@adcp/sdk 14.0.0 → 14.2.0

package/dist/lib/protocols/index.mjs

@@ -53,6 +53,7 @@ import {
 import { hasValidatedMcpAuthorizationRequirements } from "../auth/oauth/authorization-required.mjs";
 import { getNonInteractiveOAuthProvider } from "../auth/oauth/provider-cache.mjs";
 import { AuthenticationCredentialsRejectedError, is401Error } from "../errors/index.mjs";
+import { getSignedRequestRejection } from "./signedRequestRejection.mjs";
 import { isLikelyPrivateUrl } from "../net/index.mjs";
 import { validateAgentUrl } from "../validation/index.mjs";
 import { withSpan } from "../observability/tracing.mjs";
@@ -349,7 +350,7 @@ class ProtocolClient {
                   }
                 );
               } catch (err) {
-                if (agent.oauth_client_credentials && is401Error(err)) {
+                if (agent.oauth_client_credentials && is401Error(err) && getSignedRequestRejection(err)?.challenge?.scheme !== "signature") {
                   const ccStorage = getAgentStorage(agent);
                   const allowPrivateIp = transport?.allowPrivateIp ?? isLikelyPrivateUrl(agent.agent_uri);
                   await ensureClientCredentialsTokens(agent, {
@@ -381,6 +382,8 @@ class ProtocolClient {
                       }
                     );
                   } catch (retryErr) {
+                    const rejection = getSignedRequestRejection(retryErr) ?? (is401Error(retryErr) ? getSignedRequestRejection(err) : void 0);
+                    if (rejection) throw rejection;
                     await rethrowAsNeedsAuthorization(
                       retryErr,
                       agent.agent_uri,
@@ -421,7 +424,7 @@ class ProtocolClient {
                   transport?.legacyCompat
                 );
               } catch (err) {
-                if (agent.oauth_client_credentials && is401Error(err)) {
+                if (agent.oauth_client_credentials && is401Error(err) && getSignedRequestRejection(err)?.challenge?.scheme !== "signature") {
                   const ccStorage = getAgentStorage(agent);
                   const allowPrivateIp = transport?.allowPrivateIp ?? isLikelyPrivateUrl(agent.agent_uri);
                   await ensureClientCredentialsTokens(agent, {
@@ -450,6 +453,8 @@ class ProtocolClient {
                       transport?.legacyCompat
                     );
                   } catch (retryErr) {
+                    const rejection = getSignedRequestRejection(retryErr) ?? (is401Error(retryErr) ? getSignedRequestRejection(err) : void 0);
+                    if (rejection) throw rejection;
                     await rethrowAsNeedsAuthorization(
                       retryErr,
                       agent.agent_uri,
@@ -481,6 +486,8 @@ class ProtocolClient {
   }
 }
 async function rethrowAsNeedsAuthorization(err, agentUrl, fetchFn, signal, configuredAllowPrivateIp, recoveryMode = "discover") {
+  const signedRejection = getSignedRequestRejection(err);
+  if (signedRejection) throw signedRejection;
   if (err instanceof NeedsAuthorizationError) throw err;
   if (!is401Error(err)) return;
   if (recoveryMode === "static") {

package/dist/lib/protocols/mcp-modern.js

@@ -34,6 +34,7 @@ var import_session_termination = require('./session-termination.js');
 var import_client2 = require('../signing/client.js');
 var import_abort = require('./abort.js');
 var import_rawResponseCapture = require('./rawResponseCapture.js');
+var import_signedRequestRejection = require('./signedRequestRejection.js');
 var import_responseSizeLimit = require('./responseSizeLimit.js');
 var import_transportDiagnostics = require('./transportDiagnostics.js');
 var import_agent_transport_fetch = require('../net/agent-transport-fetch.js');
@@ -228,7 +229,7 @@ async function createNegotiatedClient(cacheKey, options, authHeaders, useCachedD
   const networkFetch = (input, init) => (0, import_abort.withAbortSignal)([init?.signal], requestTimeoutMs, (signal) => rawNetworkFetch(input, { ...init, signal }));
   const diagnosticFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)((0, import_responseSizeLimit.wrapFetchWithSizeLimit)(networkFetch));
   const signedFetch = options.signingContext ? (0, import_client2.buildAgentSigningFetch)({
-    upstream: diagnosticFetch,
+    upstream: (0, import_signedRequestRejection.wrapFetchWithSignedRequestRejection)(diagnosticFetch, options.agentUrl),
     signing: options.signingContext.signing,
     getCapability: options.signingContext.getCapability,
     adcpVersion: options.signingContext.adcpVersion

