@adcp/sdk 15.9.1 → 16.0.0-beta.2

package/dist/lib/signing/brand-jwks.mjs

@@ -88,11 +88,11 @@ class BrandJsonJwksResolver {
     });
     return this.onboarding;
   }
-  async resolve(keyid) {
-    return (await this.confirmedResolver()).resolve(keyid);
+  async resolve(keyid, signerOrigin) {
+    return (await this.confirmedResolver()).resolve(keyid, signerOrigin);
   }
-  async resolveWithMetadata(keyid) {
-    return (await this.confirmedResolver()).resolveWithMetadata(keyid);
+  async resolveWithMetadata(keyid, signerOrigin) {
+    return (await this.confirmedResolver()).resolveWithMetadata(keyid, signerOrigin);
   }
   get agentUrl() {
     return this.resolver?.resolvedAgentUrl;

package/dist/lib/signing/client.d.mts

@@ -23,3 +23,4 @@ export { buildAgentSigningFetch, createAgentSignedFetch, extractAdcpOperation, i
 export { buildAgentSigningContext, signingContextStorage, type AgentSigningContext, type AgentSigningIdentitySnapshot, } from './agent-context.mjs';
 export { ensureCapabilityLoaded, CAPABILITY_OP } from './capability-priming.mjs';
 export { pemToAdcpJwk, type AdcpUse, type PemToAdcpJwkOptions } from './jwks-helpers.mjs';
+export { canonicalAgentOrigin, CanonicalizeError } from './agent-resolver/canonicalize.mjs';

package/dist/lib/signing/client.d.ts

@@ -23,3 +23,4 @@ export { buildAgentSigningFetch, createAgentSignedFetch, extractAdcpOperation, i
 export { buildAgentSigningContext, signingContextStorage, type AgentSigningContext, type AgentSigningIdentitySnapshot, } from './agent-context';
 export { ensureCapabilityLoaded, CAPABILITY_OP } from './capability-priming';
 export { pemToAdcpJwk, type AdcpUse, type PemToAdcpJwkOptions } from './jwks-helpers';
+export { canonicalAgentOrigin, CanonicalizeError } from './agent-resolver/canonicalize';

package/dist/lib/signing/client.js

@@ -21,6 +21,7 @@ __export(client_exports, {
   ALLOWED_ALGS: () => import_types.ALLOWED_ALGS,
   CAPABILITY_OP: () => import_capability_priming.CAPABILITY_OP,
   CLOCK_SKEW_TOLERANCE_SECONDS: () => import_types.CLOCK_SKEW_TOLERANCE_SECONDS,
+  CanonicalizeError: () => import_canonicalize2.CanonicalizeError,
   CapabilityCache: () => import_capability_cache.CapabilityCache,
   MANDATORY_COMPONENTS: () => import_types.MANDATORY_COMPONENTS,
   MAX_SIGNATURE_WINDOW_SECONDS: () => import_types.MAX_SIGNATURE_WINDOW_SECONDS,
@@ -39,6 +40,7 @@ __export(client_exports, {
   buildCapabilityCacheKey: () => import_capability_cache.buildCapabilityCacheKey,
   buildResponseSignatureBase: () => import_canonicalize.buildResponseSignatureBase,
   buildSignatureBase: () => import_canonicalize.buildSignatureBase,
+  canonicalAgentOrigin: () => import_canonicalize2.canonicalAgentOrigin,
   canonicalAuthority: () => import_canonicalize.canonicalAuthority,
   canonicalMethod: () => import_canonicalize.canonicalMethod,
   canonicalTargetUri: () => import_canonicalize.canonicalTargetUri,
@@ -95,11 +97,13 @@ var import_agent_fetch = require('./agent-fetch.js');
 var import_agent_context = require('./agent-context.js');
 var import_capability_priming = require('./capability-priming.js');
 var import_jwks_helpers = require('./jwks-helpers.js');
+var import_canonicalize2 = require('./agent-resolver/canonicalize.js');
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ALLOWED_ALGS,
   CAPABILITY_OP,
   CLOCK_SKEW_TOLERANCE_SECONDS,
+  CanonicalizeError,
   CapabilityCache,
   MANDATORY_COMPONENTS,
   MAX_SIGNATURE_WINDOW_SECONDS,
@@ -118,6 +122,7 @@ var import_jwks_helpers = require('./jwks-helpers.js');
   buildCapabilityCacheKey,
   buildResponseSignatureBase,
   buildSignatureBase,
+  canonicalAgentOrigin,
   canonicalAuthority,
   canonicalMethod,
   canonicalTargetUri,

