@adcp/sdk 14.0.0 → 14.1.0

package/dist/lib/protocols/a2a.mjs

@@ -23,6 +23,7 @@ import { createSigningFetch } from "../signing/fetch.mjs";
 import { createSigningFetchAsync } from "../signing/fetch-async.mjs";
 import { redactArgsForLog } from "../utils/redact-args.mjs";
 import { wrapFetchWithCapture } from "./rawResponseCapture.mjs";
+import { getSignedRequestRejection, wrapFetchWithSignedRequestRejection } from "./signedRequestRejection.mjs";
 import { wrapFetchWithSizeLimit } from "./responseSizeLimit.mjs";
 import { wrapFetchWithTransportDiagnostics } from "./transportDiagnostics.mjs";
 import { DEFAULT_REQUEST_TIMEOUT_MS, resolveRequestTimeoutMs, withAbortSignal } from "./abort.mjs";
@@ -306,6 +307,7 @@ function buildFetchImpl(authToken, agentUrl) {
   const networkFetch = wrapFetchWithTransportDiagnostics(
     wrapFetchWithSizeLimit((input, init) => pinnedFetch(input, init))
   );
+  const rejectionFetch = signingContext ? wrapFetchWithSignedRequestRejection(networkFetch, agentUrl) : networkFetch;
   const baseFetch = async (url, options) => {
     const context = callContextStorage.getStore();
     const urlString = typeof url === "string" ? url : url instanceof URL ? url.toString() : url.url;
@@ -354,7 +356,11 @@ function buildFetchImpl(authToken, agentUrl) {
     const response = await withAbortSignal(
       [context?.signal, options?.signal],
       requestTimeoutMs,
-      (signal) => networkFetch(url, { ...options, headers, signal })
+      (signal) => rejectionFetch(url, {
+        ...options,
+        headers,
+        signal
+      })
     );
     if (response.status === 401 && context) {
       context.got401Ref.value = true;
@@ -532,6 +538,8 @@ async function callA2AToolImpl(agentUrl, toolName, parameters, authToken, debugL
         message: `A2A: Authentication required for ${agentUrl}`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
+      const signedRejection = getSignedRequestRejection(error);
+      if (signedRejection) throw signedRejection;
       const challenge = await probeAuthChallenge(agentUrl, {
         fetchFn: context.fetchFn,
         allowPrivateIp: context.allowPrivateIp ?? isLikelyPrivateUrl(agentUrl)

