@adcp/sdk 16.0.0-beta.2 → 16.0.0-beta.4

package/dist/lib/signing/crypto.js

@@ -19,7 +19,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var crypto_exports = {};
 __export(crypto_exports, {
   jwkToPublicKey: () => jwkToPublicKey,
-  verifySignature: () => verifySignature
+  signWithPrivateJwk: () => signWithPrivateJwk,
+  signWithPrivateJwkAsync: () => signWithPrivateJwkAsync,
+  verifySignature: () => verifySignature,
+  verifySignatureAsync: () => verifySignatureAsync
 });
 module.exports = __toCommonJS(crypto_exports);
 var import_crypto = require("crypto");
@@ -45,7 +48,16 @@ function verifySignature(alg, publicKey, data, signature) {
       return (0, import_crypto.verify)(null, data, publicKey, signature);
     }
     if (alg === "ecdsa-p256-sha256") {
-      return (0, import_crypto.verify)("sha256", data, { key: publicKey, dsaEncoding: "ieee-p1363" }, signature);
+      try {
+        return (0, import_crypto.verify)("sha256", data, { key: publicKey, dsaEncoding: "ieee-p1363" }, signature);
+      } catch {
+        return (0, import_crypto.verify)(
+          "sha256",
+          data,
+          { key: publicKey.export({ format: "jwk" }), format: "jwk", dsaEncoding: "ieee-p1363" },
+          signature
+        );
+      }
     }
     if (alg === "rsa-pss-sha512") {
       return (0, import_crypto.verify)(
@@ -60,8 +72,68 @@ function verifySignature(alg, publicKey, data, signature) {
     return false;
   }
 }
+function subtleCrypto() {
+  const subtle = globalThis.crypto?.subtle;
+  return subtle && typeof subtle.importKey === "function" ? subtle : void 0;
+}
+const P256 = { name: "ECDSA", namedCurve: "P-256" };
+const P256_SHA256 = { name: "ECDSA", hash: "SHA-256" };
+function publicP256Jwk(jwk) {
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+}
+function privateP256Jwk(jwk) {
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y, d: jwk.d };
+}
+async function verifySignatureAsync(alg, publicKey, data, signature) {
+  const subtle = subtleCrypto();
+  const keyObject = () => isKeyObject(publicKey) ? publicKey : jwkToPublicKey(publicKey);
+  if (alg !== "ecdsa-p256-sha256" || !subtle) return verifySignature(alg, keyObject(), data, signature);
+  try {
+    const jwk = isKeyObject(publicKey) ? publicKey.export({ format: "jwk" }) : publicKey;
+    const key = await importP256VerifyKey(subtle, jwk);
+    return await subtle.verify(P256_SHA256, key, toArrayBuffer(signature), toArrayBuffer(data));
+  } catch {
+    return false;
+  }
+}
+function isKeyObject(value) {
+  return typeof value?.export === "function" && "asymmetricKeyType" in value;
+}
+const p256VerifyKeys = /* @__PURE__ */ new Map();
+function importP256VerifyKey(subtle, jwk) {
+  if (jwk.kty !== "EC" || jwk.crv !== "P-256" || typeof jwk.x !== "string" || typeof jwk.y !== "string")
+    return Promise.reject(new TypeError("Not a P-256 public key"));
+  const cacheKey = `${jwk.x}.${jwk.y}`;
+  let key = p256VerifyKeys.get(cacheKey);
+  if (!key) {
+    key = subtle.importKey("jwk", publicP256Jwk(jwk), P256, false, ["verify"]);
+    key.catch(() => p256VerifyKeys.delete(cacheKey));
+    if (p256VerifyKeys.size >= 256) p256VerifyKeys.delete(p256VerifyKeys.keys().next().value);
+    p256VerifyKeys.set(cacheKey, key);
+  }
+  return key;
+}
+function signWithPrivateJwk(alg, privateJwk, data) {
+  if (alg === "ed25519")
+    return new Uint8Array((0, import_crypto.sign)(null, data, (0, import_crypto.createPrivateKey)({ key: privateJwk, format: "jwk" })));
+  if (alg === "ecdsa-p256-sha256")
+    return new Uint8Array((0, import_crypto.sign)("sha256", data, { key: privateJwk, format: "jwk", dsaEncoding: "ieee-p1363" }));
+  throw new TypeError(`Unsupported signing algorithm: ${alg}`);
+}
+async function signWithPrivateJwkAsync(alg, privateJwk, data) {
+  const subtle = subtleCrypto();
+  if (alg !== "ecdsa-p256-sha256" || !subtle) return signWithPrivateJwk(alg, privateJwk, data);
+  const key = await subtle.importKey("jwk", privateP256Jwk(privateJwk), P256, false, ["sign"]);
+  return new Uint8Array(await subtle.sign(P256_SHA256, key, toArrayBuffer(data)));
+}
+function toArrayBuffer(bytes) {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   jwkToPublicKey,
-  verifySignature
+  signWithPrivateJwk,
+  signWithPrivateJwkAsync,
+  verifySignature,
+  verifySignatureAsync
 });

