@adcp/sdk 16.0.0-beta.6 → 16.0.0-beta.8

package/dist/lib/server/property-lists.mjs

@@ -0,0 +1,129 @@
+import { z } from "zod";
+import { GetPropertyListRequestSchema, GetPropertyListResponseSchema } from "../types/schemas.generated.mjs";
+import { stripCtxMetadata } from "./ctx-metadata/wire-shape.mjs";
+function registerPropertyListTool(server, options) {
+  return server.registerTool(
+    "get_property_list",
+    {
+      description: "Retrieve an authorized property list and a page of resolved identifiers.",
+      inputSchema: GetPropertyListRequestSchema,
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true }
+    },
+    async (request, extra) => {
+      const denied = () => toolError("PERMISSION_DENIED", "Property list access denied.", request.context);
+      const headers = extra.requestInfo?.headers ?? {};
+      for (const name of ["authorization", "x-adcp-auth"]) {
+        const values = Object.entries(headers).filter(([key]) => key.toLowerCase() === name);
+        if (values.length > 1 || values.length === 1 && typeof values[0][1] !== "string") return denied();
+      }
+      const readHeader = (name) => {
+        const values = Object.entries(headers).filter(([key]) => key.toLowerCase() === name);
+        if (values.length !== 1 || typeof values[0][1] !== "string") return void 0;
+        return values[0][1];
+      };
+      const authorization = readHeader("authorization");
+      const bearer = authorization?.match(/^Bearer ([^\s]+)$/i)?.[1];
+      const adcpToken = readHeader("x-adcp-auth");
+      const authenticatedToken = extra.authInfo?.token;
+      const tokens = [bearer, adcpToken, authenticatedToken].filter((token) => token !== void 0);
+      if (!tokens.length || tokens.some((token) => !token || token !== tokens[0]) || authorization !== void 0 && !bearer)
+        return denied();
+      let principal;
+      try {
+        principal = await options.verifyToken({ listId: request.list_id, token: tokens[0] });
+      } catch {
+        return denied();
+      }
+      if (principal === null || principal === false || principal === void 0) return denied();
+      try {
+        const page = await options.loadPage(request, principal);
+        if (page.list.list_id !== request.list_id) throw new Error("Invalid list identity");
+        if (request.resolve !== false && !Array.isArray(page.identifiers))
+          throw new Error("Missing resolved identifiers");
+        const limit = request.pagination?.max_results ?? 1e3;
+        if (request.resolve !== false && (page.identifiers?.length ?? 0) > limit) throw new Error("Invalid page size");
+        if (page.pagination?.has_more && !page.pagination.cursor) throw new Error("Missing continuation cursor");
+        if (!page.pagination?.has_more && page.pagination?.cursor) throw new Error("Unexpected continuation cursor");
+        const payload = GetPropertyListResponseSchema.parse({
+          list: Object.fromEntries(
+            [
+              "list_id",
+              "name",
+              "description",
+              "account",
+              "base_properties",
+              "filters",
+              "brand",
+              "webhook_url",
+              "cache_duration_hours",
+              "created_at",
+              "updated_at",
+              "property_count",
+              "pricing_options"
+            ].filter((key) => Object.hasOwn(page.list, key)).map((key) => [key, page.list[key]])
+          ),
+          ...page.identifiers !== void 0 ? { identifiers: page.identifiers.map((identifier) => ({ type: identifier.type, value: identifier.value })) } : {},
+          ...page.pagination !== void 0 ? {
+            pagination: {
+              has_more: page.pagination.has_more,
+              cursor: page.pagination.cursor,
+              total_count: page.pagination.total_count
+            }
+          } : {},
+          ...page.resolved_at !== void 0 ? { resolved_at: page.resolved_at } : {},
+          ...page.cache_valid_until !== void 0 ? { cache_valid_until: page.cache_valid_until } : {},
+          ...page.coverage_gaps !== void 0 ? { coverage_gaps: page.coverage_gaps } : {},
+          status: "completed",
+          ...request.resolve === false ? { identifiers: void 0, pagination: void 0 } : {},
+          ...request.context ? { context: request.context } : {}
+        });
+        stripCtxMetadata({ property_list: payload.list });
+        return { content: [{ type: "text", text: JSON.stringify(payload) }], structuredContent: payload };
+      } catch {
+        return toolError("INTERNAL_ERROR", "Property list could not be loaded.", request.context);
+      }
+    }
+  );
+}
+function toolError(code, message, context) {
+  const payload = { status: "failed", errors: [{ code, message }], ...context !== void 0 ? { context } : {} };
+  return {
+    isError: true,
+    content: [{ type: "text", text: JSON.stringify(payload) }],
+    structuredContent: payload
+  };
+}
+async function sendPropertyListChanged(emitter, options) {
+  const { notification, ...delivery } = options;
+  const dateTime = z.string().datetime({ offset: true });
+  if (!notification.list_id || !dateTime.safeParse(notification.resolved_at).success || notification.cache_valid_until !== void 0 && !dateTime.safeParse(notification.cache_valid_until).success) {
+    throw new TypeError("Property-list notifications require a list_id and valid timestamps");
+  }
+  const summary = notification.change_summary === void 0 ? void 0 : Object.fromEntries(
+    ["properties_added", "properties_removed", "total_properties"].filter(
+      (key) => Object.hasOwn(notification.change_summary, key) && notification.change_summary[key] !== void 0
+    ).map((key) => [key, notification.change_summary[key]])
+  );
+  for (const count of Object.values(summary ?? {})) {
+    if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0)
+      throw new TypeError("Property-list change counts must be nonnegative integers");
+  }
+  return emitter.emit({
+    ...delivery,
+    authentication: null,
+    signingProfile: "adcp/webhook-signing/v1",
+    payload: {
+      event: "property_list_changed",
+      list_id: notification.list_id,
+      resolved_at: notification.resolved_at,
+      ...notification.list_name !== void 0 ? { list_name: notification.list_name } : {},
+      ...notification.cache_valid_until !== void 0 ? { cache_valid_until: notification.cache_valid_until } : {},
+      ...summary !== void 0 ? { change_summary: summary } : {},
+      signature: "rfc9421"
+    }
+  });
+}
+export {
+  registerPropertyListTool,
+  sendPropertyListChanged
+};

