@adcp/sdk 16.0.0-beta.2 → 16.0.0-beta.4

package/dist/lib/substitution/translate.mjs

@@ -1,14 +1,43 @@
 import { encodeUnreserved } from "./rfc3986.mjs";
-const UNIVERSAL_MACRO = /\{[A-Z][A-Z0-9_]*\}/g;
-const NATIVE_TOKEN_SHAPE = /^(?:%%.+%%|\{\{.+\}\}|\$\{.+\}|\[[A-Z][A-Z0-9_]*\])$/;
-const CONSENT_MACROS = /* @__PURE__ */ new Set([
-  "{GDPR}",
-  "{GDPR_CONSENT}",
-  "{US_PRIVACY}",
-  "{GPP_STRING}",
-  "{GPP_SID}",
-  "{LIMIT_AD_TRACKING}"
-]);
+import { isConsentMacro, isVendorScopedConsentMacro } from "./consent-macros.mjs";
+function* macroTokens(text) {
+  const missingClosers = /* @__PURE__ */ new Set();
+  let cursor = 0;
+  while (cursor < text.length) {
+    let end = -1;
+    let native = true;
+    const close = text.startsWith("%%", cursor) ? "%%" : text.startsWith("{{", cursor) ? "}}" : text.startsWith("${", cursor) ? "}" : null;
+    if (close && !missingClosers.has(close)) {
+      const closer = text.indexOf(close, cursor + 2);
+      if (closer === -1) missingClosers.add(close);
+      else end = closer + close.length;
+    }
+    if (end === -1 && (text[cursor] === "{" || text[cursor] === "[")) {
+      let nameEnd = cursor + 1;
+      if (/[A-Z]/.test(text[nameEnd] ?? "")) {
+        nameEnd += 1;
+        while (/[A-Z0-9_]/.test(text[nameEnd] ?? "")) nameEnd += 1;
+        if (text[nameEnd] === (text[cursor] === "{" ? "}" : "]")) {
+          end = nameEnd + 1;
+          native = text[cursor] === "[";
+        }
+      }
+    }
+    if (end === -1) {
+      cursor += 1;
+      continue;
+    }
+    yield { text: text.slice(cursor, end), start: cursor, end, native };
+    cursor = end;
+  }
+}
+function hasNativeTokenSyntax(value) {
+  for (const token of macroTokens(value)) {
+    const minimumLength = token.text.startsWith("${") ? 3 : token.text.startsWith("[") ? 2 : 4;
+    if (token.native && token.text.length > minimumLength) return true;
+  }
+  return false;
+}
 const UNSAFE_NATIVE_CHARACTER = /[\u0000-\u001F\u007F]/;
 class UnsafeNativeMappingError extends Error {
   code = "unsafe_native_mapping";
@@ -22,6 +51,83 @@ class UnsafeNativeMappingError extends Error {
     this.macro = macro;
   }
 }
+class MultipleVendorConsentMacrosError extends Error {
+  code = "multiple_vendor_consent_macros";
+  macro;
+  constructor(macro) {
+    super(`Multiple vendor-scoped consent macros; second token is ${JSON.stringify(macro)}`);
+    this.name = "MultipleVendorConsentMacrosError";
+    this.macro = macro;
+  }
+}
+function overlappingRange(ranges, candidate) {
+  let low = 0;
+  let high = ranges.length;
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+    if (ranges[middle].end <= candidate.start) low = middle + 1;
+    else high = middle;
+  }
+  const range = ranges[low];
+  return range && range.start < candidate.end ? range : void 0;
+}
+function assertSingleScopedConsent(spans, mapping) {
+  const url = spans.map((span) => span.text).join("");
+  const concrete = [];
+  const sources = [];
+  let offset = 0;
+  for (const span of spans) {
+    const range = { start: offset, end: offset + span.text.length };
+    if (span.concrete && range.start < range.end) {