package/dist/lib/signing/crypto.mjs

@@ -1,4 +1,10 @@
-import { constants, createPublicKey, verify as nodeVerify } from "crypto";
+import {
+  constants,
+  createPrivateKey,
+  createPublicKey,
+  sign as nodeSign,
+  verify as nodeVerify
+} from "crypto";
 import { RequestSignatureError } from "./errors.mjs";
 function jwkToPublicKey(jwk) {
   const publicJwk = { ...jwk };
@@ -21,7 +27,16 @@ function verifySignature(alg, publicKey, data, signature) {
       return nodeVerify(null, data, publicKey, signature);
     }
     if (alg === "ecdsa-p256-sha256") {
-      return nodeVerify("sha256", data, { key: publicKey, dsaEncoding: "ieee-p1363" }, signature);
+      try {
+        return nodeVerify("sha256", data, { key: publicKey, dsaEncoding: "ieee-p1363" }, signature);
+      } catch {
+        return nodeVerify(
+          "sha256",
+          data,
+          { key: publicKey.export({ format: "jwk" }), format: "jwk", dsaEncoding: "ieee-p1363" },
+          signature
+        );
+      }
     }
     if (alg === "rsa-pss-sha512") {
       return nodeVerify(
@@ -36,7 +51,67 @@ function verifySignature(alg, publicKey, data, signature) {
     return false;
   }
 }
+function subtleCrypto() {
+  const subtle = globalThis.crypto?.subtle;
+  return subtle && typeof subtle.importKey === "function" ? subtle : void 0;
+}
+const P256 = { name: "ECDSA", namedCurve: "P-256" };
+const P256_SHA256 = { name: "ECDSA", hash: "SHA-256" };
+function publicP256Jwk(jwk) {
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+}
+function privateP256Jwk(jwk) {
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y, d: jwk.d };
+}
+async function verifySignatureAsync(alg, publicKey, data, signature) {
+  const subtle = subtleCrypto();
+  const keyObject = () => isKeyObject(publicKey) ? publicKey : jwkToPublicKey(publicKey);
+  if (alg !== "ecdsa-p256-sha256" || !subtle) return verifySignature(alg, keyObject(), data, signature);
+  try {
+    const jwk = isKeyObject(publicKey) ? publicKey.export({ format: "jwk" }) : publicKey;
+    const key = await importP256VerifyKey(subtle, jwk);
+    return await subtle.verify(P256_SHA256, key, toArrayBuffer(signature), toArrayBuffer(data));
+  } catch {
+    return false;
+  }
+}
+function isKeyObject(value) {
+  return typeof value?.export === "function" && "asymmetricKeyType" in value;
+}
+const p256VerifyKeys = /* @__PURE__ */ new Map();
+function importP256VerifyKey(subtle, jwk) {
+  if (jwk.kty !== "EC" || jwk.crv !== "P-256" || typeof jwk.x !== "string" || typeof jwk.y !== "string")
+    return Promise.reject(new TypeError("Not a P-256 public key"));
+  const cacheKey = `${jwk.x}.${jwk.y}`;
+  let key = p256VerifyKeys.get(cacheKey);
+  if (!key) {
+    key = subtle.importKey("jwk", publicP256Jwk(jwk), P256, false, ["verify"]);
+    key.catch(() => p256VerifyKeys.delete(cacheKey));
+    if (p256VerifyKeys.size >= 256) p256VerifyKeys.delete(p256VerifyKeys.keys().next().value);
+    p256VerifyKeys.set(cacheKey, key);
+  }
+  return key;
+}
+function signWithPrivateJwk(alg, privateJwk, data) {
+  if (alg === "ed25519")
+    return new Uint8Array(nodeSign(null, data, createPrivateKey({ key: privateJwk, format: "jwk" })));
+  if (alg === "ecdsa-p256-sha256")
+    return new Uint8Array(nodeSign("sha256", data, { key: privateJwk, format: "jwk", dsaEncoding: "ieee-p1363" }));
+  throw new TypeError(`Unsupported signing algorithm: ${alg}`);
+}
+async function signWithPrivateJwkAsync(alg, privateJwk, data) {
+  const subtle = subtleCrypto();
+  if (alg !== "ecdsa-p256-sha256" || !subtle) return signWithPrivateJwk(alg, privateJwk, data);
+  const key = await subtle.importKey("jwk", privateP256Jwk(privateJwk), P256, false, ["sign"]);
+  return new Uint8Array(await subtle.sign(P256_SHA256, key, toArrayBuffer(data)));
+}
+function toArrayBuffer(bytes) {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
 export {
   jwkToPublicKey,
-  verifySignature
+  signWithPrivateJwk,
+  signWithPrivateJwkAsync,
+  verifySignature,
+  verifySignatureAsync
 };

