@adcp/sdk 16.0.0-beta.7 → 16.0.0-beta.8

package/dist/lib/server/property-lists.js

@@ -0,0 +1,154 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var property_lists_exports = {};
+__export(property_lists_exports, {
+  registerPropertyListTool: () => registerPropertyListTool,
+  sendPropertyListChanged: () => sendPropertyListChanged
+});
+module.exports = __toCommonJS(property_lists_exports);
+var import_zod = require("zod");
+var import_schemas = require('../types/schemas.generated.js');
+var import_wire_shape = require('./ctx-metadata/wire-shape.js');
+function registerPropertyListTool(server, options) {
+  return server.registerTool(
+    "get_property_list",
+    {
+      description: "Retrieve an authorized property list and a page of resolved identifiers.",
+      inputSchema: import_schemas.GetPropertyListRequestSchema,
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true }
+    },
+    async (request, extra) => {
+      const denied = () => toolError("PERMISSION_DENIED", "Property list access denied.", request.context);
+      const headers = extra.requestInfo?.headers ?? {};
+      for (const name of ["authorization", "x-adcp-auth"]) {
+        const values = Object.entries(headers).filter(([key]) => key.toLowerCase() === name);
+        if (values.length > 1 || values.length === 1 && typeof values[0][1] !== "string") return denied();
+      }
+      const readHeader = (name) => {
+        const values = Object.entries(headers).filter(([key]) => key.toLowerCase() === name);
+        if (values.length !== 1 || typeof values[0][1] !== "string") return void 0;
+        return values[0][1];
+      };
+      const authorization = readHeader("authorization");
+      const bearer = authorization?.match(/^Bearer ([^\s]+)$/i)?.[1];
+      const adcpToken = readHeader("x-adcp-auth");
+      const authenticatedToken = extra.authInfo?.token;
+      const tokens = [bearer, adcpToken, authenticatedToken].filter((token) => token !== void 0);
+      if (!tokens.length || tokens.some((token) => !token || token !== tokens[0]) || authorization !== void 0 && !bearer)
+        return denied();
+      let principal;
+      try {
+        principal = await options.verifyToken({ listId: request.list_id, token: tokens[0] });
+      } catch {
+        return denied();
+      }
+      if (principal === null || principal === false || principal === void 0) return denied();
+      try {
+        const page = await options.loadPage(request, principal);
+        if (page.list.list_id !== request.list_id) throw new Error("Invalid list identity");
+        if (request.resolve !== false && !Array.isArray(page.identifiers))
+          throw new Error("Missing resolved identifiers");
+        const limit = request.pagination?.max_results ?? 1e3;
+        if (request.resolve !== false && (page.identifiers?.length ?? 0) > limit) throw new Error("Invalid page size");
+        if (page.pagination?.has_more && !page.pagination.cursor) throw new Error("Missing continuation cursor");
+        if (!page.pagination?.has_more && page.pagination?.cursor) throw new Error("Unexpected continuation cursor");
+        const payload = import_schemas.GetPropertyListResponseSchema.parse({
+          list: Object.fromEntries(
+            [
+              "list_id",
+              "name",
+              "description",
+              "account",
+              "base_properties",
+              "filters",
+              "brand",
+              "webhook_url",
