await fallbackAuth(req);\n    } catch (err) {\n      fallbackThrew = true;\n      fallbackError = err;\n    }\n    // Valid fallback principal short-circuits everything: this is the\n    // documented \"bearer bypass on required_for\" semantic (per adcp#2586 —\n    // a valid credential is sufficient even when signing is required for\n    // unauthenticated callers). Return before the pre-check so the\n    // control flow below only runs on `fallbackResult === null`.\n    if (fallbackResult !== null) return fallbackResult;\n    // `requiredFor` pre-check: when the op requires a signature AND no\n    // signature was presented AND no valid fallback credential,\n    // surface `request_signature_required` regardless of whether the\n    // fallback threw (bad bearer) or returned null (no creds).\n    if (requiredFor.size > 0 && resolveOperation) {\n      const operation = resolveOperation(req as IncomingMessage & { rawBody?: string });\n      if (operation && requiredFor.has(operation)) {\n        throw new AuthError(`Signature required for ${operation}.`, {\n          cause: new RequestSignatureError(\n            'request_signature_required',\n            0,\n            `Operation ${operation} requires an RFC 9421 request signature when no other credentials are presented.`\n          ),\n        });\n      }\n    }\n    // Op not in requiredFor (or no resolver): rethrow the fallback's\n    // original error so the 401 carries the fallback's challenge\n    // (Bearer for bad-bearer, invalid_token for no-creds).\n    if (fallbackThrew) throw fallbackError;\n    return null;\n  };\n  const anyChildNeedsRawBody = authenticatorNeedsRawBody(signatureAuth) || authenticatorNeedsRawBody(fallbackAuth);\n  // When `resolveOperation` is wired, it almost always reads\n  // `req.rawBody` to parse the JSON-RPC body — the SDK's documented\n  // pattern. If no child is tagged (test stubs, agents whose signature\n  // path is non-SDK), `serve()` won't buffer the body and\n  // `resolveOperation` silently sees `undefined`, bypassing\n  // `requiredFor`. Tag the combined authenticator whenever a resolver\n  // is present so buffering happens regardless of the child shapes.\n  if (anyChildNeedsRawBody || resolveOperation) {\n    tagAuthenticatorNeedsRawBody(combined);\n  }\n  tagAuthenticatorPresenceGated(combined);\n  return combined;\n}\n\nexport interface RequireAuthenticatedOrSignedOptions {\n  /** RFC 9421 request-signature authenticator. Usually built with {@link verifySignatureAsAuthenticator}. */\n  signature: Authenticator;\n  /**\n   * Credential authenticator that runs when no signature is present.\n   * Usually {@link anyOf} of `verifyApiKey` / `verifyBearer` — whatever\n   * credential types the agent accepts on unsigned calls.\n   */\n  fallback: Authenticator;\n  /**\n   * Operations that MUST be authenticated with a signature when no other\n   * credential is presented. See\n   * {@link RequireSignatureWhenPresentOptions.requiredFor}.\n   *\n   * Pass `MUTATING_TASKS` (exported from `@adcp/sdk`) to require\n   * signatures on every mutating AdCP operation — matches the common\n   * declaration in `capabilities.request_signing.required_for`.\n   */\n  requiredFor?: readonly string[];\n  /** See {@link RequireSignatureWhenPresentOptions.resolveOperation}. */\n  resolveOperation?: (req: IncomingMessage & { rawBody?: string }) => string | undefined;\n}\n\n/**\n * Bundled composition of {@link requireSignatureWhenPresent} with an\n * operation resolver — one call produces an authenticator that:\n *\n *   1. Prefers the RFC 9421 signature path when a `Signature-Input`\n *      header is present, with no bearer fall-through on invalid\n *      signatures (matches the `signed-requests` specialism contract).\n *   2. Accepts bearer / API key when no signature is present, including\n *      on `requiredFor` operations — valid credentials bypass the\n *      signature requirement.\n *   3. Rejects unsigned calls with no credentials on `requiredFor`\n *      operations with a `WWW-Authenticate: Signature` challenge whose\n *      error is `request_signature_required`.\n *\n * ```ts\n * import {\n *   serve,\n *   verifyApiKey,\n *   verifyBearer,\n *   anyOf,\n *   verifySignatureAsAuthenticator,\n *   requireAuthenticatedOrSigned,\n *   mcpToolNameResolver,\n *   MUTATING_TASKS,\n * } from '@adcp/sdk/server';\n *\n * serve(createAgent, {\n *   authenticate: requireAuthenticatedOrSigned({\n *     signature: verifySignatureAsAuthenticator({\n *       jwks, replayStore, revocationStore, capability,\n *       resolveOperation: mcpToolNameResolver,\n *     }),\n *     fallback: anyOf(verifyApiKey({ keys }), verifyBearer({ jwksUri, issuer, audience })),\n *     requiredFor: [...MUTATING_TASKS],\n *     resolveOperation: mcpToolNameResolver,\n *   }),\n * });\n * ```\n */\nexport function requireAuthenticatedOrSigned(options: RequireAuthenticatedOrSignedOptions): Authenticator {\n  return requireSignatureWhenPresent(options.signature, options.fallback, {\n    requiredFor: options.requiredFor,\n    resolveOperation: options.resolveOperation,\n  });\n}\n\n/**\n * Default `resolveOperation` for MCP agents. Parses the buffered JSON-RPC\n * body on `req.rawBody` and returns `params.name` when `method === 'tools/call'`.\n * Returns `undefined` for non-`tools/call` methods, a missing body, or\n * malformed JSON — the same \"skip the pre-check and let the handler produce\n * a precise error\" semantics every other `resolveOperation` in the SDK\n * uses.\n *\n * Pass directly as `resolveOperation` on {@link verifySignatureAsAuthenticator},\n * {@link requireSignatureWhenPresent}, {@link requireAuthenticatedOrSigned},\n * or `createExpressVerifier` from `@adcp/sdk/signing`:\n *\n * ```ts\n * serve(createAgent, {\n *   authenticate: requireAuthenticatedOrSigned({\n *     signature: verifySignatureAsAuthenticator({\n *       jwks, replayStore, revocationStore, capability,\n *       resolveOperation: mcpToolNameResolver,\n *     }),\n *     fallback: anyOf(verifyApiKey({ keys }), verifyBearer({ jwksUri, issuer, audience })),\n *     requiredFor: [...MUTATING_TASKS],\n *     resolveOperation: mcpToolNameResolver,\n *   }),\n * });\n * ```\n *\n * A2A agents use a different envelope — write a bespoke resolver there.\n */\nexport function mcpToolNameResolver(req: { rawBody?: string }): string | undefined {\n  const raw = req.rawBody;\n  if (!raw) return undefined;\n  try {\n    const body = JSON.parse(raw) as { method?: unknown; params?: unknown };\n    if (body?.method !== 'tools/call') return undefined;\n    const params = body.params as { name?: unknown } | undefined;\n    return typeof params?.name === 'string' ? params.name : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nconst SAFE_KEYID = /^[A-Za-z0-9._-]{1,256}$/;\n\nfunction hasSignatureHeader(req: IncomingMessage): boolean {\n  // RFC 9421 pairs `Signature-Input` with `Signature`. Either is sufficient\n  // \"signed intent\" — a request carrying only one is malformed, but routing\n  // it to the fallback would mean a half-formed signing attempt (e.g., client\n  // bug that dropped the Signature-Input header) silently auths via bearer.\n  // Fail closed: send it to the signature authenticator, which will throw.\n  return nonEmptyHeader(req.headers['signature-input']) || nonEmptyHeader(req.headers['signature']);\n}\n\nfunction nonEmptyHeader(v: string | string[] | undefined): boolean {\n  if (typeof v === 'string') return v.length > 0;\n  if (Array.isArray(v)) return v.length > 0;\n  return false;\n}\n\nfunction defaultUrl(req: IncomingMessage): string {\n  const forwardedProto = firstHeader(req.headers['x-forwarded-proto']);\n  const encrypted = (req.socket as { encrypted?: boolean } | undefined)?.encrypted === true;\n  const proto = forwardedProto ?? (encrypted ? 'https' : 'http');\n  const host = firstHeader(req.headers['host']);\n  if (!host) {\n    throw new Error(\n      'verifySignatureAsAuthenticator: missing Host header. Pass `getUrl` to reconstruct the canonical URL explicitly.'\n    );\n  }\n  return `${proto}://${host}${req.url ?? '/'}`;\n}\n\nfunction firstHeader(value: string | string[] | undefined): string | undefined {\n  if (typeof value === 'string') return value;\n  if (Array.isArray(value) && value.length > 0) return value[0];\n  return undefined;\n}\n"],"mappings":"AAyCA,SAAS,6BAA6B;AAEtC,SAAS,2BAA6C;AACtD,SAAS,+BAAqD;AAE9D,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmEA,SAAS,+BAA+B,SAA+D;AAI5G,QAAM,cAAc,QAAQ,eAAe,IAAI,oBAAoB;AACnE,QAAM,kBAAkB,QAAQ,mBAAmB,IAAI,wBAAwB;AAE/E,QAAM,gBAA+B,OAAM,QAAO;AAChD,QAAI,CAAC,mBAAmB,GAAG,EAAG,QAAO;AAErC,UAAM,OAAQ,IAA+C,WAAW;AACxE,UAAM,MAAM,QAAQ,SAAS,QAAQ,OAAO,GAA6C,IAAI,WAAW,GAAG;AAC3G,UAAM,cAA2B;AAAA,MAC/B,QAAQ,IAAI,UAAU;AAAA,MACtB;AAAA,MACA,SAAS,IAAI;AAAA,MACb;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,uBAAuB,aAAa;AAAA,QACjD,YAAY,QAAQ;AAAA,QACpB,MAAM,QAAQ;AAAA,QACd;AAAA,QACA;AAAA,QACA,KAAK,QAAQ;AAAA,QACb,WAAW,QAAQ,iBAAiB,GAA6C;AAAA,QACjF,kBAAkB,QAAQ;AAAA,MAC5B,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,eAAe,uBAAuB;AACxC,cAAM,IAAI,UAAU,uBAAuB,IAAI,IAAI,MAAM,EAAE,OAAO,IAAI,CAAC;AAAA,MACzE;AACA,YAAM,IAAI,UAAU,kCAAkC,EAAE,OAAO,IAAI,CAAC;AAAA,IACtE;AAEA,QAAI,OAAO,WAAW,YAAY;AAMhC,YAAM,IAAI,UAAU,sDAAsD;AAAA,QACxE,OAAO,IAAI,MAAM,6BAA6B,OAAO,MAAM,GAAG;AAAA,MAChE,CAAC;AAAA,IACH;AAOA,QAAI,CAAC,WAAW,KAAK,OAAO,KAAK,GAAG;AAClC,YAAM,IAAI,UAAU,qDAAqD;AAAA,QACvE,OAAO,IAAI,MAAM,SAAS,KAAK,UAAU,OAAO,KAAK,CAAC,kCAAkC;AAAA,MAC1F,CAAC;AAAA,IACH;AAEA,UAAM,SAAyB;AAAA,MAC7B,OAAO,OAAO;AAAA,MACd,aAAa,OAAO;AAAA,MACpB,GAAI,OAAO,cAAc,SAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAC1E;AAaA,UAAM,aACJ,OAAO,cAAc,SACjB,oBAAoB;AAAA,MAClB,MAAM;AAAA,MACN,OAAO,OAAO;AAAA,MACd,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,IACtB,CAAC,IACD;AAEN,UAAM,YAAY,QAAQ,gBACtB,QAAQ,cAAc,MAAM,IAC5B;AAAA,MACE,WAAW,WAAW,OAAO,KAAK;AAAA,MAClC,QAAQ;AAAA,QACN,WAAW;AAAA,UACT,OAAO,OAAO;AAAA,UACd,aAAa,OAAO;AAAA,UACpB,GAAI,OAAO,cAAc,SAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,QAC1E;AAAA,MACF;AAAA,MACA,GAAI,eAAe,UAAa,EAAE,WAAW;AAAA,IAC/C;AAMJ,IAAC,IAA8D,iBAAiB;AAChF,WAAO;AAAA,EACT;AAEA,SAAO,6BAA6B,aAAa;AACnD;AAgHO,SAAS,4BACd,eACA,cACA,UAA8C,CAAC,GAChC;AACf,QAAM,cAAc,IAAI,IAAI,QAAQ,eAAe,CAAC,CAAC;AACrD,QAAM,mBAAmB,QAAQ;AACjC,QAAM,WAA0B,OAAM,QAAO;AAC3C,QAAI,mBAAmB,GAAG,GAAG;AAC3B,YAAM,SAAS,MAAM,cAAc,GAAG;AACtC,UAAI,WAAW,MAAM;AAInB,cAAM,IAAI,UAAU,wCAAwC;AAAA,MAC9D;AACA,aAAO;AAAA,IACT;AAQA,QAAI,iBAAoC;AACxC,QAAI;AACJ,QAAI,gBAAgB;AACpB,QAAI;AACF,uBAAiB,MAAM,aAAa,GAAG;AAAA,IACzC,SAAS,KAAK;AACZ,sBAAgB;AAChB,sBAAgB;AAAA,IAClB;AAMA,QAAI,mBAAmB,KAAM,QAAO;AAKpC,QAAI,YAAY,OAAO,KAAK,kBAAkB;AAC5C,YAAM,YAAY,iBAAiB,GAA6C;AAChF,UAAI,aAAa,YAAY,IAAI,SAAS,GAAG;AAC3C,cAAM,IAAI,UAAU,0BAA0B,SAAS,KAAK;AAAA,UAC1D,OAAO,IAAI;AAAA,YACT;AAAA,YACA;AAAA,YACA,aAAa,SAAS;AAAA,UACxB;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAIA,QAAI,cAAe,OAAM;AACzB,WAAO;AAAA,EACT;AACA,QAAM,uBAAuB,0BAA0B,aAAa,KAAK,0BAA0B,YAAY;AAQ/G,MAAI,wBAAwB,kBAAkB;AAC5C,iCAA6B,QAAQ;AAAA,EACvC;AACA,gCAA8B,QAAQ;AACtC,SAAO;AACT;AAgEO,SAAS,6BAA6B,SAA6D;AACxG,SAAO,4BAA4B,QAAQ,WAAW,QAAQ,UAAU;AAAA,IACtE,aAAa,QAAQ;AAAA,IACrB,kBAAkB,QAAQ;AAAA,EAC5B,CAAC;AACH;AA8BO,SAAS,oBAAoB,KAA+C;AACjF,QAAM,MAAM,IAAI;AAChB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,GAAG;AAC3B,QAAI,MAAM,WAAW,aAAc,QAAO;AAC1C,UAAM,SAAS,KAAK;AACpB,WAAO,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,aAAa;AAEnB,SAAS,mBAAmB,KAA+B;AAMzD,SAAO,eAAe,IAAI,QAAQ,iBAAiB,CAAC,KAAK,eAAe,IAAI,QAAQ,WAAW,CAAC;AAClG;AAEA,SAAS,eAAe,GAA2C;AACjE,MAAI,OAAO,MAAM,SAAU,QAAO,EAAE,SAAS;AAC7C,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,SAAS;AACxC,SAAO;AACT;AAEA,SAAS,WAAW,KAA8B;AAChD,QAAM,iBAAiB,YAAY,IAAI,QAAQ,mBAAmB,CAAC;AACnE,QAAM,YAAa,IAAI,QAAgD,cAAc;AACrF,QAAM,QAAQ,mBAAmB,YAAY,UAAU;AACvD,QAAM,OAAO,YAAY,IAAI,QAAQ,MAAM,CAAC;AAC5C,MAAI,CAAC,MAAM;AACT,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG;AAC5C;AAEA,SAAS,YAAY,OAA0D;AAC7E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,EAAG,QAAO,MAAM,CAAC;AAC5D,SAAO;AACT;","names":[]}