+      const previous = concrete[concrete.length - 1];
+      if (previous?.end === range.start) previous.end = range.end;
+      else concrete.push(range);
+    }
+    if (span.scopedSource && span.text.length > 0) sources.push({ ...range, macro: span.scopedSource });
+    offset = range.end;
+  }
+  const occurrences = [];
+  const shells = [];
+  for (const token of macroTokens(url)) {
+    const range = { start: token.start, end: token.end };
+    shells.push(range);
+    const canonical = token.text.startsWith("${") ? token.text.slice(1) : token.text;
+    if (isVendorScopedConsentMacro(canonical)) {
+      occurrences.push({ ...range, macro: canonical });
+    }
+  }
+  const aliases = [];
+  for (const [macro, entry] of Object.entries(mapping)) {
+    if (!isVendorScopedConsentMacro(macro) || !("native" in entry) || entry.native.length === 0) continue;
+    let start = url.indexOf(entry.native);
+    while (start !== -1) {
+      const range = { start, end: start + entry.native.length };
+      const shell = overlappingRange(shells, range);
+      const completeShell = shell?.start === range.start && shell.end === range.end;
+      const insideShell = shell && shell.start <= range.start && range.end <= shell.end && !completeShell;
+      const data = overlappingRange(concrete, range);
+      const entirelyConcrete = data && data.start <= range.start && range.end <= data.end;
+      if (!insideShell && (completeShell || !entirelyConcrete) && !overlappingRange(occurrences, range)) {
+        aliases.push({ ...range, macro });
+      }
+      start = url.indexOf(entry.native, range.end);
+    }
+  }
+  aliases.sort((a, b) => a.start - b.start || b.end - a.end);
+  const selectedAliases = [];
+  for (const alias of aliases) {
+    const previous = selectedAliases[selectedAliases.length - 1];
+    if (!previous || previous.end <= alias.start) selectedAliases.push(alias);
+  }
+  for (const alias of selectedAliases) occurrences.push(alias);
+  occurrences.sort((a, b) => a.start - b.start);
+  const unmatchedSources = sources.filter((source) => !overlappingRange(occurrences, source));
+  for (const source of unmatchedSources) occurrences.push(source);
+  occurrences.sort((a, b) => a.start - b.start);
+  const second = occurrences[1];
+  if (second) throw new MultipleVendorConsentMacrosError(second.macro);
+  return url;
+}
 function translateUniversalMacros(input_pixel_url, mapping) {
   const suspect_native_values = [];
   const suspectSeen = /* @__PURE__ */ new Set();
@@ -34,11 +140,11 @@ function translateUniversalMacros(input_pixel_url, mapping) {
       }
       continue;
     }
-    if (CONSENT_MACROS.has(macro) && !frozenConsentSeen.has(macro)) {
+    if (isConsentMacro(macro) && !frozenConsentSeen.has(macro)) {
       frozenConsentSeen.add(macro);
       frozen_consent_macros.push(macro);
     }
-    if (NATIVE_TOKEN_SHAPE.test(entry.value) && !suspectSeen.has(macro)) {
+    if (hasNativeTokenSyntax(entry.value) && !suspectSeen.has(macro)) {
       suspectSeen.add(macro);
       suspect_native_values.push(macro);
     }