+              "cache_duration_hours",
+              "created_at",
+              "updated_at",
+              "property_count",
+              "pricing_options"
+            ].filter((key) => Object.hasOwn(page.list, key)).map((key) => [key, page.list[key]])
+          ),
+          ...page.identifiers !== void 0 ? { identifiers: page.identifiers.map((identifier) => ({ type: identifier.type, value: identifier.value })) } : {},
+          ...page.pagination !== void 0 ? {
+            pagination: {
+              has_more: page.pagination.has_more,
+              cursor: page.pagination.cursor,
+              total_count: page.pagination.total_count
+            }
+          } : {},
+          ...page.resolved_at !== void 0 ? { resolved_at: page.resolved_at } : {},
+          ...page.cache_valid_until !== void 0 ? { cache_valid_until: page.cache_valid_until } : {},
+          ...page.coverage_gaps !== void 0 ? { coverage_gaps: page.coverage_gaps } : {},
+          status: "completed",
+          ...request.resolve === false ? { identifiers: void 0, pagination: void 0 } : {},
+          ...request.context ? { context: request.context } : {}
+        });
+        (0, import_wire_shape.stripCtxMetadata)({ property_list: payload.list });
+        return { content: [{ type: "text", text: JSON.stringify(payload) }], structuredContent: payload };
+      } catch {
+        return toolError("INTERNAL_ERROR", "Property list could not be loaded.", request.context);
+      }
+    }
+  );
+}
+function toolError(code, message, context) {
+  const payload = { status: "failed", errors: [{ code, message }], ...context !== void 0 ? { context } : {} };
+  return {
+    isError: true,
+    content: [{ type: "text", text: JSON.stringify(payload) }],
+    structuredContent: payload
+  };
+}
+async function sendPropertyListChanged(emitter, options) {
+  const { notification, ...delivery } = options;
+  const dateTime = import_zod.z.string().datetime({ offset: true });
+  if (!notification.list_id || !dateTime.safeParse(notification.resolved_at).success || notification.cache_valid_until !== void 0 && !dateTime.safeParse(notification.cache_valid_until).success) {
+    throw new TypeError("Property-list notifications require a list_id and valid timestamps");
+  }
+  const summary = notification.change_summary === void 0 ? void 0 : Object.fromEntries(
+    ["properties_added", "properties_removed", "total_properties"].filter(
+      (key) => Object.hasOwn(notification.change_summary, key) && notification.change_summary[key] !== void 0
+    ).map((key) => [key, notification.change_summary[key]])
+  );
+  for (const count of Object.values(summary ?? {})) {
+    if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0)
+      throw new TypeError("Property-list change counts must be nonnegative integers");
+  }
+  return emitter.emit({
+    ...delivery,
+    authentication: null,
+    signingProfile: "adcp/webhook-signing/v1",
+    payload: {
+      event: "property_list_changed",
+      list_id: notification.list_id,
+      resolved_at: notification.resolved_at,
+      ...notification.list_name !== void 0 ? { list_name: notification.list_name } : {},
+      ...notification.cache_valid_until !== void 0 ? { cache_valid_until: notification.cache_valid_until } : {},
+      ...summary !== void 0 ? { change_summary: summary } : {},
+      signature: "rfc9421"
+    }
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  registerPropertyListTool,
+  sendPropertyListChanged
+});

