@adcp/sdk 16.0.0-beta.1 → 16.0.0-beta.3

package/dist/lib/signing/fetch.mjs

@@ -67,7 +67,7 @@ function bodyToString(body) {
 }
 function decodeUtf8Strict(bytes) {
   try {
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
   } catch {
     throw new TypeError(
       "createSigningFetch received a Uint8Array/ArrayBuffer body that is not valid UTF-8. Pass a string body, ensure the bytes are UTF-8, or sign the request manually with `signRequest` against the exact wire bytes you intend to send."

package/dist/lib/signing/middleware.js

@@ -30,6 +30,15 @@ function createExpressVerifier(options) {
   const replayStore = options.replayStore ?? new import_replay.InMemoryReplayStore();
   const revocationStore = options.revocationStore ?? new import_revocation.InMemoryRevocationStore();
   return async function requestSignatureMiddleware(req, res, next) {
+    const { selectSignatureProfile, WebBotAuthError } = require('./web-bot-auth.js');
+    if (selectSignatureProfile({ headers: req.headers }) === "web-bot-auth") {
+      const refused = new WebBotAuthError(403, "profile_disabled");
+      res.status(refused.status).set("Cache-Control", "no-store").json({
+        ...refused.body,
+        message: "Web Bot Auth is not configured on this endpoint; use createAdcpServer signedRequests.webBotAuth or verifySignatureAsAuthenticator({ webBotAuth })"
+      });
+      return;
+    }
     try {
       const url = options.getUrl ? options.getUrl(req) : defaultUrl(req);
       const body = resolveRawBody(req);

package/dist/lib/signing/middleware.mjs

@@ -1,3 +1,8 @@
+import { fileURLToPath as __adcpFileURLToPath } from "node:url";
+import { dirname as __adcpDirname } from "node:path";
+import { createRequire as __adcpCreateRequire } from "node:module";
+const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
+const require2 = __adcpCreateRequire(import.meta.url);
 import { getHeaderValue } from "./canonicalize.mjs";
 import { RequestSignatureError } from "./errors.mjs";
 import { InMemoryReplayStore } from "./replay.mjs";
@@ -7,6 +12,15 @@ function createExpressVerifier(options) {
   const replayStore = options.replayStore ?? new InMemoryReplayStore();
   const revocationStore = options.revocationStore ?? new InMemoryRevocationStore();
   return async function requestSignatureMiddleware(req, res, next) {
+    const { selectSignatureProfile, WebBotAuthError } = require2("./web-bot-auth");
+    if (selectSignatureProfile({ headers: req.headers }) === "web-bot-auth") {
+      const refused = new WebBotAuthError(403, "profile_disabled");
+      res.status(refused.status).set("Cache-Control", "no-store").json({
+        ...refused.body,
+        message: "Web Bot Auth is not configured on this endpoint; use createAdcpServer signedRequests.webBotAuth or verifySignatureAsAuthenticator({ webBotAuth })"
+      });
+      return;
+    }
     try {
       const url = options.getUrl ? options.getUrl(req) : defaultUrl(req);
       const body = resolveRawBody(req);

package/dist/lib/signing/parser.d.mts

@@ -26,10 +26,13 @@ export interface ParsedSignature {
 export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
- * RFC 8941 §3.2 parsers deduplicate by keeping the last value. The AdCP
- * profile (step 1) overrides that: duplicate keys are a downgrade vector —
- * a proxy could smuggle a weaker component set past a verifier that reads
- * the first. Detect duplicates at the raw-header level before the library
- * silently drops them.
+ * RFC 8941 / RFC 9651 parsers deduplicate dictionary keys and parameter keys
+ * by keeping the last value. The AdCP profile (step 1) overrides that:
+ * duplicates are a cross-implementation differential and a downgrade vector
+ * (a proxy could smuggle a weaker component set or a different `created`,
+ * `keyid` or `tag` past a verifier that reads the first). Detect them at the
+ * raw-header level before the library silently drops them: top-level
+ * dictionary keys, parameters on members and inner lists, and parameters on
+ * each inner-list item.
  */
 export declare function rejectDuplicateDictionaryKeys(headerValue: string, headerName: string): void;