@@ -49,7 +155,7 @@ function translateUniversalMacros(input_pixel_url, mapping) {
   const queryIdx = withoutFragment.indexOf("?");
   if (queryIdx === -1) {
     return {
-      url: input_pixel_url,
+      url: assertSingleScopedConsent([{ text: input_pixel_url }], mapping),
       dropped_params: [],
       unmapped_macros: [],
       dropped_consent_macros: [],
@@ -69,12 +175,12 @@ function translateUniversalMacros(input_pixel_url, mapping) {
     const eqIdx = rawParam.indexOf("=");
     const key = eqIdx === -1 ? rawParam : rawParam.slice(0, eqIdx);
     const value = eqIdx === -1 ? "" : rawParam.slice(eqIdx + 1);
-    const tokens = value.match(UNIVERSAL_MACRO);
-    if (!tokens) {
-      outputParts.push(rawParam);
+    const tokens = [...macroTokens(value)].filter((token) => !token.native);
+    if (tokens.length === 0) {
+      outputParts.push([{ text: rawParam }]);
       continue;
     }
-    const missing = tokens.filter((t) => !(t in mapping));
+    const missing = tokens.map((token) => token.text).filter((token) => !(token in mapping));
     if (missing.length > 0) {
       dropped_params.push(key);
       for (const m of missing) {
@@ -82,24 +188,38 @@ function translateUniversalMacros(input_pixel_url, mapping) {
           unmappedSeen.add(m);
           unmapped_macros.push(m);
         }
-        if (CONSENT_MACROS.has(m) && !consentSeen.has(m)) {
+        if (isConsentMacro(m) && !consentSeen.has(m)) {
           consentSeen.add(m);
           dropped_consent_macros.push(m);
         }
       }
       continue;
     }
-    const translated = value.replace(UNIVERSAL_MACRO, (token) => {
+    const translated = [{ text: `${key}=` }];
+    let cursor = 0;
+    for (const match of tokens) {
+      const token = match.text;
+      translated.push({ text: value.slice(cursor, match.start) });
       const entry = mapping[token];
-      if (!entry) {
-        return token;
+      if ("native" in entry) {
+        translated.push({
+          text: entry.native,
+          ...isVendorScopedConsentMacro(token) ? { scopedSource: token } : {}
+        });
+      } else {
+        translated.push({ text: encodeUnreserved(entry.value), concrete: true });
       }
-      return "native" in entry ? entry.native : encodeUnreserved(entry.value);
-    });
-    outputParts.push(`${key}=${translated}`);
+      cursor = match.end;
+    }
+    translated.push({ text: value.slice(cursor) });
+    outputParts.push(translated);
   }
-  const newQuery = outputParts.join("&");
-  const url = newQuery ? `${base}?${newQuery}${fragment}` : `${base}${fragment}`;
+  const querySpans = outputParts.flatMap((part, index) => index === 0 ? part : [{ text: "&" }, ...part]);
+  const hasQuery = querySpans.some((span) => span.text.length > 0);
+  const url = assertSingleScopedConsent(
+    [{ text: base }, ...hasQuery ? [{ text: "?" }, ...querySpans] : [], { text: fragment }],
+    mapping
+  );
   return {
     url,
     dropped_params,
@@ -110,6 +230,7 @@ function translateUniversalMacros(input_pixel_url, mapping) {
   };
 }
 export {
+  MultipleVendorConsentMacrosError,
   UnsafeNativeMappingError,
   translateUniversalMacros
 };