package/dist/lib/signing/server.d.mts

@@ -12,7 +12,7 @@ export type { SsrfDnsLookup } from '../net/index.mjs';
 export { buildResponseSignatureBase, buildSignatureBase, canonicalAuthority, canonicalMethod, canonicalTargetUri, formatSignatureParams, getHeaderValue, type RequestLike, type RequestCanonicalizationProfile, type ResponseLike, type SignatureParams, } from './canonicalize.mjs';
 export { computeContentDigest, contentDigestMatches, parseContentDigest } from './content-digest.mjs';
 export { requestContextFromExpress, requestContextFromFetch, requestContextFromLambda, type ExpressRequestLike, type FetchRequestLike, type LambdaRequestEvent, type RequestContextFromExpressOptions, type RequestContextFromLambdaOptions, } from './request-context.mjs';
-export { jwkToPublicKey, verifySignature } from './crypto.mjs';
+export { jwkToPublicKey, verifySignature, verifySignatureAsync } from './crypto.mjs';
 export { RequestSignatureError, RequestSigningErrorCodeMetadata, type RequestSignatureErrorCode, ResponseSignatureError, type ResponseSignatureErrorCode, WebhookSignatureError, type WebhookSignatureErrorCode, } from './errors.mjs';
 export { StaticJwksResolver, type JwksResolution, type JwksResolver } from './jwks.mjs';
 export { HttpsJwksResolver, type HttpsJwksResolverOptions } from './jwks-https.mjs';

package/dist/lib/signing/server.d.ts

@@ -12,7 +12,7 @@ export type { SsrfDnsLookup } from '../net';
 export { buildResponseSignatureBase, buildSignatureBase, canonicalAuthority, canonicalMethod, canonicalTargetUri, formatSignatureParams, getHeaderValue, type RequestLike, type RequestCanonicalizationProfile, type ResponseLike, type SignatureParams, } from './canonicalize';
 export { computeContentDigest, contentDigestMatches, parseContentDigest } from './content-digest';
 export { requestContextFromExpress, requestContextFromFetch, requestContextFromLambda, type ExpressRequestLike, type FetchRequestLike, type LambdaRequestEvent, type RequestContextFromExpressOptions, type RequestContextFromLambdaOptions, } from './request-context';
-export { jwkToPublicKey, verifySignature } from './crypto';
+export { jwkToPublicKey, verifySignature, verifySignatureAsync } from './crypto';
 export { RequestSignatureError, RequestSigningErrorCodeMetadata, type RequestSignatureErrorCode, ResponseSignatureError, type ResponseSignatureErrorCode, WebhookSignatureError, type WebhookSignatureErrorCode, } from './errors';
 export { StaticJwksResolver, type JwksResolution, type JwksResolver } from './jwks';
 export { HttpsJwksResolver, type HttpsJwksResolverOptions } from './jwks-https';