package/dist/lib/protocols/index.js

@@ -68,6 +68,7 @@ var import_oauth = require('../auth/oauth/index.js');
 var import_authorization_required = require('../auth/oauth/authorization-required.js');
 var import_provider_cache = require('../auth/oauth/provider-cache.js');
 var import_errors = require('../errors/index.js');
+var import_signedRequestRejection = require('./signedRequestRejection.js');
 var import_net = require('../net/index.js');
 var import_validation = require('../validation/index.js');
 var import_tracing = require('../observability/tracing.js');
@@ -369,7 +370,7 @@ class ProtocolClient {
                   }
                 );
               } catch (err) {
-                if (agent.oauth_client_credentials && (0, import_errors.is401Error)(err)) {
+                if (agent.oauth_client_credentials && (0, import_errors.is401Error)(err) && (0, import_signedRequestRejection.getSignedRequestRejection)(err)?.challenge?.scheme !== "signature") {
                   const ccStorage = (0, import_oauth.getAgentStorage)(agent);
                   const allowPrivateIp = transport?.allowPrivateIp ?? (0, import_net.isLikelyPrivateUrl)(agent.agent_uri);
                   await (0, import_oauth.ensureClientCredentialsTokens)(agent, {
@@ -401,6 +402,8 @@ class ProtocolClient {
                       }
                     );
                   } catch (retryErr) {
+                    const rejection = (0, import_signedRequestRejection.getSignedRequestRejection)(retryErr) ?? ((0, import_errors.is401Error)(retryErr) ? (0, import_signedRequestRejection.getSignedRequestRejection)(err) : void 0);
+                    if (rejection) throw rejection;
                     await rethrowAsNeedsAuthorization(
                       retryErr,
                       agent.agent_uri,
@@ -441,7 +444,7 @@ class ProtocolClient {
                   transport?.legacyCompat
                 );
               } catch (err) {
-                if (agent.oauth_client_credentials && (0, import_errors.is401Error)(err)) {
+                if (agent.oauth_client_credentials && (0, import_errors.is401Error)(err) && (0, import_signedRequestRejection.getSignedRequestRejection)(err)?.challenge?.scheme !== "signature") {
                   const ccStorage = (0, import_oauth.getAgentStorage)(agent);
                   const allowPrivateIp = transport?.allowPrivateIp ?? (0, import_net.isLikelyPrivateUrl)(agent.agent_uri);
                   await (0, import_oauth.ensureClientCredentialsTokens)(agent, {
@@ -470,6 +473,8 @@ class ProtocolClient {
                       transport?.legacyCompat
                     );
                   } catch (retryErr) {
+                    const rejection = (0, import_signedRequestRejection.getSignedRequestRejection)(retryErr) ?? ((0, import_errors.is401Error)(retryErr) ? (0, import_signedRequestRejection.getSignedRequestRejection)(err) : void 0);
+                    if (rejection) throw rejection;
                     await rethrowAsNeedsAuthorization(
                       retryErr,
                       agent.agent_uri,
@@ -501,6 +506,8 @@ class ProtocolClient {
   }
 }
 async function rethrowAsNeedsAuthorization(err, agentUrl, fetchFn, signal, configuredAllowPrivateIp, recoveryMode = "discover") {
+  const signedRejection = (0, import_signedRequestRejection.getSignedRequestRejection)(err);
+  if (signedRejection) throw signedRejection;
   if (err instanceof import_oauth.NeedsAuthorizationError) throw err;
   if (!(0, import_errors.is401Error)(err)) return;
   if (recoveryMode === "static") {

package/dist/lib/protocols/index.mjs

@@ -53,6 +53,7 @@ import {
 import { hasValidatedMcpAuthorizationRequirements } from "../auth/oauth/authorization-required.mjs";
 import { getNonInteractiveOAuthProvider } from "../auth/oauth/provider-cache.mjs";
 import { AuthenticationCredentialsRejectedError, is401Error } from "../errors/index.mjs";
+import { getSignedRequestRejection } from "./signedRequestRejection.mjs";
 import { isLikelyPrivateUrl } from "../net/index.mjs";
 import { validateAgentUrl } from "../validation/index.mjs";
 import { withSpan } from "../observability/tracing.mjs";
@@ -349,7 +350,7 @@ class ProtocolClient {
                   }
                 );
               } catch (err) {
-                if (agent.oauth_client_credentials && is401Error(err)) {
+                if (agent.oauth_client_credentials && is401Error(err) && getSignedRequestRejection(err)?.challenge?.scheme !== "signature") {
                   const ccStorage = getAgentStorage(agent);
                   const allowPrivateIp = transport?.allowPrivateIp ?? isLikelyPrivateUrl(agent.agent_uri);
                   await ensureClientCredentialsTokens(agent, {
@@ -381,6 +382,8 @@ class ProtocolClient {
                       }
                     );
                   } catch (retryErr) {
+                    const rejection = getSignedRequestRejection(retryErr) ?? (is401Error(retryErr) ? getSignedRequestRejection(err) : void 0);
+                    if (rejection) throw rejection;
                     await rethrowAsNeedsAuthorization(
                       retryErr,
                       agent.agent_uri,
@@ -421,7 +424,7 @@ class ProtocolClient {
                   transport?.legacyCompat
                 );
               } catch (err) {
-                if (agent.oauth_client_credentials && is401Error(err)) {
+                if (agent.oauth_client_credentials && is401Error(err) && getSignedRequestRejection(err)?.challenge?.scheme !== "signature") {
                   const ccStorage = getAgentStorage(agent);
                   const allowPrivateIp = transport?.allowPrivateIp ?? isLikelyPrivateUrl(agent.agent_uri);
                   await ensureClientCredentialsTokens(agent, {
@@ -450,6 +453,8 @@ class ProtocolClient {
                       transport?.legacyCompat
                     );
                   } catch (retryErr) {
+                    const rejection = getSignedRequestRejection(retryErr) ?? (is401Error(retryErr) ? getSignedRequestRejection(err) : void 0);
+                    if (rejection) throw rejection;
                     await rethrowAsNeedsAuthorization(
                       retryErr,
                       agent.agent_uri,
@@ -481,6 +486,8 @@ class ProtocolClient {
   }
 }
 async function rethrowAsNeedsAuthorization(err, agentUrl, fetchFn, signal, configuredAllowPrivateIp, recoveryMode = "discover") {
+  const signedRejection = getSignedRequestRejection(err);
+  if (signedRejection) throw signedRejection;
   if (err instanceof NeedsAuthorizationError) throw err;
   if (!is401Error(err)) return;
   if (recoveryMode === "static") {

