@adcp/sdk 16.0.0-beta.3 → 16.0.0-beta.5

package/dist/lib/reporting/service/scheduler-support.d.mts

@@ -0,0 +1,43 @@
+/**
+ * Scheduler primitives shared by `createReliableReportingService` and by services composed with it
+ * (for example `@adcp/reporting-storage/service`). They are exported so a composition can pace its own
+ * background passes and report failures the same way the Core scheduler does.
+ */
+import type { ReportingLedgerStore } from '../ledger/types.mjs';
+/**
+ * The error's own message only, credential-redacted, bounded, and total.
+ *
+ * Stacks and error objects can carry request payloads and upstream credentials
+ * into a log sink the adopter did not choose, so only `message` is read. Every
+ * step is guarded because the value is arbitrary: `String(Object.create(null))`
+ * throws, a `Symbol.toPrimitive` or `message` getter can throw or run adopter
+ * code, and a Proxy can trap the prototype walk `instanceof` performs. This
+ * function runs while building the diagnostic, outside the catch that guards
+ * the logger call, so a throw here escaped `reportSchedulerError`, rejected the
+ * scheduler loop, and surfaced as an unhandled rejection — killing the
+ * background loop, or the host, over an error object's shape.
+ */
+export declare function reportingSchedulerErrorMessage(error: unknown): string;
+export declare function reportingSchedulerDelay(milliseconds: number, signal: AbortSignal): Promise<void>;
+/** Start each pass one tenant further along so no fixed order can starve. */
+export declare function rotateReportingRoster<T>(values: readonly T[], by: number): T[];
+/**
+ * Every account the ledger currently holds a configuration for. This is the
+ * roster a deployment-wide worker is authorized over, so it is also the roster
+ * the per-account budgets apply to.
+ */
+export declare function reportingDeploymentWideAccountIds(store: ReportingLedgerStore): Promise<string[]>;
+/** The parts of the scheduler options that failure reporting reads. */
+export interface ReportingSchedulerReportingOptionsV1 {
+    onError?: (error: unknown) => void | Promise<void>;
+    logger?: {
+        warn: (message: string) => void;
+    };
+}
+/** Where in the scheduler loop a failure happened. */
+export interface ReportingSchedulerFailureSiteV1 {
+    readonly phase: 'roster' | 'cycle' | 'maintenance';
+    readonly accountId?: string | undefined;
+}
+export declare function reportReportingSchedulerError(options: ReportingSchedulerReportingOptionsV1, signal: AbortSignal, error: unknown, site: ReportingSchedulerFailureSiteV1): Promise<void>;
+export declare function warnReportingSchedulerFailure(options: ReportingSchedulerReportingOptionsV1, site: ReportingSchedulerFailureSiteV1, error: unknown, observerError?: unknown): void;