package/dist/lib/server/serve.js

@@ -322,7 +322,8 @@ function serve(createAgent, options) {
             (0, import_auth.respondUnauthorized)(req, res, {
               signatureError: signatureCode,
               errorDescription: publicMessage,
-              resourceMetadata: resourceMetadataUrl
+              resourceMetadata: resourceMetadataUrl,
+              ...err instanceof import_auth.AuthError && err.headers && { headers: err.headers }
             });
             return;
           }

package/dist/lib/server/serve.mjs

@@ -305,7 +305,8 @@ function serve(createAgent, options) {
             respondUnauthorized(req, res, {
               signatureError: signatureCode,
               errorDescription: publicMessage,
-              resourceMetadata: resourceMetadataUrl
+              resourceMetadata: resourceMetadataUrl,
+              ...err instanceof AuthError && err.headers && { headers: err.headers }
             });
             return;
           }

package/dist/lib/server/targeting-helpers.d.mts

@@ -56,6 +56,8 @@ export declare const defaultResolvedListCache: ResolvedListCache;
 export declare function clearDefaultResolvedListCache(): void;
 export type ResolveListCallTool = (agentUrl: string, toolName: 'get_property_list' | 'get_collection_list', args: Record<string, unknown>, authToken?: string) => Promise<unknown>;
 export interface ResolveListOptions {
+    /** Require schema-valid property-list pages with identifiers when resolving. Used for certification. */
+    strictResponseValidation?: boolean;
     /** Maximum page size when calling get_property_list / get_collection_list. Defaults to 1000. */
     pageSize?: number;
     /** Maximum number of pages to walk before treating pagination as unsafe. Defaults to 100. */

package/dist/lib/server/targeting-helpers.d.ts

@@ -56,6 +56,8 @@ export declare const defaultResolvedListCache: ResolvedListCache;
 export declare function clearDefaultResolvedListCache(): void;
 export type ResolveListCallTool = (agentUrl: string, toolName: 'get_property_list' | 'get_collection_list', args: Record<string, unknown>, authToken?: string) => Promise<unknown>;
 export interface ResolveListOptions {
+    /** Require schema-valid property-list pages with identifiers when resolving. Used for certification. */
+    strictResponseValidation?: boolean;
     /** Maximum page size when calling get_property_list / get_collection_list. Defaults to 1000. */
     pageSize?: number;
     /** Maximum number of pages to walk before treating pagination as unsafe. Defaults to 100. */