package/dist/lib/testing/client.js

@@ -55,6 +55,7 @@ var import_protocols = require('../protocols/index.js');
 var import_node_crypto = require("node:crypto");
 var import_node_async_hooks = require("node:async_hooks");
 var import_client_hooks = require('../validation/client-hooks.js');
+var import_schema_loader = require('../validation/schema-loader.js');
 var import_error_extraction = require('../utils/error-extraction.js');
 var import_client = require('../signing/client.js');
 var import_storage_registry = require('../auth/oauth/storage-registry.js');
@@ -534,7 +535,7 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
           caps.data,
           "strict",
           void 0,
-          schemaAdcpVersion ?? client.getAdcpVersion()
+          (0, import_schema_loader.resolveServedValidationVersion)(caps.data, schemaAdcpVersion ?? client.getAdcpVersion())
         );
         if (!validation.valid) {
           profile.capabilities_schema_issues = validation.issues.map((issue) => ({

package/dist/lib/testing/client.mjs

@@ -12,6 +12,7 @@ import { normalizeTransportOptions } from "../protocols/index.mjs";
 import { createHmac, hkdfSync, randomBytes } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { validateIncomingResponse } from "../validation/client-hooks.mjs";
+import { resolveServedValidationVersion } from "../validation/schema-loader.mjs";
 import { extractVersionUnsupportedDetails } from "../utils/error-extraction.mjs";
 import { buildAgentSigningContext } from "../signing/client.mjs";
 import { bindAgentStorage } from "../auth/oauth/storage-registry.mjs";
@@ -491,7 +492,7 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
           caps.data,
           "strict",
           void 0,
-          schemaAdcpVersion ?? client.getAdcpVersion()
+          resolveServedValidationVersion(caps.data, schemaAdcpVersion ?? client.getAdcpVersion())
         );
         if (!validation.valid) {
           profile.capabilities_schema_issues = validation.issues.map((issue) => ({

package/dist/lib/testing/scenarios/capabilities.js

@@ -239,7 +239,7 @@ function crossValidateProtocolsAndTools(capabilities, tools) {
     creative: import_capabilities.CREATIVE_TOOLS,
     sponsored_intelligence: import_capabilities.SPONSORED_INTELLIGENCE_TOOLS,
     trusted_match: import_capabilities.TRUSTED_MATCH_TOOLS,
-    compliance: import_capabilities.COMPLIANCE_TOOLS
+    compliance_testing: import_capabilities.COMPLIANCE_TOOLS
   };
   const perProtocolDiffs = {};
   for (const protocol of capabilities.protocols) {

package/dist/lib/testing/scenarios/capabilities.mjs

@@ -225,7 +225,7 @@ function crossValidateProtocolsAndTools(capabilities, tools) {
     creative: CREATIVE_TOOLS,
     sponsored_intelligence: SPONSORED_INTELLIGENCE_TOOLS,
     trusted_match: TRUSTED_MATCH_TOOLS,
-    compliance: COMPLIANCE_TOOLS
+    compliance_testing: COMPLIANCE_TOOLS
   };
   const perProtocolDiffs = {};
   for (const protocol of capabilities.protocols) {

package/dist/lib/testing/storyboard/junit.js

@@ -82,8 +82,9 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     const suiteGroup = options.suite_groups?.[sb.storyboard_id];
     const suiteClassname = suiteGroup ? `${suiteGroup}.${sb.storyboard_id}` : sb.storyboard_id;
     const suiteCases = [];
-    let suiteFailures = sb.failed_count;
+    let suiteFailures = 0;
     let representedSkipped = 0;
+    let suiteSkipped = 0;
     const passPhases = sb.passes?.length ? sb.passes.map((pass) => ({ label: `Pass ${pass.pass_index} \u203A `, phases: pass.phases })) : [{ label: "", phases: sb.phases }];
     for (const pass of passPhases) {
       for (const phase of pass.phases) {
@@ -93,6 +94,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
           const time = ((step.duration_ms || 0) / 1e3).toFixed(3);
           if (step.skipped) {
             representedSkipped += 1;
+            suiteSkipped += 1;
             totalSkipped += 1;
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -102,7 +104,6 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
             continue;
           }
           if (!step.passed) {
-            totalFailures += 1;
             const failureDetails = [
               step.error,
               ...step.validations.filter((v) => !v.passed).map(
@@ -114,6 +115,17 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
               // report body.
               ...hintLines(step.hints)
             ].filter(Boolean).join("\n");
+            if (step.counts_toward_failure === false) {
+              suiteCases.push(
+                `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
+      <system-out>${xmlEscape(`Optional phase failure; excluded from storyboard verdict.
+${failureDetails}`)}</system-out>
+    </testcase>`
+              );
+              continue;
+            }
+            totalFailures += 1;
+            suiteFailures += 1;
             const message = step.error || firstHintMessage(step) || "validation failed";
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -136,6 +148,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     if (hasStoryboardFixtureSkip) {
       totalTests += 1;
       totalSkipped += 1;
+      suiteSkipped += 1;
       suiteCases.push(
         `    <testcase classname="${xmlEscape(suiteClassname)}" name="Fixture resolution" time="0.000">
       <skipped message="${xmlEscape(fixtureGap.detail)}"/>
@@ -159,7 +172,7 @@ ${assertion.error}` : ""}`;
     totalDuration += sb.total_duration_ms || 0;
     const suiteTests = suiteCases.length;
     suites.push(
-      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${sb.skipped_count}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
+      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${suiteSkipped}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
 ` + suiteCases.join("\n") + `
   </testsuite>`
     );