package/dist/lib/server/auth.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { createHash } from "node:crypto";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { RequestSignatureError } from "../signing/errors.mjs";

package/dist/lib/server/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/auth.ts"],"sourcesContent":["/**\n * Server-side authentication primitives for AdCP MCP agents.\n *\n * Wire one of these into {@link serve} via `ServeOptions.authenticate` to\n * require credentials on every incoming request. The supported mechanisms\n * match the storyboard security baseline:\n *\n * - `verifyApiKey({ verify })` — static or dynamic API-key lookup.\n * - `verifyBearer({ jwksUri, issuer, audience })` — OAuth 2.0 bearer JWT\n *   validation against a JWKS endpoint. Use this when your IdP issues\n *   signed JWTs (WorkOS, Auth0, Clerk, Okta, etc.).\n * - `anyOf(a, b, ...)` — pass if any sub-authenticator succeeds. The\n *   canonical way to accept \"API key OR OAuth\".\n *\n * On failure, the {@link respondUnauthorized} helper produces an RFC 6750\n * compliant 401 (or 403) with a `WWW-Authenticate` header — required for\n * compliance and what the storyboard runner probes for.\n *\n * **Audience binding is not optional.** `verifyBearer` requires an `audience`\n * and rejects tokens whose `aud` claim doesn't match — this is what stops\n * same-tenant tokens from being replayed against any agent that shares the\n * tenant. If you write a CUSTOM `authenticate` callback (instead of using\n * `verifyBearer`), you MUST validate `aud` yourself against your canonical\n * public URL. IdPs that don't include `aud` in user tokens (some WorkOS /\n * Clerk defaults) break the model: either add `aud` at mint time via a\n * custom claim, or pick a different IdP configuration. Signature + expiry\n * + scope alone is not per-resource isolation.\n */\nimport type { IncomingMessage, ServerResponse } from 'http';\nimport { createHash } from 'node:crypto';\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload, type JWTVerifyOptions } from 'jose';\nimport type { RequestSignatureErrorCode } from '../signing/errors';\nimport { RequestSignatureError } from '../signing/errors';\nimport type { AdcpCredential } from './decisioning/buyer-agent';\n\n/**\n * Hash an api-key bearer token into a stable opaque identifier suitable\n * for `credential.key_id`. The raw token MUST NOT appear on the credential\n * — anything reading `credential.key_id` (handlers, `accounts.resolve`,\n * `BuyerAgentRegistry.resolveByCredential`, log lines that flow through\n * `details.reason`) would otherwise leak the secret.\n *\n * SHA-256 truncated to 32 hex chars (128 bits): collision-resistant\n * enough for an opaque correlator, short enough to be readable in logs.\n * Adopters who want full-hash or full-token forms wire their own\n * authenticator and stamp the `credential` directly.\n */\nfunction hashApiKeyToken(token: string): string {\n  return createHash('sha256').update(token).digest('hex').slice(0, 32);\n}\n\n/**\n * Default JWT algorithm allowlist. Asymmetric only — HS-family is intentionally\n * excluded to prevent algorithm-confusion attacks where a JWKS public key is\n * used as an HMAC secret. Callers can override via {@link VerifyBearerOptions.jwtOptions}.\n */\nexport const DEFAULT_JWT_ALGORITHMS = Object.freeze([\n  'RS256',\n  'RS384',\n  'RS512',\n  'ES256',\n  'ES384',\n  'PS256',\n  'PS384',\n  'EdDSA',\n]);\n\n/** Default `exp`/`nbf` tolerance to reduce flakes under minor clock drift. */\nexport const DEFAULT_JWT_CLOCK_TOLERANCE_SECONDS = 30;\n\n/**\n * Successful authentication result. Attach whatever claims you want —\n * `principal` is recommended (an opaque identifier for who's calling).\n */\nexport interface AuthPrincipal {\n  principal: string;\n  /** Raw credential that authenticated the request. Propagated into `req.auth.token` for MCP tool handlers. */\n  token?: string;\n  scopes?: string[];\n  /**\n   * Parsed identity claims. Source depends on the authenticator:\n   * - {@link verifyBearer} populates the decoded JWT payload (RFC 7519).\n   * - {@link verifyIntrospection} populates the RFC 7662 introspection response\n   *   — same shape for the overlap fields (`iss`, `sub`, `aud`, `exp`, `iat`,\n   *   `nbf`, `jti`), plus introspection-only fields (`active`, `client_id`,\n   *   `username`, `scope`, `token_type`) typed as `unknown` via the index\n   *   signature. Narrow with a type guard before passing to an LLM context —\n   *   an upstream IdP that controls `sub`, `username`, `client_id`, or\n   *   `scope` can inject prompt content if those values reach a model\n   *   unvalidated (adapters often reflect granted scopes into UI / system\n   *   prompts, so the scope string is a real injection surface).\n   */\n  claims?: JWTPayload;\n  /** Token expiry (seconds since epoch) when known — propagated to MCP `AuthInfo.expiresAt`. */\n  expiresAt?: number;\n  /**\n   * Kind-discriminated credential variant — Phase 1 Stage 3 of #1269.\n   *\n   * Built-in authenticators stamp this:\n   * - {@link verifyApiKey} → `{ kind: 'api_key', key_id }`\n   * - {@link verifyBearer} → `{ kind: 'oauth', client_id, scopes, expires_at }`\n   * - {@link verifySignatureAsAuthenticator} → `{ kind: 'http_sig', keyid, agent_url, verified_at }`\n   *\n   * `serve()` propagates this into `req.auth.extra.credential`, where the\n   * dispatcher hoists it onto `ctx.authInfo.credential` for adopter\n   * `resolveAccount` callbacks AND for the `BuyerAgentRegistry.resolve`\n   * call. Adopters with custom `authenticate` functions can populate this\n   * directly to opt into the discriminated-credential surface; otherwise\n   * `BuyerAgentRegistry` factories return `null` (no credential = no\n   * known agent) and the framework's request flow is unchanged.\n   *\n   * The `http_sig.agent_url` is cryptographically verified (the verifier\n   * derives it from the `agents[]` entry whose `jwks_uri` resolved the\n   * `keyid` per adcontextprotocol/adcp#3831). Security-relevant decisions\n   * MUST read it from this variant, not from any informational field\n   * elsewhere on the request.\n   */\n  credential?: AdcpCredential;\n  /**\n   * Adopter-provided extension data. Stamp this in your `verifyApiKey.verify`\n   * callback (or any custom `authenticate` function) to carry pre-hash data\n   * derived from the raw token — prefix patterns, tenant IDs, test-kit flags —\n   * that you can't recover from the hashed `key_id` in `credential`.\n   *\n   * `serve()` propagates this into `req.auth.extra` and from there to\n   * `BuyerAgentResolveInput.extra`, where `BuyerAgentRegistry.bearerOnly` and\n   * `mixed` factories forward it as the second argument to `resolveByCredential`.\n   *\n   * Do NOT put raw token values, passwords, or other secrets here. Treat it\n   * with the same care as `credential` fields — avoid logging, and never\n   * include in thrown `Error` messages (the framework may project\n   * `err.message` into `error.details.reason` on the wire).\n   *\n   * @example\n   * ```ts\n   * verifyApiKey({\n   *   verify: token => {\n   *     if (!DEMO_PATTERN.test(token)) return null;\n   *     return { principal: `static:demo:${token}`, extra: { demo_token: token } };\n   *   },\n   * })\n   * // Then in bearerOnly:\n   * BuyerAgentRegistry.bearerOnly({\n   *   resolveByCredential: (cred, extra) => {\n   *     const token = extra?.demo_token as string | undefined;\n   *     return token?.startsWith('demo-billing-passthrough-')\n   *       ? Promise.resolve(demoAgent)\n   *       : Promise.resolve(null);\n   *   },\n   * })\n   * ```\n   */\n  extra?: Record<string, unknown>;\n  [key: string]: unknown;\n}\n\n/**\n * Outcome of a single authenticator. Return `null` for \"did not match\" so\n * combinators like {@link anyOf} can move on to the next authenticator.\n * Throw for \"definitely unauthorized\" (e.g., a valid JWT that failed\n * audience validation) so callers can distinguish from \"no credentials\".\n */\nexport type AuthResult = AuthPrincipal | null;\n\n/**\n * Authentication middleware applied before the MCP transport handles a request.\n * Receives the raw Node request so it can read the Authorization header or\n * a query parameter, as needed.\n */\nexport type Authenticator = (req: IncomingMessage) => AuthResult | Promise<AuthResult>;\n\n/**\n * Error class signalling \"credentials presented but rejected\". Carries a\n * sanitized public `message` safe to surface to clients and a `cause` with\n * the underlying implementation error for server-side logs. `serve()` uses\n * this to avoid leaking library-internal messages (e.g. expected `aud` values\n * from `jose`) into `WWW-Authenticate` / response bodies.\n */\nexport class AuthError extends Error {\n  readonly publicMessage: string;\n  constructor(publicMessage: string, options?: { cause?: unknown }) {\n    super(publicMessage);\n    this.name = 'AuthError';\n    this.publicMessage = publicMessage;\n    if (options?.cause !== undefined) (this as Error & { cause?: unknown }).cause = options.cause;\n  }\n}\n\n/**\n * Marker tag on an {@link Authenticator} that needs `req.rawBody` to be\n * populated before it runs. `serve()` buffers the request body ahead of\n * authentication when any wired authenticator carries this tag — RFC 9421\n * signature verifiers need the raw bytes to recompute `Content-Digest`.