package/dist/lib/server/targeting-helpers.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var targeting_helpers_exports = {};
 __export(targeting_helpers_exports, {
@@ -75,7 +85,7 @@ async function resolvePropertyList(ref, options = {}) {
   const cache = cacheForOptions(options);
   const nowMs = nowMsForOptions(options);
   const cacheKey = resolvedListCacheKey("property", structurallyNormalizedRef, options);
-  const cached = cacheKey ? cache?.get(cacheKey, nowMs) : void 0;
+  const cached = cacheKey && !options.strictResponseValidation ? cache?.get(cacheKey, nowMs) : void 0;
   if (cached) return cached;
   const normalizedRef = options.callTool ? structurallyNormalizedRef : await normalizePropertyListReference(structurallyNormalizedRef, { resolveDns: false });
   const result = await fetchResolvedPropertyList(normalizedRef, options);
@@ -89,6 +99,7 @@ async function fetchResolvedPropertyList(ref, options) {
   let cacheValidUntil;
   let missingCacheValidUntil = false;
   let cursor;
+  const seenCursors = /* @__PURE__ */ new Set();
   for (let pageIndex = 0; pageIndex < maxPagesForOptions(options); pageIndex += 1) {
     const args = buildResolveListArgs(ref.list_id, pageSizeForOptions(options), cursor);
     const raw = await callTool(ref.agent_url, "get_property_list", args, ref.auth_token);
@@ -96,6 +107,20 @@ async function fetchResolvedPropertyList(ref, options) {
       throw new Error("property_list_invalid_response");
     }
     const response = raw;
+    if (response.status !== void 0 && response.status !== "completed" || raw.errors !== void 0 && (!Array.isArray(raw.errors) || raw.errors.some((error) => !error || typeof error !== "object" || error.severity !== "warning")) || raw.adcp_error !== void 0 || !Array.isArray(response.identifiers)) {
+      throw new Error("property_list_invalid_response");
+    }
+    if (options.strictResponseValidation) {
+      const { GetPropertyListResponseSchema } = await import("../types/schemas.generated.js");
+      if (!GetPropertyListResponseSchema.safeParse(raw).success || response.status !== "completed" || response.identifiers.length > pageSizeForOptions(options)) {
+        throw new Error("property_list_invalid_response");
+      }
+    }
+    if (!response.list || response.list.list_id !== ref.list_id || response.identifiers !== void 0 && (!Array.isArray(response.identifiers) || response.identifiers.some(
+      (identifier) => !identifier || typeof identifier !== "object" || typeof identifier.type !== "string" || typeof identifier.value !== "string"
+    ))) {
+      throw new Error("property_list_invalid_response");
+    }
     listId = response.list.list_id;
     identifiers.push(...response.identifiers ?? []);
     if (typeof response.cache_valid_until === "string") {
@@ -118,6 +143,8 @@ async function fetchResolvedPropertyList(ref, options) {
     if (!pagination.cursor) {
       throw new Error("property_list_invalid_pagination");
     }
+    if (seenCursors.has(pagination.cursor)) throw new Error("property_list_invalid_pagination");
+    seenCursors.add(pagination.cursor);
     cursor = pagination.cursor;
   }
   throw new Error("property_list_pagination_limit_exceeded");