package/dist/lib/protocols/mcp-modern.mjs

@@ -28,6 +28,7 @@ import {
   withAbortSignal
 } from "./abort.mjs";
 import { wrapFetchWithCapture } from "./rawResponseCapture.mjs";
+import { wrapFetchWithSignedRequestRejection } from "./signedRequestRejection.mjs";
 import { wrapFetchWithSizeLimit } from "./responseSizeLimit.mjs";
 import { wrapFetchWithTransportDiagnostics } from "./transportDiagnostics.mjs";
 import { createAgentTransportFetch } from "../net/agent-transport-fetch.mjs";
@@ -222,7 +223,7 @@ async function createNegotiatedClient(cacheKey, options, authHeaders, useCachedD
   const networkFetch = (input, init) => withAbortSignal([init?.signal], requestTimeoutMs, (signal) => rawNetworkFetch(input, { ...init, signal }));
   const diagnosticFetch = wrapFetchWithTransportDiagnostics(wrapFetchWithSizeLimit(networkFetch));
   const signedFetch = options.signingContext ? buildAgentSigningFetch({
-    upstream: diagnosticFetch,
+    upstream: wrapFetchWithSignedRequestRejection(diagnosticFetch, options.agentUrl),
     signing: options.signingContext.signing,
     getCapability: options.signingContext.getCapability,
     adcpVersion: options.signingContext.adcpVersion

package/dist/lib/protocols/mcp.js

@@ -40,6 +40,7 @@ var import_tracing = require('../observability/tracing.js');
 var import_client2 = require('../signing/client.js');
 var import_redact_args = require('../utils/redact-args.js');
 var import_rawResponseCapture = require('./rawResponseCapture.js');
+var import_signedRequestRejection = require('./signedRequestRejection.js');
 var import_responseSizeLimit = require('./responseSizeLimit.js');
 var import_transportDiagnostics = require('./transportDiagnostics.js');
 var import_abort = require('./abort.js');
@@ -482,7 +483,7 @@ async function connectMCPWithFallbackImpl(url, authHeaders, debugLogs = [], labe
   const sizeLimited = (0, import_responseSizeLimit.wrapFetchWithSizeLimit)(networkFetch);
   const diagnosticFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)(sizeLimited);
   const baseFetch = signingContext ? (0, import_client2.buildAgentSigningFetch)({
-    upstream: diagnosticFetch,
+    upstream: (0, import_signedRequestRejection.wrapFetchWithSignedRequestRejection)(diagnosticFetch, url.toString()),
     signing: signingContext.signing,
     getCapability: signingContext.getCapability,
     adcpVersion: signingContext.adcpVersion
@@ -771,7 +772,7 @@ async function connectMCP(options) {
   );
   const diagnosticFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)(sizeLimited);
   const signedFetch = signingContext ? (0, import_client2.buildAgentSigningFetch)({
-    upstream: diagnosticFetch,
+    upstream: (0, import_signedRequestRejection.wrapFetchWithSignedRequestRejection)(diagnosticFetch, agentUrl),
     signing: signingContext.signing,
     getCapability: signingContext.getCapability,
     adcpVersion: signingContext.adcpVersion
@@ -788,6 +789,8 @@ async function connectMCP(options) {
     });
     return { client: mcpClient, transport };
   } catch (error) {
+    const signedRejection = (0, import_signedRequestRejection.getSignedRequestRejection)(error);
+    if (signedRejection) throw signedRejection;
     if (authProvider && error instanceof import_auth.UnauthorizedError) {
       debugLogs.push({
         type: "info",