package/dist/lib/reporting/service/scheduler-support.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Scheduler primitives shared by `createReliableReportingService` and by services composed with it
+ * (for example `@adcp/reporting-storage/service`). They are exported so a composition can pace its own
+ * background passes and report failures the same way the Core scheduler does.
+ */
+import type { ReportingLedgerStore } from '../ledger/types';
+/**
+ * The error's own message only, credential-redacted, bounded, and total.
+ *
+ * Stacks and error objects can carry request payloads and upstream credentials
+ * into a log sink the adopter did not choose, so only `message` is read. Every
+ * step is guarded because the value is arbitrary: `String(Object.create(null))`
+ * throws, a `Symbol.toPrimitive` or `message` getter can throw or run adopter
+ * code, and a Proxy can trap the prototype walk `instanceof` performs. This
+ * function runs while building the diagnostic, outside the catch that guards
+ * the logger call, so a throw here escaped `reportSchedulerError`, rejected the
+ * scheduler loop, and surfaced as an unhandled rejection — killing the
+ * background loop, or the host, over an error object's shape.
+ */
+export declare function reportingSchedulerErrorMessage(error: unknown): string;
+export declare function reportingSchedulerDelay(milliseconds: number, signal: AbortSignal): Promise<void>;
+/** Start each pass one tenant further along so no fixed order can starve. */
+export declare function rotateReportingRoster<T>(values: readonly T[], by: number): T[];
+/**
+ * Every account the ledger currently holds a configuration for. This is the
+ * roster a deployment-wide worker is authorized over, so it is also the roster
+ * the per-account budgets apply to.
+ */
+export declare function reportingDeploymentWideAccountIds(store: ReportingLedgerStore): Promise<string[]>;
+/** The parts of the scheduler options that failure reporting reads. */
+export interface ReportingSchedulerReportingOptionsV1 {
+    onError?: (error: unknown) => void | Promise<void>;
+    logger?: {
+        warn: (message: string) => void;
+    };
+}
+/** Where in the scheduler loop a failure happened. */
+export interface ReportingSchedulerFailureSiteV1 {
+    readonly phase: 'roster' | 'cycle' | 'maintenance';
+    readonly accountId?: string | undefined;
+}
+export declare function reportReportingSchedulerError(options: ReportingSchedulerReportingOptionsV1, signal: AbortSignal, error: unknown, site: ReportingSchedulerFailureSiteV1): Promise<void>;
+export declare function warnReportingSchedulerFailure(options: ReportingSchedulerReportingOptionsV1, site: ReportingSchedulerFailureSiteV1, error: unknown, observerError?: unknown): void;

package/dist/lib/reporting/service/scheduler-support.js

@@ -0,0 +1,125 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var scheduler_support_exports = {};
+__export(scheduler_support_exports, {
+  reportReportingSchedulerError: () => reportReportingSchedulerError,
+  reportingDeploymentWideAccountIds: () => reportingDeploymentWideAccountIds,
+  reportingSchedulerDelay: () => reportingSchedulerDelay,
+  reportingSchedulerErrorMessage: () => reportingSchedulerErrorMessage,
+  rotateReportingRoster: () => rotateReportingRoster,
+  warnReportingSchedulerFailure: () => warnReportingSchedulerFailure
+});
+module.exports = __toCommonJS(scheduler_support_exports);
+var import_redact_credential_patterns = require('../../utils/redact-credential-patterns.js');
+const MAX_SCHEDULER_MESSAGE_CHARS = 512;
+const MAX_SCHEDULER_SCAN_CHARS = 8192;
+const UNREPORTABLE_SCHEDULER_ERROR = "<unreportable error>";
