@adcp/sdk 14.0.0-beta.11 → 14.0.0-beta.13

package/dist/lib/signing/agent-fetch.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/signing/agent-fetch.ts"],"sourcesContent":["import type {\n  AgentRequestSigningConfig,\n  AgentRequestSigningConfigInline,\n  AgentRequestSigningConfigProvider,\n} from '../types/adcp';\nimport { createSigningFetch, type CoverContentDigestPredicate } from './fetch';\nimport { createSigningFetchAsync } from './fetch-async';\nimport {\n  buildCapabilityCacheKey,\n  defaultCapabilityCache,\n  type CachedCapability,\n  type CapabilityCache,\n} from './capability-cache';\nimport type { ContentDigestPolicy, VerifierCapability } from './types';\nimport type { SignerKey } from './signer';\nimport { containsWebhookAuthentication } from './webhook-auth-detection';\nimport { ADCP_VERSION } from '../version';\nimport { requestSigningEncodingForVersion } from './content-digest';\nexport { requestSigningEncodingForVersion } from './content-digest';\n\ntype FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\nconst MAX_WEBHOOK_AUTH_INSPECTION_BYTES = 1_048_576;\n\n/**\n * Resolve `globalThis.fetch` at the moment of each outbound request — not at\n * module import, and not at factory call. Late resolution lets a polyfill\n * installed after `buildAgentSigningFetch` returns (but before first request)\n * still take effect. The helper throws a clear error on environments lacking\n * global `fetch` instead of binding `undefined` and failing cryptically inside\n * the signing pipeline.\n */\nfunction defaultUpstream(): FetchLike {\n  const f = (globalThis as { fetch?: FetchLike }).fetch;\n  if (typeof f !== 'function') {\n    throw new TypeError(\n      'buildAgentSigningFetch: no upstream fetch provided and globalThis.fetch is unavailable. Pass `upstream: yourFetch` explicitly.'\n    );\n  }\n  return f;\n}\n\nfunction bodyToUtf8(body: unknown): string | undefined {\n  if (body === undefined || body === null) return undefined;\n  if (typeof body === 'string') return body.length ? body : undefined;\n  if (body instanceof Uint8Array) return Buffer.from(body).toString('utf8');\n  if (body instanceof ArrayBuffer) return Buffer.from(body).toString('utf8');\n  // FormData / Blob / ReadableStream / async iterables fall through. Throw\n  // rather than return `undefined` — a silent pass-through would ship the\n  // request unsigned with no hint to the caller, defeating the seller's\n  // `required_for` contract. Matches the strict posture of `createSigningFetch`\n  // which also refuses unsupported body shapes.\n  throw new TypeError(\n    `buildAgentSigningFetch cannot extract an AdCP operation name from a body of type ${describeBody(body)}. The signer only supports string, Uint8Array, and ArrayBuffer bodies because the signature must cover the exact wire bytes.`\n  );\n}\n\nfunction describeBody(body: unknown): string {\n  if (body && typeof body === 'object') {\n    const ctor = (body as { constructor?: { name?: string } }).constructor?.name;\n    if (ctor) return ctor;\n  }\n  return typeof body;\n}\n\n/**\n * Extract the AdCP operation name from a JSON-RPC request body, if any.\n *\n * - MCP tool calls: `method === \"tools/call\"` → `params.name` is the op name.\n * - A2A `message/send` / `message/stream`: the op name lives on the first\n *   data-kind part as `data.skill`.\n * - All other JSON-RPC methods (`initialize`, `tools/list`, notifications)\n *   return `undefined` — those are protocol-layer housekeeping, not AdCP\n *   operations subject to request-signing policy.\n *\n * Throws if the body is of a shape the signer can't read (Blob, FormData,\n * ReadableStream). The MCP / A2A SDKs both emit JSON strings today; a future\n * SDK version switching to streams would silently break signing otherwise.\n */\nexport function extractAdcpOperation(body: unknown): string | undefined {\n  const text = bodyToUtf8(body);\n  if (!text) return undefined;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return undefined;\n  }\n  if (!parsed || typeof parsed !== 'object') return undefined;\n  const rpc = parsed as { method?: unknown; params?: unknown };\n\n  if (rpc.method === 'tools/call') {\n    const params = rpc.params as { name?: unknown } | undefined;\n    return typeof params?.name === 'string' ? params.name : undefined;\n  }\n\n  if (rpc.method === 'message/send' || rpc.method === 'message/stream') {\n    const params = rpc.params as { message?: { parts?: unknown } } | undefined;\n    const parts = params?.message?.parts;\n    if (!Array.isArray(parts)) return undefined;\n    for (const part of parts) {\n      if (part && typeof part === 'object') {\n        const p = part as { kind?: unknown; data?: { skill?: unknown } };\n        if (p.kind === 'data' && typeof p.data?.skill === 'string') {\n          return p.data.skill;\n        }\n      }\n    }\n  }\n\n  return undefined;\n}\n\n/**\n * Detect webhook receiver credentials in the outbound JSON-RPC payload. The\n * verifier rejects unsigned requests carrying these credentials regardless of\n * the seller's operation-level capability advertisement, so the client must\n * sign them even while the capability cache is cold or silent for that op.\n * The scan is bounded; if the body exceeds the inspection budget, sign it.\n */\nfunction carriesWebhookAuthentication(body: unknown): boolean {\n  const text = bodyToUtf8(body);\n  if (!text) return false;\n  if (text.length > MAX_WEBHOOK_AUTH_INSPECTION_BYTES) return true;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return false;\n  }\n  return containsWebhookAuthentication(parsed);\n}\n\n/**\n * Decide whether an outbound AdCP call should be signed given the seller's\n * advertised capability block and the buyer's override list.\n *\n * Precedence matches the AdCP spec (`required_for` > `warn_for` >\n * `supported_for`):\n *   1. `always_sign` on the buyer config — pilot-time override, signs even\n *      if the seller hasn't listed the op.\n *   2. Seller `required_for` — seller rejects unsigned requests, MUST sign.\n *   3. Seller `warn_for` — shadow mode. Seller verifies when present and\n *      logs failures without rejecting; counterparties SHOULD sign so the\n *      seller can surface failure rates before flipping to `required_for`.\n *   4. Seller `supported_for` — sign only if the buyer opted in via\n *      `sign_supported: true` (defaults off).\n *\n * Returns false when the capability is unknown (cold cache) except for ops\n * in `always_sign`, so the priming `get_adcp_capabilities` call itself is\n * never signed.\n */\nexport function shouldSignOperation(\n  operation: string | undefined,\n  capability: VerifierCapability | undefined,\n  config: AgentRequestSigningConfig\n): boolean {\n  if (!operation) return false;\n  if (config.always_sign?.includes(operation)) return true;\n  if (!capability?.supported) return false;\n  if (capability.required_for?.includes(operation)) return true;\n  if (capability.warn_for?.includes(operation)) return true;\n  if (config.sign_supported && capability.supported_for?.includes(operation)) return true;\n  return false;\n}\n\n/**\n * Resolve the seller's content-digest policy into a concrete per-request\n * coverage decision.\n *\n * - `required` → must cover content-digest.\n * - `forbidden` → must NOT cover content-digest.\n * - `either` / absent → default to covering (body-binding is the safer\n *   choice; the seller has explicitly allowed both forms).\n */\nexport function resolveCoverContentDigest(policy: ContentDigestPolicy | undefined): boolean {\n  if (policy === 'forbidden') return false;\n  return true;\n}\n\n/**\n * Convert an inline `AgentRequestSigningConfig` into the `SignerKey` shape\n * expected by `signRequest` / `createSigningFetch`. Provider-backed configs\n * have no in-process key material — callers must route through\n * `createSigningFetchAsync(upstream, config.provider, ...)` instead.\n */\nexport function toSignerKey(config: AgentRequestSigningConfigInline): SignerKey {\n  return {\n    keyid: config.kid,\n    alg: config.alg,\n    privateKey: config.private_key as SignerKey['privateKey'],\n  };\n}\n\n/** Narrow predicate for the inline shape (kind absent or `'inline'`). */\nexport function isInlineSigningConfig(config: AgentRequestSigningConfig): config is AgentRequestSigningConfigInline {\n  return config.kind !