package/dist/lib/server/targeting-helpers.mjs

@@ -44,7 +44,7 @@ async function resolvePropertyList(ref, options = {}) {
   const cache = cacheForOptions(options);
   const nowMs = nowMsForOptions(options);
   const cacheKey = resolvedListCacheKey("property", structurallyNormalizedRef, options);
-  const cached = cacheKey ? cache?.get(cacheKey, nowMs) : void 0;
+  const cached = cacheKey && !options.strictResponseValidation ? cache?.get(cacheKey, nowMs) : void 0;
   if (cached) return cached;
   const normalizedRef = options.callTool ? structurallyNormalizedRef : await normalizePropertyListReference(structurallyNormalizedRef, { resolveDns: false });
   const result = await fetchResolvedPropertyList(normalizedRef, options);
@@ -58,6 +58,7 @@ async function fetchResolvedPropertyList(ref, options) {
   let cacheValidUntil;
   let missingCacheValidUntil = false;
   let cursor;
+  const seenCursors = /* @__PURE__ */ new Set();
   for (let pageIndex = 0; pageIndex < maxPagesForOptions(options); pageIndex += 1) {
     const args = buildResolveListArgs(ref.list_id, pageSizeForOptions(options), cursor);
     const raw = await callTool(ref.agent_url, "get_property_list", args, ref.auth_token);
@@ -65,6 +66,20 @@ async function fetchResolvedPropertyList(ref, options) {
       throw new Error("property_list_invalid_response");
     }
     const response = raw;
+    if (response.status !== void 0 && response.status !== "completed" || raw.errors !== void 0 && (!Array.isArray(raw.errors) || raw.errors.some((error) => !error || typeof error !== "object" || error.severity !== "warning")) || raw.adcp_error !== void 0 || !Array.isArray(response.identifiers)) {
+      throw new Error("property_list_invalid_response");
+    }
+    if (options.strictResponseValidation) {
+      const { GetPropertyListResponseSchema } = await import("../types/schemas.generated.mjs");
+      if (!GetPropertyListResponseSchema.safeParse(raw).success || response.status !== "completed" || response.identifiers.length > pageSizeForOptions(options)) {
+        throw new Error("property_list_invalid_response");
+      }
+    }
+    if (!response.list || response.list.list_id !== ref.list_id || response.identifiers !== void 0 && (!Array.isArray(response.identifiers) || response.identifiers.some(
+      (identifier) => !identifier || typeof identifier !== "object" || typeof identifier.type !== "string" || typeof identifier.value !== "string"
+    ))) {
+      throw new Error("property_list_invalid_response");
+    }
     listId = response.list.list_id;
     identifiers.push(...response.identifiers ?? []);
     if (typeof response.cache_valid_until === "string") {
@@ -87,6 +102,8 @@ async function fetchResolvedPropertyList(ref, options) {
     if (!pagination.cursor) {
       throw new Error("property_list_invalid_pagination");
     }
+    if (seenCursors.has(pagination.cursor)) throw new Error("property_list_invalid_pagination");
+    seenCursors.add(pagination.cursor);
     cursor = pagination.cursor;
   }
   throw new Error("property_list_pagination_limit_exceeded");

package/dist/lib/server/webhook-emitter.js

@@ -83,6 +83,7 @@ function createWebhookEmitter(options) {
   if (options.deliveryStore && options.idempotencyKeyStore) {
     throw new TypeError("createWebhookEmitter: provide deliveryStore, not both deliveryStore and idempotencyKeyStore");
   }
+  if (options.webBotAuth?.key) (0, import_web_bot_auth.assertWebBotAuthSigningKey)(options.webBotAuth.key);
   const retryHorizonSeconds = resolveRetryHorizonSeconds(options.deliveryRetryHorizonSeconds);
   const explicitStore = options.deliveryStore ?? options.idempotencyKeyStore;
   const store = explicitStore ?? memoryWebhookDeliveryStore({ now: options.now });

package/dist/lib/server/webhook-emitter.mjs

@@ -1,4 +1,4 @@
-import { signWebBotAuth } from "../signing/web-bot-auth.mjs";
+import { assertWebBotAuthSigningKey, signWebBotAuth } from "../signing/web-bot-auth.mjs";
 import { signWebhook } from "../signing/signer.mjs";
 import { signWebhookAsync } from "../signing/signer-async.mjs";
 import { canonicalJsonSha256 } from "../utils/jcs.mjs";
@@ -64,6 +64,7 @@ function createWebhookEmitter(options) {
   if (options.deliveryStore && options.idempotencyKeyStore) {
     throw new TypeError("createWebhookEmitter: provide deliveryStore, not both deliveryStore and idempotencyKeyStore");
   }
+  if (options.webBotAuth?.key) assertWebBotAuthSigningKey(options.webBotAuth.key);
   const retryHorizonSeconds = resolveRetryHorizonSeconds(options.deliveryRetryHorizonSeconds);
   const explicitStore = options.deliveryStore ?? options.idempotencyKeyStore;
   const store = explicitStore ?? memoryWebhookDeliveryStore({ now: options.now });