package/dist/lib/signing/parser.d.ts

@@ -26,10 +26,13 @@ export interface ParsedSignature {
 export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
- * RFC 8941 §3.2 parsers deduplicate by keeping the last value. The AdCP
- * profile (step 1) overrides that: duplicate keys are a downgrade vector —
- * a proxy could smuggle a weaker component set past a verifier that reads
- * the first. Detect duplicates at the raw-header level before the library
- * silently drops them.
+ * RFC 8941 / RFC 9651 parsers deduplicate dictionary keys and parameter keys
+ * by keeping the last value. The AdCP profile (step 1) overrides that:
+ * duplicates are a cross-implementation differential and a downgrade vector
+ * (a proxy could smuggle a weaker component set or a different `created`,
+ * `keyid` or `tag` past a verifier that reads the first). Detect them at the
+ * raw-header level before the library silently drops them: top-level
+ * dictionary keys, parameters on members and inner lists, and parameters on
+ * each inner-list item.
  */
 export declare function rejectDuplicateDictionaryKeys(headerValue: string, headerName: string): void;

package/dist/lib/signing/parser.js

@@ -111,85 +111,101 @@ function isInnerList(entry) {
   return Array.isArray(entry) && Array.isArray(entry[0]);
 }
 function rejectDuplicateDictionaryKeys(headerValue, headerName) {
-  const keys = extractTopLevelDictKeys(headerValue);
-  const seen = /* @__PURE__ */ new Set();
-  for (const key of keys) {
-    if (seen.has(key)) {
-      malformed(`${headerName} header declares key "${key}" more than once`);
-    }
-    seen.add(key);
-  }
+  const duplicate = findDuplicateStructuredKey(headerValue);
+  if (duplicate?.kind === "member") malformed(`${headerName} header declares key "${duplicate.key}" more than once`);
+  if (duplicate) malformed(`${headerName} header declares parameter "${duplicate.key}" more than once`);
 }
-function extractTopLevelDictKeys(input) {
-  const keys = [];
+function findDuplicateStructuredKey(input) {
   let i = 0;
-  const len = input.length;
-  let atEntryStart = true;
-  while (i < len) {
-    if (atEntryStart) {
-      while (i < len && (input[i] === " " || input[i] === "	")) i++;
-      const keyStart = i;
-      while (i < len && /[A-Za-z0-9_*-]/.test(input[i])) i++;
-      if (i > keyStart) keys.push(input.slice(keyStart, i).toLowerCase());
-      atEntryStart = false;
-      continue;
+  const n = input.length;
+  const ows = () => {
+    while (i < n && (input[i] === " " || input[i] === "	")) i++;
+  };
+  const key = () => {
+    const start = i;
+    while (i < n && /[A-Za-z0-9_.*-]/.test(input[i])) i++;
+    return input.slice(start, i).toLowerCase();
+  };
+  const bareItem = () => {
+    if (input[i] === "%" && input[i + 1] === '"') {
+      i += 2;
+      while (i < n && input[i] !== '"') i++;
+      i++;
+      return;
     }
-    const ch = input[i];
-    if (ch === '"') {
+    if (input[i] === '"') {
       i++;
-      while (i < len) {
-        if (input[i] === "\\" && i + 1 < len) {
+      while (i < n) {
+        if (input[i] === "\\") {
           i += 2;
           continue;
         }
-        if (input[i] === '"') {
-          i++;
-          break;
-        }
-        i++;
+        if (input[i++] === '"') return;
       }
-      continue;
+      return;
     }
-    if (ch === ":") {
+    if (input[i] === ":") {
       i++;
-      while (i < len && input[i] !== ":") i++;
-      if (i < len) i++;
-      continue;
+      while (i < n && input[i] !== ":") i++;
+      i++;
+      return;
     }
-    if (ch === "(") {
+    while (i < n && !/[;,()\s"]/.test(input[i])) i++;
+  };
+  const parameters = () => {
+    const seen = /* @__PURE__ */ new Set();
+    while (i < n && input[i] === ";") {
       i++;
-      let depth = 1;
-      while (i < len && depth > 0) {
-        const c = input[i];
-        if (c === '"') {
-          i++;
-          while (i < len) {
-            if (input[i] === "\\" && i + 1 < len) {
-              i += 2;
-              continue;
-            }
-            if (input[i] === '"') {
-              i++;
-              break;
-            }
-            i++;
-          }
-          continue;
-        }
-        if (c === "(") depth++;
-        else if (c === ")") depth--;
+      ows();
+      const k = key();
+      if (!k) return void 0;
+      if (seen.has(k)) return k;
+      seen.add(k);
+      if (input[i] === "=") {
         i++;
+        bareItem();
       }
-      continue;
     }
-    if (ch === ",") {
-      atEntryStart = true;
+    return void 0;
+  };
+  const members = /* @__PURE__ */ new Set();
+  while (i < n) {
+    ows();
+    const k = key();
+    if (!k) return void 0;
+    if (members.has(k)) return { kind: "member", key: k };
+    members.add(k);
+    let duplicate;
+    if (input[i] === "=") {
       i++;
-      continue;
-    }
+      if (input[i] === "(") {
+        i++;
+        for (; ; ) {
+          while (i < n && input[i] === " ") i++;
+          if (i >= n) return void 0;
+          if (input[i] === ")") {
+            i++;
+            break;
+          }
+          const before = i;
+          bareItem();
+          duplicate = parameters();
+          if (duplicate) return { kind: "parameter", key: `${k}: ${duplicate}` };
+          if (i === before) return void 0;
+        }
+        duplicate = parameters();
+      } else {
+        bareItem();
+        duplicate = parameters();
+      }
+    } else duplicate = parameters();
+    if (duplicate) return { kind: "parameter", key: `${k}: ${duplicate}` };
+    ows();
+    if (i >= n) return void 0;
+    if (input[i] !== ",") return void 0;
     i++;
   }
-  return keys;
+  return void 0;
 }
 function normalizeByteSequenceBase64(input) {
   let out = "";