\n *\n * Attach via {@link tagAuthenticatorNeedsRawBody}; {@link anyOf} propagates\n * the tag when any wrapped authenticator carries it.\n */\nexport const AUTH_NEEDS_RAW_BODY: unique symbol = Symbol.for('@adcp/client.auth.needsRawBody');\n\n/**\n * Marker tag on an {@link Authenticator} whose contract depends on being the\n * sole path for some class of requests — wrapping it in {@link anyOf} would\n * reintroduce an either-or fall-through that the gate was built to prevent.\n *\n * Currently carried by the authenticator returned from\n * `requireSignatureWhenPresent`, which guarantees \"if `Signature-Input` is\n * present, the signature path is the ONLY outcome.\" Composing it under\n * `anyOf` would let a valid bearer silently accept an invalid signature —\n * the exact bug the helper closes. `anyOf` throws at composition time when\n * any child is tagged.\n */\nexport const AUTH_PRESENCE_GATED: unique symbol = Symbol.for('@adcp/client.auth.presenceGated');\n\n/**\n * Request-scoped context that {@link serve} stamps on the incoming request\n * before the authenticator runs. Authenticator callbacks read this via\n * {@link getServeRequestContext} so they inherit `serve()`'s host\n * resolution (which honors `trustForwardedHost`) instead of re-reading\n * headers that may be attacker-controlled.\n */\nexport const ADCP_SERVE_REQUEST_CONTEXT: unique symbol = Symbol.for('@adcp/client.auth.serveRequestContext');\n\n/**\n * Per-request context exposed to the `verifyBearer` audience callback.\n * Authoritative host + resolved publicUrl come from `serve()` — the\n * callback MUST NOT reach past this object to read `X-Forwarded-Host`\n * itself, or it will diverge from the advertised OAuth `resource` and\n * let a spoofed header flip the audience check.\n */\nexport interface ServeRequestContext {\n  /** Canonical host for the request as resolved by `serve()`. Lowercased, port preserved. */\n  host: string;\n  /** Resolved `publicUrl` for this host (if configured). Undefined in single-host mode with no publicUrl. */\n  publicUrl?: string;\n}\n\n/** Read the serve()-populated context off a request. Returns `undefined` when the request didn't come through `serve()`. */\nexport function getServeRequestContext(req: IncomingMessage): ServeRequestContext | undefined {\n  return (req as IncomingMessage & { [ADCP_SERVE_REQUEST_CONTEXT]?: ServeRequestContext })[ADCP_SERVE_REQUEST_CONTEXT];\n}\n\ninterface AuthenticatorFlags {\n  [AUTH_NEEDS_RAW_BODY]?: boolean;\n  [AUTH_PRESENCE_GATED]?: boolean;\n}\n\n/**\n * Mark an authenticator as needing `req.rawBody`. Safe to call more than once.\n */\nexport function tagAuthenticatorNeedsRawBody(auth: Authenticator): Authenticator {\n  (auth as unknown as AuthenticatorFlags)[AUTH_NEEDS_RAW_BODY] = true;\n  return auth;\n}\n\n/**\n * Check whether an authenticator (possibly composed via {@link anyOf}) requires\n * the raw request body to be buffered before invocation.\n */\nexport function authenticatorNeedsRawBody(auth: Authenticator | undefined): boolean {\n  return !!auth && (auth as unknown as AuthenticatorFlags)[AUTH_NEEDS_RAW_BODY] === true;\n}\n\n/**\n * Mark an authenticator as presence-gated. {@link anyOf} refuses to wrap a\n * tagged authenticator — wrapping would defeat the gate.\n */\nexport function tagAuthenticatorPresenceGated(auth: Authenticator): Authenticator {\n  (auth as unknown as AuthenticatorFlags)[AUTH_PRESENCE_GATED] = true;\n  return auth;\n}\n\n/**\n * Check whether an authenticator is presence-gated (see {@link AUTH_PRESENCE_GATED}).\n */\nexport function isAuthenticatorPresenceGated(auth: Authenticator | undefined): boolean {\n  return !!auth && (auth as unknown as AuthenticatorFlags)[AUTH_PRESENCE_GATED] === true;\n}\n\n// ---------------------------------------------------------------------------\n// Token extraction\n// ---------------------------------------------------------------------------\n\n/**\n * Extract a bearer token from the request. Checks the `Authorization` header\n * first (`Bearer <token>`), then the legacy `x-adcp-auth` header our older\n * clients use.\n */\nexport function extractBearerToken(req: IncomingMessage): string | null {\n  const auth = req.headers.authorization;\n  if (auth && auth.length > 7 && auth.slice(0, 6).toLowerCase() === 'bearer') {\n    // Require at least one whitespace byte between scheme and token — avoids\n    // backtracking-prone regexes on attacker-controlled header values.\n    const sep = auth.charCodeAt(6);\n    if (sep === 0x20 || sep === 0x09) {\n      const token = auth.slice(7).trim();\n      if (token.length > 0) return token;\n    }\n  }\n  const legacy = req.headers['x-adcp-auth'];\n  if (typeof legacy === 'string' && legacy.length > 0) return legacy;\n  return null;\n}\n\n// ---------------------------------------------------------------------------\n// API-key authenticator\n// ---------------------------------------------------------------------------\n\nexport interface VerifyApiKeyOptions {\n  /**\n   * Static map of API keys to the principal they represent. Handy for\n   * single-tenant agents or local development.\n   */\n  keys?: Record<string, AuthPrincipal>;\n  /**\n   * Dynamic verifier for keys that live in a database or secret store.\n   * Return `null` for \"not my key\" (falls through to other authenticators),\n   * or a principal to accept.\n   */\n  verify?: (token: string) => Promise<AuthResult> | AuthResult;\n}\n\n/**\n * Build an API-key authenticator. Accepts a static map and/or a dynamic\n * verifier; if both are provided, the static map is checked first.\n *\n * ```ts\n * serve(createAgent, {\n *   authenticate: verifyApiKey({\n *     keys: { 'sk_live_abc': { principal: 'acct_42' } },\n *     verify: async token => db.lookupKey(token),\n *   }),\n * });\n * ```\n */\nexport function verifyApiKey(options: VerifyApiKeyOptions): Authenticator {\n  if (!options.keys && !options.verify) {\n    throw new Error('verifyApiKey: provide at least one of `keys` or `verify`.');\n  }\n  return async req => {\n    const token = extractBearerToken(req);\n    if (!token) return null;\n    // ALWAYS stamp an api_key credential — adopter-provided credentials\n    // on the matched principal are NOT honored here. Allowing an api-key\n    // entry to claim `credential: { kind: 'http_sig', ... }` would let\n    // an adopter (or attacker who can write the keys map) forge signed-\n    // path identity — `signingOnly` and `mixed` registry factories would\n    // route the request as if it were verifier-attested. The api-key\n    // path has no signature proof, so the credential MUST be `api_key`\n    // regardless of what the matched record carries. Same posture for\n    // the dynamic `verify` path below.\n    //\n    // `key_id` is a SHA-256 hash prefix of the raw token, not the token\n    // itself — `credential.key_id` flows broadly through `ctx.authInfo`,\n    // handlers, and downstream code that may log structured context.\n    // Adopters with custom api-key authenticators that need a different\n    // `key_id` shape stamp their own credential and skip this path.\n    const apiKeyCredential: AdcpCredential = { kind: 'api_key', key_id: hashApiKeyToken(token) };\n    if (options.keys && Object.prototype.hasOwnProperty.call(options.keys, token)) {\n      const matched = options.keys[token]!;\n      return {\n        ...matched,\n        token,\n        credential: apiKeyCredential,\n      };\n    }\n    if (options.verify) {\n      const result = await options.verify(token);\n      if (!result) return null;\n      return {\n        ...result,\n        token: result.token ?? token,\n        credential: apiKeyCredential,\n      };\n    }\n    return null;\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Bearer / JWT authenticator\n// ---------------------------------------------------------------------------\n\nexport interface VerifyBearerOptions {\n  /** JWKS URI — usually `<issuer>/.well-known/jwks.json`. */\n  jwksUri: string;\n  /** Expected `iss` claim. */\n  issuer: string;\n  /**\n   * Expected `aud` claim — the canonical URL clients see for this MCP\n   * endpoint (e.g., `https://my-agent.example.com/mcp`). MUST match what\n   * the token was issued for. If you advertise via\n   * {@link ServeOptions.protectedResource}, set this to the same URL.\n   *\n   * For multi-host deployments pass a function. The two-argument form\n   * receives `(req, ctx)` where `ctx.host` and `ctx.publicUrl` come from\n   * `serve()`'s host resolution — inheriting the same\n   * `trustForwardedHost` policy that governs the advertised PRM. Prefer\n   * `(_req, { publicUrl }) => publicUrl!` so the JWT audience check and\n   * the RFC 9728 `resource` URL can never diverge; a callback that reads\n   * `X-Forwarded-Host` directly is a footgun when `trustForwardedHost`\n   * is off.\n   *\n   * The single-argument form `(req) => string` still works for agents\n   * mounting `verifyBearer` outside `serve()` (e.g., under\n   * `createExpressAdapter`), but inherits none of `serve()`'s header\n   * hardening — you MUST validate audience inputs yourself.\n   */\n  audience: string | ((req: IncomingMessage) => string) | ((req: IncomingMessage, ctx: ServeRequestContext) => string);\n  /** Optional: required scopes (all must be present in the `scope` / `scp` claim). */\n  requiredScopes?: string[];\n  /**\n   * Optional: JWT verification options passthrough. Defaults to the secure\n   * asymmetric-only algorithm allowlist and a 30s clock tolerance — override\n   * only if you know why. HS256/HS384/HS512 are rejected by default to prevent\n   * algorithm-confusion attacks against the JWKS.\n   */\n  jwtOptions?: Omit<JWTVerifyOptions, 'issuer' | 'audience'>;\n}\n\n/**\n * Build a JWT bearer authenticator that validates tokens against a JWKS.\n *\n * Uses the `jose` library (already in the dependency tree). Audience and\n * issuer are enforced strictly — a token minted for the wrong audience\n * is rejected, which is the bug pattern we've seen in the wild when an\n * agent advertises an incorrect `/.well-known/oauth-protected-resource`\n * `resource` URL.