package/dist/lib/protocols/mcp.mjs

@@ -17,6 +17,7 @@ import { withSpan, injectTraceHeaders } from "../observability/tracing.mjs";
 import { buildAgentSigningFetch, signingContextStorage } from "../signing/client.mjs";
 import { redactArgsForLog } from "../utils/redact-args.mjs";
 import { wrapFetchWithCapture } from "./rawResponseCapture.mjs";
+import { getSignedRequestRejection, wrapFetchWithSignedRequestRejection } from "./signedRequestRejection.mjs";
 import { wrapFetchWithSizeLimit } from "./responseSizeLimit.mjs";
 import { sanitizeTransportUrl, wrapFetchWithTransportDiagnostics } from "./transportDiagnostics.mjs";
 import {
@@ -469,7 +470,7 @@ async function connectMCPWithFallbackImpl(url, authHeaders, debugLogs = [], labe
   const sizeLimited = wrapFetchWithSizeLimit(networkFetch);
   const diagnosticFetch = wrapFetchWithTransportDiagnostics(sizeLimited);
   const baseFetch = signingContext ? buildAgentSigningFetch({
-    upstream: diagnosticFetch,
+    upstream: wrapFetchWithSignedRequestRejection(diagnosticFetch, url.toString()),
     signing: signingContext.signing,
     getCapability: signingContext.getCapability,
     adcpVersion: signingContext.adcpVersion
@@ -758,7 +759,7 @@ async function connectMCP(options) {
   );
   const diagnosticFetch = wrapFetchWithTransportDiagnostics(sizeLimited);
   const signedFetch = signingContext ? buildAgentSigningFetch({
-    upstream: diagnosticFetch,
+    upstream: wrapFetchWithSignedRequestRejection(diagnosticFetch, agentUrl),
     signing: signingContext.signing,
     getCapability: signingContext.getCapability,
     adcpVersion: signingContext.adcpVersion
@@ -775,6 +776,8 @@ async function connectMCP(options) {
     });
     return { client: mcpClient, transport };
   } catch (error) {
+    const signedRejection = getSignedRequestRejection(error);
+    if (signedRejection) throw signedRejection;
     if (authProvider && error instanceof UnauthorizedError) {
       debugLogs.push({
         type: "info",

package/dist/lib/protocols/rawResponseCapture.d.mts

@@ -55,4 +55,10 @@ export declare function getCapturesFromError(err: unknown): RawHttpCapture[] | u
  * slot is set.
  */
 export declare function wrapFetchWithCapture(upstream: typeof fetch): typeof fetch;
+/** Record an already bounded response without cloning or reading its stream. */
+export declare function recordRawResponseCapture(input: RequestInfo | URL, init: RequestInit | undefined, response: Response, body: string, bodyTruncated: boolean, startedAt: number, safeMetadata?: {
+    url?: string;
+    headers?: Record<string, string>;
+    latencyMs?: number;
+}): void;
 export {};

package/dist/lib/protocols/rawResponseCapture.d.ts

@@ -55,4 +55,10 @@ export declare function getCapturesFromError(err: unknown): RawHttpCapture[] | u
  * slot is set.
  */
 export declare function wrapFetchWithCapture(upstream: typeof fetch): typeof fetch;
+/** Record an already bounded response without cloning or reading its stream. */
+export declare function recordRawResponseCapture(input: RequestInfo | URL, init: RequestInit | undefined, response: Response, body: string, bodyTruncated: boolean, startedAt: number, safeMetadata?: {
+    url?: string;
+    headers?: Record<string, string>;
+    latencyMs?: number;
+}): void;
 export {};