package/dist/lib/signing/parser.mjs

@@ -86,85 +86,101 @@ function isInnerList(entry) {
   return Array.isArray(entry) && Array.isArray(entry[0]);
 }
 function rejectDuplicateDictionaryKeys(headerValue, headerName) {
-  const keys = extractTopLevelDictKeys(headerValue);
-  const seen = /* @__PURE__ */ new Set();
-  for (const key of keys) {
-    if (seen.has(key)) {
-      malformed(`${headerName} header declares key "${key}" more than once`);
-    }
-    seen.add(key);
-  }
+  const duplicate = findDuplicateStructuredKey(headerValue);
+  if (duplicate?.kind === "member") malformed(`${headerName} header declares key "${duplicate.key}" more than once`);
+  if (duplicate) malformed(`${headerName} header declares parameter "${duplicate.key}" more than once`);
 }
-function extractTopLevelDictKeys(input) {
-  const keys = [];
+function findDuplicateStructuredKey(input) {
   let i = 0;
-  const len = input.length;
-  let atEntryStart = true;
-  while (i < len) {
-    if (atEntryStart) {
-      while (i < len && (input[i] === " " || input[i] === "	")) i++;
-      const keyStart = i;
-      while (i < len && /[A-Za-z0-9_*-]/.test(input[i])) i++;
-      if (i > keyStart) keys.push(input.slice(keyStart, i).toLowerCase());
-      atEntryStart = false;
-      continue;
+  const n = input.length;
+  const ows = () => {
+    while (i < n && (input[i] === " " || input[i] === "	")) i++;
+  };
+  const key = () => {
+    const start = i;
+    while (i < n && /[A-Za-z0-9_.*-]/.test(input[i])) i++;
+    return input.slice(start, i).toLowerCase();
+  };
+  const bareItem = () => {
+    if (input[i] === "%" && input[i + 1] === '"') {
+      i += 2;
+      while (i < n && input[i] !== '"') i++;
+      i++;
+      return;
     }
-    const ch = input[i];
-    if (ch === '"') {
+    if (input[i] === '"') {
       i++;
-      while (i < len) {
-        if (input[i] === "\\" && i + 1 < len) {
+      while (i < n) {
+        if (input[i] === "\\") {
           i += 2;
           continue;
         }
-        if (input[i] === '"') {
-          i++;
-          break;
-        }
-        i++;
+        if (input[i++] === '"') return;
       }
-      continue;
+      return;
     }
-    if (ch === ":") {
+    if (input[i] === ":") {
       i++;
-      while (i < len && input[i] !== ":") i++;
-      if (i < len) i++;
-      continue;
+      while (i < n && input[i] !== ":") i++;
+      i++;
+      return;
     }
-    if (ch === "(") {
+    while (i < n && !/[;,()\s"]/.test(input[i])) i++;
+  };
+  const parameters = () => {
+    const seen = /* @__PURE__ */ new Set();
+    while (i < n && input[i] === ";") {
       i++;
-      let depth = 1;
-      while (i < len && depth > 0) {
-        const c = input[i];
-        if (c === '"') {
-          i++;
-          while (i < len) {
-            if (input[i] === "\\" && i + 1 < len) {
-              i += 2;
-              continue;
-            }
-            if (input[i] === '"') {
-              i++;
-              break;
-            }
-            i++;
-          }
-          continue;
-        }
-        if (c === "(") depth++;
-        else if (c === ")") depth--;