\n *\n * ```ts\n * serve(createAgent, {\n *   authenticate: verifyBearer({\n *     jwksUri: 'https://auth.example/.well-known/jwks.json',\n *     issuer: 'https://auth.example',\n *     audience: 'https://my-agent.example.com/mcp',\n *   }),\n * });\n * ```\n */\nexport function verifyBearer(options: VerifyBearerOptions): Authenticator {\n  const jwks = createRemoteJWKSet(new URL(options.jwksUri));\n  const audienceIsFn = typeof options.audience === 'function';\n  const baseVerifyOptions: Omit<JWTVerifyOptions, 'audience'> = {\n    algorithms: DEFAULT_JWT_ALGORITHMS.slice(),\n    clockTolerance: DEFAULT_JWT_CLOCK_TOLERANCE_SECONDS,\n    ...options.jwtOptions,\n    issuer: options.issuer,\n  };\n  const staticVerifyOptions: JWTVerifyOptions | undefined = audienceIsFn\n    ? undefined\n    : { ...baseVerifyOptions, audience: options.audience as string };\n  return async req => {\n    const token = extractBearerToken(req);\n    if (!token) return null;\n    let payload: JWTPayload;\n    let verifyOptions: JWTVerifyOptions;\n    if (audienceIsFn) {\n      let audience: string;\n      try {\n        // Pass the serve()-resolved context as the second argument. The\n        // callback can use `ctx.publicUrl` (preferred — it's the same URL\n        // the RFC 9728 PRM advertises) or `ctx.host` for its own\n        // reconstruction. Falls back to an empty-host ctx when the\n        // authenticator is mounted outside `serve()`, so callbacks must\n        // still tolerate `host === ''`.\n        const ctx: ServeRequestContext = getServeRequestContext(req) ?? { host: '' };\n        audience = (options.audience as (r: IncomingMessage, c: ServeRequestContext) => string)(req, ctx);\n      } catch (err) {\n        // Resolver threw — surface as auth failure rather than 500 so the\n        // client sees a clean 401 and the operator sees the cause in the log.\n        throw new AuthError('Token validation failed.', { cause: err });\n      }\n      verifyOptions = { ...baseVerifyOptions, audience };\n    } else {\n      verifyOptions = staticVerifyOptions as JWTVerifyOptions;\n    }\n    try {\n      ({ payload } = await jwtVerify(token, jwks, verifyOptions));\n    } catch (err) {\n      // Never surface jose's message to the client — it echoes expected audience,\n      // issuer, or token-shape details that probing attackers can use.\n      throw new AuthError('Token validation failed.', { cause: err });\n    }\n    const scopes = extractScopes(payload);\n    if (options.requiredScopes?.length) {\n      const missing = options.requiredScopes.filter(s => !scopes.includes(s));\n      if (missing.length > 0) {\n        throw new AuthError('Insufficient scope.', {\n          cause: new Error(`Missing required scope(s): ${missing.join(', ')}`),\n        });\n      }\n    }\n    // Prefer `payload.client_id` over `payload.sub` per RFC 9068 §2.2:\n    // `sub` is the resource-owner subject (often the user); `client_id`\n    // is the OAuth client identity (the buyer agent for AdCP traffic).\n    // For the client-credentials grant where `sub === client_id` both\n    // resolve to the same value; for authorization-code flows where\n    // `sub` is a user, falling back to `sub` would mis-route registry\n    // lookups keyed by client identity.\n    //\n    // When neither is a usable string, omit the `credential` entirely\n    // — `BuyerAgentRegistry` sees `null` (no credential = no known\n    // agent) instead of bucketing every unauthenticated principal into\n    // a single `'unknown'` row.\n    const clientIdFromPayload =\n      typeof payload.client_id === 'string' && payload.client_id.length > 0\n        ? payload.client_id\n        : typeof payload.sub === 'string' && payload.sub.length > 0\n          ? payload.sub\n          : undefined;\n    const principal: AuthPrincipal = {\n      principal: clientIdFromPayload ?? 'unknown',\n      token,\n      scopes,\n      claims: payload,\n      ...(clientIdFromPayload !== undefined && {\n        credential: {\n          kind: 'oauth' as const,\n          client_id: clientIdFromPayload,\n          scopes,\n          ...(typeof payload.exp === 'number' && { expires_at: payload.exp }),\n        },\n      }),\n    };\n    if (typeof payload.exp === 'number') principal.expiresAt = payload.exp;\n    return principal;\n  };\n}\n\n/**\n * Extract scopes from a JWT payload. Handles both RFC 8693 `scope` (string,\n * space-delimited) and RFC 9068 / Azure AD / Okta `scp` (string or string[]).\n */\nfunction extractScopes(payload: JWTPayload): string[] {\n  const out: string[] = [];\n  if (typeof payload.scope === 'string') {\n    out.push(...payload.scope.split(/\\s+/).filter(Boolean));\n  } else if (Array.isArray(payload.scope)) {\n    out.push(...(payload.scope as unknown[]).filter((s): s is string => typeof s === 'string'));\n  }\n  const scp = (payload as JWTPayload & { scp?: unknown }).scp;\n  if (typeof scp === 'string') {\n    out.push(...scp.split(/\\s+/).filter(Boolean));\n  } else if (Array.isArray(scp)) {\n    out.push(...scp.filter((s): s is string => typeof s === 'string'));\n  }\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// Combinators\n// ---------------------------------------------------------------------------\n\n/**\n * Pass if any authenticator succeeds. A `null` from one falls through to the\n * next; a thrown error short-circuits to 401 (credentials were presented but\n * rejected — not a \"no credentials\" case). Errors are wrapped in an\n * {@link AuthError} with a generic public message so the client can't tell\n * which mechanism rejected them.\n */\nexport function anyOf(...authenticators: Authenticator[]): Authenticator {\n  for (const auth of authenticators) {\n    if (isAuthenticatorPresenceGated(auth)) {\n      throw new Error(\n        'anyOf: refusing to wrap a presence-gated authenticator. Wrapping would ' +\n          'reintroduce the bearer-bypass bug the gate was built to prevent. ' +\n          'Invert the composition: requireSignatureWhenPresent(sig, anyOf(...others)).'\n      );\n    }\n  }\n  const combined: Authenticator = async req => {\n    let rejected = false;\n    const causes: unknown[] = [];\n    for (const auth of authenticators) {\n      try {\n        const result = await auth(req);\n        if (result) return result;\n      } catch (err) {\n        rejected = true;\n        causes.push(err);\n      }\n    }\n    if (rejected) {\n      throw new AuthError('Credentials rejected.', { cause: causes });\n    }\n    return null;\n  };\n  if (authenticators.some(a => authenticatorNeedsRawBody(a))) {\n    tagAuthenticatorNeedsRawBody(combined);\n  }\n  return combined;\n}\n\n// ---------------------------------------------------------------------------\n// 401 / 403 response helper\n// ---------------------------------------------------------------------------\n\nexport interface RespondUnauthorizedOptions {\n  /**\n   * Bearer realm value. Defaults to `\"mcp\"` — a stable value that won't reflect\n   * an attacker-controlled `Host` header into the challenge.\n   */\n  realm?: string;\n  /** RFC 6750 error code. Defaults to `invalid_token`. */\n  error?: 'invalid_request' | 'invalid_token' | 'insufficient_scope';\n  /** Human-readable description. */\n  errorDescription?: string;\n  /**\n   * OAuth 2.0 resource URL (RFC 9728). If set, included in the challenge so\n   * clients can discover the auth server from the protected-resource metadata.\n   */\n  resourceMetadata?: string;\n  /** Set to 403 instead of 401 for valid-but-unauthorized scenarios. */\n  status?: 401 | 403;\n  /**\n   * RFC 9421 signature error code. When set, the challenge scheme switches\n   * from `Bearer` to `Signature` and the body's `error` field carries the\n   * signature code verbatim — what the `signed_requests` conformance grader\n   * reads from `WWW-Authenticate` to decide pass/fail on negative vectors.\n   *\n   * Set this whenever the rejection is a signature-layer failure (invalid\n   * signature, missing required signature, revoked key, replayed nonce,\n   * etc.). `serve()` auto-detects this from an {@link AuthError} whose\n   * `cause` is a {@link RequestSignatureError}; callers rarely set it\n   * directly.\n   */\n  signatureError?: RequestSignatureErrorCode;\n}\n\n/**\n * Send an RFC 6750-compliant 401/403 response with the `WWW-Authenticate`\n * header set. Called automatically by {@link serve} when `authenticate`\n * returns `null` or throws.\n *\n * When {@link RespondUnauthorizedOptions.signatureError} is set, the\n * challenge scheme becomes `Signature` (per the `signed-requests`\n * specialism) and the body's `error` field carries the RFC 9421 error\n * code — the `signed_requests` grader reads both from the challenge.\n */\nexport function respondUnauthorized(\n  _req: IncomingMessage,\n  res: ServerResponse,\n  options: RespondUnauthorizedOptions = {}\n): void {\n  const realm = options.realm ?? 'mcp';\n  const parts = [`realm=\"${escapeQuotes(realm)}\"`];\n  const useSignatureChallenge = options.signatureError !== undefined;\n  // The `error` codes are typed unions — the type system gives us the\n  // only quote-safe guarantee. Route through `escapeQuotes` so a future\n  // widening to `string` or a code that happens to include `\"` doesn't\n  // inject a new parameter into the challenge header.\n  if (useSignatureChallenge) {\n    parts.push(`error=\"${escapeQuotes(options.signatureError!)}\"`);\n  } else if (options.error) {\n    parts.push(`error=\"${escapeQuotes(options.error)}\"`);\n  }\n  if (options.errorDescription) parts.push(`error_description=\"${escapeQuotes(options.errorDescription)}\"`);\n  if (options.resourceMetadata) parts.push(`resource_metadata=\"${escapeQuotes(options.resourceMetadata)}\"`);\n\n  const scheme = useSignatureChallenge ? 'Signature' : 'Bearer';\n  res.writeHead(options.status ?? 401, {\n    'Content-Type': 'application/json',\n    'WWW-Authenticate': `${scheme} ${parts.join(', ')}`,\n  });\n  res.end(\n    JSON.stringify({\n      error: useSignatureChallenge ? options.signatureError : (options.error ?? 'unauthorized'),\n      error_description: options.errorDescription ?? 'Authentication required.',\n    })\n  );\n}\n\n/**\n * Unwrap the first {@link RequestSignatureError} found walking the\n * `cause` chain of an {@link AuthError} (or any error), so callers can\n * switch the `WWW-Authenticate` challenge scheme on signature-layer\n * failures. Returns `null` for non-signature errors.\n */\nexport function signatureErrorCodeFromCause(err: unknown): RequestSignatureErrorCode | null {\n  // Track visited refs to break arbitrary cycles (self-reference, N-cycles,\n  // or a long non-signature chain that would otherwise exhaust the walker).\n  // The visited set is a belt-and-suspenders companion to the hop cap —\n  // either one alone is enough for legitimate chains, but cycle resistance\n  // is the security-relevant property.\n  const visited = new Set<unknown>();\n  let current: unknown = err;\n  let hops = 0;\n  while (current != null && hops < 32 && !visited.has(current)) {\n    if (current instanceof RequestSignatureError) return current.code;\n    visited.add(current);\n    current = (current as { cause?: unknown }).cause;\n    hops++;\n  }\n  return null;\n}\n\nfunction escapeQuotes(s: string): string {\n  // Escape backslashes first so later-inserted escapes aren't re-escaped.