package/dist/lib/protocols/mcp-modern.js

@@ -34,6 +34,7 @@ var import_session_termination = require('./session-termination.js');
 var import_client2 = require('../signing/client.js');
 var import_abort = require('./abort.js');
 var import_rawResponseCapture = require('./rawResponseCapture.js');
+var import_signedRequestRejection = require('./signedRequestRejection.js');
 var import_responseSizeLimit = require('./responseSizeLimit.js');
 var import_transportDiagnostics = require('./transportDiagnostics.js');
 var import_agent_transport_fetch = require('../net/agent-transport-fetch.js');
@@ -228,7 +229,7 @@ async function createNegotiatedClient(cacheKey, options, authHeaders, useCachedD
   const networkFetch = (input, init) => (0, import_abort.withAbortSignal)([init?.signal], requestTimeoutMs, (signal) => rawNetworkFetch(input, { ...init, signal }));
   const diagnosticFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)((0, import_responseSizeLimit.wrapFetchWithSizeLimit)(networkFetch));
   const signedFetch = options.signingContext ? (0, import_client2.buildAgentSigningFetch)({
-    upstream: diagnosticFetch,
+    upstream: (0, import_signedRequestRejection.wrapFetchWithSignedRequestRejection)(diagnosticFetch, options.agentUrl),
     signing: options.signingContext.signing,
     getCapability: options.signingContext.getCapability,
     adcpVersion: options.signingContext.adcpVersion

package/dist/lib/protocols/mcp-modern.mjs

@@ -28,6 +28,7 @@ import {
   withAbortSignal
 } from "./abort.mjs";
 import { wrapFetchWithCapture } from "./rawResponseCapture.mjs";
+import { wrapFetchWithSignedRequestRejection } from "./signedRequestRejection.mjs";
 import { wrapFetchWithSizeLimit } from "./responseSizeLimit.mjs";
 import { wrapFetchWithTransportDiagnostics } from "./transportDiagnostics.mjs";
 import { createAgentTransportFetch } from "../net/agent-transport-fetch.mjs";
@@ -222,7 +223,7 @@ async function createNegotiatedClient(cacheKey, options, authHeaders, useCachedD
   const networkFetch = (input, init) => withAbortSignal([init?.signal], requestTimeoutMs, (signal) => rawNetworkFetch(input, { ...init, signal }));
   const diagnosticFetch = wrapFetchWithTransportDiagnostics(wrapFetchWithSizeLimit(networkFetch));
   const signedFetch = options.signingContext ? buildAgentSigningFetch({
-    upstream: diagnosticFetch,
+    upstream: wrapFetchWithSignedRequestRejection(diagnosticFetch, options.agentUrl),
     signing: options.signingContext.signing,
     getCapability: options.signingContext.getCapability,
     adcpVersion: options.signingContext.adcpVersion