== 'provider';\n}\n\n/** Narrow predicate for the provider shape. */\nexport function isProviderSigningConfig(\n  config: AgentRequestSigningConfig\n): config is AgentRequestSigningConfigProvider {\n  return config.kind === 'provider';\n}\n\nexport interface BuildAgentSigningFetchOptions {\n  /**\n   * Upstream fetch to wrap. Defaults to `globalThis.fetch` when omitted —\n   * use a Node 18+ / browser / worker global, or pass a polyfill / a\n   * decorated fetch (retries, telemetry) to compose.\n   */\n  upstream?: FetchLike;\n  signing: AgentRequestSigningConfig;\n  /** Lazy accessor for the current cached capability — re-read on every call. */\n  getCapability: () => CachedCapability | undefined;\n  /** Trusted SDK/endpoint version pin; never inferred from the request body. */\n  adcpVersion?: string;\n}\n\n/**\n * Build a fetch wrapper suitable for injection into MCP/A2A transports. On\n * every outbound request:\n *   1. Sign immediately when the payload carries webhook authentication.\n *   2. Extract the AdCP operation name from the JSON-RPC body (MCP tool-call\n *      or A2A message/send). Non-AdCP JSON-RPC methods (e.g., `initialize`)\n *      pass through unsigned.\n *   3. Consult the cached seller capability to decide whether to sign.\n *   4. Resolve the seller's content-digest policy into a per-request toggle.\n *   5. Delegate to `createSigningFetch` with the decision baked in.\n */\nexport function buildAgentSigningFetch(options: BuildAgentSigningFetchOptions): FetchLike {\n  const { signing, getCapability } = options;\n  // Resolve `globalThis.fetch` per-call when no explicit upstream was passed\n  // so a polyfill installed between factory creation and first request still\n  // takes effect. Eager resolution would freeze whatever was global at\n  // factory-call time.\n  const explicitUpstream = options.upstream;\n  const upstream: FetchLike = explicitUpstream ?? ((input, init) => defaultUpstream()(input, init));\n\n  const shouldSign = (_url: string, init: RequestInit | undefined): boolean => {\n    if (carriesWebhookAuthentication(init?.body)) return true;\n    const operation = extractAdcpOperation(init?.body);\n    const entry = getCapability();\n    return shouldSignOperation(operation, entry?.requestSigning, signing);\n  };\n\n  const binaryEncoding = requestSigningEncodingForVersion(options.adcpVersion ?? ADCP_VERSION);\n  const coverContentDigest: CoverContentDigestPredicate = (_url, _init) => {\n    if (binaryEncoding === 'rfc8941-base64') return true;\n    const entry = getCapability();\n    return resolveCoverContentDigest(entry?.requestSigning?.covers_content_digest);\n  };\n\n  if (isProviderSigningConfig(signing)) {\n    // Freeze the provider's identity fields at factory time and pass a\n    // snapshot view down to the async signer. TypeScript `readonly` on the\n    // `SigningProvider` interface is compile-time only — if a downstream\n    // adapter mutates `keyid`/`algorithm`/`fingerprint` between context\n    // build and outbound request, the wire `keyid` would drift away from\n    // the cache key the connection was bound to. The frozen view binds the\n    // wire identity to the snapshot already used for cache routing.\n    const frozen = freezeProviderIdentity(signing.provider);\n    return createSigningFetchAsync(upstream, frozen, { shouldSign, coverContentDigest, binaryEncoding });\n  }\n  return createSigningFetch(upstream, toSignerKey(signing), { shouldSign, coverContentDigest, binaryEncoding });\n}\n\nfunction freezeProviderIdentity(provider: AgentRequestSigningConfigProvider['provider']) {\n  const keyid = provider.keyid;\n  const algorithm = provider.algorithm;\n  const fingerprint = provider.fingerprint;\n  return {\n    keyid,\n    algorithm,\n    fingerprint,\n    sign: (payload: Uint8Array) => provider.sign(payload),\n  };\n}\n\nexport interface CreateAgentSignedFetchOptions {\n  /** This agent's RFC 9421 signing identity (kid, alg, private_key, agent_url). */\n  signing: AgentRequestSigningConfig;\n  /** Trusted endpoint pin used to select the 3.0/3.1 or 3.2 request profile. */\n  adcpVersion?: string;\n  /**\n   * Target seller's `agent_uri` — the base URL whose `get_adcp_capabilities`\n   * response gates whether each operation gets signed. The preset keys a\n   * capability-cache entry off this URL so repeat calls reuse the same\n   * advertisement.\n   *\n   * For multi-seller buyers, build one signed fetch per seller (or use\n   * {@link buildAgentSigningFetch} directly and supply your own\n   * `getCapability` that dispatches on the target URL).\n   */\n  sellerAgentUri: string;\n  /**\n   * Optional auth token the seller expects alongside the signing headers.\n   * Included in the capability cache key so a token rotation naturally\n   * invalidates the cached advertisement.\n   */\n  sellerAuthToken?: string;\n  /**\n   * Capability cache. Defaults to the shared {@link defaultCapabilityCache}.\n   *\n   * **The shared default is load-bearing.** `ProtocolClient` and\n   * `buildAgentSigningContext` write the seller's `get_adcp_capabilities`\n   * response into `defaultCapabilityCache`; this preset reads from the same\n   * instance so a single priming call serves every subsequent signing\n   * decision. Passing a fresh `new CapabilityCache()` here without also\n   * priming it will silently disable `required_for` enforcement: cold cache\n   * → `shouldSignOperation` returns `false` → every required op ships\n   * unsigned → seller rejects. The SDK emits no error on this path because\n   * \"decided not to sign\" is the spec-correct behavior on a cold cache.\n   *\n   * Pass an explicit cache only when you've also primed it — call\n   * {@link ensureCapabilityLoaded} against your cache instance after\n   * construction, or seed it via `cache.set(buildCapabilityCacheKey(uri,\n   * token, fingerprint, adcpVersion), entry)` — or when you genuinely want each caller to re-fetch\n   * the seller's capability block.\n   *\n   * Note: the cache stores **public** seller capability advertisements\n   * (the contents of `get_adcp_capabilities` responses), not buyer\n   * credentials. The shared default is not a multi-tenant security\n   * boundary — different sellers, different auth tokens, and different\n   * signing keys already get separate entries via\n   * {@link buildCapabilityCacheKey}.\n   */\n  cache?: CapabilityCache;\n  /** Upstream fetch. Defaults to `globalThis.fetch`. */\n  upstream?: FetchLike;\n}\n\n/**\n * One-call preset for the single-seller case: bundles\n * {@link buildAgentSigningFetch} with a {@link CapabilityCache} lookup keyed\n * by `sellerAgentUri`, so adapter authors don't have to wire the cache and\n * capability accessor themselves.\n *\n * ```ts\n * // fetch.ts\n * import { createAgentSignedFetch } from '@adcp/sdk/signing';\n *\n * export const signedFetch = createAgentSignedFetch({\n *   signing: {\n *     kid: 'my-agent-2026',\n *     alg: 'ed25519',\n *     private_key: JSON.parse(process.env.ADCP_PRIV_KEY!),\n *     agent_url: 'https://agent.example.com',\n *   },\n *   sellerAgentUri: 'https://seller.example.com',\n * });\n * ```\n *\n * ```ts\n * // any other module\n * import { signedFetch } from './fetch';\n *\n * await signedFetch('https://seller.example.com/mcp', {\n *   method: 'POST',\n *   headers: { 'Content-Type': 'application/json' },\n *   body: JSON.stringify(payload),\n * });\n * ```\n *\n * Signing only happens on operations the seller advertises as\n * `required_for` / `warn_for` (or `supported_for` when the buyer config\n * opts in) — so the `get_adcp_capabilities` priming call itself is always\n * unsigned, as the spec requires.\n *\n * For multi-seller adapters, construct one preset per seller, or use\n * {@link buildAgentSigningFetch} directly with a request-dispatching\n * `getCapability` callback.