\n  return s.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"');\n}\n"],"mappings":";;;;;;AA6BA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB,iBAAyD;AAEtF,SAAS,6BAA6B;AAetC,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACrE;AAOO,MAAM,yBAAyB,OAAO,OAAO;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,MAAM,sCAAsC;AA8G5C,MAAM,kBAAkB,MAAM;AAAA,EAC1B;AAAA,EACT,YAAY,eAAuB,SAA+B;AAChE,UAAM,aAAa;AACnB,SAAK,OAAO;AACZ,SAAK,gBAAgB;AACrB,QAAI,SAAS,UAAU,OAAW,CAAC,KAAqC,QAAQ,QAAQ;AAAA,EAC1F;AACF;AAWO,MAAM,sBAAqC,uBAAO,IAAI,gCAAgC;AActF,MAAM,sBAAqC,uBAAO,IAAI,iCAAiC;AASvF,MAAM,6BAA4C,uBAAO,IAAI,uCAAuC;AAiBpG,SAAS,uBAAuB,KAAuD;AAC5F,SAAQ,IAAiF,0BAA0B;AACrH;AAUO,SAAS,6BAA6B,MAAoC;AAC/E,EAAC,KAAuC,mBAAmB,IAAI;AAC/D,SAAO;AACT;AAMO,SAAS,0BAA0B,MAA0C;AAClF,SAAO,CAAC,CAAC,QAAS,KAAuC,mBAAmB,MAAM;AACpF;AAMO,SAAS,8BAA8B,MAAoC;AAChF,EAAC,KAAuC,mBAAmB,IAAI;AAC/D,SAAO;AACT;AAKO,SAAS,6BAA6B,MAA0C;AACrF,SAAO,CAAC,CAAC,QAAS,KAAuC,mBAAmB,MAAM;AACpF;AAWO,SAAS,mBAAmB,KAAqC;AACtE,QAAM,OAAO,IAAI,QAAQ;AACzB,MAAI,QAAQ,KAAK,SAAS,KAAK,KAAK,MAAM,GAAG,CAAC,EAAE,YAAY,MAAM,UAAU;AAG1E,UAAM,MAAM,KAAK,WAAW,CAAC;AAC7B,QAAI,QAAQ,MAAQ,QAAQ,GAAM;AAChC,YAAM,QAAQ,KAAK,MAAM,CAAC,EAAE,KAAK;AACjC,UAAI,MAAM,SAAS,EAAG,QAAO;AAAA,IAC/B;AAAA,EACF;AACA,QAAM,SAAS,IAAI,QAAQ,aAAa;AACxC,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,EAAG,QAAO;AAC5D,SAAO;AACT;AAiCO,SAAS,aAAa,SAA6C;AACxE,MAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAAQ;AACpC,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO,OAAM,QAAO;AAClB,UAAM,QAAQ,mBAAmB,GAAG;AACpC,QAAI,CAAC,MAAO,QAAO;AAgBnB,UAAM,mBAAmC,EAAE,MAAM,WAAW,QAAQ,gBAAgB,KAAK,EAAE;AAC3F,QAAI,QAAQ,QAAQ,OAAO,UAAU,eAAe,KAAK,QAAQ,MAAM,KAAK,GAAG;AAC7E,YAAM,UAAU,QAAQ,KAAK,KAAK;AAClC,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,QACA,YAAY;AAAA,MACd;AAAA,IACF;AACA,QAAI,QAAQ,QAAQ;AAClB,YAAM,SAAS,MAAM,QAAQ,OAAO,KAAK;AACzC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,OAAO,OAAO,SAAS;AAAA,QACvB,YAAY;AAAA,MACd;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AA8DO,SAAS,aAAa,SAA6C;AACxE,QAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,OAAO,CAAC;AACxD,QAAM,eAAe,OAAO,QAAQ,aAAa;AACjD,QAAM,oBAAwD;AAAA,IAC5D,YAAY,uBAAuB,MAAM;AAAA,IACzC,gBAAgB;AAAA,IAChB,GAAG,QAAQ;AAAA,IACX,QAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,sBAAoD,eACtD,SACA,EAAE,GAAG,mBAAmB,UAAU,QAAQ,SAAmB;AACjE,SAAO,OAAM,QAAO;AAClB,UAAM,QAAQ,mBAAmB,GAAG;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI;AACJ,QAAI;AACJ,QAAI,cAAc;AAChB,UAAI;AACJ,UAAI;AAOF,cAAM,MAA2B,uBAAuB,GAAG,KAAK,EAAE,MAAM,GAAG;AAC3E,mBAAY,QAAQ,SAAoE,KAAK,GAAG;AAAA,MAClG,SAAS,KAAK;AAGZ,cAAM,IAAI,UAAU,4BAA4B,EAAE,OAAO,IAAI,CAAC;AAAA,MAChE;AACA,sBAAgB,EAAE,GAAG,mBAAmB,SAAS;AAAA,IACnD,OAAO;AACL,sBAAgB;AAAA,IAClB;AACA,QAAI;AACF,OAAC,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM,aAAa;AAAA,IAC3D,SAAS,KAAK;AAGZ,YAAM,IAAI,UAAU,4BAA4B,EAAE,OAAO,IAAI,CAAC;AAAA,IAChE;AACA,UAAM,SAAS,cAAc,OAAO;AACpC,QAAI,QAAQ,gBAAgB,QAAQ;AAClC,YAAM,UAAU,QAAQ,eAAe,OAAO,OAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AACtE,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM,IAAI,UAAU,uBAAuB;AAAA,UACzC,OAAO,IAAI,MAAM,8BAA8B,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,QACrE,CAAC;AAAA,MACH;AAAA,IACF;AAaA,UAAM,sBACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,SAAS,IAChE,QAAQ,YACR,OAAO,QAAQ,QAAQ,YAAY,QAAQ,IAAI,SAAS,IACtD,QAAQ,MACR;AACR,UAAM,YAA2B;AAAA,MAC/B,WAAW,uBAAuB;AAAA,MAClC;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,GAAI,wBAAwB,UAAa;AAAA,QACvC,YAAY;AAAA,UACV,MAAM;AAAA,UACN,WAAW;AAAA,UACX;AAAA,UACA,GAAI,OAAO,QAAQ,QAAQ,YAAY,EAAE,YAAY,QAAQ,IAAI;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,QAAQ,QAAQ,SAAU,WAAU,YAAY,QAAQ;AACnE,WAAO;AAAA,EACT;AACF;AAMA,SAAS,cAAc,SAA+B;AACpD,QAAM,MAAgB,CAAC;AACvB,MAAI,OAAO,QAAQ,UAAU,UAAU;AACrC,QAAI,KAAK,GAAG,QAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,EACxD,WAAW,MAAM,QAAQ,QAAQ,KAAK,GAAG;AACvC,QAAI,KAAK,GAAI,QAAQ,MAAoB,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,CAAC;AAAA,EAC5F;AACA,QAAM,MAAO,QAA2C;AACxD,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,EAC9C,WAAW,MAAM,QAAQ,GAAG,GAAG;AAC7B,QAAI,KAAK,GAAG,IAAI,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,CAAC;AAAA,EACnE;AACA,SAAO;AACT;AAaO,SAAS,SAAS,gBAAgD;AACvE,aAAW,QAAQ,gBAAgB;AACjC,QAAI,6BAA6B,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAA0B,OAAM,QAAO;AAC3C,QAAI,WAAW;AACf,UAAM,SAAoB,CAAC;AAC3B,eAAW,QAAQ,gBAAgB;AACjC,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,GAAG;AAC7B,YAAI,OAAQ,QAAO;AAAA,MACrB,SAAS,KAAK;AACZ,mBAAW;AACX,eAAO,KAAK,GAAG;AAAA,MACjB;AAAA,IACF;AACA,QAAI,UAAU;AACZ,YAAM,IAAI,UAAU,yBAAyB,EAAE,OAAO,OAAO,CAAC;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AACA,MAAI,eAAe,KAAK,OAAK,0BAA0B,CAAC,CAAC,GAAG;AAC1D,iCAA6B,QAAQ;AAAA,EACvC;AACA,SAAO;AACT;AAgDO,SAAS,oBACd,MACA,KACA,UAAsC,CAAC,GACjC;AACN,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,QAAQ,CAAC,UAAU,aAAa,KAAK,CAAC,GAAG;AAC/C,QAAM,wBAAwB,QAAQ,mBAAmB;AAKzD,MAAI,uBAAuB;AACzB,UAAM,KAAK,UAAU,aAAa,QAAQ,cAAe,CAAC,GAAG;AAAA,EAC/D,WAAW,QAAQ,OAAO;AACxB,UAAM,KAAK,UAAU,aAAa,QAAQ,KAAK,CAAC,GAAG;AAAA,EACrD;AACA,MAAI,QAAQ,iBAAkB,OAAM,KAAK,sBAAsB,aAAa,QAAQ,gBAAgB,CAAC,GAAG;AACxG,MAAI,QAAQ,iBAAkB,OAAM,KAAK,sBAAsB,aAAa,QAAQ,gBAAgB,CAAC,GAAG;AAExG,QAAM,SAAS,wBAAwB,cAAc;AACrD,MAAI,UAAU,QAAQ,UAAU,KAAK;AAAA,IACnC,gBAAgB;AAAA,IAChB,oBAAoB,GAAG,MAAM,IAAI,MAAM,KAAK,IAAI,CAAC;AAAA,EACnD,CAAC;AACD,MAAI;AAAA,IACF,KAAK,UAAU;AAAA,MACb,OAAO,wBAAwB,QAAQ,iBAAkB,QAAQ,SAAS;AAAA,MAC1E,mBAAmB,QAAQ,oBAAoB;AAAA,IACjD,CAAC;AAAA,EACH;AACF;AAQO,SAAS,4BAA4B,KAAgD;AAM1F,QAAM,UAAU,oBAAI,IAAa;AACjC,MAAI,UAAmB;AACvB,MAAI,OAAO;AACX,SAAO,WAAW,QAAQ,OAAO,MAAM,CAAC,QAAQ,IAAI,OAAO,GAAG;AAC5D,QAAI,mBAAmB,sBAAuB,QAAO,QAAQ;AAC7D,YAAQ,IAAI,OAAO;AACnB,cAAW,QAAgC;AAC3C;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,GAAmB;AAEvC,SAAO,EAAE,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK;AACrD;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/auth.ts"],"sourcesContent":["/**\n * Server-side authentication primitives for AdCP MCP agents.\n *\n * Wire one of these into {@link serve} via `ServeOptions.authenticate` to\n * require credentials on every incoming request. The supported mechanisms\n * match the storyboard security baseline:\n *\n * - `verifyApiKey({ verify })` — static or dynamic API-key lookup.\n * - `verifyBearer({ jwksUri, issuer, audience })` — OAuth 2.0 bearer JWT\n *   validation against a JWKS endpoint. Use this when your IdP issues\n *   signed JWTs (WorkOS, Auth0, Clerk, Okta, etc.).\n * - `anyOf(a, b, ...)` — pass if any sub-authenticator succeeds. The\n *   canonical way to accept \"API key OR OAuth\".\n *\n * On failure, the {@link respondUnauthorized} helper produces an RFC 6750\n * compliant 401 (or 403) with a `WWW-Authenticate` header — required for\n * compliance and what the storyboard runner probes for.\n *\n * **Audience binding is not optional.** `verifyBearer` requires an `audience`\n * and rejects tokens whose `aud` claim doesn't match — this is what stops\n * same-tenant tokens from being replayed against any agent that shares the\n * tenant. If you write a CUSTOM `authenticate` callback (instead of using\n * `verifyBearer`), you MUST validate `aud` yourself against your canonical\n * public URL. IdPs that don't include `aud` in user tokens (some WorkOS /\n * Clerk defaults) break the model: either add `aud` at mint time via a\n * custom claim, or pick a different IdP configuration. Signature + expiry\n * + scope alone is not per-resource isolation.\n */\nimport type { IncomingMessage, ServerResponse } from 'http';\nimport { createHash } from 'node:crypto';\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload, type JWTVerifyOptions } from 'jose';\nimport type { RequestSignatureErrorCode } from '../signing/errors';\nimport { RequestSignatureError } from '../signing/errors';\nimport type { AdcpCredential } from './decisioning/buyer-agent';\n\n/**\n * Hash an api-key bearer token into a stable opaque identifier suitable\n * for `credential.key_id`. The raw token MUST NOT appear on the credential\n * — anything reading `credential.key_id` (handlers, `accounts.resolve`,\n * `BuyerAgentRegistry.resolveByCredential`, log lines that flow through\n * `details.reason`) would otherwise leak the secret.\n *\n * SHA-256 truncated to 32 hex chars (128 bits): collision-resistant\n * enough for an opaque correlator, short enough to be readable in logs.\n * Adopters who want full-hash or full-token forms wire their own\n * authenticator and stamp the `credential` directly.\n */\nfunction hashApiKeyToken(token: string): string {\n  return createHash('sha256').update(token).digest('hex').slice(0, 32);\n}\n\n/**\n * Default JWT algorithm allowlist. Asymmetric only — HS-family is intentionally\n * excluded to prevent algorithm-confusion attacks where a JWKS public key is\n * used as an HMAC secret. Callers can override via {@link VerifyBearerOptions.jwtOptions}.\n */\nexport const DEFAULT_JWT_ALGORITHMS = Object.freeze([\n  'RS256',\n  'RS384',\n  'RS512',\n  'ES256',\n  'ES384',\n  'PS256',\n  'PS384',\n  'EdDSA',\n]);\n\n/** Default `exp`/`nbf` tolerance to reduce flakes under minor clock drift. */\nexport const DEFAULT_JWT_CLOCK_TOLERANCE_SECONDS = 30;\n\n/**\n * Successful authentication result. Attach whatever claims you want —\n * `principal` is recommended (an opaque identifier for who's calling).\n */\nexport interface AuthPrincipal {\n  principal: string;\n  /** Raw credential that authenticated the request. Propagated into `req.auth.token` for MCP tool handlers. */\n  token?: string;\n  scopes?: string[];\n  /**\n   * Parsed identity claims. Source depends on the authenticator:\n   * - {@link verifyBearer} populates the decoded JWT payload (RFC 7519).\n   * - {@link verifyIntrospection} populates the RFC 7662 introspection response\n   *   — same shape for the overlap fields (`iss`, `sub`, `aud`, `exp`, `iat`,\n   *   `nbf`, `jti`), plus introspection-only fields (`active`, `client_id`,\n   *   `username`, `scope`, `token_type`) typed as `unknown` via the index\n   *   signature. Narrow with a type guard before passing to an LLM context —\n   *   an upstream IdP that controls `sub`, `username`, `client_id`, or\n   *   `scope` can inject prompt content if those values reach a model\n   *   unvalidated (adapters often reflect granted scopes into UI / system\n   *   prompts, so the scope string is a real injection surface).\n   */\n  claims?: JWTPayload;\n  /** Token expiry (seconds since epoch) when known — propagated to MCP `AuthInfo.expiresAt`. */\n  expiresAt?: number;\n  /**\n   * Kind-discriminated credential variant — Phase 1 Stage 3 of #1269.