package/dist/lib/server/property-lists.mjs

@@ -0,0 +1,129 @@
+import { z } from "zod";
+import { GetPropertyListRequestSchema, GetPropertyListResponseSchema } from "../types/schemas.generated.mjs";
+import { stripCtxMetadata } from "./ctx-metadata/wire-shape.mjs";
+function registerPropertyListTool(server, options) {
+  return server.registerTool(
+    "get_property_list",
+    {
+      description: "Retrieve an authorized property list and a page of resolved identifiers.",
+      inputSchema: GetPropertyListRequestSchema,
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true }
+    },
+    async (request, extra) => {
+      const denied = () => toolError("PERMISSION_DENIED", "Property list access denied.", request.context);
+      const headers = extra.requestInfo?.headers ?? {};
+      for (const name of ["authorization", "x-adcp-auth"]) {
+        const values = Object.entries(headers).filter(([key]) => key.toLowerCase() === name);
+        if (values.length > 1 || values.length === 1 && typeof values[0][1] !== "string") return denied();
+      }
+      const readHeader = (name) => {
+        const values = Object.entries(headers).filter(([key]) => key.toLowerCase() === name);
+        if (values.length !== 1 || typeof values[0][1] !== "string") return void 0;
+        return values[0][1];
+      };
+      const authorization = readHeader("authorization");
+      const bearer = authorization?.match(/^Bearer ([^\s]+)$/i)?.[1];
+      const adcpToken = readHeader("x-adcp-auth");
+      const authenticatedToken = extra.authInfo?.token;
+      const tokens = [bearer, adcpToken, authenticatedToken].filter((token) => token !== void 0);
+      if (!tokens.length || tokens.some((token) => !token || token !== tokens[0]) || authorization !== void 0 && !bearer)
+        return denied();
+      let principal;
+      try {
+        principal = await options.verifyToken({ listId: request.list_id, token: tokens[0] });
+      } catch {
+        return denied();
+      }
+      if (principal === null || principal === false || principal === void 0) return denied();
+      try {
+        const page = await options.loadPage(request, principal);
+        if (page.list.list_id !== request.list_id) throw new Error("Invalid list identity");
+        if (request.resolve !== false && !Array.isArray(page.identifiers))
+          throw new Error("Missing resolved identifiers");
+        const limit = request.pagination?.max_results ?? 1e3;
+        if (request.resolve !== false && (page.identifiers?.length ?? 0) > limit) throw new Error("Invalid page size");
+        if (page.pagination?.has_more && !page.pagination.cursor) throw new Error("Missing continuation cursor");
+        if (!page.pagination?.has_more && page.pagination?.cursor) throw new Error("Unexpected continuation cursor");
+        const payload = GetPropertyListResponseSchema.parse({
+          list: Object.fromEntries(
+            [
+              "list_id",
+              "name",
+              "description",
+              "account",
+              "base_properties",
+              "filters",
+              "brand",
+              "webhook_url",
+              "cache_duration_hours",
+              "created_at",
+              "updated_at",
+              "property_count",
+              "pricing_options"
+            ].filter((key) => Object.hasOwn(page.list, key)).map((key) => [key, page.list[key]])
+          ),
+          ...page.identifiers !== void 0 ? { identifiers: page.identifiers.map((identifier) => ({ type: identifier.type, value: identifier.value })) } : {},
+          ...page.pagination !== void 0 ? {
+            pagination: {
+              has_more: page.pagination.has_more,
+              cursor: page.pagination.cursor,
+              total_count: page.pagination.total_count
+            }
+          } : {},
+          ...page.resolved_at !== void 0 ? { resolved_at: page.resolved_at } : {},
+          ...page.cache_valid_until !== void 0 ? { cache_valid_until: page.cache_valid_until } : {},
+          ...page.coverage_gaps !== void 0 ? { coverage_gaps: page.coverage_gaps } : {},
+          status: "completed",
+          ...request.resolve === false ? { identifiers: void 0, pagination: void 0 } : {},
+          ...request.context ? { context: request.context } : {}
+        });
+        stripCtxMetadata({ property_list: payload.list });
+        return { content: [{ type: "text", text: JSON.stringify(payload) }], structuredContent: payload };
+      } catch {
+        return toolError("INTERNAL_ERROR", "Property list could not be loaded.", request.context);
+      }
+    }
+  );
+}
+function toolError(code, message, context) {
+  const payload = { status: "failed", errors: [{ code, message }], ...context !== void 0 ? { context } : {} };
+  return {
+    isError: true,
+    content: [{ type: "text", text: JSON.stringify(payload) }],
+    structuredContent: payload
+  };
+}
+async function sendPropertyListChanged(emitter, options) {
+  const { notification, ...delivery } = options;
+  const dateTime = z.string().datetime({ offset: true });
+  if (!notification.list_id || !dateTime.safeParse(notification.resolved_at).success || notification.cache_valid_until !== void 0 && !dateTime.safeParse(notification.cache_valid_until).success) {
+    throw new TypeError("Property-list notifications require a list_id and valid timestamps");
+  }
+  const summary = notification.change_summary === void 0 ? void 0 : Object.fromEntries(
+    ["properties_added", "properties_removed", "total_properties"].filter(
+      (key) => Object.hasOwn(notification.change_summary, key) && notification.change_summary[key] !== void 0
+    ).map((key) => [key, notification.change_summary[key]])
+  );
+  for (const count of Object.values(summary ?? {})) {
+    if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0)
+      throw new TypeError("Property-list change counts must be nonnegative integers");
+  }
+  return emitter.emit({
+    ...delivery,
+    authentication: null,
+    signingProfile: "adcp/webhook-signing/v1",
+    payload: {
+      event: "property_list_changed",
+      list_id: notification.list_id,
+      resolved_at: notification.resolved_at,
+      ...notification.list_name !== void 0 ? { list_name: notification.list_name } : {},
+      ...notification.cache_valid_until !== void 0 ? { cache_valid_until: notification.cache_valid_until } : {},
+      ...summary !== void 0 ? { change_summary: summary } : {},
+      signature: "rfc9421"
+    }
+  });
+}
+export {
+  registerPropertyListTool,
+  sendPropertyListChanged
+};