+      ows();
+      const k = key();
+      if (!k) return void 0;
+      if (seen.has(k)) return k;
+      seen.add(k);
+      if (input[i] === "=") {
         i++;
+        bareItem();
       }
-      continue;
     }
-    if (ch === ",") {
-      atEntryStart = true;
+    return void 0;
+  };
+  const members = /* @__PURE__ */ new Set();
+  while (i < n) {
+    ows();
+    const k = key();
+    if (!k) return void 0;
+    if (members.has(k)) return { kind: "member", key: k };
+    members.add(k);
+    let duplicate;
+    if (input[i] === "=") {
       i++;
-      continue;
-    }
+      if (input[i] === "(") {
+        i++;
+        for (; ; ) {
+          while (i < n && input[i] === " ") i++;
+          if (i >= n) return void 0;
+          if (input[i] === ")") {
+            i++;
+            break;
+          }
+          const before = i;
+          bareItem();
+          duplicate = parameters();
+          if (duplicate) return { kind: "parameter", key: `${k}: ${duplicate}` };
+          if (i === before) return void 0;
+        }
+        duplicate = parameters();
+      } else {
+        bareItem();
+        duplicate = parameters();
+      }
+    } else duplicate = parameters();
+    if (duplicate) return { kind: "parameter", key: `${k}: ${duplicate}` };
+    ows();
+    if (i >= n) return void 0;
+    if (input[i] !== ",") return void 0;
     i++;
   }
-  return keys;
+  return void 0;
 }
 function normalizeByteSequenceBase64(input) {
   let out = "";

package/dist/lib/signing/revocation.js

@@ -59,6 +59,9 @@ const REASONS = [
 ];
 function mergeRevocationDetails(prior, detail) {
   const reason = REASONS.indexOf(detail.reason ?? "unspecified") > REASONS.indexOf(prior?.reason ?? "unspecified") ? detail.reason : prior?.reason ?? detail.reason;
+  const hasValidDate = (entry) => !!entry?.invalidity_date && Number.isFinite(Date.parse(entry.invalidity_date));
+  if (reason === "keyCompromise" && [prior, detail].some((entry) => entry?.reason === "keyCompromise" && !hasValidDate(entry)))
+    return { reason };
   const dates = [prior?.invalidity_date, detail.invalidity_date].filter((s) => !!s && Number.isFinite(Date.parse(s))).sort((a, b) => Date.parse(a) - Date.parse(b));
   return { ...reason ? { reason } : {}, ...dates[0] ? { invalidity_date: dates[0] } : {} };
 }

package/dist/lib/signing/revocation.mjs

@@ -35,6 +35,9 @@ const REASONS = [
 ];
 function mergeRevocationDetails(prior, detail) {
   const reason = REASONS.indexOf(detail.reason ?? "unspecified") > REASONS.indexOf(prior?.reason ?? "unspecified") ? detail.reason : prior?.reason ?? detail.reason;
+  const hasValidDate = (entry) => !!entry?.invalidity_date && Number.isFinite(Date.parse(entry.invalidity_date));
+  if (reason === "keyCompromise" && [prior, detail].some((entry) => entry?.reason === "keyCompromise" && !hasValidDate(entry)))
+    return { reason };
   const dates = [prior?.invalidity_date, detail.invalidity_date].filter((s) => !!s && Number.isFinite(Date.parse(s))).sort((a, b) => Date.parse(a) - Date.parse(b));
   return { ...reason ? { reason } : {}, ...dates[0] ? { invalidity_date: dates[0] } : {} };
 }