\n   *\n   * Built-in authenticators stamp this:\n   * - {@link verifyApiKey} → `{ kind: 'api_key', key_id }`\n   * - {@link verifyBearer} → `{ kind: 'oauth', client_id, scopes, expires_at }`\n   * - {@link verifySignatureAsAuthenticator} → `{ kind: 'http_sig', keyid, agent_url, verified_at }`\n   *\n   * `serve()` propagates this into `req.auth.extra.credential`, where the\n   * dispatcher hoists it onto `ctx.authInfo.credential` for adopter\n   * `resolveAccount` callbacks AND for the `BuyerAgentRegistry.resolve`\n   * call. Adopters with custom `authenticate` functions can populate this\n   * directly to opt into the discriminated-credential surface; otherwise\n   * `BuyerAgentRegistry` factories return `null` (no credential = no\n   * known agent) and the framework's request flow is unchanged.\n   *\n   * The `http_sig.agent_url` is cryptographically verified (the verifier\n   * derives it from the `agents[]` entry whose `jwks_uri` resolved the\n   * `keyid` per adcontextprotocol/adcp#3831). Security-relevant decisions\n   * MUST read it from this variant, not from any informational field\n   * elsewhere on the request.\n   */\n  credential?: AdcpCredential;\n  /**\n   * Adopter-provided extension data. Stamp this in your `verifyApiKey.verify`\n   * callback (or any custom `authenticate` function) to carry pre-hash data\n   * derived from the raw token — prefix patterns, tenant IDs, test-kit flags —\n   * that you can't recover from the hashed `key_id` in `credential`.\n   *\n   * `serve()` propagates this into `req.auth.extra` and from there to\n   * `BuyerAgentResolveInput.extra`, where `BuyerAgentRegistry.bearerOnly` and\n   * `mixed` factories forward it as the second argument to `resolveByCredential`.\n   *\n   * Do NOT put raw token values, passwords, or other secrets here. Treat it\n   * with the same care as `credential` fields — avoid logging, and never\n   * include in thrown `Error` messages (the framework may project\n   * `err.message` into `error.details.reason` on the wire).\n   *\n   * @example\n   * ```ts\n   * verifyApiKey({\n   *   verify: token => {\n   *     if (!DEMO_PATTERN.test(token)) return null;\n   *     return { principal: `static:demo:${token}`, extra: { demo_token: token } };\n   *   },\n   * })\n   * // Then in bearerOnly:\n   * BuyerAgentRegistry.bearerOnly({\n   *   resolveByCredential: (cred, extra) => {\n   *     const token = extra?.demo_token as string | undefined;\n   *     return token?.startsWith('demo-billing-passthrough-')\n   *       ? Promise.resolve(demoAgent)\n   *       : Promise.resolve(null);\n   *   },\n   * })\n   * ```\n   */\n  extra?: Record<string, unknown>;\n  [key: string]: unknown;\n}\n\n/**\n * Outcome of a single authenticator. Return `null` for \"did not match\" so\n * combinators like {@link anyOf} can move on to the next authenticator.\n * Throw for \"definitely unauthorized\" (e.g., a valid JWT that failed\n * audience validation) so callers can distinguish from \"no credentials\".\n */\nexport type AuthResult = AuthPrincipal | null;\n\n/**\n * Authentication middleware applied before the MCP transport handles a request.\n * Receives the raw Node request so it can read the Authorization header or\n * a query parameter, as needed.\n */\nexport type Authenticator = (req: IncomingMessage) => AuthResult | Promise<AuthResult>;\n\n/**\n * Error class signalling \"credentials presented but rejected\". Carries a\n * sanitized public `message` safe to surface to clients and a `cause` with\n * the underlying implementation error for server-side logs. `serve()` uses\n * this to avoid leaking library-internal messages (e.g. expected `aud` values\n * from `jose`) into `WWW-Authenticate` / response bodies.\n */\nexport class AuthError extends Error {\n  readonly publicMessage: string;\n  constructor(publicMessage: string, options?: { cause?: unknown }) {\n    super(publicMessage);\n    this.name = 'AuthError';\n    this.publicMessage = publicMessage;\n    if (options?.cause !== undefined) (this as Error & { cause?: unknown }).cause = options.cause;\n  }\n}\n\n/**\n * Marker tag on an {@link Authenticator} that needs `req.rawBody` to be\n * populated before it runs. `serve()` buffers the request body ahead of\n * authentication when any wired authenticator carries this tag — RFC 9421\n * signature verifiers need the raw bytes to recompute `Content-Digest`.\n *\n * Attach via {@link tagAuthenticatorNeedsRawBody}; {@link anyOf} propagates\n * the tag when any wrapped authenticator carries it.\n */\nexport const AUTH_NEEDS_RAW_BODY: unique symbol = Symbol.for('@adcp/client.auth.needsRawBody');\n\n/**\n * Marker tag on an {@link Authenticator} whose contract depends on being the\n * sole path for some class of requests — wrapping it in {@link anyOf} would\n * reintroduce an either-or fall-through that the gate was built to prevent.\n *\n * Currently carried by the authenticator returned from\n * `requireSignatureWhenPresent`, which guarantees \"if `Signature-Input` is\n * present, the signature path is the ONLY outcome.\" Composing it under\n * `anyOf` would let a valid bearer silently accept an invalid signature —\n * the exact bug the helper closes. `anyOf` throws at composition time when\n * any child is tagged.\n */\nexport const AUTH_PRESENCE_GATED: unique symbol = Symbol.for('@adcp/client.auth.presenceGated');\n\n/**\n * Request-scoped context that {@link serve} stamps on the incoming request\n * before the authenticator runs. Authenticator callbacks read this via\n * {@link getServeRequestContext} so they inherit `serve()`'s host\n * resolution (which honors `trustForwardedHost`) instead of re-reading\n * headers that may be attacker-controlled.\n */\nexport const ADCP_SERVE_REQUEST_CONTEXT: unique symbol = Symbol.for('@adcp/client.auth.serveRequestContext');\n\n/**\n * Per-request context exposed to the `verifyBearer` audience callback.\n * Authoritative host + resolved publicUrl come from `serve()` — the\n * callback MUST NOT reach past this object to read `X-Forwarded-Host`\n * itself, or it will diverge from the advertised OAuth `resource` and\n * let a spoofed header flip the audience check.\n */\nexport interface ServeRequestContext {\n  /** Canonical host for the request as resolved by `serve()`. Lowercased, port preserved. */\n  host: string;\n  /** Resolved `publicUrl` for this host (if configured). Undefined in single-host mode with no publicUrl. */\n  publicUrl?: string;\n}\n\n/** Read the serve()-populated context off a request. Returns `undefined` when the request didn't come through `serve()`. */\nexport function getServeRequestContext(req: IncomingMessage): ServeRequestContext | undefined {\n  return (req as IncomingMessage & { [ADCP_SERVE_REQUEST_CONTEXT]?: ServeRequestContext })[ADCP_SERVE_REQUEST_CONTEXT];\n}\n\ninterface AuthenticatorFlags {\n  [AUTH_NEEDS_RAW_BODY]?: boolean;\n  [AUTH_PRESENCE_GATED]?: boolean;\n}\n\n/**\n * Mark an authenticator as needing `req.rawBody`. Safe to call more than once.\n */\nexport function tagAuthenticatorNeedsRawBody(auth: Authenticator): Authenticator {\n  (auth as unknown as AuthenticatorFlags)[AUTH_NEEDS_RAW_BODY] = true;\n  return auth;\n}\n\n/**\n * Check whether an authenticator (possibly composed via {@link anyOf}) requires\n * the raw request body to be buffered before invocation.\n */\nexport function authenticatorNeedsRawBody(auth: Authenticator | undefined): boolean {\n  return !!auth && (auth as unknown as AuthenticatorFlags)[AUTH_NEEDS_RAW_BODY] === true;\n}\n\n/**\n * Mark an authenticator as presence-gated. {@link anyOf} refuses to wrap a\n * tagged authenticator — wrapping would defeat the gate.\n */\nexport function tagAuthenticatorPresenceGated(auth: Authenticator): Authenticator {\n  (auth as unknown as AuthenticatorFlags)[AUTH_PRESENCE_GATED] = true;\n  return auth;\n}\n\n/**\n * Check whether an authenticator is presence-gated (see {@link AUTH_PRESENCE_GATED}).\n */\nexport function isAuthenticatorPresenceGated(auth: Authenticator | undefined): boolean {\n  return !!auth && (auth as unknown as AuthenticatorFlags)[AUTH_PRESENCE_GATED] === true;\n}\n\n// ---------------------------------------------------------------------------\n// Token extraction\n// ---------------------------------------------------------------------------\n\n/**\n * Extract a bearer token from the request. Checks the `Authorization` header\n * first (`Bearer <token>`), then the legacy `x-adcp-auth` header our older\n * clients use.\n */\nexport function extractBearerToken(req: IncomingMessage): string | null {\n  const auth = req.headers.authorization;\n  if (auth && auth.length > 7 && auth.slice(0, 6).toLowerCase() === 'bearer') {\n    // Require at least one whitespace byte between scheme and token — avoids\n    // backtracking-prone regexes on attacker-controlled header values.\n    const sep = auth.charCodeAt(6);\n    if (sep === 0x20 || sep === 0x09) {\n      const token = auth.slice(7).trim();\n      if (token.length > 0) return token;\n    }\n  }\n  const legacy = req.headers['x-adcp-auth'];\n  if (typeof legacy === 'string' && legacy.length > 0) return legacy;\n  return null;\n}\n\n// ---------------------------------------------------------------------------\n// API-key authenticator\n// ---------------------------------------------------------------------------\n\nexport interface VerifyApiKeyOptions {\n  /**\n   * Static map of API keys to the principal they represent. Handy for\n   * single-tenant agents or local development.\n   */\n  keys?: Record<string, AuthPrincipal>;\n  /**\n   * Dynamic verifier for keys that live in a database or secret store.\n   * Return `null` for \"not my key\" (falls through to other authenticators),\n   * or a principal to accept.\n   */\n  verify?: (token: string) => Promise<AuthResult> | AuthResult;\n}\n\n/**\n * Build an API-key authenticator. Accepts a static map and/or a dynamic\n * verifier; if both are provided, the static map is checked first.\n *\n * ```ts\n * serve(createAgent, {\n *   authenticate: verifyApiKey({\n *     keys: { 'sk_live_abc': { principal: 'acct_42' } },\n *     verify: async token => db.lookupKey(token),\n *   }),\n * });\n * ```\n */\nexport function verifyApiKey(options: VerifyApiKeyOptions): Authenticator {\n  if (!options.keys && !options.verify) {\n    throw new Error('verifyApiKey: provide at least one of `keys` or `verify`.');\n  }\n  return async req => {\n    const token = extractBearerToken(req);\n    if (!token) return null;\n    // ALWAYS stamp an api_key credential — adopter-provided credentials\n    // on the matched principal are NOT honored here. Allowing an api-key\n    // entry to claim `credential: { kind: 'http_sig', ... }` would let\n    // an adopter (or attacker who can write the keys map) forge signed-\n    // path identity — `signingOnly` and `mixed` registry factories would\n    // route the request as if it were verifier-attested. The api-key\n    // path has no signature proof, so the credential MUST be `api_key`\n    // regardless of what the matched record carries. Same posture for\n    // the dynamic `verify` path below.