@adcp/sdk 14.0.0 → 14.1.0

package/dist/lib/protocols/signedRequestRejection.js

@@ -0,0 +1,209 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var signedRequestRejection_exports = {};
+__export(signedRequestRejection_exports, {
+  getSignedRequestRejection: () => getSignedRequestRejection,
+  wrapFetchWithSignedRequestRejection: () => wrapFetchWithSignedRequestRejection
+});
+module.exports = __toCommonJS(signedRequestRejection_exports);
+var import_errors = require('../errors/index.js');
+var import_enums = require('../types/enums.generated.js');
+var import_diagnostics = require('../auth/oauth/diagnostics.js');
+var import_transportDiagnostics = require('./transportDiagnostics.js');
+var import_rawResponseCapture = require('./rawResponseCapture.js');
+const CAPTURE_BYTES = 16 * 1024;
+const EXCERPT_LENGTH = 2048;
+const CAPTURE_TIMEOUT_MS = 1e3;
+const PUBLIC_HEADERS = /* @__PURE__ */ new Set([
+  "accept",
+  "content-type",
+  "content-length",
+  "user-agent",
+  "host",
+  "a2a-version",
+  "a2a-extensions",
+  "adcp-version",
+  "mcp-protocol-version",
+  "mcp-session-id",
+  "traceparent",
+  "tracestate",
+  "signature",
+  "signature-input",
+  "content-digest"
+]);
+function wrapFetchWithSignedRequestRejection(upstream, agentUrl) {
+  return async (input, init) => {
+    const startedAt = Date.now();
+    const response = await upstream(input, init);
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+    if (response.status !== 401 || !headers.has("signature")) return response;
+    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    const parsed = (0, import_diagnostics.parseWWWAuthenticate)(response.headers.get("www-authenticate"));
+    if (parsed && parsed.scheme !== "signature") return response;
+    const knownCode = parsed?.scheme === "signature" && parsed.error && Object.prototype.hasOwnProperty.call(import_enums.RequestSigningErrorCodeMetadata, parsed.error);
+    const challenge = parsed ? { scheme: parsed.scheme.slice(0, 64), ...knownCode && { error: parsed.error } } : void 0;
+    const secrets = getHeaderSecrets(headers);
+    const captured = await captureBody(response, secrets, init?.signal);
+    const captureHeaders = (0, import_transportDiagnostics.sanitizeTransportHeaders)(response.headers);
+    for (const key of Object.keys(captureHeaders)) {
+      captureHeaders[key] = redactReflected(captureHeaders[key], secrets);
+    }
+    if (parsed) captureHeaders["www-authenticate"] = knownCode ? `Signature error="${parsed.error}"` : "Signature";
+    (0, import_rawResponseCapture.recordRawResponseCapture)(input, init, response, captured?.body ?? "", captured?.truncated ?? true, startedAt, {
+      url: (0, import_transportDiagnostics.sanitizeTransportUrl)(url),
+      headers: captureHeaders
+    });
+    const body = captured?.body;
+    let excerpt = body;
+    if (body && body.length > EXCERPT_LENGTH) {
+      let end = EXCERPT_LENGTH - 1;
+      if (/[\uD800-\uDBFF]/.test(body[end - 1])) end--;
+      excerpt = body.slice(0, end) + "\u2026";
+    }
+    throw new import_errors.AuthenticationRequiredError((0, import_transportDiagnostics.sanitizeTransportUrl)(agentUrl ?? url), void 0, void 0, challenge, {
+      status: response.status,
+      responseBody: excerpt
+    });
+  };
+}
+function getSignedRequestRejection(error) {
+  const seen = /* @__PURE__ */ new Set();
+  while (error && typeof error === "object" && !seen.has(error)) {
+    seen.add(error);
+    if (error instanceof import_errors.AuthenticationRequiredError && error.requestSigned) return error;
+    error = error.cause;
+  }
+  return void 0;
+}
+function getHeaderSecrets(headers) {
+  const secrets = [];
+  headers.forEach((value, name) => {
+    if (value && !PUBLIC_HEADERS.has(name)) {
+      secrets.push(value);