package/dist/lib/signing/server.d.mts

@@ -12,7 +12,7 @@ export type { SsrfDnsLookup } from '../net/index.mjs';
 export { buildResponseSignatureBase, buildSignatureBase, canonicalAuthority, canonicalMethod, canonicalTargetUri, formatSignatureParams, getHeaderValue, type RequestLike, type RequestCanonicalizationProfile, type ResponseLike, type SignatureParams, } from './canonicalize.mjs';
 export { computeContentDigest, contentDigestMatches, parseContentDigest } from './content-digest.mjs';
 export { requestContextFromExpress, requestContextFromFetch, requestContextFromLambda, type ExpressRequestLike, type FetchRequestLike, type LambdaRequestEvent, type RequestContextFromExpressOptions, type RequestContextFromLambdaOptions, } from './request-context.mjs';
-export { jwkToPublicKey, verifySignature } from './crypto.mjs';
+export { jwkToPublicKey, verifySignature, verifySignatureAsync } from './crypto.mjs';
 export { RequestSignatureError, RequestSigningErrorCodeMetadata, type RequestSignatureErrorCode, ResponseSignatureError, type ResponseSignatureErrorCode, WebhookSignatureError, type WebhookSignatureErrorCode, } from './errors.mjs';
 export { StaticJwksResolver, type JwksResolution, type JwksResolver } from './jwks.mjs';
 export { HttpsJwksResolver, type HttpsJwksResolverOptions } from './jwks-https.mjs';

package/dist/lib/signing/server.d.ts

@@ -12,7 +12,7 @@ export type { SsrfDnsLookup } from '../net';
 export { buildResponseSignatureBase, buildSignatureBase, canonicalAuthority, canonicalMethod, canonicalTargetUri, formatSignatureParams, getHeaderValue, type RequestLike, type RequestCanonicalizationProfile, type ResponseLike, type SignatureParams, } from './canonicalize';
 export { computeContentDigest, contentDigestMatches, parseContentDigest } from './content-digest';
 export { requestContextFromExpress, requestContextFromFetch, requestContextFromLambda, type ExpressRequestLike, type FetchRequestLike, type LambdaRequestEvent, type RequestContextFromExpressOptions, type RequestContextFromLambdaOptions, } from './request-context';
-export { jwkToPublicKey, verifySignature } from './crypto';
+export { jwkToPublicKey, verifySignature, verifySignatureAsync } from './crypto';
 export { RequestSignatureError, RequestSigningErrorCodeMetadata, type RequestSignatureErrorCode, ResponseSignatureError, type ResponseSignatureErrorCode, WebhookSignatureError, type WebhookSignatureErrorCode, } from './errors';
 export { StaticJwksResolver, type JwksResolution, type JwksResolver } from './jwks';
 export { HttpsJwksResolver, type HttpsJwksResolverOptions } from './jwks-https';

package/dist/lib/signing/server.js

@@ -83,6 +83,7 @@ __export(server_exports, {
   sweepExpiredReplays: () => import_postgres_replay_store.sweepExpiredReplays,
   verifyRequestSignature: () => import_verifier.verifyRequestSignature,
   verifySignature: () => import_crypto.verifySignature,
+  verifySignatureAsync: () => import_crypto.verifySignatureAsync,
   verifyWebhookSignature: () => import_webhook_verifier.verifyWebhookSignature
 });
 module.exports = __toCommonJS(server_exports);
@@ -175,5 +176,6 @@ var import_agent_resolver = require('./agent-resolver/index.js');
   sweepExpiredReplays,
   verifyRequestSignature,
   verifySignature,
+  verifySignatureAsync,
   verifyWebhookSignature
 });

package/dist/lib/signing/server.mjs

@@ -13,7 +13,7 @@ import {
   requestContextFromFetch,
   requestContextFromLambda
 } from "./request-context.mjs";
-import { jwkToPublicKey, verifySignature } from "./crypto.mjs";
+import { jwkToPublicKey, verifySignature, verifySignatureAsync } from "./crypto.mjs";
 import {
   RequestSignatureError,
   RequestSigningErrorCodeMetadata,
@@ -150,5 +150,6 @@ export {
   sweepExpiredReplays,
   verifyRequestSignature,
   verifySignature,
+  verifySignatureAsync,
   verifyWebhookSignature
 };