+function reportingSchedulerErrorMessage(error) {
+  try {
+    const raw = rawMessage(error);
+    const redacted = (0, import_redact_credential_patterns.redactCredentialPatterns)(raw.slice(0, MAX_SCHEDULER_SCAN_CHARS));
+    const text = typeof redacted === "string" && redacted.length > 0 ? redacted : UNREPORTABLE_SCHEDULER_ERROR;
+    return text.length > MAX_SCHEDULER_MESSAGE_CHARS ? `${text.slice(0, MAX_SCHEDULER_MESSAGE_CHARS)}\u2026` : text;
+  } catch {
+    return UNREPORTABLE_SCHEDULER_ERROR;
+  }
+}
+function rawMessage(error) {
+  switch (typeof error) {
+    case "string":
+      return error;
+    case "number":
+    case "boolean":
+    case "bigint":
+      return String(error);
+    case "undefined":
+      return "undefined";
+    case "symbol":
+      return error.description ?? "symbol";
+    default:
+      break;
+  }
+  if (error === null) return "null";
+  const message = error.message;
+  return typeof message === "string" ? message : "non-Error scheduler failure";
+}
+const MAX_TIMER_DELAY_MILLISECONDS = 2147483647;
+async function reportingSchedulerDelay(milliseconds, signal) {
+  let remaining = milliseconds;
+  while (remaining > 0 && !signal.aborted) {
+    const chunk = Math.min(remaining, MAX_TIMER_DELAY_MILLISECONDS);
+    await abortableTimeout(chunk, signal);
+    remaining -= chunk;
+  }
+}
+function abortableTimeout(milliseconds, signal) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(done, milliseconds);
+    function done() {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", done);
+      resolve();
+    }
+    signal.addEventListener("abort", done, { once: true });
+  });
+}
+function rotateReportingRoster(values, by) {
+  if (values.length < 2) return [...values];
+  const offset = (by % values.length + values.length) % values.length;
+  return [...values.slice(offset), ...values.slice(0, offset)];
+}
+async function reportingDeploymentWideAccountIds(store) {
+  const configurations = await store.listConfigurations();
+  return [...new Set(configurations.map((value) => value.account.account_id))].sort();
+}
+async function reportReportingSchedulerError(options, signal, error, site) {
+  if (signal.aborted) return;
+  if (options.onError) {
+    try {
+      await options.onError(error);
+    } catch (observerError) {
+      warnReportingSchedulerFailure(options, site, error, observerError);
+    }
+    return;
+  }
+  warnReportingSchedulerFailure(options, site, error);
+}
+function warnReportingSchedulerFailure(options, site, error, observerError) {
+  const where = site.phase === "roster" ? "could not resolve its account roster, so this pass ran no tenants" : site.phase === "maintenance" ? "ledger maintenance failed; the scheduler continues" : site.accountId === void 0 ? "deployment-wide cycle failed; the scheduler continues" : `cycle failed for account ${site.accountId}; later tenants continue`;
+  const observed = observerError === void 0 ? "" : ` (the configured onError also threw: ${reportingSchedulerErrorMessage(observerError)})`;
+  const message = `[adcp/reporting] scheduler ${where}: ${reportingSchedulerErrorMessage(error)}${observed}`;
+  const logger = options.logger;
+  try {
+    if (logger !== void 0) logger.warn(message);
+    else defaultSchedulerWarn(message);
+  } catch {
+  }
+}
+function defaultSchedulerWarn(message) {
+  console.warn(message);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  reportReportingSchedulerError,
+  reportingDeploymentWideAccountIds,
+  reportingSchedulerDelay,
+  reportingSchedulerErrorMessage,
+  rotateReportingRoster,
+  warnReportingSchedulerFailure
+});