\n */\nexport function createAgentSignedFetch(options: CreateAgentSignedFetchOptions): FetchLike {\n  const cache = options.cache ?? defaultCapabilityCache;\n  const adcpVersion = options.adcpVersion ?? ADCP_VERSION;\n  const cacheKey = buildCapabilityCacheKey(options.sellerAgentUri, options.sellerAuthToken, undefined, adcpVersion);\n  return buildAgentSigningFetch({\n    signing: options.signing,\n    upstream: options.upstream,\n    getCapability: () => cache.get(cacheKey),\n    adcpVersion,\n  });\n}\n"],"mappings":"AAKA,SAAS,0BAA4D;AACrE,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAGP,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAC7B,SAAS,wCAAwC;AACjD,SAAS,oCAAAA,yCAAwC;AAGjD,MAAM,oCAAoC;AAU1C,SAAS,kBAA6B;AACpC,QAAM,IAAK,WAAqC;AAChD,MAAI,OAAO,MAAM,YAAY;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,MAAmC;AACrD,MAAI,SAAS,UAAa,SAAS,KAAM,QAAO;AAChD,MAAI,OAAO,SAAS,SAAU,QAAO,KAAK,SAAS,OAAO;AAC1D,MAAI,gBAAgB,WAAY,QAAO,OAAO,KAAK,IAAI,EAAE,SAAS,MAAM;AACxE,MAAI,gBAAgB,YAAa,QAAO,OAAO,KAAK,IAAI,EAAE,SAAS,MAAM;AAMzE,QAAM,IAAI;AAAA,IACR,oFAAoF,aAAa,IAAI,CAAC;AAAA,EACxG;AACF;AAEA,SAAS,aAAa,MAAuB;AAC3C,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,OAAQ,KAA6C,aAAa;AACxE,QAAI,KAAM,QAAO;AAAA,EACnB;AACA,SAAO,OAAO;AAChB;AAgBO,SAAS,qBAAqB,MAAmC;AACtE,QAAM,OAAO,WAAW,IAAI;AAC5B,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,MAAM;AAEZ,MAAI,IAAI,WAAW,cAAc;AAC/B,UAAM,SAAS,IAAI;AACnB,WAAO,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO;AAAA,EAC1D;AAEA,MAAI,IAAI,WAAW,kBAAkB,IAAI,WAAW,kBAAkB;AACpE,UAAM,SAAS,IAAI;AACnB,UAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,eAAW,QAAQ,OAAO;AACxB,UAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,cAAM,IAAI;AACV,YAAI,EAAE,SAAS,UAAU,OAAO,EAAE,MAAM,UAAU,UAAU;AAC1D,iBAAO,EAAE,KAAK;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASA,SAAS,6BAA6B,MAAwB;AAC5D,QAAM,OAAO,WAAW,IAAI;AAC5B,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAS,kCAAmC,QAAO;AAC5D,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,8BAA8B,MAAM;AAC7C;AAqBO,SAAS,oBACd,WACA,YACA,QACS;AACT,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI,OAAO,aAAa,SAAS,SAAS,EAAG,QAAO;AACpD,MAAI,CAAC,YAAY,UAAW,QAAO;AACnC,MAAI,WAAW,cAAc,SAAS,SAAS,EAAG,QAAO;AACzD,MAAI,WAAW,UAAU,SAAS,SAAS,EAAG,QAAO;AACrD,MAAI,OAAO,kBAAkB,WAAW,eAAe,SAAS,SAAS,EAAG,QAAO;AACnF,SAAO;AACT;AAWO,SAAS,0BAA0B,QAAkD;AAC1F,MAAI,WAAW,YAAa,QAAO;AACnC,SAAO;AACT;AAQO,SAAS,YAAY,QAAoD;AAC9E,SAAO;AAAA,IACL,OAAO,OAAO;AAAA,IACd,KAAK,OAAO;AAAA,IACZ,YAAY,OAAO;AAAA,EACrB;AACF;AAGO,SAAS,sBAAsB,QAA8E;AAClH,SAAO,OAAO,SAAS;AACzB;AAGO,SAAS,wBACd,QAC6C;AAC7C,SAAO,OAAO,SAAS;AACzB;AA2BO,SAAS,uBAAuB,SAAmD;AACxF,QAAM,EAAE,SAAS,cAAc,IAAI;AAKnC,QAAM,mBAAmB,QAAQ;AACjC,QAAM,WAAsB,qBAAqB,CAAC,OAAO,SAAS,gBAAgB,EAAE,OAAO,IAAI;AAE/F,QAAM,aAAa,CAAC,MAAc,SAA2C;AAC3E,QAAI,6BAA6B,MAAM,IAAI,EAAG,QAAO;AACrD,UAAM,YAAY,qBAAqB,MAAM,IAAI;AACjD,UAAM,QAAQ,cAAc;AAC5B,WAAO,oBAAoB,WAAW,OAAO,gBAAgB,OAAO;AAAA,EACtE;AAEA,QAAM,iBAAiB,iCAAiC,QAAQ,eAAe,YAAY;AAC3F,QAAM,qBAAkD,CAAC,MAAM,UAAU;AACvE,QAAI,mBAAmB,iBAAkB,QAAO;AAChD,UAAM,QAAQ,cAAc;AAC5B,WAAO,0BAA0B,OAAO,gBAAgB,qBAAqB;AAAA,EAC/E;AAEA,MAAI,wBAAwB,OAAO,GAAG;AAQpC,UAAM,SAAS,uBAAuB,QAAQ,QAAQ;AACtD,WAAO,wBAAwB,UAAU,QAAQ,EAAE,YAAY,oBAAoB,eAAe,CAAC;AAAA,EACrG;AACA,SAAO,mBAAmB,UAAU,YAAY,OAAO,GAAG,EAAE,YAAY,oBAAoB,eAAe,CAAC;AAC9G;AAEA,SAAS,uBAAuB,UAAyD;AACvF,QAAM,QAAQ,SAAS;AACvB,QAAM,YAAY,SAAS;AAC3B,QAAM,cAAc,SAAS;AAC7B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,CAAC,YAAwB,SAAS,KAAK,OAAO;AAAA,EACtD;AACF;AAgGO,SAAS,uBAAuB,SAAmD;AACxF,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,WAAW,wBAAwB,QAAQ,gBAAgB,QAAQ,iBAAiB,QAAW,WAAW;AAChH,SAAO,uBAAuB;AAAA,IAC5B,SAAS,QAAQ;AAAA,IACjB,UAAU,QAAQ;AAAA,IAClB,eAAe,MAAM,MAAM,IAAI,QAAQ;AAAA,IACvC;AAAA,EACF,CAAC;AACH;","names":["requestSigningEncodingForVersion"]}
+{"version":3,"sources":["../../../src/lib/signing/agent-fetch.ts"],"sourcesContent":["import type {\n  AgentRequestSigningConfig,\n  AgentRequestSigningConfigInline,\n  AgentRequestSigningConfigProvider,\n} from '../types/adcp';\nimport { createSigningFetch, type CoverContentDigestPredicate } from './fetch';\nimport { createSigningFetchAsync } from './fetch-async';\nimport {\n  buildCapabilityCacheKey,\n  defaultCapabilityCache,\n  type CachedCapability,\n  type CapabilityCache,\n} from './capability-cache';\nimport type { ContentDigestPolicy, VerifierCapability } from './types';\nimport type { SignerKey } from './signer';\nimport { containsWebhookAuthentication } from './webhook-auth-detection';\nimport { ADCP_VERSION } from '../version';\nimport { requestSigningEncodingForVersion } from './content-digest';\nexport { requestSigningEncodingForVersion } from './content-digest';\n\ntype FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\nconst MAX_WEBHOOK_AUTH_INSPECTION_BYTES = 1_048_576;\n\n/**\n * Resolve `globalThis.fetch` at the moment of each outbound request — not at\n * module import, and not at factory call. Late resolution lets a polyfill\n * installed after `buildAgentSigningFetch` returns (but before first request)\n * still take effect. The helper throws a clear error on environments lacking\n * global `fetch` instead of binding `undefined` and failing cryptically inside\n * the signing pipeline.\n */\nfunction defaultUpstream(): FetchLike {\n  const f = (globalThis as { fetch?: FetchLike }).fetch;\n  if (typeof f !== 'function') {\n    throw new TypeError(\n      'buildAgentSigningFetch: no upstream fetch provided and globalThis.fetch is unavailable. Pass `upstream: yourFetch` explicitly.'\n    );\n  }\n  return f;\n}\n\nfunction bodyToUtf8(body: unknown): string | undefined {\n  if (body === undefined || body === null) return undefined;\n  if (typeof body === 'string') return body.length ? body : undefined;\n  if (body instanceof Uint8Array) return Buffer.from(body).toString('utf8');\n  if (body instanceof ArrayBuffer) return Buffer.from(body).toString('utf8');\n  // FormData / Blob / ReadableStream / async iterables fall through. Throw\n  // rather than return `undefined` — a silent pass-through would ship the\n  // request unsigned with no hint to the caller, defeating the seller's\n  // `required_for` contract. Matches the strict posture of `createSigningFetch`\n  // which also refuses unsupported body shapes.\n  throw new TypeError(\n    `buildAgentSigningFetch cannot extract an AdCP operation name from a body of type ${describeBody(body)}. The signer only supports string, Uint8Array, and ArrayBuffer bodies because the signature must cover the exact wire bytes.`\n  );\n}\n\nfunction describeBody(body: unknown): string {\n  if (body && typeof body === 'object') {\n    const ctor = (body as { constructor?: { name?: string } }).constructor?.name;\n    if (ctor) return ctor;\n  }\n  return typeof body;\n}\n\n/**\n * Extract the AdCP operation name from a JSON-RPC request body, if any.\n *\n * - MCP tool calls: `method === \"tools/call\"` → `params.name` is the op name.\n * - A2A `message/send` / `message/stream`: the op name lives on the first\n *   data-kind part as `data.skill`.\n * - All other JSON-RPC methods (`initialize`, `tools/list`, notifications)\n *   return `undefined` — those are protocol-layer housekeeping, not AdCP\n *   operations subject to request-signing policy.\n *\n * Throws if the body is of a shape the signer can't read (Blob, FormData,\n * ReadableStream). The MCP / A2A SDKs both emit JSON strings today; a future\n * SDK version switching to streams would silently break signing otherwise.\n */\nexport function extractAdcpOperation(body: unknown): string | undefined {\n  const text = bodyToUtf8(body);\n  if (!text) return undefined;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return undefined;\n  }\n  if (!parsed || typeof parsed !== 'object') return undefined;\n  const rpc = parsed as { method?: unknown; params?: unknown };\n\n  if (rpc.method === 'tools/call') {\n    const params = rpc.params as { name?: unknown } | undefined;\n    return typeof params?.name === 'string' ? params.name : undefined;\n  }\n\n  if (rpc.method === 'message/send' || rpc.method === 'message/stream') {\n    const params = rpc.params as { message?: { parts?: unknown } } | undefined;\n    const parts = params?.message?.parts;\n    if (!Array.isArray(parts)) return undefined;\n    for (const part of parts) {\n      if (part && typeof part === 'object') {\n        const p = part as { kind?: unknown; data?: { skill?: unknown } };\n        if (p.kind === 'data' && typeof p.data?.skill === 'string') {\n          return p.data.skill;\n        }\n      }\n    }\n  }\n\n  return undefined;\n}\n\n/**\n * Detect webhook receiver credentials in the outbound JSON-RPC payload. The\n * verifier rejects unsigned requests carrying these credentials regardless of\n * the seller's operation-level capability advertisement, so the client must\n * sign them even while the capability cache is cold or silent for that op.\n * The scan is bounded; if the body exceeds the inspection budget, sign it.\n */\nfunction carriesWebhookAuthentication(body: unknown): boolean {\n  const text = bodyToUtf8(body);\n  if (!text) return false;\n  if (text.length > MAX_WEBHOOK_AUTH_INSPECTION_BYTES) return true;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return false;\n  }\n  return containsWebhookAuthentication(parsed);\n}\n\n/**\n * Decide whether an outbound AdCP call should be signed given the seller's\n * advertised capability block and the buyer's override list.