+      if (/^(authorization|proxy-authorization)$/i.test(name)) {
+        const credential = value.replace(/^\S+\s+/, "");
+        if (credential) secrets.push(credential);
+      }
+    }
+  });
+  return secrets;
+}
+function redactReflected(value, secrets) {
+  const mask = new Uint8Array(value.length);
+  for (const secret of secrets) {
+    for (let from = 0; from < value.length; ) {
+      const at = value.indexOf(secret, from);
+      if (at < 0) break;
+      mask.fill(1, at, at + secret.length);
+      from = at + 1;
+    }
+  }
+  let out = "";
+  let cursor = 0;
+  for (let at = 0; at < value.length; ) {
+    if (!mask[at]) {
+      at++;
+      continue;
+    }
+    out += value.slice(cursor, at) + "[redacted]";
+    while (at < value.length && mask[at]) at++;
+    cursor = at;
+  }
+  return out + value.slice(cursor);
+}
+async function captureBody(response, secrets, signal) {
+  if (!response.body) return void 0;
+  const reader = response.body.getReader();
+  let timer;
+  let cancelled = false;
+  const cancel = () => {
+    cancelled = true;
+    void reader.cancel().catch(() => {
+    });
+  };
+  signal?.addEventListener("abort", cancel, { once: true });
+  if (signal?.aborted) cancel();
+  try {
+    return await Promise.race([
+      (async () => {
+        const chunks = [];
+        let bytes = 0;
+        while (true) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          if (bytes + value.byteLength > CAPTURE_BYTES) {
+            return { body: "[seller response exceeds diagnostic capture limit]", truncated: true };
+          }
+          chunks.push(value);
+          bytes += value.byteLength;
+        }
+        if (cancelled) return void 0;
+        let text = Buffer.concat(chunks).toString("utf8");
+        const redact = (value) => redactReflected(value, secrets);
+        if (/^\s*[{["]/.test(text)) {
+          try {
+            const valueRedacted = JSON.stringify(
+              JSON.parse(text, (_key, value) => {
+                if (typeof value === "string") return redact(value);
+                if ((typeof value === "boolean" || value === null) && secrets.includes(String(value)))
+                  return "[redacted]";
+                if (typeof value === "number" && secrets.some((secret) => /^-?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(secret) && Number(secret) === value))
+                  return "[redacted]";
+                return value;
+              })
+            );
+            text = JSON.stringify(
+              JSON.parse((0, import_transportDiagnostics.redactSensitiveJsonOrText)(valueRedacted), (_key, value) => {
+                if (value && typeof value === "object" && !Array.isArray(value)) {
+                  const out = /* @__PURE__ */ Object.create(null);
+                  for (const key of Object.keys(value)) out[redact(key)] = value[key];
+                  return out;
+                }
+                return value;
+              })
+            );
+          } catch {
+            return { body: "[seller response is not valid diagnostic JSON]", truncated: true };
+          }
+        } else {
+          text = redact(text);
+        }
+        text = (0, import_transportDiagnostics.redactSensitiveJsonOrText)(text).replace(/[\u0000-\u001f\u007f]/g, " ");
+        return { body: text, truncated: false };
+      })(),
+      new Promise((resolve) => {
+        timer = setTimeout(() => {
+          cancel();
+          resolve(void 0);
+        }, CAPTURE_TIMEOUT_MS);
+      })
+    ]);
+  } catch {
+    return void 0;
+  } finally {
+    if (timer) clearTimeout(timer);
+    signal?.removeEventListener("abort", cancel);
+    cancel();
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getSignedRequestRejection,
+  wrapFetchWithSignedRequestRejection
+});