\n    //\n    // `key_id` is a SHA-256 hash prefix of the raw token, not the token\n    // itself — `credential.key_id` flows broadly through `ctx.authInfo`,\n    // handlers, and downstream code that may log structured context.\n    // Adopters with custom api-key authenticators that need a different\n    // `key_id` shape stamp their own credential and skip this path.\n    const apiKeyCredential: AdcpCredential = { kind: 'api_key', key_id: hashApiKeyToken(token) };\n    if (options.keys && Object.prototype.hasOwnProperty.call(options.keys, token)) {\n      const matched = options.keys[token]!;\n      return {\n        ...matched,\n        token,\n        credential: apiKeyCredential,\n      };\n    }\n    if (options.verify) {\n      const result = await options.verify(token);\n      if (!result) return null;\n      return {\n        ...result,\n        token: result.token ?? token,\n        credential: apiKeyCredential,\n      };\n    }\n    return null;\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Bearer / JWT authenticator\n// ---------------------------------------------------------------------------\n\nexport interface VerifyBearerOptions {\n  /** JWKS URI — usually `<issuer>/.well-known/jwks.json`. */\n  jwksUri: string;\n  /** Expected `iss` claim. */\n  issuer: string;\n  /**\n   * Expected `aud` claim — the canonical URL clients see for this MCP\n   * endpoint (e.g., `https://my-agent.example.com/mcp`). MUST match what\n   * the token was issued for. If you advertise via\n   * {@link ServeOptions.protectedResource}, set this to the same URL.\n   *\n   * For multi-host deployments pass a function. The two-argument form\n   * receives `(req, ctx)` where `ctx.host` and `ctx.publicUrl` come from\n   * `serve()`'s host resolution — inheriting the same\n   * `trustForwardedHost` policy that governs the advertised PRM. Prefer\n   * `(_req, { publicUrl }) => publicUrl!` so the JWT audience check and\n   * the RFC 9728 `resource` URL can never diverge; a callback that reads\n   * `X-Forwarded-Host` directly is a footgun when `trustForwardedHost`\n   * is off.\n   *\n   * The single-argument form `(req) => string` still works for agents\n   * mounting `verifyBearer` outside `serve()` (e.g., under\n   * `createExpressAdapter`), but inherits none of `serve()`'s header\n   * hardening — you MUST validate audience inputs yourself.\n   */\n  audience: string | ((req: IncomingMessage) => string) | ((req: IncomingMessage, ctx: ServeRequestContext) => string);\n  /** Optional: required scopes (all must be present in the `scope` / `scp` claim). */\n  requiredScopes?: string[];\n  /**\n   * Optional: JWT verification options passthrough. Defaults to the secure\n   * asymmetric-only algorithm allowlist and a 30s clock tolerance — override\n   * only if you know why. HS256/HS384/HS512 are rejected by default to prevent\n   * algorithm-confusion attacks against the JWKS.\n   */\n  jwtOptions?: Omit<JWTVerifyOptions, 'issuer' | 'audience'>;\n}\n\n/**\n * Build a JWT bearer authenticator that validates tokens against a JWKS.\n *\n * Uses the `jose` library (already in the dependency tree). Audience and\n * issuer are enforced strictly — a token minted for the wrong audience\n * is rejected, which is the bug pattern we've seen in the wild when an\n * agent advertises an incorrect `/.well-known/oauth-protected-resource`\n * `resource` URL.\n *\n * ```ts\n * serve(createAgent, {\n *   authenticate: verifyBearer({\n *     jwksUri: 'https://auth.example/.well-known/jwks.json',\n *     issuer: 'https://auth.example',\n *     audience: 'https://my-agent.example.com/mcp',\n *   }),\n * });\n * ```\n */\nexport function verifyBearer(options: VerifyBearerOptions): Authenticator {\n  const jwks = createRemoteJWKSet(new URL(options.jwksUri));\n  const audienceIsFn = typeof options.audience === 'function';\n  const baseVerifyOptions: Omit<JWTVerifyOptions, 'audience'> = {\n    algorithms: DEFAULT_JWT_ALGORITHMS.slice(),\n    clockTolerance: DEFAULT_JWT_CLOCK_TOLERANCE_SECONDS,\n    ...options.jwtOptions,\n    issuer: options.issuer,\n  };\n  const staticVerifyOptions: JWTVerifyOptions | undefined = audienceIsFn\n    ? undefined\n    : { ...baseVerifyOptions, audience: options.audience as string };\n  return async req => {\n    const token = extractBearerToken(req);\n    if (!token) return null;\n    let payload: JWTPayload;\n    let verifyOptions: JWTVerifyOptions;\n    if (audienceIsFn) {\n      let audience: string;\n      try {\n        // Pass the serve()-resolved context as the second argument. The\n        // callback can use `ctx.publicUrl` (preferred — it's the same URL\n        // the RFC 9728 PRM advertises) or `ctx.host` for its own\n        // reconstruction. Falls back to an empty-host ctx when the\n        // authenticator is mounted outside `serve()`, so callbacks must\n        // still tolerate `host === ''`.\n        const ctx: ServeRequestContext = getServeRequestContext(req) ?? { host: '' };\n        audience = (options.audience as (r: IncomingMessage, c: ServeRequestContext) => string)(req, ctx);\n      } catch (err) {\n        // Resolver threw — surface as auth failure rather than 500 so the\n        // client sees a clean 401 and the operator sees the cause in the log.\n        throw new AuthError('Token validation failed.', { cause: err });\n      }\n      verifyOptions = { ...baseVerifyOptions, audience };\n    } else {\n      verifyOptions = staticVerifyOptions as JWTVerifyOptions;\n    }\n    try {\n      ({ payload } = await jwtVerify(token, jwks, verifyOptions));\n    } catch (err) {\n      // Never surface jose's message to the client — it echoes expected audience,\n      // issuer, or token-shape details that probing attackers can use.\n      throw new AuthError('Token validation failed.', { cause: err });\n    }\n    const scopes = extractScopes(payload);\n    if (options.requiredScopes?.length) {\n      const missing = options.requiredScopes.filter(s => !scopes.includes(s));\n      if (missing.length > 0) {\n        throw new AuthError('Insufficient scope.', {\n          cause: new Error(`Missing required scope(s): ${missing.join(', ')}`),\n        });\n      }\n    }\n    // Prefer `payload.client_id` over `payload.sub` per RFC 9068 §2.2:\n    // `sub` is the resource-owner subject (often the user); `client_id`\n    // is the OAuth client identity (the buyer agent for AdCP traffic).\n    // For the client-credentials grant where `sub === client_id` both\n    // resolve to the same value; for authorization-code flows where\n    // `sub` is a user, falling back to `sub` would mis-route registry\n    // lookups keyed by client identity.\n    //\n    // When neither is a usable string, omit the `credential` entirely\n    // — `BuyerAgentRegistry` sees `null` (no credential = no known\n    // agent) instead of bucketing every unauthenticated principal into\n    // a single `'unknown'` row.\n    const clientIdFromPayload =\n      typeof payload.client_id === 'string' && payload.client_id.length > 0\n        ? payload.client_id\n        : typeof payload.sub === 'string' && payload.sub.length > 0\n          ? payload.sub\n          : undefined;\n    const principal: AuthPrincipal = {\n      principal: clientIdFromPayload ?? 'unknown',\n      token,\n      scopes,\n      claims: payload,\n      ...(clientIdFromPayload !== undefined && {\n        credential: {\n          kind: 'oauth' as const,\n          client_id: clientIdFromPayload,\n          scopes,\n          ...(typeof payload.exp === 'number' && { expires_at: payload.exp }),\n        },\n      }),\n    };\n    if (typeof payload.exp === 'number') principal.expiresAt = payload.exp;\n    return principal;\n  };\n}\n\n/**\n * Extract scopes from a JWT payload. Handles both RFC 8693 `scope` (string,\n * space-delimited) and RFC 9068 / Azure AD / Okta `scp` (string or string[]).\n */\nfunction extractScopes(payload: JWTPayload): string[] {\n  const out: string[] = [];\n  if (typeof payload.scope === 'string') {\n    out.push(...payload.scope.split(/\\s+/).filter(Boolean));\n  } else if (Array.isArray(payload.scope)) {\n    out.push(...(payload.scope as unknown[]).filter((s): s is string => typeof s === 'string'));\n  }\n  const scp = (payload as JWTPayload & { scp?: unknown }).scp;\n  if (typeof scp === 'string') {\n    out.push(...scp.split(/\\s+/).filter(Boolean));\n  } else if (Array.isArray(scp)) {\n    out.push(...scp.filter((s): s is string => typeof s === 'string'));\n  }\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// Combinators\n// ---------------------------------------------------------------------------\n\n/**\n * Pass if any authenticator succeeds. A `null` from one falls through to the\n * next; a thrown error short-circuits to 401 (credentials were presented but\n * rejected — not a \"no credentials\" case). Errors are wrapped in an\n * {@link AuthError} with a generic public message so the client can't tell\n * which mechanism rejected them.\n */\nexport function anyOf(...authenticators: Authenticator[]): Authenticator {\n  for (const auth of authenticators) {\n    if (isAuthenticatorPresenceGated(auth)) {\n      throw new Error(\n        'anyOf: refusing to wrap a presence-gated authenticator. Wrapping would ' +\n          'reintroduce the bearer-bypass bug the gate was built to prevent. ' +\n          'Invert the composition: requireSignatureWhenPresent(sig, anyOf(...others)).'\n      );\n    }\n  }\n  const combined: Authenticator = async req => {\n    let rejected = false;\n    const causes: unknown[] = [];\n    for (const auth of authenticators) {\n      try {\n        const result = await auth(req);\n        if (result) return result;\n      } catch (err) {\n        rejected = true;\n        causes.push(err);\n      }\n    }\n    if (rejected) {\n      throw new AuthError('Credentials rejected.', { cause: causes });\n    }\n    return null;\n  };\n  if (authenticators.some(a => authenticatorNeedsRawBody(a))) {\n    tagAuthenticatorNeedsRawBody(combined);\n  }\n  return combined;\n}\n\n// ---------------------------------------------------------------------------\n// 401 / 403 response helper\n// ---------------------------------------------------------------------------\n\nexport interface RespondUnauthorizedOptions {\n  /**\n   * Bearer realm value. Defaults to `\"mcp\"` — a stable value that won't reflect\n   * an attacker-controlled `Host` header into the challenge.