\n *\n * Precedence matches the AdCP spec (`required_for` > `warn_for` >\n * `supported_for`):\n *   1. `always_sign` on the buyer config — pilot-time override, signs even\n *      if the seller hasn't listed the op.\n *   2. Seller `required_for` — seller rejects unsigned requests, MUST sign.\n *   3. Seller `warn_for` — shadow mode. Seller verifies when present and\n *      logs failures without rejecting; counterparties SHOULD sign so the\n *      seller can surface failure rates before flipping to `required_for`.\n *   4. Seller `supported_for` — sign only if the buyer opted in via\n *      `sign_supported: true` (defaults off).\n *\n * Returns false when the capability is unknown (cold cache) except for ops\n * in `always_sign`.\n */\nexport function shouldSignOperation(\n  operation: string | undefined,\n  capability: VerifierCapability | undefined,\n  config: AgentRequestSigningConfig\n): boolean {\n  if (!operation) return false;\n  if (config.always_sign?.includes(operation)) return true;\n  if (!capability?.supported) return false;\n  if (capability.required_for?.includes(operation)) return true;\n  if (capability.warn_for?.includes(operation)) return true;\n  if (config.sign_supported && capability.supported_for?.includes(operation)) return true;\n  return false;\n}\n\n/**\n * Resolve the seller's content-digest policy into a concrete per-request\n * coverage decision.\n *\n * - `required` → must cover content-digest.\n * - `forbidden` → must NOT cover content-digest.\n * - `either` / absent → default to covering (body-binding is the safer\n *   choice; the seller has explicitly allowed both forms).\n */\nexport function resolveCoverContentDigest(policy: ContentDigestPolicy | undefined): boolean {\n  if (policy === 'forbidden') return false;\n  return true;\n}\n\n/**\n * Convert an inline `AgentRequestSigningConfig` into the `SignerKey` shape\n * expected by `signRequest` / `createSigningFetch`. Provider-backed configs\n * have no in-process key material — callers must route through\n * `createSigningFetchAsync(upstream, config.provider, ...)` instead.\n */\nexport function toSignerKey(config: AgentRequestSigningConfigInline): SignerKey {\n  return {\n    keyid: config.kid,\n    alg: config.alg,\n    privateKey: config.private_key as SignerKey['privateKey'],\n  };\n}\n\n/** Narrow predicate for the inline shape (kind absent or `'inline'`). */\nexport function isInlineSigningConfig(config: AgentRequestSigningConfig): config is AgentRequestSigningConfigInline {\n  return config.kind !== 'provider';\n}\n\n/** Narrow predicate for the provider shape. */\nexport function isProviderSigningConfig(\n  config: AgentRequestSigningConfig\n): config is AgentRequestSigningConfigProvider {\n  return config.kind === 'provider';\n}\n\nexport interface BuildAgentSigningFetchOptions {\n  /**\n   * Upstream fetch to wrap. Defaults to `globalThis.fetch` when omitted —\n   * use a Node 18+ / browser / worker global, or pass a polyfill / a\n   * decorated fetch (retries, telemetry) to compose.\n   */\n  upstream?: FetchLike;\n  signing: AgentRequestSigningConfig;\n  /** Lazy accessor for the current cached capability — re-read on every call. */\n  getCapability: () => CachedCapability | undefined;\n  /** Trusted SDK/endpoint version pin; never inferred from the request body. */\n  adcpVersion?: string;\n}\n\n/**\n * Build a fetch wrapper suitable for injection into MCP/A2A transports. On\n * every outbound request:\n *   1. Sign immediately when the payload carries webhook authentication.\n *   2. Extract the AdCP operation name from the JSON-RPC body (MCP tool-call\n *      or A2A message/send). Non-AdCP JSON-RPC methods (e.g., `initialize`)\n *      pass through unsigned.\n *   3. Consult the cached seller capability to decide whether to sign.\n *   4. Resolve the seller's content-digest policy into a per-request toggle.\n *   5. Delegate to `createSigningFetch` with the decision baked in.\n */\nexport function buildAgentSigningFetch(options: BuildAgentSigningFetchOptions): FetchLike {\n  const { signing, getCapability } = options;\n  // Resolve `globalThis.fetch` per-call when no explicit upstream was passed\n  // so a polyfill installed between factory creation and first request still\n  // takes effect. Eager resolution would freeze whatever was global at\n  // factory-call time.\n  const explicitUpstream = options.upstream;\n  const upstream: FetchLike = explicitUpstream ?? ((input, init) => defaultUpstream()(input, init));\n\n  const shouldSign = (_url: string, init: RequestInit | undefined): boolean => {\n    if (carriesWebhookAuthentication(init?.body)) return true;\n    const operation = extractAdcpOperation(init?.body);\n    const entry = getCapability();\n    return shouldSignOperation(operation, entry?.requestSigning, signing);\n  };\n\n  const binaryEncoding = requestSigningEncodingForVersion(options.adcpVersion ?? ADCP_VERSION);\n  const coverContentDigest: CoverContentDigestPredicate = (_url, _init) => {\n    if (binaryEncoding === 'rfc8941-base64') return true;\n    const entry = getCapability();\n    return resolveCoverContentDigest(entry?.requestSigning?.covers_content_digest);\n  };\n\n  if (isProviderSigningConfig(signing)) {\n    // Freeze the provider's identity fields at factory time and pass a\n    // snapshot view down to the async signer. TypeScript `readonly` on the\n    // `SigningProvider` interface is compile-time only — if a downstream\n    // adapter mutates `keyid`/`algorithm`/`fingerprint` between context\n    // build and outbound request, the wire `keyid` would drift away from\n    // the cache key the connection was bound to. The frozen view binds the\n    // wire identity to the snapshot already used for cache routing.\n    const frozen = freezeProviderIdentity(signing.provider);\n    return createSigningFetchAsync(upstream, frozen, { shouldSign, coverContentDigest, binaryEncoding });\n  }\n  return createSigningFetch(upstream, toSignerKey(signing), { shouldSign, coverContentDigest, binaryEncoding });\n}\n\nfunction freezeProviderIdentity(provider: AgentRequestSigningConfigProvider['provider']) {\n  const keyid = provider.keyid;\n  const algorithm = provider.algorithm;\n  const adcpUse = provider.adcpUse;\n  const fingerprint = provider.fingerprint;\n  return {\n    keyid,\n    algorithm,\n    adcpUse,\n    fingerprint,\n    sign: (payload: Uint8Array) => provider.sign(payload),\n  };\n}\n\nexport interface CreateAgentSignedFetchOptions {\n  /** This agent's RFC 9421 signing identity (kid, alg, private_key, agent_url). */\n  signing: AgentRequestSigningConfig;\n  /** Trusted endpoint pin used to select the 3.0/3.1 or 3.2 request profile. */\n  adcpVersion?: string;\n  /**\n   * Target seller's `agent_uri` — the base URL whose `get_adcp_capabilities`\n   * response gates whether each operation gets signed. The preset keys a\n   * capability-cache entry off this URL so repeat calls reuse the same\n   * advertisement.\n   *\n   * For multi-seller buyers, build one signed fetch per seller (or use\n   * {@link buildAgentSigningFetch} directly and supply your own\n   * `getCapability` that dispatches on the target URL).\n   */\n  sellerAgentUri: string;\n  /**\n   * Optional auth token the seller expects alongside the signing headers.\n   * Included in the capability cache key so a token rotation naturally\n   * invalidates the cached advertisement.\n   */\n  sellerAuthToken?: string;\n  /**\n   * Capability cache. Defaults to the shared {@link defaultCapabilityCache}.\n   *\n   * **The shared default is load-bearing.** `ProtocolClient` and\n   * `buildAgentSigningContext` write the seller's `get_adcp_capabilities`\n   * response into `defaultCapabilityCache`; this preset reads from the same\n   * instance so a single priming call serves every subsequent signing\n   * decision. Passing a fresh `new CapabilityCache()` here without also\n   * priming it will silently disable `required_for` enforcement: cold cache\n   * → `shouldSignOperation` returns `false` → every required op ships\n   * unsigned → seller rejects. The SDK emits no error on this path because\n   * \"decided not to sign\" is the spec-correct behavior on a cold cache.\n   *\n   * Pass an explicit cache only when you've also primed it — call\n   * {@link ensureCapabilityLoaded} against your cache instance after\n   * construction, or seed it via `cache.set(buildCapabilityCacheKey(uri,\n   * token, fingerprint, adcpVersion), entry)` — or when you genuinely want each caller to re-fetch\n   * the seller's capability block.