package/dist/lib/reporting/service/scheduler-support.mjs

@@ -0,0 +1,96 @@
+import { redactCredentialPatterns } from "../../utils/redact-credential-patterns.mjs";
+const MAX_SCHEDULER_MESSAGE_CHARS = 512;
+const MAX_SCHEDULER_SCAN_CHARS = 8192;
+const UNREPORTABLE_SCHEDULER_ERROR = "<unreportable error>";
+function reportingSchedulerErrorMessage(error) {
+  try {
+    const raw = rawMessage(error);
+    const redacted = redactCredentialPatterns(raw.slice(0, MAX_SCHEDULER_SCAN_CHARS));
+    const text = typeof redacted === "string" && redacted.length > 0 ? redacted : UNREPORTABLE_SCHEDULER_ERROR;
+    return text.length > MAX_SCHEDULER_MESSAGE_CHARS ? `${text.slice(0, MAX_SCHEDULER_MESSAGE_CHARS)}\u2026` : text;
+  } catch {
+    return UNREPORTABLE_SCHEDULER_ERROR;
+  }
+}
+function rawMessage(error) {
+  switch (typeof error) {
+    case "string":
+      return error;
+    case "number":
+    case "boolean":
+    case "bigint":
+      return String(error);
+    case "undefined":
+      return "undefined";
+    case "symbol":
+      return error.description ?? "symbol";
+    default:
+      break;
+  }
+  if (error === null) return "null";
+  const message = error.message;
+  return typeof message === "string" ? message : "non-Error scheduler failure";
+}
+const MAX_TIMER_DELAY_MILLISECONDS = 2147483647;
+async function reportingSchedulerDelay(milliseconds, signal) {
+  let remaining = milliseconds;
+  while (remaining > 0 && !signal.aborted) {
+    const chunk = Math.min(remaining, MAX_TIMER_DELAY_MILLISECONDS);
+    await abortableTimeout(chunk, signal);
+    remaining -= chunk;
+  }
+}
+function abortableTimeout(milliseconds, signal) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(done, milliseconds);
+    function done() {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", done);
+      resolve();
+    }
+    signal.addEventListener("abort", done, { once: true });
+  });
+}
+function rotateReportingRoster(values, by) {
+  if (values.length < 2) return [...values];
+  const offset = (by % values.length + values.length) % values.length;
+  return [...values.slice(offset), ...values.slice(0, offset)];
+}
+async function reportingDeploymentWideAccountIds(store) {
+  const configurations = await store.listConfigurations();
+  return [...new Set(configurations.map((value) => value.account.account_id))].sort();
+}
+async function reportReportingSchedulerError(options, signal, error, site) {
+  if (signal.aborted) return;
+  if (options.onError) {
+    try {
+      await options.onError(error);
+    } catch (observerError) {
+      warnReportingSchedulerFailure(options, site, error, observerError);
+    }
+    return;
+  }
+  warnReportingSchedulerFailure(options, site, error);
+}
+function warnReportingSchedulerFailure(options, site, error, observerError) {
+  const where = site.phase === "roster" ? "could not resolve its account roster, so this pass ran no tenants" : site.phase === "maintenance" ? "ledger maintenance failed; the scheduler continues" : site.accountId === void 0 ? "deployment-wide cycle failed; the scheduler continues" : `cycle failed for account ${site.accountId}; later tenants continue`;
+  const observed = observerError === void 0 ? "" : ` (the configured onError also threw: ${reportingSchedulerErrorMessage(observerError)})`;
+  const message = `[adcp/reporting] scheduler ${where}: ${reportingSchedulerErrorMessage(error)}${observed}`;
+  const logger = options.logger;
+  try {
+    if (logger !== void 0) logger.warn(message);
+    else defaultSchedulerWarn(message);
+  } catch {
+  }
+}
+function defaultSchedulerWarn(message) {
+  console.warn(message);
+}
+export {
+  reportReportingSchedulerError,
+  reportingDeploymentWideAccountIds,
+  reportingSchedulerDelay,
+  reportingSchedulerErrorMessage,
+  rotateReportingRoster,
+  warnReportingSchedulerFailure
+};

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-10-15T19:30:04.842Z"
+  "synced_at": "2026-10-16T16:11:36.533Z"
 }

package/dist/lib/signing/canonicalize.d.mts

@@ -60,6 +60,10 @@ export declare function buildSignatureBase(components: ReadonlyArray<string>, re
  * meaning as in {@link buildSignatureBase}.
  */
 export declare function buildResponseSignatureBase(components: ReadonlyArray<string>, response: ResponseLike, params: SignatureParams, signatureParamsValue?: string): string;
+/**
+ * Serialize the `@signature-params` inner list (RFC 9421 §2.3) with the
+ * structured-field serializer, in the canonical AdCP parameter order.
+ */
 export declare function formatSignatureParams(components: ReadonlyArray<string>, params: SignatureParams): string;
 /**
  * Raw non-ASCII bytes in the URL authority (IDN U-label) are a parse-time

package/dist/lib/signing/canonicalize.d.ts

@@ -60,6 +60,10 @@ export declare function buildSignatureBase(components: ReadonlyArray<string>, re
  * meaning as in {@link buildSignatureBase}.
  */
 export declare function buildResponseSignatureBase(components: ReadonlyArray<string>, response: ResponseLike, params: SignatureParams, signatureParamsValue?: string): string;
+/**
+ * Serialize the `@signature-params` inner list (RFC 9421 §2.3) with the
+ * structured-field serializer, in the canonical AdCP parameter order.
+ */
 export declare function formatSignatureParams(components: ReadonlyArray<string>, params: SignatureParams): string;
 /**
  * Raw non-ASCII bytes in the URL authority (IDN U-label) are a parse-time