package/dist/lib/testing/storyboard/junit.mjs

@@ -58,8 +58,9 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     const suiteGroup = options.suite_groups?.[sb.storyboard_id];
     const suiteClassname = suiteGroup ? `${suiteGroup}.${sb.storyboard_id}` : sb.storyboard_id;
     const suiteCases = [];
-    let suiteFailures = sb.failed_count;
+    let suiteFailures = 0;
     let representedSkipped = 0;
+    let suiteSkipped = 0;
     const passPhases = sb.passes?.length ? sb.passes.map((pass) => ({ label: `Pass ${pass.pass_index} \u203A `, phases: pass.phases })) : [{ label: "", phases: sb.phases }];
     for (const pass of passPhases) {
       for (const phase of pass.phases) {
@@ -69,6 +70,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
           const time = ((step.duration_ms || 0) / 1e3).toFixed(3);
           if (step.skipped) {
             representedSkipped += 1;
+            suiteSkipped += 1;
             totalSkipped += 1;
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -78,7 +80,6 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
             continue;
           }
           if (!step.passed) {
-            totalFailures += 1;
             const failureDetails = [
               step.error,
               ...step.validations.filter((v) => !v.passed).map(
@@ -90,6 +91,17 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
               // report body.
               ...hintLines(step.hints)
             ].filter(Boolean).join("\n");
+            if (step.counts_toward_failure === false) {
+              suiteCases.push(
+                `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
+      <system-out>${xmlEscape(`Optional phase failure; excluded from storyboard verdict.
+${failureDetails}`)}</system-out>
+    </testcase>`
+              );
+              continue;
+            }
+            totalFailures += 1;
+            suiteFailures += 1;
             const message = step.error || firstHintMessage(step) || "validation failed";
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -112,6 +124,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     if (hasStoryboardFixtureSkip) {
       totalTests += 1;
       totalSkipped += 1;
+      suiteSkipped += 1;
       suiteCases.push(
         `    <testcase classname="${xmlEscape(suiteClassname)}" name="Fixture resolution" time="0.000">
       <skipped message="${xmlEscape(fixtureGap.detail)}"/>
@@ -135,7 +148,7 @@ ${assertion.error}` : ""}`;
     totalDuration += sb.total_duration_ms || 0;
     const suiteTests = suiteCases.length;
     suites.push(
-      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${sb.skipped_count}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
+      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${suiteSkipped}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
 ` + suiteCases.join("\n") + `
   </testsuite>`
     );