package/dist/lib/signing/client.mjs

@@ -71,10 +71,12 @@ import {
 } from "./agent-context.mjs";
 import { ensureCapabilityLoaded, CAPABILITY_OP } from "./capability-priming.mjs";
 import { pemToAdcpJwk } from "./jwks-helpers.mjs";
+import { canonicalAgentOrigin, CanonicalizeError } from "./agent-resolver/canonicalize.mjs";
 export {
   ALLOWED_ALGS,
   CAPABILITY_OP,
   CLOCK_SKEW_TOLERANCE_SECONDS,
+  CanonicalizeError,
   CapabilityCache,
   MANDATORY_COMPONENTS,
   MAX_SIGNATURE_WINDOW_SECONDS,
@@ -93,6 +95,7 @@ export {
   buildCapabilityCacheKey,
   buildResponseSignatureBase,
   buildSignatureBase,
+  canonicalAgentOrigin,
   canonicalAuthority,
   canonicalMethod,
   canonicalTargetUri,

package/dist/lib/signing/crypto.js

@@ -47,6 +47,14 @@ function verifySignature(alg, publicKey, data, signature) {
     if (alg === "ecdsa-p256-sha256") {
       return (0, import_crypto.verify)("sha256", data, { key: publicKey, dsaEncoding: "ieee-p1363" }, signature);
     }
+    if (alg === "rsa-pss-sha512") {
+      return (0, import_crypto.verify)(
+        "sha512",
+        data,
+        { key: publicKey, padding: import_crypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 64 },
+        signature
+      );
+    }
     return false;
   } catch {
     return false;

package/dist/lib/signing/crypto.mjs

@@ -1,4 +1,4 @@
-import { createPublicKey, verify as nodeVerify } from "crypto";
+import { constants, createPublicKey, verify as nodeVerify } from "crypto";
 import { RequestSignatureError } from "./errors.mjs";
 function jwkToPublicKey(jwk) {
   const publicJwk = { ...jwk };
@@ -23,6 +23,14 @@ function verifySignature(alg, publicKey, data, signature) {
     if (alg === "ecdsa-p256-sha256") {
       return nodeVerify("sha256", data, { key: publicKey, dsaEncoding: "ieee-p1363" }, signature);
     }
+    if (alg === "rsa-pss-sha512") {
+      return nodeVerify(
+        "sha512",
+        data,
+        { key: publicKey, padding: constants.RSA_PKCS1_PSS_PADDING, saltLength: 64 },
+        signature
+      );
+    }
     return false;
   } catch {
     return false;

package/dist/lib/signing/fetch-async.js

@@ -82,7 +82,7 @@ function bodyToString(body) {
 }
 function decodeUtf8Strict(bytes) {
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
   } catch {
     throw new TypeError(
       "createSigningFetchAsync received a Uint8Array/ArrayBuffer body that is not valid UTF-8. Pass a string body, ensure the bytes are UTF-8, or sign the request manually with `signRequestAsync` against the exact wire bytes you intend to send."

package/dist/lib/signing/fetch-async.mjs

@@ -61,7 +61,7 @@ function bodyToString(body) {
 }
 function decodeUtf8Strict(bytes) {
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
   } catch {
     throw new TypeError(
       "createSigningFetchAsync received a Uint8Array/ArrayBuffer body that is not valid UTF-8. Pass a string body, ensure the bytes are UTF-8, or sign the request manually with `signRequestAsync` against the exact wire bytes you intend to send."

package/dist/lib/signing/fetch.js

@@ -91,7 +91,7 @@ function bodyToString(body) {
 }
 function decodeUtf8Strict(bytes) {
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
   } catch {
     throw new TypeError(
       "createSigningFetch received a Uint8Array/ArrayBuffer body that is not valid UTF-8. Pass a string body, ensure the bytes are UTF-8, or sign the request manually with `signRequest` against the exact wire bytes you intend to send."