package/dist/lib/server/targeting-helpers.d.mts

@@ -56,6 +56,8 @@ export declare const defaultResolvedListCache: ResolvedListCache;
 export declare function clearDefaultResolvedListCache(): void;
 export type ResolveListCallTool = (agentUrl: string, toolName: 'get_property_list' | 'get_collection_list', args: Record<string, unknown>, authToken?: string) => Promise<unknown>;
 export interface ResolveListOptions {
+    /** Require schema-valid property-list pages with identifiers when resolving. Used for certification. */
+    strictResponseValidation?: boolean;
     /** Maximum page size when calling get_property_list / get_collection_list. Defaults to 1000. */
     pageSize?: number;
     /** Maximum number of pages to walk before treating pagination as unsafe. Defaults to 100. */

package/dist/lib/server/targeting-helpers.d.ts

@@ -56,6 +56,8 @@ export declare const defaultResolvedListCache: ResolvedListCache;
 export declare function clearDefaultResolvedListCache(): void;
 export type ResolveListCallTool = (agentUrl: string, toolName: 'get_property_list' | 'get_collection_list', args: Record<string, unknown>, authToken?: string) => Promise<unknown>;
 export interface ResolveListOptions {
+    /** Require schema-valid property-list pages with identifiers when resolving. Used for certification. */
+    strictResponseValidation?: boolean;
     /** Maximum page size when calling get_property_list / get_collection_list. Defaults to 1000. */
     pageSize?: number;
     /** Maximum number of pages to walk before treating pagination as unsafe. Defaults to 100. */

package/dist/lib/server/targeting-helpers.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var targeting_helpers_exports = {};
 __export(targeting_helpers_exports, {
@@ -75,7 +85,7 @@ async function resolvePropertyList(ref, options = {}) {
   const cache = cacheForOptions(options);
   const nowMs = nowMsForOptions(options);
   const cacheKey = resolvedListCacheKey("property", structurallyNormalizedRef, options);
-  const cached = cacheKey ? cache?.get(cacheKey, nowMs) : void 0;
+  const cached = cacheKey && !options.strictResponseValidation ? cache?.get(cacheKey, nowMs) : void 0;
   if (cached) return cached;
   const normalizedRef = options.callTool ? structurallyNormalizedRef : await normalizePropertyListReference(structurallyNormalizedRef, { resolveDns: false });
   const result = await fetchResolvedPropertyList(normalizedRef, options);
@@ -89,6 +99,7 @@ async function fetchResolvedPropertyList(ref, options) {
   let cacheValidUntil;
   let missingCacheValidUntil = false;
   let cursor;
+  const seenCursors = /* @__PURE__ */ new Set();
   for (let pageIndex = 0; pageIndex < maxPagesForOptions(options); pageIndex += 1) {
     const args = buildResolveListArgs(ref.list_id, pageSizeForOptions(options), cursor);
     const raw = await callTool(ref.agent_url, "get_property_list", args, ref.auth_token);
@@ -96,6 +107,20 @@ async function fetchResolvedPropertyList(ref, options) {
       throw new Error("property_list_invalid_response");
     }
     const response = raw;
+    if (response.status !== void 0 && response.status !== "completed" || raw.errors !== void 0 && (!Array.isArray(raw.errors) || raw.errors.some((error) => !error || typeof error !== "object" || error.severity !== "warning")) || raw.adcp_error !== void 0 || !Array.isArray(response.identifiers)) {
+      throw new Error("property_list_invalid_response");
+    }
+    if (options.strictResponseValidation) {
+      const { GetPropertyListResponseSchema } = await import("../types/schemas.generated.js");
+      if (!GetPropertyListResponseSchema.safeParse(raw).success || response.status !== "completed" || response.identifiers.length > pageSizeForOptions(options)) {
+        throw new Error("property_list_invalid_response");
+      }
+    }
+    if (!response.list || response.list.list_id !== ref.list_id || response.identifiers !== void 0 && (!Array.isArray(response.identifiers) || response.identifiers.some(
+      (identifier) => !identifier || typeof identifier !== "object" || typeof identifier.type !== "string" || typeof identifier.value !== "string"
+    ))) {
+      throw new Error("property_list_invalid_response");
+    }
     listId = response.list.list_id;
     identifiers.push(...response.identifiers ?? []);
     if (typeof response.cache_valid_until === "string") {
@@ -118,6 +143,8 @@ async function fetchResolvedPropertyList(ref, options) {
     if (!pagination.cursor) {
       throw new Error("property_list_invalid_pagination");
     }
+    if (seenCursors.has(pagination.cursor)) throw new Error("property_list_invalid_pagination");
+    seenCursors.add(pagination.cursor);
     cursor = pagination.cursor;
   }
   throw new Error("property_list_pagination_limit_exceeded");