package/dist/lib/signing/server.js

@@ -83,6 +83,7 @@ __export(server_exports, {
   sweepExpiredReplays: () => import_postgres_replay_store.sweepExpiredReplays,
   verifyRequestSignature: () => import_verifier.verifyRequestSignature,
   verifySignature: () => import_crypto.verifySignature,
+  verifySignatureAsync: () => import_crypto.verifySignatureAsync,
   verifyWebhookSignature: () => import_webhook_verifier.verifyWebhookSignature
 });
 module.exports = __toCommonJS(server_exports);
@@ -175,5 +176,6 @@ var import_agent_resolver = require('./agent-resolver/index.js');
   sweepExpiredReplays,
   verifyRequestSignature,
   verifySignature,
+  verifySignatureAsync,
   verifyWebhookSignature
 });

package/dist/lib/signing/server.mjs

@@ -13,7 +13,7 @@ import {
   requestContextFromFetch,
   requestContextFromLambda
 } from "./request-context.mjs";
-import { jwkToPublicKey, verifySignature } from "./crypto.mjs";
+import { jwkToPublicKey, verifySignature, verifySignatureAsync } from "./crypto.mjs";
 import {
   RequestSignatureError,
   RequestSigningErrorCodeMetadata,
@@ -150,5 +150,6 @@ export {
   sweepExpiredReplays,
   verifyRequestSignature,
   verifySignature,
+  verifySignatureAsync,
   verifyWebhookSignature
 };