package/dist/lib/protocols/rawResponseCapture.js

@@ -21,6 +21,7 @@ __export(rawResponseCapture_exports, {
   getCaptureOverflowFromError: () => getCaptureOverflowFromError,
   getCapturesFromError: () => getCapturesFromError,
   rawResponseCaptureStorage: () => rawResponseCaptureStorage,
+  recordRawResponseCapture: () => recordRawResponseCapture,
   withRawResponseCapture: () => withRawResponseCapture,
   wrapFetchWithCapture: () => wrapFetchWithCapture
 });
@@ -88,44 +89,54 @@ function wrapFetchWithCapture(upstream) {
   const wrapped = async (input, init) => {
     const slot = rawResponseCaptureStorage.getStore();
     if (!slot) return upstream(input, init);
-    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-    const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
-    const requestMetadata = extractSafeRequestMetadata(init?.body, slot.maxBodyBytes);
     const startedAt = Date.now();
     const response = await upstream(input, init);
     const latencyMs = Date.now() - startedAt;
     const cloneForRead = response.clone();
     const { body, bodyTruncated } = await readBodyBounded(cloneForRead, slot.maxBodyBytes);
-    const headers = {};
-    response.headers.forEach((value, key) => {
-      const lower = key.toLowerCase();
-      headers[key] = REDACTED_HEADER_NAMES.has(lower) ? REDACTED_PLACEHOLDER : value;
-    });
-    if (slot.maxCaptures !== void 0 && slot.captures.length >= slot.maxCaptures) {
-      slot.overflowed ??= "captures";
-      return response;
-    }
-    const redactedBody = redactBearerInBody(body);
-    if (slot.maxTotalBodyBytes !== void 0 && slot.totalBodyBytes + redactedBody.length > slot.maxTotalBodyBytes) {
-      slot.overflowed ??= "bytes";
-      return response;
-    }
-    slot.totalBodyBytes += redactedBody.length;
-    slot.captures.push({
-      url,
-      method,
-      ...requestMetadata,
-      status: response.status,
-      headers,
-      body: redactedBody,
-      latencyMs,
-      timestamp: new Date(startedAt).toISOString(),
-      bodyTruncated
-    });
+    recordRawResponseCapture(input, init, response, body, bodyTruncated, startedAt, { latencyMs });
     return response;
   };
   return wrapped;
 }
+function recordRawResponseCapture(input, init, response, body, bodyTruncated, startedAt, safeMetadata) {
+  const slot = rawResponseCaptureStorage.getStore();
+  if (!slot) return;
+  const url = safeMetadata?.url ?? (typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url);
+  const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+  const requestMetadata = extractSafeRequestMetadata(init?.body, slot.maxBodyBytes);
+  const latencyMs = safeMetadata?.latencyMs ?? Date.now() - startedAt;
+  if (body.length > slot.maxBodyBytes) {
+    body = body.slice(0, slot.maxBodyBytes);
+    bodyTruncated = true;
+  }
+  const headers = {};
+  response.headers.forEach((value, key) => {
+    const lower = key.toLowerCase();
+    headers[key] = REDACTED_HEADER_NAMES.has(lower) ? REDACTED_PLACEHOLDER : value;
+  });
+  if (slot.maxCaptures !== void 0 && slot.captures.length >= slot.maxCaptures) {
+    slot.overflowed ??= "captures";
+    return;
+  }
+  const redactedBody = redactBearerInBody(body);
+  if (slot.maxTotalBodyBytes !== void 0 && slot.totalBodyBytes + redactedBody.length > slot.maxTotalBodyBytes) {
+    slot.overflowed ??= "bytes";
+    return;
+  }
+  slot.totalBodyBytes += redactedBody.length;
+  slot.captures.push({
+    url,
+    method,
+    ...requestMetadata,
+    status: response.status,
+    headers: safeMetadata?.headers ?? headers,
+    body: redactedBody,
+    latencyMs,
+    timestamp: new Date(startedAt).toISOString(),
+    bodyTruncated
+  });
+}
 function extractSafeRequestMetadata(body, maxBodyBytes) {
   if (typeof body !== "string" || body.length > maxBodyBytes) return {};
   let parsed;
@@ -175,6 +186,7 @@ async function readBodyBounded(response, maxBodyBytes) {
   getCaptureOverflowFromError,
   getCapturesFromError,
   rawResponseCaptureStorage,
+  recordRawResponseCapture,
   withRawResponseCapture,
   wrapFetchWithCapture
 });