package/dist/lib/signing/fetch.mjs

@@ -67,7 +67,7 @@ function bodyToString(body) {
 }
 function decodeUtf8Strict(bytes) {
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
   } catch {
     throw new TypeError(
       "createSigningFetch received a Uint8Array/ArrayBuffer body that is not valid UTF-8. Pass a string body, ensure the bytes are UTF-8, or sign the request manually with `signRequest` against the exact wire bytes you intend to send."

package/dist/lib/signing/jwks-https.d.mts

@@ -58,7 +58,7 @@ export declare class HttpsJwksResolver implements JwksResolver {
     private inFlight;
     private lastAttemptAt;
     constructor(url: string, options?: HttpsJwksResolverOptions);
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    resolve(keyid: string, _signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
     /**
      * Force a refetch, bypassing the cooldown. Primarily for tests and for
      * operator-triggered rotation flushes; normal callers should rely on the

package/dist/lib/signing/jwks-https.d.ts

@@ -58,7 +58,7 @@ export declare class HttpsJwksResolver implements JwksResolver {
     private inFlight;
     private lastAttemptAt;
     constructor(url: string, options?: HttpsJwksResolverOptions);
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    resolve(keyid: string, _signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
     /**
      * Force a refetch, bypassing the cooldown. Primarily for tests and for
      * operator-triggered rotation flushes; normal callers should rely on the

package/dist/lib/signing/jwks-https.js

@@ -56,7 +56,7 @@ class HttpsJwksResolver {
     this.lookup = options.lookup;
     this.now = options.now ?? (() => Math.floor(Date.now() / 1e3));
   }
-  async resolve(keyid) {
+  async resolve(keyid, _signerOrigin) {
     if (!this.cache) {
       if (!this.inFlight && this.now() - this.lastAttemptAt < this.minCooldown) {
         throw new Error("JWKS lookup is in its retry cooldown");

package/dist/lib/signing/jwks-https.mjs

@@ -33,7 +33,7 @@ class HttpsJwksResolver {
     this.lookup = options.lookup;
     this.now = options.now ?? (() => Math.floor(Date.now() / 1e3));
   }
-  async resolve(keyid) {
+  async resolve(keyid, _signerOrigin) {
     if (!this.cache) {
       if (!this.inFlight && this.now() - this.lastAttemptAt < this.minCooldown) {
         throw new Error("JWKS lookup is in its retry cooldown");

package/dist/lib/signing/jwks.d.mts

@@ -13,12 +13,20 @@ export interface JwksResolution {
     operatorAuthorizationValidUntil?: number;
 }
 export interface JwksResolver {
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    /**
+     * Optional signer-origin locator for resolvers serving multiple signers.
+     * It is unverified request context, never proof of identity or authority.
+     * Origin-aware caches must scope entries by (canonical origin, keyid).
+     * Wrappers must forward it on both lookup methods. Existing one-argument
+     * implementations remain valid; static and HTTPS resolvers stay pinned to
+     * their configured key source and do not attribute identity from this value.
+     */
+    resolve(keyid: string, signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
     /** Optional metadata-aware lookup used by verifiers that must enforce delegation expiry at acceptance time. */
-    resolveWithMetadata?(keyid: string): Promise<JwksResolution>;
+    resolveWithMetadata?(keyid: string, signerOrigin?: string): Promise<JwksResolution>;
 }
 export declare class StaticJwksResolver implements JwksResolver {
     private readonly byKid;
     constructor(keys: AdcpJsonWebKey[]);
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    resolve(keyid: string, _signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
 }

package/dist/lib/signing/jwks.d.ts

@@ -13,12 +13,20 @@ export interface JwksResolution {
     operatorAuthorizationValidUntil?: number;
 }
 export interface JwksResolver {
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    /**
+     * Optional signer-origin locator for resolvers serving multiple signers.
+     * It is unverified request context, never proof of identity or authority.
+     * Origin-aware caches must scope entries by (canonical origin, keyid).
+     * Wrappers must forward it on both lookup methods. Existing one-argument
+     * implementations remain valid; static and HTTPS resolvers stay pinned to
+     * their configured key source and do not attribute identity from this value.
+     */
+    resolve(keyid: string, signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
     /** Optional metadata-aware lookup used by verifiers that must enforce delegation expiry at acceptance time. */
-    resolveWithMetadata?(keyid: string): Promise<JwksResolution>;
+    resolveWithMetadata?(keyid: string, signerOrigin?: string): Promise<JwksResolution>;
 }
 export declare class StaticJwksResolver implements JwksResolver {
     private readonly byKid;
     constructor(keys: AdcpJsonWebKey[]);
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    resolve(keyid: string, _signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
 }