package/dist/lib/signing/crypto.d.mts

@@ -15,5 +15,5 @@ export declare function verifySignatureAsync(alg: string, publicKey: KeyObject |
  * path passes the key as a JWK so workerd accepts it (#3243).
  */
 export declare function signWithPrivateJwk(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Uint8Array;
-/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 when available. */
+/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 and RSA-PSS when available (workerd, #3243). */
 export declare function signWithPrivateJwkAsync(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Promise<Uint8Array>;

package/dist/lib/signing/crypto.d.ts

@@ -15,5 +15,5 @@ export declare function verifySignatureAsync(alg: string, publicKey: KeyObject |
  * path passes the key as a JWK so workerd accepts it (#3243).
  */
 export declare function signWithPrivateJwk(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Uint8Array;
-/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 when available. */
+/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 and RSA-PSS when available (workerd, #3243). */
 export declare function signWithPrivateJwkAsync(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Promise<Uint8Array>;

package/dist/lib/signing/crypto.js

@@ -87,15 +87,36 @@ function privateP256Jwk(jwk) {
 async function verifySignatureAsync(alg, publicKey, data, signature) {
   const subtle = subtleCrypto();
   const keyObject = () => isKeyObject(publicKey) ? publicKey : jwkToPublicKey(publicKey);
-  if (alg !== "ecdsa-p256-sha256" || !subtle) return verifySignature(alg, keyObject(), data, signature);
+  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
+    return verifySignature(alg, keyObject(), data, signature);
   try {
     const jwk = isKeyObject(publicKey) ? publicKey.export({ format: "jwk" }) : publicKey;
+    if (alg === "rsa-pss-sha512") {
+      const key2 = await importRsaPssVerifyKey(subtle, jwk);
+      return await subtle.verify(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(signature), toArrayBuffer(data));
+    }
     const key = await importP256VerifyKey(subtle, jwk);
     return await subtle.verify(P256_SHA256, key, toArrayBuffer(signature), toArrayBuffer(data));
   } catch {
     return false;
   }
 }
+const RSA_PSS_SHA512 = { name: "RSA-PSS", hash: "SHA-512" };
+const RSA_PSS_SHA512_SIGN = { name: "RSA-PSS", saltLength: 64 };
+const rsaPssVerifyKeys = /* @__PURE__ */ new Map();
+function importRsaPssVerifyKey(subtle, jwk) {
+  if (jwk.kty !== "RSA" || typeof jwk.n !== "string" || typeof jwk.e !== "string")
+    return Promise.reject(new TypeError("Not an RSA public key"));
+  const cacheKey = `${jwk.e}.${jwk.n}`;
+  let key = rsaPssVerifyKeys.get(cacheKey);
+  if (!key) {
+    key = subtle.importKey("jwk", { kty: "RSA", n: jwk.n, e: jwk.e }, RSA_PSS_SHA512, false, ["verify"]);
+    key.catch(() => rsaPssVerifyKeys.delete(cacheKey));
+    if (rsaPssVerifyKeys.size >= 256) rsaPssVerifyKeys.delete(rsaPssVerifyKeys.keys().next().value);
+    rsaPssVerifyKeys.set(cacheKey, key);
+  }
+  return key;
+}
 function isKeyObject(value) {
   return typeof value?.export === "function" && "asymmetricKeyType" in value;
 }
@@ -118,11 +139,25 @@ function signWithPrivateJwk(alg, privateJwk, data) {
     return new Uint8Array((0, import_crypto.sign)(null, data, (0, import_crypto.createPrivateKey)({ key: privateJwk, format: "jwk" })));
   if (alg === "ecdsa-p256-sha256")
     return new Uint8Array((0, import_crypto.sign)("sha256", data, { key: privateJwk, format: "jwk", dsaEncoding: "ieee-p1363" }));
+  if (alg === "rsa-pss-sha512")
+    return new Uint8Array(
+      (0, import_crypto.sign)("sha512", data, {
+        key: (0, import_crypto.createPrivateKey)({ key: privateJwk, format: "jwk" }),
+        padding: import_crypto.constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: 64
+      })
+    );
   throw new TypeError(`Unsupported signing algorithm: ${alg}`);
 }
 async function signWithPrivateJwkAsync(alg, privateJwk, data) {
   const subtle = subtleCrypto();
-  if (alg !== "ecdsa-p256-sha256" || !subtle) return signWithPrivateJwk(alg, privateJwk, data);
+  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
+    return signWithPrivateJwk(alg, privateJwk, data);
+  if (alg === "rsa-pss-sha512") {
+    const { kty, n, e, d, p, q, dp, dq, qi } = privateJwk;
+    const key2 = await subtle.importKey("jwk", { kty, n, e, d, p, q, dp, dq, qi }, RSA_PSS_SHA512, false, ["sign"]);
+    return new Uint8Array(await subtle.sign(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(data)));
+  }
   const key = await subtle.importKey("jwk", privateP256Jwk(privateJwk), P256, false, ["sign"]);
   return new Uint8Array(await subtle.sign(P256_SHA256, key, toArrayBuffer(data)));
 }