package/dist/lib/signing/canonicalize.js

@@ -28,6 +28,7 @@ __export(canonicalize_exports, {
   rejectNonAsciiHost: () => rejectNonAsciiHost
 });
 module.exports = __toCommonJS(canonicalize_exports);
+var import_structured_headers = require("structured-headers");
 var import_errors = require('./errors.js');
 const DEFAULT_PARAM_ORDER = [
   "created",
@@ -37,7 +38,6 @@ const DEFAULT_PARAM_ORDER = [
   "alg",
   "tag"
 ];
-const STRING_PARAMS = /* @__PURE__ */ new Set(["nonce", "keyid", "alg", "tag"]);
 const SUPPORTED_DERIVED = /* @__PURE__ */ new Set(["@method", "@target-uri", "@authority", "@status"]);
 function canonicalTargetUri(rawUrl, profile = "legacy") {
   const u = parseCanonicalUrl(rawUrl, profile);
@@ -127,14 +127,17 @@ function buildResponseSignatureBase(components, response, params, signatureParam
   return lines.join("\n");
 }
 function formatSignatureParams(components, params) {
-  const componentList = components.map(formatComponentIdentifier).join(" ");
-  const paramPairs = [];
+  const parameters = /* @__PURE__ */ new Map();
   for (const key of DEFAULT_PARAM_ORDER) {
     const raw = params[key];
-    if (raw === void 0) continue;
-    paramPairs.push(STRING_PARAMS.has(key) ? `${key}="${raw}"` : `${key}=${raw}`);
+    if (raw !== void 0) parameters.set(key, raw);
+  }
+  try {
+    return (0, import_structured_headers.serializeInnerList)([components.map(componentItem), parameters]);
+  } catch (error) {
+    if (!(error instanceof import_structured_headers.SerializeError)) throw error;
+    throw new TypeError(`Signature parameters are not RFC 8941 serializable: ${error.message}`);
   }
-  return `(${componentList});${paramPairs.join(";")}`;
 }
 function parseComponentIdentifier(component) {
   if (!component.includes(";")) return { bare: component, requestBound: false };
@@ -152,9 +155,12 @@ function parseComponentIdentifier(component) {
     requestBound: params.includes("req")
   };
 }
-function formatComponentIdentifier(component) {
+function componentItem(component) {
   const { bare, requestBound } = parseComponentIdentifier(component);
-  return `"${bare}"${requestBound ? ";req" : ""}`;
+  return [bare, new Map(requestBound ? [["req", true]] : [])];
+}
+function formatComponentIdentifier(component) {
+  return (0, import_structured_headers.serializeItem)(componentItem(component));
 }
 function resolveResponseComponentValue(bare, requestBound, response, requestView) {
   if (bare === "@status") {