\n   *\n   * Note: the cache stores **public** seller capability advertisements\n   * (the contents of `get_adcp_capabilities` responses), not buyer\n   * credentials. The shared default is not a multi-tenant security\n   * boundary — different sellers, different auth tokens, and different\n   * signing keys already get separate entries via\n   * {@link buildCapabilityCacheKey}.\n   */\n  cache?: CapabilityCache;\n  /** Upstream fetch. Defaults to `globalThis.fetch`. */\n  upstream?: FetchLike;\n}\n\n/**\n * One-call preset for the single-seller case: bundles\n * {@link buildAgentSigningFetch} with a {@link CapabilityCache} lookup keyed\n * by `sellerAgentUri`, so adapter authors don't have to wire the cache and\n * capability accessor themselves.\n *\n * ```ts\n * // fetch.ts\n * import { createAgentSignedFetch } from '@adcp/sdk/signing';\n *\n * export const signedFetch = createAgentSignedFetch({\n *   signing: {\n *     kid: 'my-agent-2026',\n *     alg: 'ed25519',\n *     private_key: JSON.parse(process.env.ADCP_PRIV_KEY!),\n *     agent_url: 'https://agent.example.com',\n *   },\n *   sellerAgentUri: 'https://seller.example.com',\n * });\n * ```\n *\n * ```ts\n * // any other module\n * import { signedFetch } from './fetch';\n *\n * await signedFetch('https://seller.example.com/mcp', {\n *   method: 'POST',\n *   headers: { 'Content-Type': 'application/json' },\n *   body: JSON.stringify(payload),\n * });\n * ```\n *\n * Signing only happens on operations the seller advertises as\n * `required_for` / `warn_for` (or `supported_for` when the buyer config\n * opts in) — so the `get_adcp_capabilities` priming call itself is always\n * unsigned, as the spec requires.\n *\n * For multi-seller adapters, construct one preset per seller, or use\n * {@link buildAgentSigningFetch} directly with a request-dispatching\n * `getCapability` callback.\n */\nexport function createAgentSignedFetch(options: CreateAgentSignedFetchOptions): FetchLike {\n  const cache = options.cache ?? defaultCapabilityCache;\n  const adcpVersion = options.adcpVersion ?? ADCP_VERSION;\n  const cacheKey = buildCapabilityCacheKey(options.sellerAgentUri, options.sellerAuthToken, undefined, adcpVersion);\n  return buildAgentSigningFetch({\n    signing: options.signing,\n    upstream: options.upstream,\n    getCapability: () => cache.get(cacheKey),\n    adcpVersion,\n  });\n}\n"],"mappings":"AAKA,SAAS,0BAA4D;AACrE,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAGP,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAC7B,SAAS,wCAAwC;AACjD,SAAS,oCAAAA,yCAAwC;AAGjD,MAAM,oCAAoC;AAU1C,SAAS,kBAA6B;AACpC,QAAM,IAAK,WAAqC;AAChD,MAAI,OAAO,MAAM,YAAY;AAC3B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,MAAmC;AACrD,MAAI,SAAS,UAAa,SAAS,KAAM,QAAO;AAChD,MAAI,OAAO,SAAS,SAAU,QAAO,KAAK,SAAS,OAAO;AAC1D,MAAI,gBAAgB,WAAY,QAAO,OAAO,KAAK,IAAI,EAAE,SAAS,MAAM;AACxE,MAAI,gBAAgB,YAAa,QAAO,OAAO,KAAK,IAAI,EAAE,SAAS,MAAM;AAMzE,QAAM,IAAI;AAAA,IACR,oFAAoF,aAAa,IAAI,CAAC;AAAA,EACxG;AACF;AAEA,SAAS,aAAa,MAAuB;AAC3C,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,OAAQ,KAA6C,aAAa;AACxE,QAAI,KAAM,QAAO;AAAA,EACnB;AACA,SAAO,OAAO;AAChB;AAgBO,SAAS,qBAAqB,MAAmC;AACtE,QAAM,OAAO,WAAW,IAAI;AAC5B,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,MAAM;AAEZ,MAAI,IAAI,WAAW,cAAc;AAC/B,UAAM,SAAS,IAAI;AACnB,WAAO,OAAO,QAAQ,SAAS,WAAW,OAAO,OAAO;AAAA,EAC1D;AAEA,MAAI,IAAI,WAAW,kBAAkB,IAAI,WAAW,kBAAkB;AACpE,UAAM,SAAS,IAAI;AACnB,UAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,eAAW,QAAQ,OAAO;AACxB,UAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,cAAM,IAAI;AACV,YAAI,EAAE,SAAS,UAAU,OAAO,EAAE,MAAM,UAAU,UAAU;AAC1D,iBAAO,EAAE,KAAK;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASA,SAAS,6BAA6B,MAAwB;AAC5D,QAAM,OAAO,WAAW,IAAI;AAC5B,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAS,kCAAmC,QAAO;AAC5D,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,8BAA8B,MAAM;AAC7C;AAoBO,SAAS,oBACd,WACA,YACA,QACS;AACT,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI,OAAO,aAAa,SAAS,SAAS,EAAG,QAAO;AACpD,MAAI,CAAC,YAAY,UAAW,QAAO;AACnC,MAAI,WAAW,cAAc,SAAS,SAAS,EAAG,QAAO;AACzD,MAAI,WAAW,UAAU,SAAS,SAAS,EAAG,QAAO;AACrD,MAAI,OAAO,kBAAkB,WAAW,eAAe,SAAS,SAAS,EAAG,QAAO;AACnF,SAAO;AACT;AAWO,SAAS,0BAA0B,QAAkD;AAC1F,MAAI,WAAW,YAAa,QAAO;AACnC,SAAO;AACT;AAQO,SAAS,YAAY,QAAoD;AAC9E,SAAO;AAAA,IACL,OAAO,OAAO;AAAA,IACd,KAAK,OAAO;AAAA,IACZ,YAAY,OAAO;AAAA,EACrB;AACF;AAGO,SAAS,sBAAsB,QAA8E;AAClH,SAAO,OAAO,SAAS;AACzB;AAGO,SAAS,wBACd,QAC6C;AAC7C,SAAO,OAAO,SAAS;AACzB;AA2BO,SAAS,uBAAuB,SAAmD;AACxF,QAAM,EAAE,SAAS,cAAc,IAAI;AAKnC,QAAM,mBAAmB,QAAQ;AACjC,QAAM,WAAsB,qBAAqB,CAAC,OAAO,SAAS,gBAAgB,EAAE,OAAO,IAAI;AAE/F,QAAM,aAAa,CAAC,MAAc,SAA2C;AAC3E,QAAI,6BAA6B,MAAM,IAAI,EAAG,QAAO;AACrD,UAAM,YAAY,qBAAqB,MAAM,IAAI;AACjD,UAAM,QAAQ,cAAc;AAC5B,WAAO,oBAAoB,WAAW,OAAO,gBAAgB,OAAO;AAAA,EACtE;AAEA,QAAM,iBAAiB,iCAAiC,QAAQ,eAAe,YAAY;AAC3F,QAAM,qBAAkD,CAAC,MAAM,UAAU;AACvE,QAAI,mBAAmB,iBAAkB,QAAO;AAChD,UAAM,QAAQ,cAAc;AAC5B,WAAO,0BAA0B,OAAO,gBAAgB,qBAAqB;AAAA,EAC/E;AAEA,MAAI,wBAAwB,OAAO,GAAG;AAQpC,UAAM,SAAS,uBAAuB,QAAQ,QAAQ;AACtD,WAAO,wBAAwB,UAAU,QAAQ,EAAE,YAAY,oBAAoB,eAAe,CAAC;AAAA,EACrG;AACA,SAAO,mBAAmB,UAAU,YAAY,OAAO,GAAG,EAAE,YAAY,oBAAoB,eAAe,CAAC;AAC9G;AAEA,SAAS,uBAAuB,UAAyD;AACvF,QAAM,QAAQ,SAAS;AACvB,QAAM,YAAY,SAAS;AAC3B,QAAM,UAAU,SAAS;AACzB,QAAM,cAAc,SAAS;AAC7B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM,CAAC,YAAwB,SAAS,KAAK,OAAO;AAAA,EACtD;AACF;AAgGO,SAAS,uBAAuB,SAAmD;AACxF,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,WAAW,wBAAwB,QAAQ,gBAAgB,QAAQ,iBAAiB,QAAW,WAAW;AAChH,SAAO,uBAAuB;AAAA,IAC5B,SAAS,QAAQ;AAAA,IACjB,UAAU,QAAQ;AAAA,IAClB,eAAe,MAAM,MAAM,IAAI,QAAQ;AAAA,IACvC;AAAA,EACF,CAAC;AACH;","names":["requestSigningEncodingForVersion"]}

package/dist/lib/signing/agent-resolver/etld.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/signing/agent-resolver/etld.ts"],"sourcesContent":["/**\n * eTLD+1 computation against a pinned, dated PSL snapshot. Backed by\n * `tldts`, which ships its PSL bundled into the published package — pinning\n * the dependency in `package.json` pins the snapshot. Runtime PSL fetches are\n * never performed: a runtime fetch creates both a denial-of-service oracle\n * (PSL host outage stalls verification) and a non-deterministic eTLD+1\n * across deployments running on different snapshot ages\n * (security.mdx §\"Quickstart: implement a `brand_json_url`-based verifier\"\n * step 3).\n *\n * Both ICANN and PRIVATE PSL sections are in scope: platforms like\n * `vercel.app`, `pages.dev`, `github.io` MUST be treated as suffixes so an\n * attacker on `attacker.vercel.app` cannot pretend to share an eTLD+1 with\n * a legitimate publisher on `legit.vercel.app`.\n */\nimport { parse as parseTld } from 'tldts';\n\nimport { canonicalizeHost } from './canonicalize';\n\nexport const PSL_SNAPSHOT_VERSION = 'tldts@7';\n\nexport class EtldComputationError extends Error {\n  constructor(\n    message: string,\n    readonly meta: { hostOrUrl?: string }\n  ) {\n    super(message);\n    this.name = 'EtldComputationError';\n  }\n}\n\n/**\n * Compute eTLD+1 for a hostname or URL. Caller should pass either a bare\n * hostname (`buyer.example.com`) or a full URL (`https://buyer.example.com/mcp`).\n *\n * Returns the registrable domain in canonical form (ASCII-lowercased, IDNA-2008\n * A-label). Throws when the input has no PSL match — typically because the host\n * is an IP literal or a single-label name.\n */\nexport function eTldPlusOne(hostOrUrl: string): string {\n  const host = canonicalizeHost(extractHost(hostOrUrl));\n  const result = parseTld(host, { allowPrivateDomains: true });\n  if (result.isIp) {\n    throw new EtldComputationError(`Cannot compute eTLD+1 for IP literal`, { hostOrUrl });\n  }\n  if (!result.domain) {\n    throw new EtldComputationError(`No PSL match for hostname`, { hostOrUrl });\n  }\n  return canonicalizeHost(result.domain);\n}\n\n/**\n * Convenience: do two hostnames share an eTLD+1? Returns false when either\n * input has no PSL match (rather than throwing) — callers comparing two\n * hostnames typically want a non-match boolean, not an exception.\n */\nexport function sameEtldPlusOne(a: string, b: string): boolean {\n  let aEtld: string;\n  let bEtld: string;\n  try {\n    aEtld = eTldPlusOne(a);\n    bEtld = eTldPlusOne(b);\n  } catch {\n    return false;\n  }\n  return aEtld === bEtld;\n}\n\nfunction extractHost(hostOrUrl: string): string {\n  if (hostOrUrl.includes('://')) {\n    return new URL(hostOrUrl).hostname;\n  }\n  return hostOrUrl;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,mBAAkC;AAElC,0BAAiC;AAE1B,MAAM,uBAAuB;AAE7B,MAAM,6BAA6B,MAAM;AAAA,EAC9C,YACE,SACS,MACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EAJW;AAKb;AAUO,SAAS,YAAY,WAA2B;AACrD,QAAM,WAAO,sCAAiB,YAAY,SAAS,CAAC;AACpD,QAAM,aAAS,aAAAA,OAAS,MAAM,EAAE,qBAAqB,KAAK,CAAC;AAC3D,MAAI,OAAO,MAAM;AACf,UAAM,IAAI,qBAAqB,wCAAwC,EAAE,UAAU,CAAC;AAAA,EACtF;AACA,MAAI,CAAC,OAAO,QAAQ;AAClB,UAAM,IAAI,qBAAqB,6BAA6B,EAAE,UAAU,CAAC;AAAA,EAC3E;AACA,aAAO,sCAAiB,OAAO,MAAM;AACvC;AAOO,SAAS,gBAAgB,GAAW,GAAoB;AAC7D,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,YAAQ,YAAY,CAAC;AACrB,YAAQ,YAAY,CAAC;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,UAAU;AACnB;AAEA,SAAS,YAAY,WAA2B;AAC9C,MAAI,UAAU,SAAS,KAAK,GAAG;AAC7B,WAAO,IAAI,IAAI,SAAS,EAAE;AAAA,EAC5B;AACA,SAAO;AACT;","names":["parseTld"]}