package/dist/lib/signing/signer.js

@@ -32,6 +32,7 @@ __export(signer_exports, {
 });
 module.exports = __toCommonJS(signer_exports);
 var import_crypto = require("crypto");
+var import_crypto2 = require('./crypto.js');
 var import_canonicalize = require('./canonicalize.js');
 var import_content_digest = require('./content-digest.js');
 var import_errors = require('./errors.js');
@@ -203,14 +204,7 @@ function signResponse(response, key, options = {}) {
   return finalizeResponseSignature(prepared, signature);
 }
 function produceSignature(key, data) {
-  const privateKey = (0, import_crypto.createPrivateKey)({
-    key: key.privateKey,
-    format: "jwk"
-  });
-  if (key.alg === "ed25519") {
-    return new Uint8Array((0, import_crypto.sign)(null, data, privateKey));
-  }
-  return new Uint8Array((0, import_crypto.sign)("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+  return (0, import_crypto2.signWithPrivateJwk)(key.alg, key.privateKey, data);
 }
 function flattenHeaders(headers) {
   const out = {};

package/dist/lib/signing/signer.mjs

@@ -1,4 +1,5 @@
-import { createPrivateKey, randomBytes, sign as nodeSign } from "crypto";
+import { randomBytes } from "crypto";
+import { signWithPrivateJwk } from "./crypto.mjs";
 import {
   buildResponseSignatureBase,
   buildSignatureBase,
@@ -180,14 +181,7 @@ function signResponse(response, key, options = {}) {
   return finalizeResponseSignature(prepared, signature);
 }
 function produceSignature(key, data) {
-  const privateKey = createPrivateKey({
-    key: key.privateKey,
-    format: "jwk"
-  });
-  if (key.alg === "ed25519") {
-    return new Uint8Array(nodeSign(null, data, privateKey));
-  }
-  return new Uint8Array(nodeSign("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+  return signWithPrivateJwk(key.alg, key.privateKey, data);
 }
 function flattenHeaders(headers) {
   const out = {};

package/dist/lib/signing/testing.js

@@ -35,6 +35,7 @@ __export(testing_exports, {
 });
 module.exports = __toCommonJS(testing_exports);
 var import_node_crypto = require("node:crypto");
+var import_crypto = require('./crypto.js');
 var import_jwks_helpers = require('./jwks-helpers.js');
 const ALLOW_IN_MEMORY_SIGNER_ENV = "ADCP_ALLOW_IN_MEMORY_SIGNER";
 class InMemorySigningProvider {
@@ -61,12 +62,7 @@ class InMemorySigningProvider {
     this.fingerprint = (0, import_node_crypto.createHash)("sha256").update(options.keyid).update("\0").update(options.privateKey.d).digest("hex").slice(0, 16);
   }
   async sign(payload) {
-    const privateKey = (0, import_node_crypto.createPrivateKey)({ key: this.privateKey, format: "jwk" });
-    const data = Buffer.from(payload);
-    if (this.algorithm === "ed25519") {
-      return new Uint8Array((0, import_node_crypto.sign)(null, data, privateKey));
-    }
-    return new Uint8Array((0, import_node_crypto.sign)("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+    return (0, import_crypto.signWithPrivateJwkAsync)(this.algorithm, this.privateKey, payload);
   }
 }
 function signerKeyToProvider(key) {

package/dist/lib/signing/testing.mjs

@@ -1,4 +1,5 @@
-import { createHash, createPrivateKey, randomUUID, sign as nodeSign } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
+import { signWithPrivateJwkAsync } from "./crypto.mjs";
 import { assertAdcpUse } from "./jwks-helpers.mjs";
 const ALLOW_IN_MEMORY_SIGNER_ENV = "ADCP_ALLOW_IN_MEMORY_SIGNER";
 class InMemorySigningProvider {
@@ -25,12 +26,7 @@ class InMemorySigningProvider {
     this.fingerprint = createHash("sha256").update(options.keyid).update("\0").update(options.privateKey.d).digest("hex").slice(0, 16);
   }
   async sign(payload) {
-    const privateKey = createPrivateKey({ key: this.privateKey, format: "jwk" });
-    const data = Buffer.from(payload);
-    if (this.algorithm === "ed25519") {
-      return new Uint8Array(nodeSign(null, data, privateKey));
-    }
-    return new Uint8Array(nodeSign("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+    return signWithPrivateJwkAsync(this.algorithm, this.privateKey, payload);
   }
 }
 function signerKeyToProvider(key) {