package/dist/lib/server/targeting-helpers.mjs

@@ -44,7 +44,7 @@ async function resolvePropertyList(ref, options = {}) {
   const cache = cacheForOptions(options);
   const nowMs = nowMsForOptions(options);
   const cacheKey = resolvedListCacheKey("property", structurallyNormalizedRef, options);
-  const cached = cacheKey ? cache?.get(cacheKey, nowMs) : void 0;
+  const cached = cacheKey && !options.strictResponseValidation ? cache?.get(cacheKey, nowMs) : void 0;
   if (cached) return cached;
   const normalizedRef = options.callTool ? structurallyNormalizedRef : await normalizePropertyListReference(structurallyNormalizedRef, { resolveDns: false });
   const result = await fetchResolvedPropertyList(normalizedRef, options);
@@ -58,6 +58,7 @@ async function fetchResolvedPropertyList(ref, options) {
   let cacheValidUntil;
   let missingCacheValidUntil = false;
   let cursor;
+  const seenCursors = /* @__PURE__ */ new Set();
   for (let pageIndex = 0; pageIndex < maxPagesForOptions(options); pageIndex += 1) {
     const args = buildResolveListArgs(ref.list_id, pageSizeForOptions(options), cursor);
     const raw = await callTool(ref.agent_url, "get_property_list", args, ref.auth_token);
@@ -65,6 +66,20 @@ async function fetchResolvedPropertyList(ref, options) {
       throw new Error("property_list_invalid_response");
     }
     const response = raw;
+    if (response.status !== void 0 && response.status !== "completed" || raw.errors !== void 0 && (!Array.isArray(raw.errors) || raw.errors.some((error) => !error || typeof error !== "object" || error.severity !== "warning")) || raw.adcp_error !== void 0 || !Array.isArray(response.identifiers)) {
+      throw new Error("property_list_invalid_response");
+    }
+    if (options.strictResponseValidation) {
+      const { GetPropertyListResponseSchema } = await import("../types/schemas.generated.mjs");
+      if (!GetPropertyListResponseSchema.safeParse(raw).success || response.status !== "completed" || response.identifiers.length > pageSizeForOptions(options)) {
+        throw new Error("property_list_invalid_response");
+      }
+    }
+    if (!response.list || response.list.list_id !== ref.list_id || response.identifiers !== void 0 && (!Array.isArray(response.identifiers) || response.identifiers.some(
+      (identifier) => !identifier || typeof identifier !== "object" || typeof identifier.type !== "string" || typeof identifier.value !== "string"
+    ))) {
+      throw new Error("property_list_invalid_response");
+    }
     listId = response.list.list_id;
     identifiers.push(...response.identifiers ?? []);
     if (typeof response.cache_valid_until === "string") {
@@ -87,6 +102,8 @@ async function fetchResolvedPropertyList(ref, options) {
     if (!pagination.cursor) {
       throw new Error("property_list_invalid_pagination");
     }
+    if (seenCursors.has(pagination.cursor)) throw new Error("property_list_invalid_pagination");
+    seenCursors.add(pagination.cursor);
     cursor = pagination.cursor;
   }
   throw new Error("property_list_pagination_limit_exceeded");