package/dist/lib/signing/signer.js

@@ -32,6 +32,7 @@ __export(signer_exports, {
 });
 module.exports = __toCommonJS(signer_exports);
 var import_crypto = require("crypto");
+var import_crypto2 = require('./crypto.js');
 var import_canonicalize = require('./canonicalize.js');
 var import_content_digest = require('./content-digest.js');
 var import_errors = require('./errors.js');
@@ -81,6 +82,7 @@ function prepareRequestSignature(request, identity, options = {}) {
   const windowSeconds = Math.min(options.windowSeconds ?? 300, import_types.MAX_SIGNATURE_WINDOW_SECONDS);
   const nonce = options.nonce ?? base64UrlRandom(16);
   const label = options.label ?? "sig1";
+  assertLabelAndClock(label, now);
   const hasBody = (request.body ?? "").length > 0;
   const binaryEncoding = options.binaryEncoding ?? "legacy-base64url";
   const coverDigest = options.coverContentDigest ?? binaryEncoding === "rfc8941-base64";
@@ -111,11 +113,8 @@ function prepareRequestSignature(request, identity, options = {}) {
 }
 function finalizeRequestSignature(prepared, signature) {
   const headers = { ...prepared.headers };
-  const sigB64 = Buffer.from(signature).toString(
-    prepared.binaryEncoding === "legacy-base64url" ? "base64url" : "base64"
-  );
   headers["Signature-Input"] = `${prepared.label}=${(0, import_canonicalize.formatSignatureParams)(prepared.components, prepared.params)}`;
-  headers["Signature"] = `${prepared.label}=:${sigB64}:`;
+  headers["Signature"] = (0, import_content_digest.serializeByteSequenceMember)(prepared.label, signature, prepared.binaryEncoding);
   return { headers, signatureBase: prepared.base, params: prepared.params };
 }
 function signRequest(request, key, options = {}) {
@@ -137,6 +136,7 @@ function prepareWebhookSignature(request, identity, options = {}) {
   const windowSeconds = Math.min(options.windowSeconds ?? 300, import_types.MAX_SIGNATURE_WINDOW_SECONDS);
   const nonce = options.nonce ?? base64UrlRandom(16);
   const label = options.label ?? "sig1";
+  assertLabelAndClock(label, now);
   const headers = { ...flattenHeaders(request.headers) };
   headers["Content-Digest"] = (0, import_content_digest.computeContentDigest)(request.body ?? "", "legacy-base64url");
   const components = [...import_webhook_verifier.WEBHOOK_MANDATORY_COMPONENTS];
@@ -163,6 +163,7 @@ function prepareResponseSignature(response, identity, options = {}) {
   const windowSeconds = Math.min(options.windowSeconds ?? 300, import_types.MAX_SIGNATURE_WINDOW_SECONDS);
   const nonce = options.nonce ?? base64UrlRandom(16);
   const label = options.label ?? "sig1";
+  assertLabelAndClock(label, now);
   const hasBody = (response.body ?? "").length > 0;
   const coverDigest = (options.coverContentDigest ?? true) && hasBody;
   const headers = { ...flattenHeaders(response.headers) };
@@ -191,9 +192,8 @@ function prepareResponseSignature(response, identity, options = {}) {
 }
 function finalizeResponseSignature(prepared, signature) {
   const headers = { ...prepared.headers };
-  const sigB64 = Buffer.from(signature).toString("base64url");
   headers["Signature-Input"] = `${prepared.label}=${(0, import_canonicalize.formatSignatureParams)(prepared.components, prepared.params)}`;
-  headers["Signature"] = `${prepared.label}=:${sigB64}:`;
+  headers["Signature"] = (0, import_content_digest.serializeByteSequenceMember)(prepared.label, signature, "legacy-base64url");
   return { status: prepared.status, headers, signatureBase: prepared.base, params: prepared.params };
 }
 function signResponse(response, key, options = {}) {
@@ -203,14 +203,7 @@ function signResponse(response, key, options = {}) {
   return finalizeResponseSignature(prepared, signature);
 }
 function produceSignature(key, data) {
-  const privateKey = (0, import_crypto.createPrivateKey)({
-    key: key.privateKey,
-    format: "jwk"
-  });
-  if (key.alg === "ed25519") {
-    return new Uint8Array((0, import_crypto.sign)(null, data, privateKey));
-  }
-  return new Uint8Array((0, import_crypto.sign)("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+  return (0, import_crypto2.signWithPrivateJwk)(key.alg, key.privateKey, data);
 }
 function flattenHeaders(headers) {
   const out = {};
@@ -220,6 +213,10 @@ function flattenHeaders(headers) {
   }
   return out;
 }
+function assertLabelAndClock(label, now) {
+  if (!/^[a-z*][a-z0-9_.*-]*$/.test(label)) throw new TypeError(`Signature label "${label}" is not an RFC 8941 key`);
+  if (!Number.isSafeInteger(now)) throw new TypeError("Signature clock must return integer epoch seconds");
+}
 function base64UrlRandom(byteLength) {
   return (0, import_crypto.randomBytes)(byteLength).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }

package/dist/lib/signing/signer.mjs

@@ -1,10 +1,11 @@
-import { createPrivateKey, randomBytes, sign as nodeSign } from "crypto";
+import { randomBytes } from "crypto";
+import { signWithPrivateJwk } from "./crypto.mjs";
 import {
   buildResponseSignatureBase,
   buildSignatureBase,
   formatSignatureParams
 } from "./canonicalize.mjs";
-import { computeContentDigest } from "./content-digest.mjs";
+import { computeContentDigest, serializeByteSequenceMember } from "./content-digest.mjs";
 import { RequestSignatureError, ResponseSignatureError, WebhookSignatureError } from "./errors.mjs";
 import {
   MANDATORY_COMPONENTS,
@@ -58,6 +59,7 @@ function prepareRequestSignature(request, identity, options = {}) {
   const windowSeconds = Math.min(options.windowSeconds ?? 300, MAX_SIGNATURE_WINDOW_SECONDS);
   const nonce = options.nonce ?? base64UrlRandom(16);
   const label = options.label ?? "sig1";
+  assertLabelAndClock(label, now);
   const hasBody = (request.body ?? "").length > 0;
   const binaryEncoding = options.binaryEncoding ?? "legacy-base64url";
   const coverDigest = options.coverContentDigest ?? binaryEncoding === "rfc8941-base64";
@@ -88,11 +90,8 @@ function prepareRequestSignature(request, identity, options = {}) {
 }
 function finalizeRequestSignature(prepared, signature) {
   const headers = { ...prepared.headers };
-  const sigB64 = Buffer.from(signature).toString(
-    prepared.binaryEncoding === "legacy-base64url" ? "base64url" : "base64"
-  );
   headers["Signature-Input"] = `${prepared.label}=${formatSignatureParams(prepared.components, prepared.params)}`;
-  headers["Signature"] = `${prepared.label}=:${sigB64}:`;
+  headers["Signature"] = serializeByteSequenceMember(prepared.label, signature, prepared.binaryEncoding);
   return { headers, signatureBase: prepared.base, params: prepared.params };
 }
 function signRequest(request, key, options = {}) {
@@ -114,6 +113,7 @@ function prepareWebhookSignature(request, identity, options = {}) {
   const windowSeconds = Math.min(options.windowSeconds ?? 300, MAX_SIGNATURE_WINDOW_SECONDS);
   const nonce = options.nonce ?? base64UrlRandom(16);
   const label = options.label ?? "sig1";
+  assertLabelAndClock(label, now);
   const headers = { ...flattenHeaders(request.headers) };
   headers["Content-Digest"] = computeContentDigest(request.body ?? "", "legacy-base64url");
   const components = [...WEBHOOK_MANDATORY_COMPONENTS];
@@ -140,6 +140,7 @@ function prepareResponseSignature(response, identity, options = {}) {
   const windowSeconds = Math.min(options.windowSeconds ?? 300, MAX_SIGNATURE_WINDOW_SECONDS);
   const nonce = options.nonce ?? base64UrlRandom(16);
   const label = options.label ?? "sig1";
+  assertLabelAndClock(label, now);
   const hasBody = (response.body ?? "").length > 0;
   const coverDigest = (options.coverContentDigest ?? true) && hasBody;
   const headers = { ...flattenHeaders(response.headers) };
@@ -168,9 +169,8 @@ function prepareResponseSignature(response, identity, options = {}) {
 }
 function finalizeResponseSignature(prepared, signature) {
   const headers = { ...prepared.headers };
-  const sigB64 = Buffer.from(signature).toString("base64url");
   headers["Signature-Input"] = `${prepared.label}=${formatSignatureParams(prepared.components, prepared.params)}`;
-  headers["Signature"] = `${prepared.label}=:${sigB64}:`;
+  headers["Signature"] = serializeByteSequenceMember(prepared.label, signature, "legacy-base64url");
   return { status: prepared.status, headers, signatureBase: prepared.base, params: prepared.params };
 }
 function signResponse(response, key, options = {}) {
@@ -180,14 +180,7 @@ function signResponse(response, key, options = {}) {
   return finalizeResponseSignature(prepared, signature);
 }
 function produceSignature(key, data) {
-  const privateKey = createPrivateKey({
-    key: key.privateKey,
-    format: "jwk"
-  });
-  if (key.alg === "ed25519") {
-    return new Uint8Array(nodeSign(null, data, privateKey));
-  }
-  return new Uint8Array(nodeSign("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+  return signWithPrivateJwk(key.alg, key.privateKey, data);
 }
 function flattenHeaders(headers) {
   const out = {};
@@ -197,6 +190,10 @@ function flattenHeaders(headers) {
   }
   return out;
 }
+function assertLabelAndClock(label, now) {
+  if (!/^[a-z*][a-z0-9_.*-]*$/.test(label)) throw new TypeError(`Signature label "${label}" is not an RFC 8941 key`);
+  if (!Number.isSafeInteger(now)) throw new TypeError("Signature clock must return integer epoch seconds");
+}
 function base64UrlRandom(byteLength) {
   return randomBytes(byteLength).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }

package/dist/lib/signing/testing.js

@@ -35,6 +35,7 @@ __export(testing_exports, {
 });
 module.exports = __toCommonJS(testing_exports);
 var import_node_crypto = require("node:crypto");
+var import_crypto = require('./crypto.js');
 var import_jwks_helpers = require('./jwks-helpers.js');
 const ALLOW_IN_MEMORY_SIGNER_ENV = "ADCP_ALLOW_IN_MEMORY_SIGNER";
 class InMemorySigningProvider {
@@ -61,12 +62,7 @@ class InMemorySigningProvider {
     this.fingerprint = (0, import_node_crypto.createHash)("sha256").update(options.keyid).update("\0").update(options.privateKey.d).digest("hex").slice(0, 16);
   }
   async sign(payload) {
-    const privateKey = (0, import_node_crypto.createPrivateKey)({ key: this.privateKey, format: "jwk" });
-    const data = Buffer.from(payload);
-    if (this.algorithm === "ed25519") {
-      return new Uint8Array((0, import_node_crypto.sign)(null, data, privateKey));
-    }
-    return new Uint8Array((0, import_node_crypto.sign)("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+    return (0, import_crypto.signWithPrivateJwkAsync)(this.algorithm, this.privateKey, payload);
   }
 }
 function signerKeyToProvider(key) {

package/dist/lib/signing/testing.mjs

@@ -1,4 +1,5 @@
-import { createHash, createPrivateKey, randomUUID, sign as nodeSign } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
+import { signWithPrivateJwkAsync } from "./crypto.mjs";
 import { assertAdcpUse } from "./jwks-helpers.mjs";
 const ALLOW_IN_MEMORY_SIGNER_ENV = "ADCP_ALLOW_IN_MEMORY_SIGNER";
 class InMemorySigningProvider {
@@ -25,12 +26,7 @@ class InMemorySigningProvider {
     this.fingerprint = createHash("sha256").update(options.keyid).update("\0").update(options.privateKey.d).digest("hex").slice(0, 16);
   }
   async sign(payload) {
-    const privateKey = createPrivateKey({ key: this.privateKey, format: "jwk" });
-    const data = Buffer.from(payload);
-    if (this.algorithm === "ed25519") {
-      return new Uint8Array(nodeSign(null, data, privateKey));
-    }
-    return new Uint8Array(nodeSign("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+    return signWithPrivateJwkAsync(this.algorithm, this.privateKey, payload);
   }
 }
 function signerKeyToProvider(key) {

package/dist/lib/signing/verifier.js

@@ -191,8 +191,8 @@ async function verifyRequestSignature(request, options) {
     parsedInput.signatureParamsValue,
     canonicalizationProfile
   );
-  const publicKey = (0, import_crypto.jwkToPublicKey)(jwk);
-  const valid = (0, import_crypto.verifySignature)(parsedInput.params.alg, publicKey, Buffer.from(base, "utf8"), parsedSig.bytes);
+  (0, import_crypto.jwkToPublicKey)(jwk);
+  const valid = await (0, import_crypto.verifySignatureAsync)(parsedInput.params.alg, jwk, Buffer.from(base, "utf8"), parsedSig.bytes);
   if (!valid) {
     throw new import_errors.RequestSignatureError(
       "request_signature_invalid",

package/dist/lib/signing/verifier.mjs

@@ -16,7 +16,7 @@ import { RequestSignatureError } from "./errors.mjs";
 import { AgentResolverError } from "./agent-resolver/errors.mjs";
 import { parseStrictJson, StrictJsonError } from "./agent-resolver/strict-json.mjs";
 import { parseSignature, parseSignatureInput } from "./parser.mjs";
-import { jwkToPublicKey, verifySignature } from "./crypto.mjs";
+import { jwkToPublicKey, verifySignatureAsync } from "./crypto.mjs";
 import { isUnresolvableOperation } from "./operation-resolution.mjs";
 import { containsWebhookAuthentication, WEBHOOK_AUTH_TRAVERSAL_DEPTH } from "./webhook-auth-detection.mjs";
 import {
@@ -180,8 +180,8 @@ async function verifyRequestSignature(request, options) {
     parsedInput.signatureParamsValue,
     canonicalizationProfile
   );
-  const publicKey = jwkToPublicKey(jwk);
-  const valid = verifySignature(parsedInput.params.alg, publicKey, Buffer.from(base, "utf8"), parsedSig.bytes);
+  jwkToPublicKey(jwk);
+  const valid = await verifySignatureAsync(parsedInput.params.alg, jwk, Buffer.from(base, "utf8"), parsedSig.bytes);
   if (!valid) {
     throw new RequestSignatureError(
       "request_signature_invalid",