package/dist/lib/protocols/signedRequestRejection.mjs

@@ -0,0 +1,189 @@
+import { fileURLToPath as __adcpFileURLToPath } from "node:url";
+import { dirname as __adcpDirname } from "node:path";
+import { createRequire as __adcpCreateRequire } from "node:module";
+const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
+const require2 = __adcpCreateRequire(import.meta.url);
+import { AuthenticationRequiredError } from "../errors/index.mjs";
+import { RequestSigningErrorCodeMetadata } from "../types/enums.generated.mjs";
+import { parseWWWAuthenticate } from "../auth/oauth/diagnostics.mjs";
+import { redactSensitiveJsonOrText, sanitizeTransportHeaders, sanitizeTransportUrl } from "./transportDiagnostics.mjs";
+import { recordRawResponseCapture } from "./rawResponseCapture.mjs";
+const CAPTURE_BYTES = 16 * 1024;
+const EXCERPT_LENGTH = 2048;
+const CAPTURE_TIMEOUT_MS = 1e3;
+const PUBLIC_HEADERS = /* @__PURE__ */ new Set([
+  "accept",
+  "content-type",
+  "content-length",
+  "user-agent",
+  "host",
+  "a2a-version",
+  "a2a-extensions",
+  "adcp-version",
+  "mcp-protocol-version",
+  "mcp-session-id",
+  "traceparent",
+  "tracestate",
+  "signature",
+  "signature-input",
+  "content-digest"
+]);
+function wrapFetchWithSignedRequestRejection(upstream, agentUrl) {
+  return async (input, init) => {
+    const startedAt = Date.now();
+    const response = await upstream(input, init);
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+    if (response.status !== 401 || !headers.has("signature")) return response;
+    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    const parsed = parseWWWAuthenticate(response.headers.get("www-authenticate"));
+    if (parsed && parsed.scheme !== "signature") return response;
+    const knownCode = parsed?.scheme === "signature" && parsed.error && Object.prototype.hasOwnProperty.call(RequestSigningErrorCodeMetadata, parsed.error);
+    const challenge = parsed ? { scheme: parsed.scheme.slice(0, 64), ...knownCode && { error: parsed.error } } : void 0;
+    const secrets = getHeaderSecrets(headers);
+    const captured = await captureBody(response, secrets, init?.signal);
+    const captureHeaders = sanitizeTransportHeaders(response.headers);
+    for (const key of Object.keys(captureHeaders)) {
+      captureHeaders[key] = redactReflected(captureHeaders[key], secrets);
+    }
+    if (parsed) captureHeaders["www-authenticate"] = knownCode ? `Signature error="${parsed.error}"` : "Signature";
+    recordRawResponseCapture(input, init, response, captured?.body ?? "", captured?.truncated ?? true, startedAt, {
+      url: sanitizeTransportUrl(url),
+      headers: captureHeaders
+    });
+    const body = captured?.body;
+    let excerpt = body;
+    if (body && body.length > EXCERPT_LENGTH) {
+      let end = EXCERPT_LENGTH - 1;
+      if (/[\uD800-\uDBFF]/.test(body[end - 1])) end--;
+      excerpt = body.slice(0, end) + "\u2026";
+    }
+    throw new AuthenticationRequiredError(sanitizeTransportUrl(agentUrl ?? url), void 0, void 0, challenge, {
+      status: response.status,
+      responseBody: excerpt
+    });
+  };
+}
+function getSignedRequestRejection(error) {
+  const seen = /* @__PURE__ */ new Set();
+  while (error && typeof error === "object" && !seen.has(error)) {
+    seen.add(error);
+    if (error instanceof AuthenticationRequiredError && error.requestSigned) return error;
+    error = error.cause;
+  }
+  return void 0;
+}
+function getHeaderSecrets(headers) {
+  const secrets = [];
+  headers.forEach((value, name) => {
+    if (value && !PUBLIC_HEADERS.has(name)) {
+      secrets.push(value);
+      if (/^(authorization|proxy-authorization)$/i.test(name)) {
+        const credential = value.replace(/^\S+\s+/, "");
+        if (credential) secrets.push(credential);
+      }
+    }
+  });
+  return secrets;
+}
+function redactReflected(value, secrets) {
+  const mask = new Uint8Array(value.length);
+  for (const secret of secrets) {
+    for (let from = 0; from < value.length; ) {
+      const at = value.indexOf(secret, from);
+      if (at < 0) break;
+      mask.fill(1, at, at + secret.length);
+      from = at + 1;
+    }
+  }
+  let out = "";
+  let cursor = 0;
+  for (let at = 0; at < value.length; ) {
+    if (!mask[at]) {
+      at++;
+      continue;
+    }
+    out += value.slice(cursor, at) + "[redacted]";
+    while (at < value.length && mask[at]) at++;
+    cursor = at;
+  }
+  return out + value.slice(cursor);
+}
+async function captureBody(response, secrets, signal) {
+  if (!response.body) return void 0;
+  const reader = response.body.getReader();
+  let timer;
+  let cancelled = false;
+  const cancel = () => {
+    cancelled = true;
+    void reader.cancel().catch(() => {
+    });
+  };
+  signal?.addEventListener("abort", cancel, { once: true });
+  if (signal?.aborted) cancel();
+  try {
+    return await Promise.race([
+      (async () => {
+        const chunks = [];
+        let bytes = 0;
+        while (true) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          if (bytes + value.byteLength > CAPTURE_BYTES) {
+            return { body: "[seller response exceeds diagnostic capture limit]", truncated: true };
+          }
+          chunks.push(value);
+          bytes += value.byteLength;
+        }
+        if (cancelled) return void 0;
+        let text = Buffer.concat(chunks).toString("utf8");
+        const redact = (value) => redactReflected(value, secrets);
+        if (/^\s*[{["]/.test(text)) {
+          try {
+            const valueRedacted = JSON.stringify(
+              JSON.parse(text, (_key, value) => {
+                if (typeof value === "string") return redact(value);
+                if ((typeof value === "boolean" || value === null) && secrets.includes(String(value)))
+                  return "[redacted]";
+                if (typeof value === "number" && secrets.some((secret) => /^-?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(secret) && Number(secret) === value))
+                  return "[redacted]";
+                return value;
+              })
+            );
+            text = JSON.stringify(
+              JSON.parse(redactSensitiveJsonOrText(valueRedacted), (_key, value) => {
+                if (value && typeof value === "object" && !Array.isArray(value)) {
+                  const out = /* @__PURE__ */ Object.create(null);
+                  for (const key of Object.keys(value)) out[redact(key)] = value[key];
+                  return out;
+                }
+                return value;
+              })
+            );
+          } catch {
+            return { body: "[seller response is not valid diagnostic JSON]", truncated: true };
+          }
+        } else {
+          text = redact(text);
+        }
+        text = redactSensitiveJsonOrText(text).replace(/[\u0000-\u001f\u007f]/g, " ");
+        return { body: text, truncated: false };
+      })(),
+      new Promise((resolve) => {
+        timer = setTimeout(() => {
+          cancel();
+          resolve(void 0);
+        }, CAPTURE_TIMEOUT_MS);
+      })
+    ]);
+  } catch {
+    return void 0;
+  } finally {
+    if (timer) clearTimeout(timer);
+    signal?.removeEventListener("abort", cancel);
+    cancel();
+  }
+}
+export {
+  getSignedRequestRejection,
+  wrapFetchWithSignedRequestRejection
+};