package/dist/lib/signing/crypto.mjs

@@ -66,15 +66,36 @@ function privateP256Jwk(jwk) {
 async function verifySignatureAsync(alg, publicKey, data, signature) {
   const subtle = subtleCrypto();
   const keyObject = () => isKeyObject(publicKey) ? publicKey : jwkToPublicKey(publicKey);
-  if (alg !== "ecdsa-p256-sha256" || !subtle) return verifySignature(alg, keyObject(), data, signature);
+  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
+    return verifySignature(alg, keyObject(), data, signature);
   try {
     const jwk = isKeyObject(publicKey) ? publicKey.export({ format: "jwk" }) : publicKey;
+    if (alg === "rsa-pss-sha512") {
+      const key2 = await importRsaPssVerifyKey(subtle, jwk);
+      return await subtle.verify(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(signature), toArrayBuffer(data));
+    }
     const key = await importP256VerifyKey(subtle, jwk);
     return await subtle.verify(P256_SHA256, key, toArrayBuffer(signature), toArrayBuffer(data));
   } catch {
     return false;
   }
 }
+const RSA_PSS_SHA512 = { name: "RSA-PSS", hash: "SHA-512" };
+const RSA_PSS_SHA512_SIGN = { name: "RSA-PSS", saltLength: 64 };
+const rsaPssVerifyKeys = /* @__PURE__ */ new Map();
+function importRsaPssVerifyKey(subtle, jwk) {
+  if (jwk.kty !== "RSA" || typeof jwk.n !== "string" || typeof jwk.e !== "string")
+    return Promise.reject(new TypeError("Not an RSA public key"));
+  const cacheKey = `${jwk.e}.${jwk.n}`;
+  let key = rsaPssVerifyKeys.get(cacheKey);
+  if (!key) {
+    key = subtle.importKey("jwk", { kty: "RSA", n: jwk.n, e: jwk.e }, RSA_PSS_SHA512, false, ["verify"]);
+    key.catch(() => rsaPssVerifyKeys.delete(cacheKey));
+    if (rsaPssVerifyKeys.size >= 256) rsaPssVerifyKeys.delete(rsaPssVerifyKeys.keys().next().value);
+    rsaPssVerifyKeys.set(cacheKey, key);
+  }
+  return key;
+}
 function isKeyObject(value) {
   return typeof value?.export === "function" && "asymmetricKeyType" in value;
 }
@@ -97,11 +118,25 @@ function signWithPrivateJwk(alg, privateJwk, data) {
     return new Uint8Array(nodeSign(null, data, createPrivateKey({ key: privateJwk, format: "jwk" })));
   if (alg === "ecdsa-p256-sha256")
     return new Uint8Array(nodeSign("sha256", data, { key: privateJwk, format: "jwk", dsaEncoding: "ieee-p1363" }));
+  if (alg === "rsa-pss-sha512")
+    return new Uint8Array(
+      nodeSign("sha512", data, {
+        key: createPrivateKey({ key: privateJwk, format: "jwk" }),
+        padding: constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: 64
+      })
+    );
   throw new TypeError(`Unsupported signing algorithm: ${alg}`);
 }
 async function signWithPrivateJwkAsync(alg, privateJwk, data) {
   const subtle = subtleCrypto();
-  if (alg !== "ecdsa-p256-sha256" || !subtle) return signWithPrivateJwk(alg, privateJwk, data);
+  if (alg !== "ecdsa-p256-sha256" && alg !== "rsa-pss-sha512" || !subtle)
+    return signWithPrivateJwk(alg, privateJwk, data);
+  if (alg === "rsa-pss-sha512") {
+    const { kty, n, e, d, p, q, dp, dq, qi } = privateJwk;
+    const key2 = await subtle.importKey("jwk", { kty, n, e, d, p, q, dp, dq, qi }, RSA_PSS_SHA512, false, ["sign"]);
+    return new Uint8Array(await subtle.sign(RSA_PSS_SHA512_SIGN, key2, toArrayBuffer(data)));
+  }
   const key = await subtle.importKey("jwk", privateP256Jwk(privateJwk), P256, false, ["sign"]);
   return new Uint8Array(await subtle.sign(P256_SHA256, key, toArrayBuffer(data)));
 }