package/dist/lib/testing/storyboard/request-signing/builder.js

@@ -24,6 +24,8 @@ __export(builder_exports, {
 });
 module.exports = __toCommonJS(builder_exports);
 var import_crypto = require("crypto");
+var import_structured_headers = require("structured-headers");
+var import_crypto2 = require('../../../signing/crypto.js');
 var import_signing = require('../../../signing/index.js');
 var import_vector_loader = require('./vector-loader.js');
 function buildPositiveRequest(vector, keys, options = {}) {
@@ -560,22 +562,18 @@ function refreshContentDigest(shaped, vector, shape) {
   });
 }
 function formatParamsWithOmissions(components, params, override) {
-  const componentList = components.map((c) => `"${c}"`).join(" ");
-  const pairs = [];
-  pairs.push(`created=${params.created}`);
-  if (!override.omitExpires) pairs.push(`expires=${params.expires}`);
-  if (!override.omitNonce) pairs.push(`nonce="${params.nonce}"`);
-  pairs.push(`keyid="${params.keyid}"`);
-  pairs.push(`alg="${params.alg}"`);
-  pairs.push(`tag="${params.tag}"`);
-  return `(${componentList});${pairs.join(";")}`;
+  const omitted = /* @__PURE__ */ new Set([
+    ...override.omitExpires ? ["expires"] : [],
+    ...override.omitNonce ? ["nonce"] : []
+  ]);
+  const pairs = /* @__PURE__ */ new Map();
+  for (const key of ["created", "expires", "nonce", "keyid", "alg", "tag"]) {
+    if (!omitted.has(key) && params[key] !== void 0) pairs.set(key, params[key]);
+  }
+  return (0, import_structured_headers.serializeInnerList)([components.map((c) => [c, /* @__PURE__ */ new Map()]), pairs]);
 }
 function produceSignature(key, data) {
-  const privateKey = (0, import_crypto.createPrivateKey)({ key: key.privateKey, format: "jwk" });
-  if (key.alg === "ed25519") {
-    return new Uint8Array((0, import_crypto.sign)(null, data, privateKey));
-  }
-  return new Uint8Array((0, import_crypto.sign)("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+  return (0, import_crypto2.signWithPrivateJwk)(key.alg, key.privateKey, data);
 }
 function signerKeyFor(vector, keys) {
   const kid = vector.jwks_ref?.[0];

package/dist/lib/testing/storyboard/request-signing/builder.mjs

@@ -1,4 +1,6 @@
-import { createHash, createPrivateKey, randomBytes, randomUUID, sign as nodeSign } from "crypto";
+import { createHash, randomBytes, randomUUID } from "crypto";
+import { serializeInnerList } from "structured-headers";
+import { signWithPrivateJwk } from "../../../signing/crypto.mjs";
 import {
   buildSignatureBase,
   computeContentDigest,
@@ -543,22 +545,18 @@ function refreshContentDigest(shaped, vector, shape) {
   });
 }
 function formatParamsWithOmissions(components, params, override) {
-  const componentList = components.map((c) => `"${c}"`).join(" ");
-  const pairs = [];
-  pairs.push(`created=${params.created}`);
-  if (!override.omitExpires) pairs.push(`expires=${params.expires}`);
-  if (!override.omitNonce) pairs.push(`nonce="${params.nonce}"`);
-  pairs.push(`keyid="${params.keyid}"`);
-  pairs.push(`alg="${params.alg}"`);
-  pairs.push(`tag="${params.tag}"`);
-  return `(${componentList});${pairs.join(";")}`;
+  const omitted = /* @__PURE__ */ new Set([
+    ...override.omitExpires ? ["expires"] : [],
+    ...override.omitNonce ? ["nonce"] : []
+  ]);
+  const pairs = /* @__PURE__ */ new Map();
+  for (const key of ["created", "expires", "nonce", "keyid", "alg", "tag"]) {
+    if (!omitted.has(key) && params[key] !== void 0) pairs.set(key, params[key]);
+  }
+  return serializeInnerList([components.map((c) => [c, /* @__PURE__ */ new Map()]), pairs]);
 }
 function produceSignature(key, data) {
-  const privateKey = createPrivateKey({ key: key.privateKey, format: "jwk" });
-  if (key.alg === "ed25519") {
-    return new Uint8Array(nodeSign(null, data, privateKey));
-  }
-  return new Uint8Array(nodeSign("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+  return signWithPrivateJwk(key.alg, key.privateKey, data);
 }
 function signerKeyFor(vector, keys) {
   const kid = vector.jwks_ref?.[0];