package/dist/lib/protocols/transportDiagnostics.d.mts

@@ -53,4 +53,5 @@ export declare function withTransportDiagnostics<T>(context: TransportActivityCo
 export declare function sanitizeTransportUrl(value: string): string;
 export declare function sanitizeTransportHeaders(headers: HeadersInit | undefined): Record<string, string>;
 export declare function wrapFetchWithTransportDiagnostics(upstream: typeof fetch): typeof fetch;
+export declare function redactSensitiveJsonOrText(text: string): string;
 export {};

package/dist/lib/protocols/transportDiagnostics.d.ts

@@ -53,4 +53,5 @@ export declare function withTransportDiagnostics<T>(context: TransportActivityCo
 export declare function sanitizeTransportUrl(value: string): string;
 export declare function sanitizeTransportHeaders(headers: HeadersInit | undefined): Record<string, string>;
 export declare function wrapFetchWithTransportDiagnostics(upstream: typeof fetch): typeof fetch;
+export declare function redactSensitiveJsonOrText(text: string): string;
 export {};

package/dist/lib/protocols/transportDiagnostics.js

@@ -20,6 +20,7 @@ var transportDiagnostics_exports = {};
 __export(transportDiagnostics_exports, {
   BODY_SNIPPET_TIMEOUT_MS: () => BODY_SNIPPET_TIMEOUT_MS,
   OBSERVER_FLUSH_TIMEOUT_MS: () => OBSERVER_FLUSH_TIMEOUT_MS,
+  redactSensitiveJsonOrText: () => redactSensitiveJsonOrText,
   sanitizeTransportHeaders: () => sanitizeTransportHeaders,
   sanitizeTransportUrl: () => sanitizeTransportUrl,
   transportDiagnosticsStorage: () => transportDiagnosticsStorage,
@@ -385,6 +386,7 @@ function fingerprintDiagnosticValue(value) {
 0 && (module.exports = {
   BODY_SNIPPET_TIMEOUT_MS,
   OBSERVER_FLUSH_TIMEOUT_MS,
+  redactSensitiveJsonOrText,
   sanitizeTransportHeaders,
   sanitizeTransportUrl,
   transportDiagnosticsStorage,

package/dist/lib/protocols/transportDiagnostics.mjs

@@ -360,6 +360,7 @@ function fingerprintDiagnosticValue(value) {
 export {
   BODY_SNIPPET_TIMEOUT_MS,
   OBSERVER_FLUSH_TIMEOUT_MS,
+  redactSensitiveJsonOrText,
   sanitizeTransportHeaders,
   sanitizeTransportUrl,
   transportDiagnosticsStorage,