\n   */\n  realm?: string;\n  /** RFC 6750 error code. Defaults to `invalid_token`. */\n  error?: 'invalid_request' | 'invalid_token' | 'insufficient_scope';\n  /** Human-readable description. */\n  errorDescription?: string;\n  /**\n   * OAuth 2.0 resource URL (RFC 9728). If set, included in the challenge so\n   * clients can discover the auth server from the protected-resource metadata.\n   */\n  resourceMetadata?: string;\n  /** Set to 403 instead of 401 for valid-but-unauthorized scenarios. */\n  status?: 401 | 403;\n  /**\n   * RFC 9421 signature error code. When set, the challenge scheme switches\n   * from `Bearer` to `Signature` and the body's `error` field carries the\n   * signature code verbatim — what the `signed_requests` conformance grader\n   * reads from `WWW-Authenticate` to decide pass/fail on negative vectors.\n   *\n   * Set this whenever the rejection is a signature-layer failure (invalid\n   * signature, missing required signature, revoked key, replayed nonce,\n   * etc.). `serve()` auto-detects this from an {@link AuthError} whose\n   * `cause` is a {@link RequestSignatureError}; callers rarely set it\n   * directly.\n   */\n  signatureError?: RequestSignatureErrorCode;\n}\n\n/**\n * Send an RFC 6750-compliant 401/403 response with the `WWW-Authenticate`\n * header set. Called automatically by {@link serve} when `authenticate`\n * returns `null` or throws.\n *\n * When {@link RespondUnauthorizedOptions.signatureError} is set, the\n * challenge scheme becomes `Signature` (per the `signed-requests`\n * specialism) and the body's `error` field carries the RFC 9421 error\n * code — the `signed_requests` grader reads both from the challenge.\n */\nexport function respondUnauthorized(\n  _req: IncomingMessage,\n  res: ServerResponse,\n  options: RespondUnauthorizedOptions = {}\n): void {\n  const realm = options.realm ?? 'mcp';\n  const parts = [`realm=\"${escapeQuotes(realm)}\"`];\n  const useSignatureChallenge = options.signatureError !== undefined;\n  // The `error` codes are typed unions — the type system gives us the\n  // only quote-safe guarantee. Route through `escapeQuotes` so a future\n  // widening to `string` or a code that happens to include `\"` doesn't\n  // inject a new parameter into the challenge header.\n  if (useSignatureChallenge) {\n    parts.push(`error=\"${escapeQuotes(options.signatureError!)}\"`);\n  } else if (options.error) {\n    parts.push(`error=\"${escapeQuotes(options.error)}\"`);\n  }\n  if (options.errorDescription) parts.push(`error_description=\"${escapeQuotes(options.errorDescription)}\"`);\n  if (options.resourceMetadata) parts.push(`resource_metadata=\"${escapeQuotes(options.resourceMetadata)}\"`);\n\n  const scheme = useSignatureChallenge ? 'Signature' : 'Bearer';\n  res.writeHead(options.status ?? 401, {\n    'Content-Type': 'application/json',\n    'WWW-Authenticate': `${scheme} ${parts.join(', ')}`,\n  });\n  res.end(\n    JSON.stringify({\n      error: useSignatureChallenge ? options.signatureError : (options.error ?? 'unauthorized'),\n      error_description: options.errorDescription ?? 'Authentication required.',\n    })\n  );\n}\n\n/**\n * Unwrap the first {@link RequestSignatureError} found walking the\n * `cause` chain of an {@link AuthError} (or any error), so callers can\n * switch the `WWW-Authenticate` challenge scheme on signature-layer\n * failures. Returns `null` for non-signature errors.\n */\nexport function signatureErrorCodeFromCause(err: unknown): RequestSignatureErrorCode | null {\n  // Track visited refs to break arbitrary cycles (self-reference, N-cycles,\n  // or a long non-signature chain that would otherwise exhaust the walker).\n  // The visited set is a belt-and-suspenders companion to the hop cap —\n  // either one alone is enough for legitimate chains, but cycle resistance\n  // is the security-relevant property.\n  const visited = new Set<unknown>();\n  let current: unknown = err;\n  let hops = 0;\n  while (current != null && hops < 32 && !visited.has(current)) {\n    if (current instanceof RequestSignatureError) return current.code;\n    visited.add(current);\n    current = (current as { cause?: unknown }).cause;\n    hops++;\n  }\n  return null;\n}\n\nfunction escapeQuotes(s: string): string {\n  // Escape backslashes first so later-inserted escapes aren't re-escaped.\n  return s.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"');\n}\n"],"mappings":"AA6BA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB,iBAAyD;AAEtF,SAAS,6BAA6B;AAetC,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACrE;AAOO,MAAM,yBAAyB,OAAO,OAAO;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,MAAM,sCAAsC;AA8G5C,MAAM,kBAAkB,MAAM;AAAA,EAC1B;AAAA,EACT,YAAY,eAAuB,SAA+B;AAChE,UAAM,aAAa;AACnB,SAAK,OAAO;AACZ,SAAK,gBAAgB;AACrB,QAAI,SAAS,UAAU,OAAW,CAAC,KAAqC,QAAQ,QAAQ;AAAA,EAC1F;AACF;AAWO,MAAM,sBAAqC,uBAAO,IAAI,gCAAgC;AActF,MAAM,sBAAqC,uBAAO,IAAI,iCAAiC;AASvF,MAAM,6BAA4C,uBAAO,IAAI,uCAAuC;AAiBpG,SAAS,uBAAuB,KAAuD;AAC5F,SAAQ,IAAiF,0BAA0B;AACrH;AAUO,SAAS,6BAA6B,MAAoC;AAC/E,EAAC,KAAuC,mBAAmB,IAAI;AAC/D,SAAO;AACT;AAMO,SAAS,0BAA0B,MAA0C;AAClF,SAAO,CAAC,CAAC,QAAS,KAAuC,mBAAmB,MAAM;AACpF;AAMO,SAAS,8BAA8B,MAAoC;AAChF,EAAC,KAAuC,mBAAmB,IAAI;AAC/D,SAAO;AACT;AAKO,SAAS,6BAA6B,MAA0C;AACrF,SAAO,CAAC,CAAC,QAAS,KAAuC,mBAAmB,MAAM;AACpF;AAWO,SAAS,mBAAmB,KAAqC;AACtE,QAAM,OAAO,IAAI,QAAQ;AACzB,MAAI,QAAQ,KAAK,SAAS,KAAK,KAAK,MAAM,GAAG,CAAC,EAAE,YAAY,MAAM,UAAU;AAG1E,UAAM,MAAM,KAAK,WAAW,CAAC;AAC7B,QAAI,QAAQ,MAAQ,QAAQ,GAAM;AAChC,YAAM,QAAQ,KAAK,MAAM,CAAC,EAAE,KAAK;AACjC,UAAI,MAAM,SAAS,EAAG,QAAO;AAAA,IAC/B;AAAA,EACF;AACA,QAAM,SAAS,IAAI,QAAQ,aAAa;AACxC,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,EAAG,QAAO;AAC5D,SAAO;AACT;AAiCO,SAAS,aAAa,SAA6C;AACxE,MAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAAQ;AACpC,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO,OAAM,QAAO;AAClB,UAAM,QAAQ,mBAAmB,GAAG;AACpC,QAAI,CAAC,MAAO,QAAO;AAgBnB,UAAM,mBAAmC,EAAE,MAAM,WAAW,QAAQ,gBAAgB,KAAK,EAAE;AAC3F,QAAI,QAAQ,QAAQ,OAAO,UAAU,eAAe,KAAK,QAAQ,MAAM,KAAK,GAAG;AAC7E,YAAM,UAAU,QAAQ,KAAK,KAAK;AAClC,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,QACA,YAAY;AAAA,MACd;AAAA,IACF;AACA,QAAI,QAAQ,QAAQ;AAClB,YAAM,SAAS,MAAM,QAAQ,OAAO,KAAK;AACzC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO;AAAA,QACL,GAAG;AAAA,QACH,OAAO,OAAO,SAAS;AAAA,QACvB,YAAY;AAAA,MACd;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AA8DO,SAAS,aAAa,SAA6C;AACxE,QAAM,OAAO,mBAAmB,IAAI,IAAI,QAAQ,OAAO,CAAC;AACxD,QAAM,eAAe,OAAO,QAAQ,aAAa;AACjD,QAAM,oBAAwD;AAAA,IAC5D,YAAY,uBAAuB,MAAM;AAAA,IACzC,gBAAgB;AAAA,IAChB,GAAG,QAAQ;AAAA,IACX,QAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,sBAAoD,eACtD,SACA,EAAE,GAAG,mBAAmB,UAAU,QAAQ,SAAmB;AACjE,SAAO,OAAM,QAAO;AAClB,UAAM,QAAQ,mBAAmB,GAAG;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI;AACJ,QAAI;AACJ,QAAI,cAAc;AAChB,UAAI;AACJ,UAAI;AAOF,cAAM,MAA2B,uBAAuB,GAAG,KAAK,EAAE,MAAM,GAAG;AAC3E,mBAAY,QAAQ,SAAoE,KAAK,GAAG;AAAA,MAClG,SAAS,KAAK;AAGZ,cAAM,IAAI,UAAU,4BAA4B,EAAE,OAAO,IAAI,CAAC;AAAA,MAChE;AACA,sBAAgB,EAAE,GAAG,mBAAmB,SAAS;AAAA,IACnD,OAAO;AACL,sBAAgB;AAAA,IAClB;AACA,QAAI;AACF,OAAC,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM,aAAa;AAAA,IAC3D,SAAS,KAAK;AAGZ,YAAM,IAAI,UAAU,4BAA4B,EAAE,OAAO,IAAI,CAAC;AAAA,IAChE;AACA,UAAM,SAAS,cAAc,OAAO;AACpC,QAAI,QAAQ,gBAAgB,QAAQ;AAClC,YAAM,UAAU,QAAQ,eAAe,OAAO,OAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AACtE,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM,IAAI,UAAU,uBAAuB;AAAA,UACzC,OAAO,IAAI,MAAM,8BAA8B,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,QACrE,CAAC;AAAA,MACH;AAAA,IACF;AAaA,UAAM,sBACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,SAAS,IAChE,QAAQ,YACR,OAAO,QAAQ,QAAQ,YAAY,QAAQ,IAAI,SAAS,IACtD,QAAQ,MACR;AACR,UAAM,YAA2B;AAAA,MAC/B,WAAW,uBAAuB;AAAA,MAClC;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,GAAI,wBAAwB,UAAa;AAAA,QACvC,YAAY;AAAA,UACV,MAAM;AAAA,UACN,WAAW;AAAA,UACX;AAAA,UACA,GAAI,OAAO,QAAQ,QAAQ,YAAY,EAAE,YAAY,QAAQ,IAAI;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,QAAQ,QAAQ,SAAU,WAAU,YAAY,QAAQ;AACnE,WAAO;AAAA,EACT;AACF;AAMA,SAAS,cAAc,SAA+B;AACpD,QAAM,MAAgB,CAAC;AACvB,MAAI,OAAO,QAAQ,UAAU,UAAU;AACrC,QAAI,KAAK,GAAG,QAAQ,MAAM,MAAM,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,EACxD,WAAW,MAAM,QAAQ,QAAQ,KAAK,GAAG;AACvC,QAAI,KAAK,GAAI,QAAQ,MAAoB,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,CAAC;AAAA,EAC5F;AACA,QAAM,MAAO,QAA2C;AACxD,MAAI,OAAO,QAAQ,UAAU;AAC3B,QAAI,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,EAC9C,WAAW,MAAM,QAAQ,GAAG,GAAG;AAC7B,QAAI,KAAK,GAAG,IAAI,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,CAAC;AAAA,EACnE;AACA,SAAO;AACT;AAaO,SAAS,SAAS,gBAAgD;AACvE,aAAW,QAAQ,gBAAgB;AACjC,QAAI,6BAA6B,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAA0B,OAAM,QAAO;AAC3C,QAAI,WAAW;AACf,UAAM,SAAoB,CAAC;AAC3B,eAAW,QAAQ,gBAAgB;AACjC,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,GAAG;AAC7B,YAAI,OAAQ,QAAO;AAAA,MACrB,SAAS,KAAK;AACZ,mBAAW;AACX,eAAO,KAAK,GAAG;AAAA,MACjB;AAAA,IACF;AACA,QAAI,UAAU;AACZ,YAAM,IAAI,UAAU,yBAAyB,EAAE,OAAO,OAAO,CAAC;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AACA,MAAI,eAAe,KAAK,OAAK,0BAA0B,CAAC,CAAC,GAAG;AAC1D,iCAA6B,QAAQ;AAAA,EACvC;AACA,SAAO;AACT;AAgDO,SAAS,oBACd,MACA,KACA,UAAsC,CAAC,GACjC;AACN,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,QAAQ,CAAC,UAAU,aAAa,KAAK,CAAC,GAAG;AAC/C,QAAM,wBAAwB,QAAQ,mBAAmB;AAKzD,MAAI,uBAAuB;AACzB,UAAM,KAAK,UAAU,aAAa,QAAQ,cAAe,CAAC,GAAG;AAAA,EAC/D,WAAW,QAAQ,OAAO;AACxB,UAAM,KAAK,UAAU,aAAa,QAAQ,KAAK,CAAC,GAAG;AAAA,EACrD;AACA,MAAI,QAAQ,iBAAkB,OAAM,KAAK,sBAAsB,aAAa,QAAQ,gBAAgB,CAAC,GAAG;AACxG,MAAI,QAAQ,iBAAkB,OAAM,KAAK,sBAAsB,aAAa,QAAQ,gBAAgB,CAAC,GAAG;AAExG,QAAM,SAAS,wBAAwB,cAAc;AACrD,MAAI,UAAU,QAAQ,UAAU,KAAK;AAAA,IACnC,gBAAgB;AAAA,IAChB,oBAAoB,GAAG,MAAM,IAAI,MAAM,KAAK,IAAI,CAAC;AAAA,EACnD,CAAC;AACD,MAAI;AAAA,IACF,KAAK,UAAU;AAAA,MACb,OAAO,wBAAwB,QAAQ,iBAAkB,QAAQ,SAAS;AAAA,MAC1E,mBAAmB,QAAQ,oBAAoB;AAAA,IACjD,CAAC;AAAA,EACH;AACF;AAQO,SAAS,4BAA4B,KAAgD;AAM1F,QAAM,UAAU,oBAAI,IAAa;AACjC,MAAI,UAAmB;AACvB,MAAI,OAAO;AACX,SAAO,WAAW,QAAQ,OAAO,MAAM,CAAC,QAAQ,IAAI,OAAO,GAAG;AAC5D,QAAI,mBAAmB,sBAAuB,QAAO,QAAQ;AAC7D,YAAQ,IAAI,OAAO;AACnB,cAAW,QAAgC;AAC3C;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,GAAmB;AAEvC,SAAO,EAAE,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK;AACrD;","names":[]}

package/dist/lib/server/create-adcp-server.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { z } from "zod";
 import { parseAdcpMajorVersion, toReleasePrecisionVersion } from "../version.mjs";
 import { resolveAdcpVersion } from "../utils/adcp-version-config.mjs";