+{"version":3,"sources":["../../../../src/lib/signing/agent-resolver/etld.ts"],"sourcesContent":["/**\n * eTLD+1 computation against a pinned, dated PSL snapshot. Backed by\n * `tldts`, which ships its PSL bundled into the published package — pinning\n * the resolved version in `package-lock.json` pins this repository's snapshot.\n * Runtime PSL fetches are never performed: a runtime fetch creates both a\n * denial-of-service oracle (PSL host outage stalls verification) and a\n * non-deterministic eTLD+1 across deployments running on different snapshot ages\n * (security.mdx §\"Quickstart: implement a `brand_json_url`-based verifier\"\n * step 3).\n *\n * Both ICANN and PRIVATE PSL sections are in scope: platforms like\n * `vercel.app`, `pages.dev`, `github.io` MUST be treated as suffixes so an\n * attacker on `attacker.vercel.app` cannot pretend to share an eTLD+1 with\n * a legitimate publisher on `legit.vercel.app`.\n */\nimport { parse as parseTld } from 'tldts';\n\nimport { canonicalizeHost } from './canonicalize';\n\nexport const PSL_SNAPSHOT_VERSION = 'tldts@7';\n\nexport class EtldComputationError extends Error {\n  constructor(\n    message: string,\n    readonly meta: { hostOrUrl?: string }\n  ) {\n    super(message);\n    this.name = 'EtldComputationError';\n  }\n}\n\n/**\n * Compute eTLD+1 for a hostname or URL. Caller should pass either a bare\n * hostname (`buyer.example.com`) or a full URL (`https://buyer.example.com/mcp`).\n *\n * Returns the registrable domain in canonical form (ASCII-lowercased, IDNA-2008\n * A-label). Throws when the input has no PSL match — typically because the host\n * is an IP literal or a single-label name.\n */\nexport function eTldPlusOne(hostOrUrl: string): string {\n  const host = canonicalizeHost(extractHost(hostOrUrl));\n  const result = parseTld(host, { allowPrivateDomains: true });\n  if (result.isIp) {\n    throw new EtldComputationError(`Cannot compute eTLD+1 for IP literal`, { hostOrUrl });\n  }\n  if (!result.domain) {\n    throw new EtldComputationError(`No PSL match for hostname`, { hostOrUrl });\n  }\n  return canonicalizeHost(result.domain);\n}\n\n/**\n * Convenience: do two hostnames share an eTLD+1? Returns false when either\n * input has no PSL match (rather than throwing) — callers comparing two\n * hostnames typically want a non-match boolean, not an exception.\n */\nexport function sameEtldPlusOne(a: string, b: string): boolean {\n  let aEtld: string;\n  let bEtld: string;\n  try {\n    aEtld = eTldPlusOne(a);\n    bEtld = eTldPlusOne(b);\n  } catch {\n    return false;\n  }\n  return aEtld === bEtld;\n}\n\nfunction extractHost(hostOrUrl: string): string {\n  if (hostOrUrl.includes('://')) {\n    return new URL(hostOrUrl).hostname;\n  }\n  return hostOrUrl;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,mBAAkC;AAElC,0BAAiC;AAE1B,MAAM,uBAAuB;AAE7B,MAAM,6BAA6B,MAAM;AAAA,EAC9C,YACE,SACS,MACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EAJW;AAKb;AAUO,SAAS,YAAY,WAA2B;AACrD,QAAM,WAAO,sCAAiB,YAAY,SAAS,CAAC;AACpD,QAAM,aAAS,aAAAA,OAAS,MAAM,EAAE,qBAAqB,KAAK,CAAC;AAC3D,MAAI,OAAO,MAAM;AACf,UAAM,IAAI,qBAAqB,wCAAwC,EAAE,UAAU,CAAC;AAAA,EACtF;AACA,MAAI,CAAC,OAAO,QAAQ;AAClB,UAAM,IAAI,qBAAqB,6BAA6B,EAAE,UAAU,CAAC;AAAA,EAC3E;AACA,aAAO,sCAAiB,OAAO,MAAM;AACvC;AAOO,SAAS,gBAAgB,GAAW,GAAoB;AAC7D,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,YAAQ,YAAY,CAAC;AACrB,YAAQ,YAAY,CAAC;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,UAAU;AACnB;AAEA,SAAS,YAAY,WAA2B;AAC9C,MAAI,UAAU,SAAS,KAAK,GAAG;AAC7B,WAAO,IAAI,IAAI,SAAS,EAAE;AAAA,EAC5B;AACA,SAAO;AACT;","names":["parseTld"]}

package/dist/lib/signing/agent-resolver/etld.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/signing/agent-resolver/etld.ts"],"sourcesContent":["/**\n * eTLD+1 computation against a pinned, dated PSL snapshot. Backed by\n * `tldts`, which ships its PSL bundled into the published package — pinning\n * the dependency in `package.json` pins the snapshot. Runtime PSL fetches are\n * never performed: a runtime fetch creates both a denial-of-service oracle\n * (PSL host outage stalls verification) and a non-deterministic eTLD+1\n * across deployments running on different snapshot ages\n * (security.mdx §\"Quickstart: implement a `brand_json_url`-based verifier\"\n * step 3).\n *\n * Both ICANN and PRIVATE PSL sections are in scope: platforms like\n * `vercel.app`, `pages.dev`, `github.io` MUST be treated as suffixes so an\n * attacker on `attacker.vercel.app` cannot pretend to share an eTLD+1 with\n * a legitimate publisher on `legit.vercel.app`.\n */\nimport { parse as parseTld } from 'tldts';\n\nimport { canonicalizeHost } from './canonicalize';\n\nexport const PSL_SNAPSHOT_VERSION = 'tldts@7';\n\nexport class EtldComputationError extends Error {\n  constructor(\n    message: string,\n    readonly meta: { hostOrUrl?: string }\n  ) {\n    super(message);\n    this.name = 'EtldComputationError';\n  }\n}\n\n/**\n * Compute eTLD+1 for a hostname or URL. Caller should pass either a bare\n * hostname (`buyer.example.com`) or a full URL (`https://buyer.example.com/mcp`).\n *\n * Returns the registrable domain in canonical form (ASCII-lowercased, IDNA-2008\n * A-label). Throws when the input has no PSL match — typically because the host\n * is an IP literal or a single-label name.\n */\nexport function eTldPlusOne(hostOrUrl: string): string {\n  const host = canonicalizeHost(extractHost(hostOrUrl));\n  const result = parseTld(host, { allowPrivateDomains: true });\n  if (result.isIp) {\n    throw new EtldComputationError(`Cannot compute eTLD+1 for IP literal`, { hostOrUrl });\n  }\n  if (!result.domain) {\n    throw new EtldComputationError(`No PSL match for hostname`, { hostOrUrl });\n  }\n  return canonicalizeHost(result.domain);\n}\n\n/**\n * Convenience: do two hostnames share an eTLD+1? Returns false when either\n * input has no PSL match (rather than throwing) — callers comparing two\n * hostnames typically want a non-match boolean, not an exception.\n */\nexport function sameEtldPlusOne(a: string, b: string): boolean {\n  let aEtld: string;\n  let bEtld: string;\n  try {\n    aEtld = eTldPlusOne(a);\n    bEtld = eTldPlusOne(b);\n  } catch {\n    return false;\n  }\n  return aEtld === bEtld;\n}\n\nfunction extractHost(hostOrUrl: string): string {\n  if (hostOrUrl.includes('://')) {\n    return new URL(hostOrUrl).hostname;\n  }\n  return hostOrUrl;\n}\n"],"mappings":"AAeA,SAAS,SAAS,gBAAgB;AAElC,SAAS,wBAAwB;AAE1B,MAAM,uBAAuB;AAE7B,MAAM,6BAA6B,MAAM;AAAA,EAC9C,YACE,SACS,MACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EAJW;AAKb;AAUO,SAAS,YAAY,WAA2B;AACrD,QAAM,OAAO,iBAAiB,YAAY,SAAS,CAAC;AACpD,QAAM,SAAS,SAAS,MAAM,EAAE,qBAAqB,KAAK,CAAC;AAC3D,MAAI,OAAO,MAAM;AACf,UAAM,IAAI,qBAAqB,wCAAwC,EAAE,UAAU,CAAC;AAAA,EACtF;AACA,MAAI,CAAC,OAAO,QAAQ;AAClB,UAAM,IAAI,qBAAqB,6BAA6B,EAAE,UAAU,CAAC;AAAA,EAC3E;AACA,SAAO,iBAAiB,OAAO,MAAM;AACvC;AAOO,SAAS,gBAAgB,GAAW,GAAoB;AAC7D,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,YAAQ,YAAY,CAAC;AACrB,YAAQ,YAAY,CAAC;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,UAAU;AACnB;AAEA,SAAS,YAAY,WAA2B;AAC9C,MAAI,UAAU,SAAS,KAAK,GAAG;AAC7B,WAAO,IAAI,IAAI,SAAS,EAAE;AAAA,EAC5B;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../../src/lib/signing/agent-resolver/etld.ts"],"sourcesContent":["/**\n * eTLD+1 computation against a pinned, dated PSL snapshot. Backed by\n * `tldts`, which ships its PSL bundled into the published package — pinning\n * the resolved version in `package-lock.json` pins this repository's snapshot.\n * Runtime PSL fetches are never performed: a runtime fetch creates both a\n * denial-of-service oracle (PSL host outage stalls verification) and a\n * non-deterministic eTLD+1 across deployments running on different snapshot ages\n * (security.mdx §\"Quickstart: implement a `brand_json_url`-based verifier\"\n * step 3).\n *\n * Both ICANN and PRIVATE PSL sections are in scope: platforms like\n * `vercel.app`, `pages.dev`, `github.io` MUST be treated as suffixes so an\n * attacker on `attacker.vercel.app` cannot pretend to share an eTLD+1 with\n * a legitimate publisher on `legit.vercel.app`.