package/dist/lib/signing/parser.d.mts

@@ -24,6 +24,12 @@ export interface ParsedSignature {
     bytes: Uint8Array;
 }
 export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
+/**
+ * {@link parseSignatureInput} for one member of an already parsed (and
+ * duplicate-checked) `Signature-Input` dictionary, so a caller that needs
+ * every label parses the field once.
+ */
+export declare function parseSignatureInputMember(label: string, entry: unknown): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
  * RFC 8941 / RFC 9651 parsers deduplicate dictionary keys and parameter keys

package/dist/lib/signing/parser.d.ts

@@ -24,6 +24,12 @@ export interface ParsedSignature {
     bytes: Uint8Array;
 }
 export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
+/**
+ * {@link parseSignatureInput} for one member of an already parsed (and
+ * duplicate-checked) `Signature-Input` dictionary, so a caller that needs
+ * every label parses the field once.
+ */
+export declare function parseSignatureInputMember(label: string, entry: unknown): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
  * RFC 8941 / RFC 9651 parsers deduplicate dictionary keys and parameter keys

package/dist/lib/signing/parser.js

@@ -20,6 +20,7 @@ var parser_exports = {};
 __export(parser_exports, {
   parseSignature: () => parseSignature,
   parseSignatureInput: () => parseSignatureInput,
+  parseSignatureInputMember: () => parseSignatureInputMember,
   rejectDuplicateDictionaryKeys: () => rejectDuplicateDictionaryKeys
 });
 module.exports = __toCommonJS(parser_exports);
@@ -43,7 +44,9 @@ function parseSignatureInput(headerValue, expectedLabel) {
   if (dict.size === 0) malformed("Signature-Input header is empty");
   const label = expectedLabel ?? (dict.has("sig1") ? "sig1" : dict.keys().next().value);
   if (!dict.has(label)) malformed("Signature-Input label is missing");
-  const entry = dict.get(label);
+  return parseSignatureInputMember(label, dict.get(label));
+}
+function parseSignatureInputMember(label, entry) {
   if (!isInnerList(entry)) {
     malformed("Signature-Input value must be a parenthesized component list");
   }
@@ -83,10 +86,10 @@ function parseSignature(headerValue, expectedLabel, encoding = "legacy-base64url
   if (!rawBytes) malformed(`Signature header does not contain a byte sequence for label "${expectedLabel}"`);
   if (encoding === "rfc8941-base64") {
     if (!(0, import_content_digest.isPaddedStandardBase64)(rawBytes)) {
-      malformed("Signature value must use padded standard Base64 for AdCP 3.2+");
+      malformed("Signature value must use padded standard Base64 for the selected signing profile");
     }
   } else if (!/^[A-Za-z0-9_-]+$/.test(rawBytes)) {
-    malformed("Signature value must use unpadded Base64URL for AdCP 3.0/3.1");
+    malformed("Signature value must use unpadded Base64URL for the selected signing profile");
   }
   let dict;
   try {
@@ -255,5 +258,6 @@ function normalizeByteSequenceBase64(input) {
 0 && (module.exports = {
   parseSignature,
   parseSignatureInput,
+  parseSignatureInputMember,
   rejectDuplicateDictionaryKeys
 });