package/dist/lib/protocols/mcp.js

@@ -40,6 +40,7 @@ var import_tracing = require('../observability/tracing.js');
 var import_client2 = require('../signing/client.js');
 var import_redact_args = require('../utils/redact-args.js');
 var import_rawResponseCapture = require('./rawResponseCapture.js');
+var import_signedRequestRejection = require('./signedRequestRejection.js');
 var import_responseSizeLimit = require('./responseSizeLimit.js');
 var import_transportDiagnostics = require('./transportDiagnostics.js');
 var import_abort = require('./abort.js');
@@ -482,7 +483,7 @@ async function connectMCPWithFallbackImpl(url, authHeaders, debugLogs = [], labe
   const sizeLimited = (0, import_responseSizeLimit.wrapFetchWithSizeLimit)(networkFetch);
   const diagnosticFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)(sizeLimited);
   const baseFetch = signingContext ? (0, import_client2.buildAgentSigningFetch)({
-    upstream: diagnosticFetch,
+    upstream: (0, import_signedRequestRejection.wrapFetchWithSignedRequestRejection)(diagnosticFetch, url.toString()),
     signing: signingContext.signing,
     getCapability: signingContext.getCapability,
     adcpVersion: signingContext.adcpVersion
@@ -771,7 +772,7 @@ async function connectMCP(options) {
   );
   const diagnosticFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)(sizeLimited);
   const signedFetch = signingContext ? (0, import_client2.buildAgentSigningFetch)({
-    upstream: diagnosticFetch,
+    upstream: (0, import_signedRequestRejection.wrapFetchWithSignedRequestRejection)(diagnosticFetch, agentUrl),
     signing: signingContext.signing,
     getCapability: signingContext.getCapability,
     adcpVersion: signingContext.adcpVersion
@@ -788,6 +789,8 @@ async function connectMCP(options) {
     });
     return { client: mcpClient, transport };
   } catch (error) {
+    const signedRejection = (0, import_signedRequestRejection.getSignedRequestRejection)(error);
+    if (signedRejection) throw signedRejection;
     if (authProvider && error instanceof import_auth.UnauthorizedError) {
       debugLogs.push({
         type: "info",

package/dist/lib/protocols/mcp.mjs

@@ -17,6 +17,7 @@ import { withSpan, injectTraceHeaders } from "../observability/tracing.mjs";
 import { buildAgentSigningFetch, signingContextStorage } from "../signing/client.mjs";
 import { redactArgsForLog } from "../utils/redact-args.mjs";
 import { wrapFetchWithCapture } from "./rawResponseCapture.mjs";
+import { getSignedRequestRejection, wrapFetchWithSignedRequestRejection } from "./signedRequestRejection.mjs";
 import { wrapFetchWithSizeLimit } from "./responseSizeLimit.mjs";
 import { sanitizeTransportUrl, wrapFetchWithTransportDiagnostics } from "./transportDiagnostics.mjs";
 import {
@@ -469,7 +470,7 @@ async function connectMCPWithFallbackImpl(url, authHeaders, debugLogs = [], labe
   const sizeLimited = wrapFetchWithSizeLimit(networkFetch);
   const diagnosticFetch = wrapFetchWithTransportDiagnostics(sizeLimited);
   const baseFetch = signingContext ? buildAgentSigningFetch({
-    upstream: diagnosticFetch,
+    upstream: wrapFetchWithSignedRequestRejection(diagnosticFetch, url.toString()),
     signing: signingContext.signing,
     getCapability: signingContext.getCapability,
     adcpVersion: signingContext.adcpVersion
@@ -758,7 +759,7 @@ async function connectMCP(options) {
   );
   const diagnosticFetch = wrapFetchWithTransportDiagnostics(sizeLimited);
   const signedFetch = signingContext ? buildAgentSigningFetch({
-    upstream: diagnosticFetch,
+    upstream: wrapFetchWithSignedRequestRejection(diagnosticFetch, agentUrl),
     signing: signingContext.signing,
     getCapability: signingContext.getCapability,
     adcpVersion: signingContext.adcpVersion
@@ -775,6 +776,8 @@ async function connectMCP(options) {
     });
     return { client: mcpClient, transport };
   } catch (error) {
+    const signedRejection = getSignedRequestRejection(error);
+    if (signedRejection) throw signedRejection;
     if (authProvider && error instanceof UnauthorizedError) {
       debugLogs.push({
         type: "info",