package/dist/lib/signing/verifier.js

@@ -191,8 +191,8 @@ async function verifyRequestSignature(request, options) {
     parsedInput.signatureParamsValue,
     canonicalizationProfile
   );
-  const publicKey = (0, import_crypto.jwkToPublicKey)(jwk);
-  const valid = (0, import_crypto.verifySignature)(parsedInput.params.alg, publicKey, Buffer.from(base, "utf8"), parsedSig.bytes);
+  (0, import_crypto.jwkToPublicKey)(jwk);
+  const valid = await (0, import_crypto.verifySignatureAsync)(parsedInput.params.alg, jwk, Buffer.from(base, "utf8"), parsedSig.bytes);
   if (!valid) {
     throw new import_errors.RequestSignatureError(
       "request_signature_invalid",
@@ -239,7 +239,7 @@ async function verifyRequestSignature(request, options) {
       "Delegated operator authorization expired during verification"
     );
   }
-  const remaining = parsedInput.params.expires - now + import_types.CLOCK_SKEW_TOLERANCE_SECONDS;
+  const remaining = parsedInput.params.expires - now + import_types.CLOCK_SKEW_TOLERANCE_SECONDS + 1;
   const ttl = Math.max(remaining, import_types.MAX_SIGNATURE_WINDOW_SECONDS + import_types.CLOCK_SKEW_TOLERANCE_SECONDS);
   const insertResult = await options.replayStore.insert(jwk.kid, replayScope, parsedInput.params.nonce, ttl, now);
   if (insertResult === "replayed") {

package/dist/lib/signing/verifier.mjs

@@ -16,7 +16,7 @@ import { RequestSignatureError } from "./errors.mjs";
 import { AgentResolverError } from "./agent-resolver/errors.mjs";
 import { parseStrictJson, StrictJsonError } from "./agent-resolver/strict-json.mjs";
 import { parseSignature, parseSignatureInput } from "./parser.mjs";
-import { jwkToPublicKey, verifySignature } from "./crypto.mjs";
+import { jwkToPublicKey, verifySignatureAsync } from "./crypto.mjs";
 import { isUnresolvableOperation } from "./operation-resolution.mjs";
 import { containsWebhookAuthentication, WEBHOOK_AUTH_TRAVERSAL_DEPTH } from "./webhook-auth-detection.mjs";
 import {
@@ -180,8 +180,8 @@ async function verifyRequestSignature(request, options) {
     parsedInput.signatureParamsValue,
     canonicalizationProfile
   );
-  const publicKey = jwkToPublicKey(jwk);
-  const valid = verifySignature(parsedInput.params.alg, publicKey, Buffer.from(base, "utf8"), parsedSig.bytes);
+  jwkToPublicKey(jwk);
+  const valid = await verifySignatureAsync(parsedInput.params.alg, jwk, Buffer.from(base, "utf8"), parsedSig.bytes);
   if (!valid) {
     throw new RequestSignatureError(
       "request_signature_invalid",
@@ -228,7 +228,7 @@ async function verifyRequestSignature(request, options) {
       "Delegated operator authorization expired during verification"
     );
   }
-  const remaining = parsedInput.params.expires - now + CLOCK_SKEW_TOLERANCE_SECONDS;
+  const remaining = parsedInput.params.expires - now + CLOCK_SKEW_TOLERANCE_SECONDS + 1;
   const ttl = Math.max(remaining, MAX_SIGNATURE_WINDOW_SECONDS + CLOCK_SKEW_TOLERANCE_SECONDS);
   const insertResult = await options.replayStore.insert(jwk.kid, replayScope, parsedInput.params.nonce, ttl, now);
   if (insertResult === "replayed") {