\n */\nimport { parse as parseTld } from 'tldts';\n\nimport { canonicalizeHost } from './canonicalize';\n\nexport const PSL_SNAPSHOT_VERSION = 'tldts@7';\n\nexport class EtldComputationError extends Error {\n  constructor(\n    message: string,\n    readonly meta: { hostOrUrl?: string }\n  ) {\n    super(message);\n    this.name = 'EtldComputationError';\n  }\n}\n\n/**\n * Compute eTLD+1 for a hostname or URL. Caller should pass either a bare\n * hostname (`buyer.example.com`) or a full URL (`https://buyer.example.com/mcp`).\n *\n * Returns the registrable domain in canonical form (ASCII-lowercased, IDNA-2008\n * A-label). Throws when the input has no PSL match — typically because the host\n * is an IP literal or a single-label name.\n */\nexport function eTldPlusOne(hostOrUrl: string): string {\n  const host = canonicalizeHost(extractHost(hostOrUrl));\n  const result = parseTld(host, { allowPrivateDomains: true });\n  if (result.isIp) {\n    throw new EtldComputationError(`Cannot compute eTLD+1 for IP literal`, { hostOrUrl });\n  }\n  if (!result.domain) {\n    throw new EtldComputationError(`No PSL match for hostname`, { hostOrUrl });\n  }\n  return canonicalizeHost(result.domain);\n}\n\n/**\n * Convenience: do two hostnames share an eTLD+1? Returns false when either\n * input has no PSL match (rather than throwing) — callers comparing two\n * hostnames typically want a non-match boolean, not an exception.\n */\nexport function sameEtldPlusOne(a: string, b: string): boolean {\n  let aEtld: string;\n  let bEtld: string;\n  try {\n    aEtld = eTldPlusOne(a);\n    bEtld = eTldPlusOne(b);\n  } catch {\n    return false;\n  }\n  return aEtld === bEtld;\n}\n\nfunction extractHost(hostOrUrl: string): string {\n  if (hostOrUrl.includes('://')) {\n    return new URL(hostOrUrl).hostname;\n  }\n  return hostOrUrl;\n}\n"],"mappings":"AAeA,SAAS,SAAS,gBAAgB;AAElC,SAAS,wBAAwB;AAE1B,MAAM,uBAAuB;AAE7B,MAAM,6BAA6B,MAAM;AAAA,EAC9C,YACE,SACS,MACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EAJW;AAKb;AAUO,SAAS,YAAY,WAA2B;AACrD,QAAM,OAAO,iBAAiB,YAAY,SAAS,CAAC;AACpD,QAAM,SAAS,SAAS,MAAM,EAAE,qBAAqB,KAAK,CAAC;AAC3D,MAAI,OAAO,MAAM;AACf,UAAM,IAAI,qBAAqB,wCAAwC,EAAE,UAAU,CAAC;AAAA,EACtF;AACA,MAAI,CAAC,OAAO,QAAQ;AAClB,UAAM,IAAI,qBAAqB,6BAA6B,EAAE,UAAU,CAAC;AAAA,EAC3E;AACA,SAAO,iBAAiB,OAAO,MAAM;AACvC;AAOO,SAAS,gBAAgB,GAAW,GAAoB;AAC7D,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,YAAQ,YAAY,CAAC;AACrB,YAAQ,YAAY,CAAC;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,UAAU;AACnB;AAEA,SAAS,YAAY,WAA2B;AAC9C,MAAI,UAAU,SAAS,KAAK,GAAG;AAC7B,WAAO,IAAI,IAAI,SAAS,EAAE;AAAA,EAC5B;AACA,SAAO;AACT;","names":[]}

package/dist/lib/testing/client.d.mts

@@ -54,6 +54,12 @@ export declare function getOrDiscoverProfile(client: TestClient, options: TestOp
     profile: AgentProfile;
     step: TestStepResult;
 }>;
+/**
+ * Reuse the already-observed capability advertisement for signing decisions.
+ * This avoids a second discovery call whose failure could otherwise downgrade
+ * a functional compliance dispatch to unsigned.
+ */
+export declare function seedTestClientSigningCapability(client: TestClient, profile: AgentProfile, adcpVersion?: string): void;
 /**
  * Result of {@link runStep}. The optional `caughtError` carries the raw
  * thrown value (typed `unknown`, narrow via `instanceof` at the call site)

package/dist/lib/testing/client.d.ts

@@ -54,6 +54,12 @@ export declare function getOrDiscoverProfile(client: TestClient, options: TestOp
     profile: AgentProfile;
     step: TestStepResult;
 }>;
+/**
+ * Reuse the already-observed capability advertisement for signing decisions.
+ * This avoids a second discovery call whose failure could otherwise downgrade
+ * a functional compliance dispatch to unsigned.
+ */
+export declare function seedTestClientSigningCapability(client: TestClient, profile: AgentProfile, adcpVersion?: string): void;
 /**
  * Result of {@link runStep}. The optional `caughtError` carries the raw
  * thrown value (typed `unknown`, narrow via `instanceof` at the call site)

package/dist/lib/testing/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/testing/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,KAAK,EAIV,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAc,MAAM,EAAE,MAAM,SAAS,CAAC;AAwB7F;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAU7E;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,CAMjE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,gBAAgB,CAOrE;AAaD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/D;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,GAAE,KAAK,GAAG,KAAa,EAAE,OAAO,GAAE,WAAgB,4BA+G5G;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC7D,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,UAAU,CAEpF;AAED,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,oBAAoB,CAMxG;AA0ED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CAQ1D;AAqDD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,OAAO,CAAC,CAAC,EAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CA4B5B;AA0BD;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,CAAC,EAAE,WAAW;AACpB,iFAAiF;AACjF,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CAgF1D;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAAC,KAAK,EAAE,cAAc,EAAE,CAAA;CAAE,CAAC,CAkF3E;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CAsF/E;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,OAAO,EAAE,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAC3C,UAAU,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,EAAE,cAAc,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B,CAAC,CAoFD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,cAAc,CAqEpH"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/testing/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,KAAK,EAIV,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAc,MAAM,EAAE,MAAM,SAAS,CAAC;AAkC7F;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAU7E;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,CAMjE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,gBAAgB,CAOrE;AAaD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/D;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,GAAE,KAAK,GAAG,KAAa,EAAE,OAAO,GAAE,WAAgB,4BA2H5G;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC7D,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,UAAU,CAEpF;AAED,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,oBAAoB,CAMxG;AAoID;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CAS1D;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAwBrH;AAqDD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,OAAO,CAAC,CAAC,EAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CA4B5B;AA0BD;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,MAAM,CAAC,EAAE,WAAW;AACpB,iFAAiF;AACjF,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CAiF1D;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAAC,KAAK,EAAE,cAAc,EAAE,CAAA;CAAE,CAAC,CAkF3E;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CAsF/E;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,OAAO,EAAE,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAC3C,UAAU,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,EAAE,cAAc,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B,CAAC,CAoFD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,CAAC,EAAE,MAAM,GAAG,cAAc,CAqEpH"}

package/dist/lib/testing/client.js

@@ -31,6 +31,7 @@ __export(client_exports, {
   resolveAuthPrincipal: () => resolveAuthPrincipal,
   resolveBrand: () => resolveBrand,
   runStep: () => runStep,
+  seedTestClientSigningCapability: () => seedTestClientSigningCapability,
   setAgentTesterLogger: () => setAgentTesterLogger,
   validateResponseSchema: () => validateResponseSchema
 });
@@ -45,9 +46,12 @@ var import_capabilities = require('../utils/capabilities.js');
 var import_probe_policy = require('../utils/probe-policy.js');
 var import_ssrf_fetch = require('../net/ssrf-fetch.js');
 var import_version = require('../version.js');
+var import_node_crypto = require("node:crypto");
 var import_client_hooks = require('../validation/client-hooks.js');
 var import_error_extraction = require('../utils/error-extraction.js');
+var import_client = require('../signing/client.js');
 const TEST_CLIENT_VERSION_OPTIONS = /* @__PURE__ */ Symbol("adcp.testClientVersionOptions");
+const TEST_CLIENT_SCOPE_SALT = (0, import_node_crypto.randomBytes)(32);
 function resolveAuthPrincipal(options) {
   if (!options.auth) return void 0;
   switch (options.auth.type) {