package/dist/lib/protocols/rawResponseCapture.mjs

@@ -66,44 +66,54 @@ function wrapFetchWithCapture(upstream) {
   const wrapped = async (input, init) => {
     const slot = rawResponseCaptureStorage.getStore();
     if (!slot) return upstream(input, init);
-    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-    const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
-    const requestMetadata = extractSafeRequestMetadata(init?.body, slot.maxBodyBytes);
     const startedAt = Date.now();
     const response = await upstream(input, init);
     const latencyMs = Date.now() - startedAt;
     const cloneForRead = response.clone();
     const { body, bodyTruncated } = await readBodyBounded(cloneForRead, slot.maxBodyBytes);
-    const headers = {};
-    response.headers.forEach((value, key) => {
-      const lower = key.toLowerCase();
-      headers[key] = REDACTED_HEADER_NAMES.has(lower) ? REDACTED_PLACEHOLDER : value;
-    });
-    if (slot.maxCaptures !== void 0 && slot.captures.length >= slot.maxCaptures) {
-      slot.overflowed ??= "captures";
-      return response;
-    }
-    const redactedBody = redactBearerInBody(body);
-    if (slot.maxTotalBodyBytes !== void 0 && slot.totalBodyBytes + redactedBody.length > slot.maxTotalBodyBytes) {
-      slot.overflowed ??= "bytes";
-      return response;
-    }
-    slot.totalBodyBytes += redactedBody.length;
-    slot.captures.push({
-      url,
-      method,
-      ...requestMetadata,
-      status: response.status,
-      headers,
-      body: redactedBody,
-      latencyMs,
-      timestamp: new Date(startedAt).toISOString(),
-      bodyTruncated
-    });
+    recordRawResponseCapture(input, init, response, body, bodyTruncated, startedAt, { latencyMs });
     return response;
   };
   return wrapped;
 }
+function recordRawResponseCapture(input, init, response, body, bodyTruncated, startedAt, safeMetadata) {
+  const slot = rawResponseCaptureStorage.getStore();
+  if (!slot) return;
+  const url = safeMetadata?.url ?? (typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url);
+  const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+  const requestMetadata = extractSafeRequestMetadata(init?.body, slot.maxBodyBytes);
+  const latencyMs = safeMetadata?.latencyMs ?? Date.now() - startedAt;
+  if (body.length > slot.maxBodyBytes) {
+    body = body.slice(0, slot.maxBodyBytes);
+    bodyTruncated = true;
+  }
+  const headers = {};
+  response.headers.forEach((value, key) => {
+    const lower = key.toLowerCase();
+    headers[key] = REDACTED_HEADER_NAMES.has(lower) ? REDACTED_PLACEHOLDER : value;
+  });
+  if (slot.maxCaptures !== void 0 && slot.captures.length >= slot.maxCaptures) {
+    slot.overflowed ??= "captures";
+    return;
+  }
+  const redactedBody = redactBearerInBody(body);
+  if (slot.maxTotalBodyBytes !== void 0 && slot.totalBodyBytes + redactedBody.length > slot.maxTotalBodyBytes) {
+    slot.overflowed ??= "bytes";
+    return;
+  }
+  slot.totalBodyBytes += redactedBody.length;
+  slot.captures.push({
+    url,
+    method,
+    ...requestMetadata,
+    status: response.status,
+    headers: safeMetadata?.headers ?? headers,
+    body: redactedBody,
+    latencyMs,
+    timestamp: new Date(startedAt).toISOString(),
+    bodyTruncated
+  });
+}
 function extractSafeRequestMetadata(body, maxBodyBytes) {
   if (typeof body !== "string" || body.length > maxBodyBytes) return {};
   let parsed;
@@ -152,6 +162,7 @@ export {
   getCaptureOverflowFromError,
   getCapturesFromError,
   rawResponseCaptureStorage,
+  recordRawResponseCapture,
   withRawResponseCapture,
   wrapFetchWithCapture
 };

package/dist/lib/protocols/signedRequestRejection.d.mts

@@ -0,0 +1,9 @@
+import { AuthenticationRequiredError } from '../errors/index.mjs';
+/**
+ * Install below the SDK signer, on the actual outbound transport. Only a
+ * request carrying Signature is classified as signed; signing configuration
+ * alone says nothing about unsigned discovery/housekeeping calls.
+ */
+export declare function wrapFetchWithSignedRequestRejection(upstream: typeof fetch, agentUrl?: string): typeof fetch;
+/** Official clients may retain fetch failures under a transport error cause. */
+export declare function getSignedRequestRejection(error: unknown): AuthenticationRequiredError | undefined;