package/dist/lib/protocols/rawResponseCapture.d.mts

@@ -55,4 +55,10 @@ export declare function getCapturesFromError(err: unknown): RawHttpCapture[] | u
  * slot is set.
  */
 export declare function wrapFetchWithCapture(upstream: typeof fetch): typeof fetch;
+/** Record an already bounded response without cloning or reading its stream. */
+export declare function recordRawResponseCapture(input: RequestInfo | URL, init: RequestInit | undefined, response: Response, body: string, bodyTruncated: boolean, startedAt: number, safeMetadata?: {
+    url?: string;
+    headers?: Record<string, string>;
+    latencyMs?: number;
+}): void;
 export {};

package/dist/lib/protocols/rawResponseCapture.d.ts

@@ -55,4 +55,10 @@ export declare function getCapturesFromError(err: unknown): RawHttpCapture[] | u
  * slot is set.
  */
 export declare function wrapFetchWithCapture(upstream: typeof fetch): typeof fetch;
+/** Record an already bounded response without cloning or reading its stream. */
+export declare function recordRawResponseCapture(input: RequestInfo | URL, init: RequestInit | undefined, response: Response, body: string, bodyTruncated: boolean, startedAt: number, safeMetadata?: {
+    url?: string;
+    headers?: Record<string, string>;
+    latencyMs?: number;
+}): void;
 export {};