package/dist/lib/signing/parser.js

@@ -86,10 +86,10 @@ function parseSignature(headerValue, expectedLabel, encoding = "legacy-base64url
   if (!rawBytes) malformed(`Signature header does not contain a byte sequence for label "${expectedLabel}"`);
   if (encoding === "rfc8941-base64") {
     if (!(0, import_content_digest.isPaddedStandardBase64)(rawBytes)) {
-      malformed("Signature value must use padded standard Base64 for AdCP 3.2+");
+      malformed("Signature value must use padded standard Base64 for the selected signing profile");
     }
   } else if (!/^[A-Za-z0-9_-]+$/.test(rawBytes)) {
-    malformed("Signature value must use unpadded Base64URL for AdCP 3.0/3.1");
+    malformed("Signature value must use unpadded Base64URL for the selected signing profile");
   }
   let dict;
   try {

package/dist/lib/signing/parser.mjs

@@ -60,10 +60,10 @@ function parseSignature(headerValue, expectedLabel, encoding = "legacy-base64url
   if (!rawBytes) malformed(`Signature header does not contain a byte sequence for label "${expectedLabel}"`);
   if (encoding === "rfc8941-base64") {
     if (!isPaddedStandardBase64(rawBytes)) {
-      malformed("Signature value must use padded standard Base64 for AdCP 3.2+");
+      malformed("Signature value must use padded standard Base64 for the selected signing profile");
     }
   } else if (!/^[A-Za-z0-9_-]+$/.test(rawBytes)) {
-    malformed("Signature value must use unpadded Base64URL for AdCP 3.0/3.1");
+    malformed("Signature value must use unpadded Base64URL for the selected signing profile");
   }
   let dict;
   try {

package/dist/lib/signing/server.d.mts

@@ -10,7 +10,7 @@
  */
 export type { SsrfDnsLookup } from '../net/index.mjs';
 export { buildResponseSignatureBase, buildSignatureBase, canonicalAuthority, canonicalMethod, canonicalTargetUri, formatSignatureParams, getHeaderValue, type RequestLike, type RequestCanonicalizationProfile, type ResponseLike, type SignatureParams, } from './canonicalize.mjs';
-export { computeContentDigest, contentDigestMatches, parseContentDigest } from './content-digest.mjs';
+export { computeContentDigest, contentDigestMatches, parseContentDigest, type SfBinaryEncoding, } from './content-digest.mjs';
 export { requestContextFromExpress, requestContextFromFetch, requestContextFromLambda, type ExpressRequestLike, type FetchRequestLike, type LambdaRequestEvent, type RequestContextFromExpressOptions, type RequestContextFromLambdaOptions, } from './request-context.mjs';
 export { jwkToPublicKey, verifySignature, verifySignatureAsync } from './crypto.mjs';
 export { RequestSignatureError, RequestSigningErrorCodeMetadata, type RequestSignatureErrorCode, ResponseSignatureError, type ResponseSignatureErrorCode, WebhookSignatureError, type WebhookSignatureErrorCode, } from './errors.mjs';

package/dist/lib/signing/server.d.ts

@@ -10,7 +10,7 @@
  */
 export type { SsrfDnsLookup } from '../net';
 export { buildResponseSignatureBase, buildSignatureBase, canonicalAuthority, canonicalMethod, canonicalTargetUri, formatSignatureParams, getHeaderValue, type RequestLike, type RequestCanonicalizationProfile, type ResponseLike, type SignatureParams, } from './canonicalize';
-export { computeContentDigest, contentDigestMatches, parseContentDigest } from './content-digest';
+export { computeContentDigest, contentDigestMatches, parseContentDigest, type SfBinaryEncoding, } from './content-digest';
 export { requestContextFromExpress, requestContextFromFetch, requestContextFromLambda, type ExpressRequestLike, type FetchRequestLike, type LambdaRequestEvent, type RequestContextFromExpressOptions, type RequestContextFromLambdaOptions, } from './request-context';
 export { jwkToPublicKey, verifySignature, verifySignatureAsync } from './crypto';
 export { RequestSignatureError, RequestSigningErrorCodeMetadata, type RequestSignatureErrorCode, ResponseSignatureError, type ResponseSignatureErrorCode, WebhookSignatureError, type WebhookSignatureErrorCode, } from './errors';