package/dist/lib/signing/parser.mjs

@@ -18,7 +18,9 @@ function parseSignatureInput(headerValue, expectedLabel) {
   if (dict.size === 0) malformed("Signature-Input header is empty");
   const label = expectedLabel ?? (dict.has("sig1") ? "sig1" : dict.keys().next().value);
   if (!dict.has(label)) malformed("Signature-Input label is missing");
-  const entry = dict.get(label);
+  return parseSignatureInputMember(label, dict.get(label));
+}
+function parseSignatureInputMember(label, entry) {
   if (!isInnerList(entry)) {
     malformed("Signature-Input value must be a parenthesized component list");
   }
@@ -58,10 +60,10 @@ function parseSignature(headerValue, expectedLabel, encoding = "legacy-base64url
   if (!rawBytes) malformed(`Signature header does not contain a byte sequence for label "${expectedLabel}"`);
   if (encoding === "rfc8941-base64") {
     if (!isPaddedStandardBase64(rawBytes)) {
-      malformed("Signature value must use padded standard Base64 for AdCP 3.2+");
+      malformed("Signature value must use padded standard Base64 for the selected signing profile");
     }
   } else if (!/^[A-Za-z0-9_-]+$/.test(rawBytes)) {
-    malformed("Signature value must use unpadded Base64URL for AdCP 3.0/3.1");
+    malformed("Signature value must use unpadded Base64URL for the selected signing profile");
   }
   let dict;
   try {
@@ -229,5 +231,6 @@ function normalizeByteSequenceBase64(input) {
 export {
   parseSignature,
   parseSignatureInput,
+  parseSignatureInputMember,
   rejectDuplicateDictionaryKeys
 };

package/dist/lib/signing/server.d.mts

@@ -10,7 +10,7 @@
  */
 export type { SsrfDnsLookup } from '../net/index.mjs';
 export { buildResponseSignatureBase, buildSignatureBase, canonicalAuthority, canonicalMethod, canonicalTargetUri, formatSignatureParams, getHeaderValue, type RequestLike, type RequestCanonicalizationProfile, type ResponseLike, type SignatureParams, } from './canonicalize.mjs';
-export { computeContentDigest, contentDigestMatches, parseContentDigest } from './content-digest.mjs';
+export { computeContentDigest, contentDigestMatches, parseContentDigest, type SfBinaryEncoding, } from './content-digest.mjs';
 export { requestContextFromExpress, requestContextFromFetch, requestContextFromLambda, type ExpressRequestLike, type FetchRequestLike, type LambdaRequestEvent, type RequestContextFromExpressOptions, type RequestContextFromLambdaOptions, } from './request-context.mjs';
 export { jwkToPublicKey, verifySignature, verifySignatureAsync } from './crypto.mjs';
 export { RequestSignatureError, RequestSigningErrorCodeMetadata, type RequestSignatureErrorCode, ResponseSignatureError, type ResponseSignatureErrorCode, WebhookSignatureError, type WebhookSignatureErrorCode, } from './errors.mjs';

package/dist/lib/signing/server.d.ts

@@ -10,7 +10,7 @@
  */
 export type { SsrfDnsLookup } from '../net';
 export { buildResponseSignatureBase, buildSignatureBase, canonicalAuthority, canonicalMethod, canonicalTargetUri, formatSignatureParams, getHeaderValue, type RequestLike, type RequestCanonicalizationProfile, type ResponseLike, type SignatureParams, } from './canonicalize';
-export { computeContentDigest, contentDigestMatches, parseContentDigest } from './content-digest';
+export { computeContentDigest, contentDigestMatches, parseContentDigest, type SfBinaryEncoding, } from './content-digest';
 export { requestContextFromExpress, requestContextFromFetch, requestContextFromLambda, type ExpressRequestLike, type FetchRequestLike, type LambdaRequestEvent, type RequestContextFromExpressOptions, type RequestContextFromLambdaOptions, } from './request-context';
 export { jwkToPublicKey, verifySignature, verifySignatureAsync } from './crypto';
 export { RequestSignatureError, RequestSigningErrorCodeMetadata, type RequestSignatureErrorCode, ResponseSignatureError, type ResponseSignatureErrorCode, WebhookSignatureError, type WebhookSignatureErrorCode, } from './errors';

package/dist/lib/signing/server.mjs

@@ -7,7 +7,11 @@ import {
   formatSignatureParams,
   getHeaderValue
 } from "./canonicalize.mjs";
-import { computeContentDigest, contentDigestMatches, parseContentDigest } from "./content-digest.mjs";
+import {
+  computeContentDigest,
+  contentDigestMatches,
+  parseContentDigest
+} from "./content-digest.mjs";
 import {
   requestContextFromExpress,
   requestContextFromFetch,