package/dist/lib/protocols/rawResponseCapture.js

@@ -21,6 +21,7 @@ __export(rawResponseCapture_exports, {
   getCaptureOverflowFromError: () => getCaptureOverflowFromError,
   getCapturesFromError: () => getCapturesFromError,
   rawResponseCaptureStorage: () => rawResponseCaptureStorage,
+  recordRawResponseCapture: () => recordRawResponseCapture,
   withRawResponseCapture: () => withRawResponseCapture,
   wrapFetchWithCapture: () => wrapFetchWithCapture
 });
@@ -88,44 +89,54 @@ function wrapFetchWithCapture(upstream) {
   const wrapped = async (input, init) => {
     const slot = rawResponseCaptureStorage.getStore();
     if (!slot) return upstream(input, init);
-    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-    const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
-    const requestMetadata = extractSafeRequestMetadata(init?.body, slot.maxBodyBytes);
     const startedAt = Date.now();
     const response = await upstream(input, init);
     const latencyMs = Date.now() - startedAt;
     const cloneForRead = response.clone();
     const { body, bodyTruncated } = await readBodyBounded(cloneForRead, slot.maxBodyBytes);
-    const headers = {};
-    response.headers.forEach((value, key) => {
-      const lower = key.toLowerCase();
-      headers[key] = REDACTED_HEADER_NAMES.has(lower) ? REDACTED_PLACEHOLDER : value;
-    });
-    if (slot.maxCaptures !== void 0 && slot.captures.length >= slot.maxCaptures) {
-      slot.overflowed ??= "captures";
-      return response;
-    }
-    const redactedBody = redactBearerInBody(body);
-    if (slot.maxTotalBodyBytes !== void 0 && slot.totalBodyBytes + redactedBody.length > slot.maxTotalBodyBytes) {
-      slot.overflowed ??= "bytes";
-      return response;
-    }
-    slot.totalBodyBytes += redactedBody.length;
-    slot.captures.push({
-      url,
-      method,
-      ...requestMetadata,
-      status: response.status,
-      headers,
-      body: redactedBody,
-      latencyMs,
-      timestamp: new Date(startedAt).toISOString(),
-      bodyTruncated
-    });
+    recordRawResponseCapture(input, init, response, body, bodyTruncated, startedAt, { latencyMs });
     return response;
   };
   return wrapped;
 }
+function recordRawResponseCapture(input, init, response, body, bodyTruncated, startedAt, safeMetadata) {
+  const slot = rawResponseCaptureStorage.getStore();
+  if (!slot) return;
+  const url = safeMetadata?.url ?? (typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url);
+  const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+  const requestMetadata = extractSafeRequestMetadata(init?.body, slot.maxBodyBytes);
+  const latencyMs = safeMetadata?.latencyMs ?? Date.now() - startedAt;
+  if (body.length > slot.maxBodyBytes) {
+    body = body.slice(0, slot.maxBodyBytes);
+    bodyTruncated = true;
+  }
+  const headers = {};
+  response.headers.forEach((value, key) => {
+    const lower = key.toLowerCase();
+    headers[key] = REDACTED_HEADER_NAMES.has(lower) ? REDACTED_PLACEHOLDER : value;
+  });
+  if (slot.maxCaptures !== void 0 && slot.captures.length >= slot.maxCaptures) {
+    slot.overflowed ??= "captures";
+    return;
+  }
+  const redactedBody = redactBearerInBody(body);
+  if (slot.maxTotalBodyBytes !== void 0 && slot.totalBodyBytes + redactedBody.length > slot.maxTotalBodyBytes) {
+    slot.overflowed ??= "bytes";
+    return;
+  }
+  slot.totalBodyBytes += redactedBody.length;
+  slot.captures.push({
+    url,
+    method,
+    ...requestMetadata,
+    status: response.status,
+    headers: safeMetadata?.headers ?? headers,
+    body: redactedBody,
+    latencyMs,
+    timestamp: new Date(startedAt).toISOString(),
+    bodyTruncated
+  });
+}
 function extractSafeRequestMetadata(body, maxBodyBytes) {
   if (typeof body !== "string" || body.length > maxBodyBytes) return {};
   let parsed;
@@ -175,6 +186,7 @@ async function readBodyBounded(response, maxBodyBytes) {
   getCaptureOverflowFromError,
   getCapturesFromError,
   rawResponseCaptureStorage,
+  recordRawResponseCapture,
   withRawResponseCapture,
   wrapFetchWithCapture
 });