package/dist/lib/signing/server.mjs

@@ -7,7 +7,11 @@ import {
   formatSignatureParams,
   getHeaderValue
 } from "./canonicalize.mjs";
-import { computeContentDigest, contentDigestMatches, parseContentDigest } from "./content-digest.mjs";
+import {
+  computeContentDigest,
+  contentDigestMatches,
+  parseContentDigest
+} from "./content-digest.mjs";
 import {
   requestContextFromExpress,
   requestContextFromFetch,

package/dist/lib/signing/webhook-verifier.d.mts

@@ -22,6 +22,7 @@
  * so failures can point at a specific spec clause. Numbers are 1-based to
  * match the security doc.
  */
+import { type SfBinaryEncoding } from './content-digest.mjs';
 import type { JwksResolver } from './jwks.mjs';
 import { type PublisherSigningKeyPin } from './publisher-pins.mjs';
 import { type ReplayStore } from './replay.mjs';
@@ -43,6 +44,16 @@ export interface WebhookRequestLike {
 export declare const WEBHOOK_MANDATORY_COMPONENTS: ReadonlyArray<string>;
 export interface VerifyWebhookOptions {
     jwks: JwksResolver;
+    /**
+     * Trusted receiver configuration for the Signature byte sequence.
+     * Defaults to `legacy-base64url`, as the AdCP webhook-v1 profile requires
+     * throughout 3.x. Set `rfc8941-base64` only for an explicitly configured
+     * peer emitting standard padded Base64 (for example, a generic RFC 9421
+     * request signer with the webhook tag). There is no encoding fallback.
+     * URL canonicalization remains AdCP 3.2 in either mode; Signature encoding
+     * does not identify a webhook's AdCP version.
+     */
+    signatureEncoding?: SfBinaryEncoding;
     /** Applicable publishers from the verifier's own media-buy record. */
     publisherPins?: readonly PublisherSigningKeyPin[];
     /** Log the underlying request_signature_* discovery cause locally. */

package/dist/lib/signing/webhook-verifier.d.ts

@@ -22,6 +22,7 @@
  * so failures can point at a specific spec clause. Numbers are 1-based to
  * match the security doc.
  */
+import { type SfBinaryEncoding } from './content-digest';
 import type { JwksResolver } from './jwks';
 import { type PublisherSigningKeyPin } from './publisher-pins';
 import { type ReplayStore } from './replay';
@@ -43,6 +44,16 @@ export interface WebhookRequestLike {
 export declare const WEBHOOK_MANDATORY_COMPONENTS: ReadonlyArray<string>;
 export interface VerifyWebhookOptions {
     jwks: JwksResolver;
+    /**
+     * Trusted receiver configuration for the Signature byte sequence.
+     * Defaults to `legacy-base64url`, as the AdCP webhook-v1 profile requires
+     * throughout 3.x. Set `rfc8941-base64` only for an explicitly configured
+     * peer emitting standard padded Base64 (for example, a generic RFC 9421
+     * request signer with the webhook tag). There is no encoding fallback.
+     * URL canonicalization remains AdCP 3.2 in either mode; Signature encoding
+     * does not identify a webhook's AdCP version.
+     */
+    signatureEncoding?: SfBinaryEncoding;
     /** Applicable publishers from the verifier's own media-buy record. */
     publisherPins?: readonly PublisherSigningKeyPin[];
     /** Log the underlying request_signature_* discovery cause locally. */

package/dist/lib/signing/webhook-verifier.js

@@ -50,6 +50,7 @@ const WEBHOOK_MANDATORY_COMPONENTS = [
   "content-digest"
 ];
 async function verifyWebhookSignature(request, options) {
+  const signatureEncoding = resolveSignatureEncoding(options.signatureEncoding);
   const currentTime = options.now ?? (() => Date.now() / 1e3);
   const now = currentTime();
   const requiredTag = options.requiredTag ?? WEBHOOK_SIGNING_TAG;
@@ -66,12 +67,12 @@ async function verifyWebhookSignature(request, options) {
   let parsedSig;
   try {
     parsedInput = (0, import_parser.parseSignatureInput)(sigInputHeader);
-    parsedSig = (0, import_parser.parseSignature)(sigHeader, parsedInput.label);
+    parsedSig = (0, import_parser.parseSignature)(sigHeader, parsedInput.label, signatureEncoding);
   } catch (err) {
     throw new import_errors.WebhookSignatureError(
       "webhook_signature_header_malformed",
       1,
-      err instanceof Error ? err.message : String(err)
+      `${err instanceof Error ? err.message : String(err)} (webhook signatureEncoding="${signatureEncoding}").`
     );
   }
   requireParams(parsedInput);
@@ -239,6 +240,12 @@ async function verifyWebhookSignature(request, options) {
     verified_at: Math.floor(now)
   };
 }
+function resolveSignatureEncoding(encoding = "legacy-base64url") {
+  if (encoding !== "legacy-base64url" && encoding !== "rfc8941-base64") {
+    throw new TypeError('signatureEncoding must be "legacy-base64url" or "rfc8941-base64".');
+  }
+  return encoding;
+}
 function assertDelegatedOperatorAuthorizationActive(validUntil, now) {
   if (validUntil !== void 0 && (!Number.isFinite(validUntil) || now >= validUntil)) {
     throw new import_errors.WebhookSignatureError(
@@ -345,9 +352,10 @@ function isWebhookLoopbackHost(hostname) {
   return LOOPBACK_IPV4.test(normalized);
 }
 function createWebhookVerifier(options) {
+  const signatureEncoding = resolveSignatureEncoding(options.signatureEncoding);
   const replayStore = options.replayStore ?? new import_replay.InMemoryReplayStore();
   const revocationStore = options.revocationStore ?? new import_revocation.InMemoryRevocationStore();
-  return (request) => verifyWebhookSignature(request, { ...options, replayStore, revocationStore });
+  return (request) => verifyWebhookSignature(request, { ...options, signatureEncoding, replayStore, revocationStore });
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/lib/signing/webhook-verifier.mjs

@@ -23,6 +23,7 @@ const WEBHOOK_MANDATORY_COMPONENTS = [
   "content-digest"
 ];
 async function verifyWebhookSignature(request, options) {
+  const signatureEncoding = resolveSignatureEncoding(options.signatureEncoding);
   const currentTime = options.now ?? (() => Date.now() / 1e3);
   const now = currentTime();
   const requiredTag = options.requiredTag ?? WEBHOOK_SIGNING_TAG;
@@ -39,12 +40,12 @@ async function verifyWebhookSignature(request, options) {
   let parsedSig;
   try {
     parsedInput = parseSignatureInput(sigInputHeader);
-    parsedSig = parseSignature(sigHeader, parsedInput.label);
+    parsedSig = parseSignature(sigHeader, parsedInput.label, signatureEncoding);
   } catch (err) {
     throw new WebhookSignatureError(
       "webhook_signature_header_malformed",
       1,
-      err instanceof Error ? err.message : String(err)
+      `${err instanceof Error ? err.message : String(err)} (webhook signatureEncoding="${signatureEncoding}").`
     );
   }
   requireParams(parsedInput);
@@ -212,6 +213,12 @@ async function verifyWebhookSignature(request, options) {
     verified_at: Math.floor(now)
   };
 }
+function resolveSignatureEncoding(encoding = "legacy-base64url") {
+  if (encoding !== "legacy-base64url" && encoding !== "rfc8941-base64") {
+    throw new TypeError('signatureEncoding must be "legacy-base64url" or "rfc8941-base64".');
+  }
+  return encoding;
+}
 function assertDelegatedOperatorAuthorizationActive(validUntil, now) {
   if (validUntil !== void 0 && (!Number.isFinite(validUntil) || now >= validUntil)) {
     throw new WebhookSignatureError(
@@ -318,9 +325,10 @@ function isWebhookLoopbackHost(hostname) {
   return LOOPBACK_IPV4.test(normalized);
 }
 function createWebhookVerifier(options) {
+  const signatureEncoding = resolveSignatureEncoding(options.signatureEncoding);
   const replayStore = options.replayStore ?? new InMemoryReplayStore();
   const revocationStore = options.revocationStore ?? new InMemoryRevocationStore();
-  return (request) => verifyWebhookSignature(request, { ...options, replayStore, revocationStore });
+  return (request) => verifyWebhookSignature(request, { ...options, signatureEncoding, replayStore, revocationStore });
 }
 export {
   WEBHOOK_MANDATORY_COMPONENTS,