package/dist/lib/signing/canonicalize.mjs

@@ -1,3 +1,4 @@
+import { SerializeError, serializeInnerList, serializeItem } from "structured-headers";
 import { RequestSignatureError } from "./errors.mjs";
 const DEFAULT_PARAM_ORDER = [
   "created",
@@ -7,7 +8,6 @@ const DEFAULT_PARAM_ORDER = [
   "alg",
   "tag"
 ];
-const STRING_PARAMS = /* @__PURE__ */ new Set(["nonce", "keyid", "alg", "tag"]);
 const SUPPORTED_DERIVED = /* @__PURE__ */ new Set(["@method", "@target-uri", "@authority", "@status"]);
 function canonicalTargetUri(rawUrl, profile = "legacy") {
   const u = parseCanonicalUrl(rawUrl, profile);
@@ -97,14 +97,17 @@ function buildResponseSignatureBase(components, response, params, signatureParam
   return lines.join("\n");
 }
 function formatSignatureParams(components, params) {
-  const componentList = components.map(formatComponentIdentifier).join(" ");
-  const paramPairs = [];
+  const parameters = /* @__PURE__ */ new Map();
   for (const key of DEFAULT_PARAM_ORDER) {
     const raw = params[key];
-    if (raw === void 0) continue;
-    paramPairs.push(STRING_PARAMS.has(key) ? `${key}="${raw}"` : `${key}=${raw}`);
+    if (raw !== void 0) parameters.set(key, raw);
+  }
+  try {
+    return serializeInnerList([components.map(componentItem), parameters]);
+  } catch (error) {
+    if (!(error instanceof SerializeError)) throw error;
+    throw new TypeError(`Signature parameters are not RFC 8941 serializable: ${error.message}`);
   }
-  return `(${componentList});${paramPairs.join(";")}`;
 }
 function parseComponentIdentifier(component) {
   if (!component.includes(";")) return { bare: component, requestBound: false };
@@ -122,9 +125,12 @@ function parseComponentIdentifier(component) {
     requestBound: params.includes("req")
   };
 }
-function formatComponentIdentifier(component) {
+function componentItem(component) {
   const { bare, requestBound } = parseComponentIdentifier(component);
-  return `"${bare}"${requestBound ? ";req" : ""}`;
+  return [bare, new Map(requestBound ? [["req", true]] : [])];
+}
+function formatComponentIdentifier(component) {
+  return serializeItem(componentItem(component));
 }
 function resolveResponseComponentValue(bare, requestBound, response, requestView) {
   if (bare === "@status") {

package/dist/lib/signing/content-digest.d.mts

@@ -2,6 +2,14 @@ export type SfBinaryEncoding = 'rfc8941-base64' | 'legacy-base64url';
 /** Select the request-signing binary profile from a trusted endpoint pin. */
 export declare function requestSigningEncodingForVersion(adcpVersion: string): SfBinaryEncoding;
 export declare function computeContentDigest(body: string | Uint8Array, encoding?: SfBinaryEncoding): string;
+/**
+ * Serialize a one-member Dictionary whose value is a byte sequence, e.g.
+ * `sig1=:...:` in `Signature` or `sha-256=:...:` in `Content-Digest`. The
+ * RFC 8941 form comes from the structured-field serializer. The AdCP 3.0/3.1
+ * profile wrote byte sequences in unpadded Base64URL, which is not an RFC 8941
+ * `sf-binary` and no serializer emits, so that legacy form stays hand-written.
+ */
+export declare function serializeByteSequenceMember(key: string, bytes: Uint8Array | ArrayBuffer, encoding: SfBinaryEncoding): string;
 /**
  * Extract the `sha-256` member from an RFC 9530 Content-Digest header. The
  * header is an RFC 8941 Dictionary and MAY list multiple algorithms; we look

package/dist/lib/signing/content-digest.d.ts

@@ -2,6 +2,14 @@ export type SfBinaryEncoding = 'rfc8941-base64' | 'legacy-base64url';
 /** Select the request-signing binary profile from a trusted endpoint pin. */
 export declare function requestSigningEncodingForVersion(adcpVersion: string): SfBinaryEncoding;
 export declare function computeContentDigest(body: string | Uint8Array, encoding?: SfBinaryEncoding): string;
+/**
+ * Serialize a one-member Dictionary whose value is a byte sequence, e.g.
+ * `sig1=:...:` in `Signature` or `sha-256=:...:` in `Content-Digest`. The
+ * RFC 8941 form comes from the structured-field serializer. The AdCP 3.0/3.1
+ * profile wrote byte sequences in unpadded Base64URL, which is not an RFC 8941
+ * `sf-binary` and no serializer emits, so that legacy form stays hand-written.
+ */
+export declare function serializeByteSequenceMember(key: string, bytes: Uint8Array | ArrayBuffer, encoding: SfBinaryEncoding): string;
 /**
  * Extract the `sha-256` member from an RFC 9530 Content-Digest header. The
  * header is an RFC 8941 Dictionary and MAY list multiple algorithms; we look