package/dist/lib/protocols/rawResponseCapture.mjs

@@ -66,44 +66,54 @@ function wrapFetchWithCapture(upstream) {
   const wrapped = async (input, init) => {
     const slot = rawResponseCaptureStorage.getStore();
     if (!slot) return upstream(input, init);
-    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-    const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
-    const requestMetadata = extractSafeRequestMetadata(init?.body, slot.maxBodyBytes);
     const startedAt = Date.now();
     const response = await upstream(input, init);
     const latencyMs = Date.now() - startedAt;
     const cloneForRead = response.clone();
     const { body, bodyTruncated } = await readBodyBounded(cloneForRead, slot.maxBodyBytes);
-    const headers = {};
-    response.headers.forEach((value, key) => {
-      const lower = key.toLowerCase();
-      headers[key] = REDACTED_HEADER_NAMES.has(lower) ? REDACTED_PLACEHOLDER : value;
-    });
-    if (slot.maxCaptures !== void 0 && slot.captures.length >= slot.maxCaptures) {
-      slot.overflowed ??= "captures";
-      return response;
-    }
-    const redactedBody = redactBearerInBody(body);
-    if (slot.maxTotalBodyBytes !== void 0 && slot.totalBodyBytes + redactedBody.length > slot.maxTotalBodyBytes) {
-      slot.overflowed ??= "bytes";
-      return response;
-    }
-    slot.totalBodyBytes += redactedBody.length;
-    slot.captures.push({
-      url,
-      method,
-      ...requestMetadata,
-      status: response.status,
-      headers,
-      body: redactedBody,
-      latencyMs,
-      timestamp: new Date(startedAt).toISOString(),
-      bodyTruncated
-    });
+    recordRawResponseCapture(input, init, response, body, bodyTruncated, startedAt, { latencyMs });
     return response;
   };
   return wrapped;
 }
+function recordRawResponseCapture(input, init, response, body, bodyTruncated, startedAt, safeMetadata) {
+  const slot = rawResponseCaptureStorage.getStore();
+  if (!slot) return;
+  const url = safeMetadata?.url ?? (typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url);
+  const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+  const requestMetadata = extractSafeRequestMetadata(init?.body, slot.maxBodyBytes);
+  const latencyMs = safeMetadata?.latencyMs ?? Date.now() - startedAt;
+  if (body.length > slot.maxBodyBytes) {
+    body = body.slice(0, slot.maxBodyBytes);
+    bodyTruncated = true;
+  }
+  const headers = {};
+  response.headers.forEach((value, key) => {
+    const lower = key.toLowerCase();
+    headers[key] = REDACTED_HEADER_NAMES.has(lower) ? REDACTED_PLACEHOLDER : value;
+  });
+  if (slot.maxCaptures !== void 0 && slot.captures.length >= slot.maxCaptures) {
+    slot.overflowed ??= "captures";
+    return;
+  }
+  const redactedBody = redactBearerInBody(body);
+  if (slot.maxTotalBodyBytes !== void 0 && slot.totalBodyBytes + redactedBody.length > slot.maxTotalBodyBytes) {
+    slot.overflowed ??= "bytes";
+    return;
+  }
+  slot.totalBodyBytes += redactedBody.length;
+  slot.captures.push({
+    url,
+    method,
+    ...requestMetadata,
+    status: response.status,
+    headers: safeMetadata?.headers ?? headers,
+    body: redactedBody,
+    latencyMs,
+    timestamp: new Date(startedAt).toISOString(),
+    bodyTruncated
+  });
+}
 function extractSafeRequestMetadata(body, maxBodyBytes) {
   if (typeof body !== "string" || body.length > maxBodyBytes) return {};
   let parsed;
@@ -152,6 +162,7 @@ export {
   getCaptureOverflowFromError,
   getCapturesFromError,
   rawResponseCaptureStorage,
+  recordRawResponseCapture,
   withRawResponseCapture,
   wrapFetchWithCapture
 };

package/dist/lib/protocols/signedRequestRejection.d.mts

@@ -0,0 +1,9 @@
+import { AuthenticationRequiredError } from '../errors/index.mjs';
+/**
+ * Install below the SDK signer, on the actual outbound transport. Only a
+ * request carrying Signature is classified as signed; signing configuration
+ * alone says nothing about unsigned discovery/housekeeping calls.
+ */
+export declare function wrapFetchWithSignedRequestRejection(upstream: typeof fetch, agentUrl?: string): typeof fetch;
+/** Official clients may retain fetch failures under a transport error cause. */
+export declare function getSignedRequestRejection(error: unknown): AuthenticationRequiredError | undefined;

package/dist/lib/protocols/signedRequestRejection.d.ts

@@ -0,0 +1,9 @@
+import { AuthenticationRequiredError } from '../errors';
+/**
+ * Install below the SDK signer, on the actual outbound transport. Only a
+ * request carrying Signature is classified as signed; signing configuration
+ * alone says nothing about unsigned discovery/housekeeping calls.
+ */
+export declare function wrapFetchWithSignedRequestRejection(upstream: typeof fetch, agentUrl?: string): typeof fetch;
+/** Official clients may retain fetch failures under a transport error cause. */
+export declare function getSignedRequestRejection(error: unknown): AuthenticationRequiredError | undefined;