package/dist/lib/protocols/signedRequestRejection.d.ts

@@ -0,0 +1,9 @@
+import { AuthenticationRequiredError } from '../errors';
+/**
+ * Install below the SDK signer, on the actual outbound transport. Only a
+ * request carrying Signature is classified as signed; signing configuration
+ * alone says nothing about unsigned discovery/housekeeping calls.
+ */
+export declare function wrapFetchWithSignedRequestRejection(upstream: typeof fetch, agentUrl?: string): typeof fetch;
+/** Official clients may retain fetch failures under a transport error cause. */
+export declare function getSignedRequestRejection(error: unknown): AuthenticationRequiredError | undefined;

package/dist/lib/protocols/signedRequestRejection.js

@@ -0,0 +1,209 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var signedRequestRejection_exports = {};
+__export(signedRequestRejection_exports, {
+  getSignedRequestRejection: () => getSignedRequestRejection,
+  wrapFetchWithSignedRequestRejection: () => wrapFetchWithSignedRequestRejection
+});
+module.exports = __toCommonJS(signedRequestRejection_exports);
+var import_errors = require('../errors/index.js');
+var import_enums = require('../types/enums.generated.js');
+var import_diagnostics = require('../auth/oauth/diagnostics.js');
+var import_transportDiagnostics = require('./transportDiagnostics.js');
+var import_rawResponseCapture = require('./rawResponseCapture.js');
+const CAPTURE_BYTES = 16 * 1024;
+const EXCERPT_LENGTH = 2048;
+const CAPTURE_TIMEOUT_MS = 1e3;
+const PUBLIC_HEADERS = /* @__PURE__ */ new Set([
+  "accept",
+  "content-type",
+  "content-length",
+  "user-agent",
+  "host",
+  "a2a-version",
+  "a2a-extensions",
+  "adcp-version",
+  "mcp-protocol-version",
+  "mcp-session-id",
+  "traceparent",
+  "tracestate",
+  "signature",
+  "signature-input",
+  "content-digest"
+]);
+function wrapFetchWithSignedRequestRejection(upstream, agentUrl) {
+  return async (input, init) => {
+    const startedAt = Date.now();
+    const response = await upstream(input, init);
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+    if (response.status !== 401 || !headers.has("signature")) return response;
+    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    const parsed = (0, import_diagnostics.parseWWWAuthenticate)(response.headers.get("www-authenticate"));
+    if (parsed && parsed.scheme !== "signature") return response;
+    const knownCode = parsed?.scheme === "signature" && parsed.error && Object.prototype.hasOwnProperty.call(import_enums.RequestSigningErrorCodeMetadata, parsed.error);
+    const challenge = parsed ? { scheme: parsed.scheme.slice(0, 64), ...knownCode && { error: parsed.error } } : void 0;
+    const secrets = getHeaderSecrets(headers);
+    const captured = await captureBody(response, secrets, init?.signal);
+    const captureHeaders = (0, import_transportDiagnostics.sanitizeTransportHeaders)(response.headers);
+    for (const key of Object.keys(captureHeaders)) {
+      captureHeaders[key] = redactReflected(captureHeaders[key], secrets);
+    }
+    if (parsed) captureHeaders["www-authenticate"] = knownCode ? `Signature error="${parsed.error}"` : "Signature";
+    (0, import_rawResponseCapture.recordRawResponseCapture)(input, init, response, captured?.body ?? "", captured?.truncated ?? true, startedAt, {
+      url: (0, import_transportDiagnostics.sanitizeTransportUrl)(url),
+      headers: captureHeaders
+    });
+    const body = captured?.body;
+    let excerpt = body;
+    if (body && body.length > EXCERPT_LENGTH) {
+      let end = EXCERPT_LENGTH - 1;
+      if (/[\uD800-\uDBFF]/.test(body[end - 1])) end--;
+      excerpt = body.slice(0, end) + "\u2026";
+    }
+    throw new import_errors.AuthenticationRequiredError((0, import_transportDiagnostics.sanitizeTransportUrl)(agentUrl ?? url), void 0, void 0, challenge, {
+      status: response.status,
+      responseBody: excerpt
+    });
+  };
+}
+function getSignedRequestRejection(error) {
+  const seen = /* @__PURE__ */ new Set();
+  while (error && typeof error === "object" && !seen.has(error)) {
+    seen.add(error);
+    if (error instanceof import_errors.AuthenticationRequiredError && error.requestSigned) return error;
+    error = error.cause;
+  }
+  return void 0;
+}
+function getHeaderSecrets(headers) {
+  const secrets = [];
+  headers.forEach((value, name) => {
+    if (value && !PUBLIC_HEADERS.has(name)) {
+      secrets.push(value);
+      if (/^(authorization|proxy-authorization)$/i.test(name)) {
+        const credential = value.replace(/^\S+\s+/, "");
+        if (credential) secrets.push(credential);
+      }
+    }
+  });
+  return secrets;
+}
+function redactReflected(value, secrets) {
+  const mask = new Uint8Array(value.length);
+  for (const secret of secrets) {
+    for (let from = 0; from < value.length; ) {
+      const at = value.indexOf(secret, from);
+      if (at < 0) break;
+      mask.fill(1, at, at + secret.length);
+      from = at + 1;
+    }
+  }
+  let out = "";
+  let cursor = 0;
+  for (let at = 0; at < value.length; ) {
+    if (!mask[at]) {
+      at++;
+      continue;
+    }
+    out += value.slice(cursor, at) + "[redacted]";
+    while (at < value.length && mask[at]) at++;
+    cursor = at;
+  }
+  return out + value.slice(cursor);
+}
+async function captureBody(response, secrets, signal) {
+  if (!response.body) return void 0;
+  const reader = response.body.getReader();
+  let timer;
+  let cancelled = false;
+  const cancel = () => {
+    cancelled = true;
+    void reader.cancel().catch(() => {
+    });
+  };
+  signal?.addEventListener("abort", cancel, { once: true });
+  if (signal?.aborted) cancel();
+  try {
+    return await Promise.race([
+      (async () => {
+        const chunks = [];
+        let bytes = 0;
+        while (true) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          if (bytes + value.byteLength > CAPTURE_BYTES) {
+            return { body: "[seller response exceeds diagnostic capture limit]", truncated: true };
+          }
+          chunks.push(value);
+          bytes += value.byteLength;
+        }
+        if (cancelled) return void 0;
+        let text = Buffer.concat(chunks).toString("utf8");
+        const redact = (value) => redactReflected(value, secrets);
+        if (/^\s*[{["]/.test(text)) {
+          try {
+            const valueRedacted = JSON.stringify(
+              JSON.parse(text, (_key, value) => {
+                if (typeof value === "string") return redact(value);
+                if ((typeof value === "boolean" || value === null) && secrets.includes(String(value)))
+                  return "[redacted]";
+                if (typeof value === "number" && secrets.some((secret) => /^-?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(secret) && Number(secret) === value))
+                  return "[redacted]";
+                return value;
+              })
+            );
+            text = JSON.stringify(
+              JSON.parse((0, import_transportDiagnostics.redactSensitiveJsonOrText)(valueRedacted), (_key, value) => {
+                if (value && typeof value === "object" && !Array.isArray(value)) {
+                  const out = /* @__PURE__ */ Object.create(null);
+                  for (const key of Object.keys(value)) out[redact(key)] = value[key];
+                  return out;
+                }
+                return value;
+              })
+            );
+          } catch {
+            return { body: "[seller response is not valid diagnostic JSON]", truncated: true };
+          }
+        } else {
+          text = redact(text);
+        }
+        text = (0, import_transportDiagnostics.redactSensitiveJsonOrText)(text).replace(/[\u0000-\u001f\u007f]/g, " ");
+        return { body: text, truncated: false };
+      })(),
+      new Promise((resolve) => {
+        timer = setTimeout(() => {
+          cancel();
+          resolve(void 0);
+        }, CAPTURE_TIMEOUT_MS);
+      })
+    ]);
+  } catch {
+    return void 0;
+  } finally {
+    if (timer) clearTimeout(timer);
+    signal?.removeEventListener("abort", cancel);
+    cancel();
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getSignedRequestRejection,
+  wrapFetchWithSignedRequestRejection
+});