package/dist/lib/signing/content-digest.js

@@ -24,7 +24,8 @@ __export(content_digest_exports, {
   contentDigestUsesEncoding: () => contentDigestUsesEncoding,
   isPaddedStandardBase64: () => isPaddedStandardBase64,
   parseContentDigest: () => parseContentDigest,
-  requestSigningEncodingForVersion: () => requestSigningEncodingForVersion
+  requestSigningEncodingForVersion: () => requestSigningEncodingForVersion,
+  serializeByteSequenceMember: () => serializeByteSequenceMember
 });
 module.exports = __toCommonJS(content_digest_exports);
 var import_crypto = require("crypto");
@@ -35,9 +36,13 @@ function requestSigningEncodingForVersion(adcpVersion) {
   return /^(?:2(?:\.|$)|3\.(?:0|1)(?:\.|-|$)|3$)/.test(normalized) ? "legacy-base64url" : "rfc8941-base64";
 }
 function computeContentDigest(body, encoding = "rfc8941-base64") {
-  const buf = toBuffer(body);
-  const hash = (0, import_crypto.createHash)("sha256").update(buf).digest(encoding === "legacy-base64url" ? "base64url" : "base64");
-  return `sha-256=:${hash}:`;
+  return serializeByteSequenceMember("sha-256", (0, import_crypto.createHash)("sha256").update(toBuffer(body)).digest(), encoding);
+}
+function serializeByteSequenceMember(key, bytes, encoding) {
+  const buf = Buffer.from(bytes);
+  if (encoding === "legacy-base64url") return `${key}=:${buf.toString("base64url")}:`;
+  const exact = buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+  return (0, import_structured_headers.serializeDictionary)(/* @__PURE__ */ new Map([[key, [exact, /* @__PURE__ */ new Map()]]]));
 }
 function parseContentDigest(header) {
   try {
@@ -81,5 +86,6 @@ function toBuffer(body) {
   contentDigestUsesEncoding,
   isPaddedStandardBase64,
   parseContentDigest,
-  requestSigningEncodingForVersion
+  requestSigningEncodingForVersion,
+  serializeByteSequenceMember
 });

package/dist/lib/signing/content-digest.mjs

@@ -1,14 +1,18 @@
 import { createHash, timingSafeEqual } from "crypto";
-import { parseDictionary } from "structured-headers";
+import { parseDictionary, serializeDictionary } from "structured-headers";
 const SHA256_MEMBER_RE = /(?:^|[,\s])sha-256=:([A-Za-z0-9+/_-]+={0,2}):/;
 function requestSigningEncodingForVersion(adcpVersion) {
   const normalized = adcpVersion.trim().replace(/^v/, "");
   return /^(?:2(?:\.|$)|3\.(?:0|1)(?:\.|-|$)|3$)/.test(normalized) ? "legacy-base64url" : "rfc8941-base64";
 }
 function computeContentDigest(body, encoding = "rfc8941-base64") {
-  const buf = toBuffer(body);
-  const hash = createHash("sha256").update(buf).digest(encoding === "legacy-base64url" ? "base64url" : "base64");
-  return `sha-256=:${hash}:`;
+  return serializeByteSequenceMember("sha-256", createHash("sha256").update(toBuffer(body)).digest(), encoding);
+}
+function serializeByteSequenceMember(key, bytes, encoding) {
+  const buf = Buffer.from(bytes);
+  if (encoding === "legacy-base64url") return `${key}=:${buf.toString("base64url")}:`;
+  const exact = buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+  return serializeDictionary(/* @__PURE__ */ new Map([[key, [exact, /* @__PURE__ */ new Map()]]]));
 }
 function parseContentDigest(header) {
   try {
@@ -51,5 +55,6 @@ export {
   contentDigestUsesEncoding,
   isPaddedStandardBase64,
   parseContentDigest,
-  requestSigningEncodingForVersion
+  requestSigningEncodingForVersion,
+  serializeByteSequenceMember
 };