package/dist/lib/signing/jwks.js

@@ -26,7 +26,7 @@ class StaticJwksResolver {
   constructor(keys) {
     for (const k of keys) this.byKid.set(k.kid, k);
   }
-  async resolve(keyid) {
+  async resolve(keyid, _signerOrigin) {
     return this.byKid.get(keyid) ?? null;
   }
 }

package/dist/lib/signing/jwks.mjs

@@ -3,7 +3,7 @@ class StaticJwksResolver {
   constructor(keys) {
     for (const k of keys) this.byKid.set(k.kid, k);
   }
-  async resolve(keyid) {
+  async resolve(keyid, _signerOrigin) {
     return this.byKid.get(keyid) ?? null;
   }
 }

package/dist/lib/signing/middleware.js

@@ -30,6 +30,15 @@ function createExpressVerifier(options) {
   const replayStore = options.replayStore ?? new import_replay.InMemoryReplayStore();
   const revocationStore = options.revocationStore ?? new import_revocation.InMemoryRevocationStore();
   return async function requestSignatureMiddleware(req, res, next) {
+    const { selectSignatureProfile, WebBotAuthError } = require('./web-bot-auth.js');
+    if (selectSignatureProfile({ headers: req.headers }) === "web-bot-auth") {
+      const refused = new WebBotAuthError(403, "profile_disabled");
+      res.status(refused.status).set("Cache-Control", "no-store").json({
+        ...refused.body,
+        message: "Web Bot Auth is not configured on this endpoint; use createAdcpServer signedRequests.webBotAuth or verifySignatureAsAuthenticator({ webBotAuth })"
+      });
+      return;
+    }
     try {
       const url = options.getUrl ? options.getUrl(req) : defaultUrl(req);
       const body = resolveRawBody(req);

package/dist/lib/signing/middleware.mjs

@@ -1,3 +1,8 @@
+import { fileURLToPath as __adcpFileURLToPath } from "node:url";
+import { dirname as __adcpDirname } from "node:path";
+import { createRequire as __adcpCreateRequire } from "node:module";
+const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
+const require2 = __adcpCreateRequire(import.meta.url);
 import { getHeaderValue } from "./canonicalize.mjs";
 import { RequestSignatureError } from "./errors.mjs";
 import { InMemoryReplayStore } from "./replay.mjs";
@@ -7,6 +12,15 @@ function createExpressVerifier(options) {
   const replayStore = options.replayStore ?? new InMemoryReplayStore();
   const revocationStore = options.revocationStore ?? new InMemoryRevocationStore();
   return async function requestSignatureMiddleware(req, res, next) {
+    const { selectSignatureProfile, WebBotAuthError } = require2("./web-bot-auth");
+    if (selectSignatureProfile({ headers: req.headers }) === "web-bot-auth") {
+      const refused = new WebBotAuthError(403, "profile_disabled");
+      res.status(refused.status).set("Cache-Control", "no-store").json({
+        ...refused.body,
+        message: "Web Bot Auth is not configured on this endpoint; use createAdcpServer signedRequests.webBotAuth or verifySignatureAsAuthenticator({ webBotAuth })"
+      });
+      return;
+    }
     try {
       const url = options.getUrl ? options.getUrl(req) : defaultUrl(req);
       const body = resolveRawBody(req);

package/dist/lib/signing/parser.d.mts

@@ -23,13 +23,16 @@ export interface ParsedSignature {
     label: string;
     bytes: Uint8Array;
 }
-export declare function parseSignatureInput(headerValue: string): ParsedSignatureInput;
+export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
- * RFC 8941 §3.2 parsers deduplicate by keeping the last value. The AdCP
- * profile (step 1) overrides that: duplicate keys are a downgrade vector —
- * a proxy could smuggle a weaker component set past a verifier that reads
- * the first. Detect duplicates at the raw-header level before the library
- * silently drops them.
+ * RFC 8941 / RFC 9651 parsers deduplicate dictionary keys and parameter keys
+ * by keeping the last value. The AdCP profile (step 1) overrides that:
+ * duplicates are a cross-implementation differential and a downgrade vector
+ * (a proxy could smuggle a weaker component set or a different `created`,
+ * `keyid` or `tag` past a verifier that reads the first). Detect them at the
+ * raw-header level before the library silently drops them: top-level
+ * dictionary keys, parameters on members and inner lists, and parameters on
+ * each inner-list item.
  */
 export declare function rejectDuplicateDictionaryKeys(headerValue: string, headerName: string): void;

package/dist/lib/signing/parser.d.ts

@@ -23,13 +23,16 @@ export interface ParsedSignature {
     label: string;
     bytes: Uint8Array;
 }
-export declare function parseSignatureInput(headerValue: string): ParsedSignatureInput;
+export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
- * RFC 8941 §3.2 parsers deduplicate by keeping the last value. The AdCP
- * profile (step 1) overrides that: duplicate keys are a downgrade vector —
- * a proxy could smuggle a weaker component set past a verifier that reads
- * the first. Detect duplicates at the raw-header level before the library
- * silently drops them.
+ * RFC 8941 / RFC 9651 parsers deduplicate dictionary keys and parameter keys
+ * by keeping the last value. The AdCP profile (step 1) overrides that:
+ * duplicates are a cross-implementation differential and a downgrade vector
+ * (a proxy could smuggle a weaker component set or a different `created`,
+ * `keyid` or `tag` past a verifier that reads the first). Detect them at the
+ * raw-header level before the library silently drops them: top-level
+ * dictionary keys, parameters on members and inner lists, and parameters on
+ * each inner-list item.
  */
 export declare function rejectDuplicateDictionaryKeys(headerValue: string, headerName: string): void;

package/dist/lib/signing/parser.js

@@ -31,7 +31,7 @@ const INTEGER_PARAMS = /* @__PURE__ */ new Set(["created", "expires"]);
 function malformed(message) {
   throw new import_errors.RequestSignatureError("request_signature_header_malformed", 1, message);
 }
-function parseSignatureInput(headerValue) {
+function parseSignatureInput(headerValue, expectedLabel) {
   rejectDuplicateDictionaryKeys(headerValue, "Signature-Input");
   let dict;
   try {
@@ -41,7 +41,8 @@ function parseSignatureInput(headerValue) {
     throw e;
   }
   if (dict.size === 0) malformed("Signature-Input header is empty");
-  const label = dict.has("sig1") ? "sig1" : dict.keys().next().value;
+  const label = expectedLabel ?? (dict.has("sig1") ? "sig1" : dict.keys().next().value);
+  if (!dict.has(label)) malformed("Signature-Input label is missing");
   const entry = dict.get(label);
   if (!isInnerList(entry)) {
     malformed("Signature-Input value must be a parenthesized component list");
@@ -49,7 +50,8 @@ function parseSignatureInput(headerValue) {
   const components = [];
   for (const [bare, itemParams] of entry[0]) {
     if (typeof bare !== "string") malformed("Signature-Input components must all be strings");
-    components.push(itemParams instanceof Map && itemParams.get("req") === true ? `${bare};req` : bare);
+    const serialized = (0, import_structured_headers.serializeItem)([bare, itemParams]);
+    components.push(`${bare}${serialized.slice(serialized.indexOf('"', 1) + 1)}`);
   }
   const params = {};
   for (const [key, value] of entry[1]) {
@@ -109,85 +111,101 @@ function isInnerList(entry) {
   return Array.isArray(entry) && Array.isArray(entry[0]);
 }
 function rejectDuplicateDictionaryKeys(headerValue, headerName) {
-  const keys = extractTopLevelDictKeys(headerValue);
-  const seen = /* @__PURE__ */ new Set();
-  for (const key of keys) {
-    if (seen.has(key)) {
-      malformed(`${headerName} header declares key "${key}" more than once`);
-    }
-    seen.add(key);
-  }
+  const duplicate = findDuplicateStructuredKey(headerValue);
+  if (duplicate?.kind === "member") malformed(`${headerName} header declares key "${duplicate.key}" more than once`);
+  if (duplicate) malformed(`${headerName} header declares parameter "${duplicate.key}" more than once`);
 }
-function extractTopLevelDictKeys(input) {
-  const keys = [];
+function findDuplicateStructuredKey(input) {
   let i = 0;
-  const len = input.length;
-  let atEntryStart = true;
-  while (i < len) {
-    if (atEntryStart) {
-      while (i < len && (input[i] === " " || input[i] === "	")) i++;
-      const keyStart = i;
-      while (i < len && /[A-Za-z0-9_*-]/.test(input[i])) i++;
-      if (i > keyStart) keys.push(input.slice(keyStart, i).toLowerCase());
-      atEntryStart = false;
-      continue;
+  const n = input.length;
+  const ows = () => {
+    while (i < n && (input[i] === " " || input[i] === "	")) i++;
+  };
+  const key = () => {
+    const start = i;
+    while (i < n && /[A-Za-z0-9_.*-]/.test(input[i])) i++;
+    return input.slice(start, i).toLowerCase();
+  };
+  const bareItem = () => {
+    if (input[i] === "%" && input[i + 1] === '"') {
+      i += 2;
+      while (i < n && input[i] !== '"') i++;
+      i++;
+      return;
     }
-    const ch = input[i];
-    if (ch === '"') {
+    if (input[i] === '"') {
       i++;
-      while (i < len) {
-        if (input[i] === "\\" && i + 1 < len) {
+      while (i < n) {
+        if (input[i] === "\\") {
           i += 2;
           continue;
         }
-        if (input[i] === '"') {
-          i++;
-          break;
-        }
-        i++;
+        if (input[i++] === '"') return;
       }
-      continue;
+      return;
     }
-    if (ch === ":") {
+    if (input[i] === ":") {
       i++;
-      while (i < len && input[i] !== ":") i++;
-      if (i < len) i++;
-      continue;
+      while (i < n && input[i] !== ":") i++;
+      i++;
+      return;
     }
-    if (ch === "(") {
+    while (i < n && !/[;,()\s"]/.test(input[i])) i++;
+  };
+  const parameters = () => {
+    const seen = /* @__PURE__ */ new Set();
+    while (i < n && input[i] === ";") {
       i++;
-      let depth = 1;
-      while (i < len && depth > 0) {
-        const c = input[i];
-        if (c === '"') {
-          i++;
-          while (i < len) {
-            if (input[i] === "\\" && i + 1 < len) {
-              i += 2;
-              continue;
-            }
-            if (input[i] === '"') {
-              i++;
-              break;
-            }
-            i++;
-          }
-          continue;
-        }
-        if (c === "(") depth++;
-        else if (c === ")") depth--;
+      ows();
+      const k = key();
+      if (!k) return void 0;
+      if (seen.has(k)) return k;
+      seen.add(k);
+      if (input[i] === "=") {
         i++;
+        bareItem();
       }
-      continue;
     }
-    if (ch === ",") {
-      atEntryStart = true;
+    return void 0;
+  };
+  const members = /* @__PURE__ */ new Set();
+  while (i < n) {
+    ows();
+    const k = key();
+    if (!k) return void 0;
+    if (members.has(k)) return { kind: "member", key: k };
+    members.add(k);
+    let duplicate;
+    if (input[i] === "=") {
       i++;
-      continue;
-    }
+      if (input[i] === "(") {
+        i++;
+        for (; ; ) {
+          while (i < n && input[i] === " ") i++;
+          if (i >= n) return void 0;
+          if (input[i] === ")") {
+            i++;
+            break;
+          }
+          const before = i;
+          bareItem();
+          duplicate = parameters();
+          if (duplicate) return { kind: "parameter", key: `${k}: ${duplicate}` };
+          if (i === before) return void 0;
+        }
+        duplicate = parameters();
+      } else {
+        bareItem();
+        duplicate = parameters();
+      }
+    } else duplicate = parameters();
+    if (duplicate) return { kind: "parameter", key: `${k}: ${duplicate}` };
+    ows();
+    if (i >= n) return void 0;
+    if (input[i] !== ",") return void 0;
     i++;
   }
-  return keys;
+  return void 0;
 }
 function normalizeByteSequenceBase64(input) {
   let out = "";