@@ -124,6 +128,9 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
       agentConfig.auth_token = options.auth.token;
     }
   }
+  if (options.functional_request_signing) {
+    agentConfig.request_signing = options.functional_request_signing;
+  }
   const multiClient = new import_ADCPMultiAgentClient.ADCPMultiAgentClient([agentConfig], {
     headers,
     validation: {
@@ -138,14 +145,21 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
   });
   const client = multiClient.agent("test");
   const authMode = authReuseMode(options);
+  const requestScopeMode = requestScopeReuseMode(options);
+  const requestSigningMode = requestSigningReuseMode(options.functional_request_signing);
   Object.defineProperty(client, TEST_CLIENT_VERSION_OPTIONS, {
     value: {
+      agentUrl,
+      protocol,
       adcpVersion: multiClient.getAdcpVersion(),
       ...options.wireAdcpVersion !== void 0 && { wireAdcpVersion: options.wireAdcpVersion },
       versionEnvelope: options.versionEnvelope ?? "auto",
       strictResponseSchemaValidation: options.strictResponseSchemaValidation !== false,
       ...authMode !== void 0 && { authMode },
+      ...requestScopeMode !== void 0 && { requestScopeMode },
+      ...requestSigningMode !== void 0 && { requestSigningMode },
       ...options.transport?.trustedFetchFn && { fetchFn: options.transport.trustedFetchFn },
+      ...options.transport?.allowPrivateIp !== void 0 && { allowPrivateIp: options.transport.allowPrivateIp },
       ...options.transport?.maxResponseBytes !== void 0 && {
         maxResponseBytes: options.transport.maxResponseBytes
       },
@@ -162,7 +176,7 @@ function getOrCreateClient(agentUrl, options) {
 }
 function getOrCreateClientResolution(agentUrl, options) {
   const shared = options._client;
-  if (shared && isExecutableTestClient(shared) && testClientMatchesVersionOptions(shared, options)) {
+  if (shared && isExecutableTestClient(shared) && testClientMatchesVersionOptions(shared, agentUrl, options)) {
     return { client: shared, reusedShared: true };
   }
   return { client: createTestClient(agentUrl, options.protocol || "mcp", options), reusedShared: false };
@@ -173,17 +187,19 @@ function isExecutableTestClient(client) {
   if (typeof candidate["executeTask"] === "function" || typeof candidate["resetContext"] === "function") return true;
   return Object.entries(candidate).some(([key, value]) => key !== "getAgentInfo" && typeof value === "function");
 }
-function testClientMatchesVersionOptions(client, options) {
+function testClientMatchesVersionOptions(client, agentUrl, options) {
   const effectiveOptions = withTestKitAuthDefaults(options);
   const meta = client[TEST_CLIENT_VERSION_OPTIONS];
   const expectedAuthMode = authReuseMode(effectiveOptions);
+  const expectedRequestScopeMode = requestScopeReuseMode(effectiveOptions);
+  const expectedRequestSigningMode = requestSigningReuseMode(effectiveOptions.functional_request_signing);
   if (!meta) {
-    return effectiveOptions.adcpVersion === void 0 && effectiveOptions.versionEnvelope === void 0 && effectiveOptions.transport === void 0;
+    return expectedRequestSigningMode === void 0 && effectiveOptions.adcpVersion === void 0 && effectiveOptions.versionEnvelope === void 0 && effectiveOptions.transport === void 0;
   }
   const expectedAdcpVersion = effectiveOptions.adcpVersion ?? import_version.ADCP_VERSION;
   const expectedWireAdcpVersion = effectiveOptions.wireAdcpVersion;
   const expectedVersionEnvelope = effectiveOptions.versionEnvelope ?? "auto";
-  return meta.adcpVersion === expectedAdcpVersion && meta.wireAdcpVersion === expectedWireAdcpVersion && meta.versionEnvelope === expectedVersionEnvelope && meta.strictResponseSchemaValidation === (effectiveOptions.strictResponseSchemaValidation !== false) && meta.authMode === expectedAuthMode && meta.fetchFn === effectiveOptions.transport?.trustedFetchFn && meta.maxResponseBytes === effectiveOptions.transport?.maxResponseBytes && meta.requestTimeoutMs === effectiveOptions.transport?.requestTimeoutMs;
+  return meta.agentUrl === agentUrl && meta.protocol === (effectiveOptions.protocol ?? "mcp") && meta.adcpVersion === expectedAdcpVersion && meta.wireAdcpVersion === expectedWireAdcpVersion && meta.versionEnvelope === expectedVersionEnvelope && meta.strictResponseSchemaValidation === (effectiveOptions.strictResponseSchemaValidation !== false) && meta.authMode === expectedAuthMode && meta.requestScopeMode === expectedRequestScopeMode && meta.requestSigningMode === expectedRequestSigningMode && meta.fetchFn === effectiveOptions.transport?.trustedFetchFn && meta.allowPrivateIp === effectiveOptions.transport?.allowPrivateIp && meta.maxResponseBytes === effectiveOptions.transport?.maxResponseBytes && meta.requestTimeoutMs === effectiveOptions.transport?.requestTimeoutMs;
 }
 function withTestKitAuthDefaults(options) {
   if (options.auth) return options;
@@ -214,8 +230,46 @@ function withTestKitAuthDefaults(options) {
 function authReuseMode(options) {
   return options.auth?.type;
 }
+function requestScopeReuseMode(options) {
+  const headers = options.headers ? Object.fromEntries(
+    Object.entries(options.headers).map(([name, value]) => [name.toLowerCase(), value]).sort(([a], [b]) => a.localeCompare(b))
+  ) : void 0;
+  if (!options.auth && !headers && !options.test_session_id && !options.userAgent) return void 0;
+  return testClientScopeDisambiguator(
+    JSON.stringify({
+      auth: options.auth,
+      headers,
+      testSessionId: options.test_session_id,
+      userAgent: options.userAgent
+    })
+  );
+}
+function testClientScopeDisambiguator(value) {
+  return Buffer.from((0, import_node_crypto.hkdfSync)("sha256", value, TEST_CLIENT_SCOPE_SALT, "adcp-test-client-cache", 8)).toString("hex");
+}
+function requestSigningReuseMode(config) {
+  if (!config) return void 0;
+  const kind = config.kind === "provider" ? "provider" : "inline";
+  const identity = config.kind === "provider" ? {
+    algorithm: config.provider.algorithm,
+    keyid: config.provider.keyid,
+    adcpUse: config.provider.adcpUse,
+    fingerprint: config.provider.fingerprint
+  } : { algorithm: config.alg, keyid: config.kid, privateKey: config.private_key };
+  const fingerprint = (0, import_node_crypto.createHmac)("sha256", "").update(
+    JSON.stringify({
+      identity,
+      agentUrl: config.agent_url,
+      jwksUri: config.jwks_uri,
+      signSupported: config.sign_supported === true,
+      alwaysSign: config.always_sign ?? []
+    })
+  ).digest("hex").slice(0, 16);
+  return `${kind}:${fingerprint}`;
+}
 async function getOrDiscoverProfile(client, options) {
   if (options._profile) {
+    seedTestClientSigningCapability(client, options._profile, options.adcpVersion);
     return {
       profile: options._profile,
       step: { step: "Discover agent capabilities", passed: true, duration_ms: 0 }
@@ -223,6 +277,22 @@ async function getOrDiscoverProfile(client, options) {
   }
   return discoverAgentProfile(client, options.signal, options.adcpVersion);
 }
+function seedTestClientSigningCapability(client, profile, adcpVersion) {
+  const raw = profile.raw_capabilities;
+  if (!raw || typeof raw !== "object") return;
+  const clientAccess = client;
+  if (typeof clientAccess.getAgent !== "function") return;
+  const agent = clientAccess.getAgent.call(client);
+  const meta = client[TEST_CLIENT_VERSION_OPTIONS];
+  const effectiveVersion = meta?.wireAdcpVersion ?? meta?.adcpVersion ?? (typeof clientAccess.getAdcpVersion === "function" ? clientAccess.getAdcpVersion.call(client) : void 0) ?? adcpVersion;
+  const signingContext = (0, import_client.buildAgentSigningContext)(agent, { adcpVersion: effectiveVersion });
+  if (!signingContext) return;
+  signingContext.cache.set(signingContext.capabilityCacheKey, {
+    requestSigning: raw.request_signing,
+    adcpVersion: profile.adcp_major_versions?.[0],
+    fetchedAt: Math.floor(Date.now() / 1e3)
+  });
+}
 function raceWithSignal(promise, signal) {
   if (!signal) return promise;
   if (signal.aborted) {
@@ -354,6 +424,7 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
       profile.capabilities_probe_error = err?.message || String(err);
     }
   }
+  seedTestClientSigningCapability(client, profile, schemaAdcpVersion);
   return { profile, step };
 }
 async function discoverAgentCapabilities(client, profile, options) {
@@ -667,6 +738,7 @@ function zodCodeToKeyword(code) {
   resolveAuthPrincipal,
   resolveBrand,
   runStep,
+  seedTestClientSigningCapability,
   setAgentTesterLogger,
   validateResponseSchema
 });