package/dist/lib/signing/signer.js

@@ -82,6 +82,7 @@ function prepareRequestSignature(request, identity, options = {}) {
   const windowSeconds = Math.min(options.windowSeconds ?? 300, import_types.MAX_SIGNATURE_WINDOW_SECONDS);
   const nonce = options.nonce ?? base64UrlRandom(16);
   const label = options.label ?? "sig1";
+  assertLabelAndClock(label, now);
   const hasBody = (request.body ?? "").length > 0;
   const binaryEncoding = options.binaryEncoding ?? "legacy-base64url";
   const coverDigest = options.coverContentDigest ?? binaryEncoding === "rfc8941-base64";
@@ -112,11 +113,8 @@ function prepareRequestSignature(request, identity, options = {}) {
 }
 function finalizeRequestSignature(prepared, signature) {
   const headers = { ...prepared.headers };
-  const sigB64 = Buffer.from(signature).toString(
-    prepared.binaryEncoding === "legacy-base64url" ? "base64url" : "base64"
-  );
   headers["Signature-Input"] = `${prepared.label}=${(0, import_canonicalize.formatSignatureParams)(prepared.components, prepared.params)}`;
-  headers["Signature"] = `${prepared.label}=:${sigB64}:`;
+  headers["Signature"] = (0, import_content_digest.serializeByteSequenceMember)(prepared.label, signature, prepared.binaryEncoding);
   return { headers, signatureBase: prepared.base, params: prepared.params };
 }
 function signRequest(request, key, options = {}) {
@@ -138,6 +136,7 @@ function prepareWebhookSignature(request, identity, options = {}) {
   const windowSeconds = Math.min(options.windowSeconds ?? 300, import_types.MAX_SIGNATURE_WINDOW_SECONDS);
   const nonce = options.nonce ?? base64UrlRandom(16);
   const label = options.label ?? "sig1";
+  assertLabelAndClock(label, now);
   const headers = { ...flattenHeaders(request.headers) };
   headers["Content-Digest"] = (0, import_content_digest.computeContentDigest)(request.body ?? "", "legacy-base64url");
   const components = [...import_webhook_verifier.WEBHOOK_MANDATORY_COMPONENTS];
@@ -164,6 +163,7 @@ function prepareResponseSignature(response, identity, options = {}) {
   const windowSeconds = Math.min(options.windowSeconds ?? 300, import_types.MAX_SIGNATURE_WINDOW_SECONDS);
   const nonce = options.nonce ?? base64UrlRandom(16);
   const label = options.label ?? "sig1";
+  assertLabelAndClock(label, now);
   const hasBody = (response.body ?? "").length > 0;
   const coverDigest = (options.coverContentDigest ?? true) && hasBody;
   const headers = { ...flattenHeaders(response.headers) };
@@ -192,9 +192,8 @@ function prepareResponseSignature(response, identity, options = {}) {
 }
 function finalizeResponseSignature(prepared, signature) {
   const headers = { ...prepared.headers };
-  const sigB64 = Buffer.from(signature).toString("base64url");
   headers["Signature-Input"] = `${prepared.label}=${(0, import_canonicalize.formatSignatureParams)(prepared.components, prepared.params)}`;
-  headers["Signature"] = `${prepared.label}=:${sigB64}:`;
+  headers["Signature"] = (0, import_content_digest.serializeByteSequenceMember)(prepared.label, signature, "legacy-base64url");
   return { status: prepared.status, headers, signatureBase: prepared.base, params: prepared.params };
 }
 function signResponse(response, key, options = {}) {
@@ -214,6 +213,10 @@ function flattenHeaders(headers) {
   }
   return out;
 }
+function assertLabelAndClock(label, now) {
+  if (!/^[a-z*][a-z0-9_.*-]*$/.test(label)) throw new TypeError(`Signature label "${label}" is not an RFC 8941 key`);
+  if (!Number.isSafeInteger(now)) throw new TypeError("Signature clock must return integer epoch seconds");
+}
 function base64UrlRandom(byteLength) {
   return (0, import_crypto.randomBytes)(byteLength).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }