@adcp/sdk 5.23.0

package/dist/lib/signing/brand-jwks.js

@@ -0,0 +1,433 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrandJsonJwksResolver = exports.BrandJsonResolverError = void 0;
+/**
+ * Receiver-side ergonomic: resolve a sender's JWKS by fetching their
+ * `brand.json`, extracting the `jwks_uri` for the agent whose webhooks we're
+ * verifying, and delegating to {@link HttpsJwksResolver}.
+ *
+ * Hand the resulting instance to `verifyWebhookSignature.jwks` (or
+ * `verifyRequestSignature.jwks`) and the receiver never has to know where the
+ * sender hosts their keys — brand.json is the single source of truth.
+ *
+ * Follows the two documented redirect variants of `brand.json`
+ * (`authoritative_location` and `house`) up to a caller-configurable hop
+ * depth. When the selected agent has no `jwks_uri`, falls back to
+ * `/.well-known/jwks.json` on the origin of the agent's `url` — but only
+ * when that origin matches the final brand.json origin. The spec's
+ * well-known fallback exists so publishers hosting brand.json and their
+ * agents on the same origin can skip the explicit `jwks_uri`; accepting a
+ * cross-origin fallback would let an attacker pivot the trust anchor to a
+ * controlled host with a permissive JWKS.
+ *
+ * Caching is stacked with the inner {@link HttpsJwksResolver}: brand.json
+ * honors its own `Cache-Control`/`ETag` (bounded by `maxAgeSeconds`), and
+ * unknown-kid refreshes cascade — first to the JWKS endpoint, then (if the
+ * JWKS still doesn't have the kid and the brand.json cooldown has elapsed) to
+ * brand.json itself, in case the sender rotated `jwks_uri`.
+ */
+const net_1 = require("../net");
+const jwks_https_1 = require("./jwks-https");
+/**
+ * Typed error surfaced by the resolver pipeline. Verifier callers can fold
+ * these into `webhook_signature_key_unknown` (or treat ambiguous/schema
+ * errors as config bugs) without parsing error message strings.
+ */
+class BrandJsonResolverError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'BrandJsonResolverError';
+        this.code = code;
+    }
+}
+exports.BrandJsonResolverError = BrandJsonResolverError;
+const DEFAULT_MIN_COOLDOWN_SECONDS = 30;
+const DEFAULT_MAX_AGE_SECONDS = 3600;
+const DEFAULT_MAX_REDIRECTS = 3;
+// Bare hostname pattern: lowercase labels separated by dots, no userinfo,
+// no path, no control characters. Matches the `house` domain regex used in
+// the brand.json schema (`^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]…)*$`).
+const BARE_HOSTNAME = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
+/**
+ * JWKS resolver backed by a sender's `brand.json`. Construct one per
+ * counterparty (or keyed by `brand.json` URL + agent selector) and hand it to
+ * the webhook/request verifier as the `jwks` dependency.
+ */
+class BrandJsonJwksResolver {
+    url;
+    selector;
+    minCooldown;
+    maxAge;
+    maxRedirects;
+    allowPrivateIp;
+    jwksOptions;
+    now;
+    snapshot;
+    inner;
+    inFlight;
+    constructor(brandJsonUrl, options) {
+        this.url = brandJsonUrl;
+        this.selector = {
+            agentType: options.agentType,
+            ...(options.agentId !== undefined && { agentId: options.agentId }),
+            ...(options.brandId !== undefined && { brandId: options.brandId }),
+        };
+        this.minCooldown = options.minCooldownSeconds ?? DEFAULT_MIN_COOLDOWN_SECONDS;
+        this.maxAge = options.maxAgeSeconds ?? DEFAULT_MAX_AGE_SECONDS;
+        this.maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+        this.allowPrivateIp = options.allowPrivateIp ?? false;
+        this.jwksOptions = options.jwksOptions ?? {};
+        this.now = options.now ?? (() => Math.floor(Date.now() / 1000));
+    }
+    /**
+     * Resolve a JWK by `kid`. On a cold cache, fetches brand.json first; on an
+     * expired brand.json snapshot, refreshes respecting the cooldown. Unknown
+     * kids cascade: first ask the inner HttpsJwksResolver (which will refetch
+     * its own URL if cooldown has elapsed); if still unknown, refresh
+     * brand.json in case `jwks_uri` rotated.
+     */
+    async resolve(keyid) {
+        if (!this.snapshot || !this.inner) {
+            await this.refresh();
+        }
+        else if (this.now() > this.snapshot.expiresAt && this.now() - this.snapshot.fetchedAt >= this.minCooldown) {
+            await this.refresh().catch(() => {
+                /* keep stale on transient failure */
+            });
+        }
+        if (!this.inner)
+            return null;
+        const hit = await this.inner.resolve(keyid);
+        if (hit)
+            return hit;
+        if (this.snapshot && this.now() - this.snapshot.fetchedAt >= this.minCooldown) {
+            await this.refresh().catch(() => {
+                /* keep stale on transient failure */
+            });
+            return this.inner ? this.inner.resolve(keyid) : null;
+        }
+        return null;
+    }
+    /**
+     * The agent URL we resolved `jwks_uri` from. Populated after the first
+     * successful refresh; useful for verifier result attribution
+     * (`VerifyWebhookOptions.agentUrlForKeyid`).
+     */
+    get agentUrl() {
+        return this.snapshot?.agentUrl;
+    }
+    /** Force a refetch of both brand.json and the inner JWKS, bypassing the cooldown. */
+    async forceRefresh() {
+        this.snapshot = undefined;
+        this.inner = undefined;
+        await this.refresh();
+    }
+    async refresh() {
+        if (this.inFlight) {
+            await this.inFlight;
+            return;
+        }
+        this.inFlight = this.doRefresh().finally(() => {
+            this.inFlight = undefined;
+        });
+        await this.inFlight;
+    }
+    async doRefresh() {
+        const fetched = await fetchBrandJson({
+            startUrl: this.url,
+            currentEtag: this.snapshot?.etag,
+            maxRedirects: this.maxRedirects,
+            allowPrivateIp: this.allowPrivateIp,
+        });
+        // 304 on the entry URL: extend the lifetime, keep the inner resolver.
+        if (fetched.status === 'not_modified' && this.snapshot) {
+            this.snapshot = {
+                ...this.snapshot,
+                ...(fetched.etag && { etag: fetched.etag }),
+                fetchedAt: this.now(),
+                expiresAt: this.now() + computeLifetime(fetched.cacheControl, this.maxAge),
+            };
+            return;
+        }
+        const agent = selectAgent(fetched.data, fetched.finalUrl, this.selector);
+        if (!this.inner || this.snapshot?.jwksUri !== agent.jwksUri) {
+            this.inner = new jwks_https_1.HttpsJwksResolver(agent.jwksUri, {
+                ...this.jwksOptions,
+                allowPrivateIp: this.allowPrivateIp,
+                now: this.now,
+            });
+        }
+        this.snapshot = {
+            jwksUri: agent.jwksUri,
+            agentUrl: agent.url,
+            ...(fetched.etag && { etag: fetched.etag }),
+            fetchedAt: this.now(),
+            expiresAt: this.now() + computeLifetime(fetched.cacheControl, this.maxAge),
+        };
+    }
+}
+exports.BrandJsonJwksResolver = BrandJsonJwksResolver;
+/**
+ * Fetch brand.json from `startUrl`, following `authoritative_location` and
+ * `house` string redirect variants up to `maxRedirects` hops. Each hop goes
+ * through the SSRF-safe fetch primitive so an attacker-supplied chain can't
+ * land on a private address or IMDS. Redirect targets are structurally
+ * validated before dispatch — an attacker-controlled brand.json that emits
+ * `{"house": "evil.com\\@victim.com"}` or `{"authoritative_location":
+ * "http://169.254.169.254/..."}` is rejected at parse time rather than
+ * relying on `ssrfSafeFetch` to catch every pathological shape.
+ */
+async function fetchBrandJson(args) {
+    const seen = new Set();
+    let url = canonicalizeUrl(args.startUrl, args.allowPrivateIp);
+    for (let hop = 0; hop <= args.maxRedirects; hop++) {
+        if (seen.has(url)) {
+            throw new BrandJsonResolverError('redirect_loop', `brand.json redirect loop detected`);
+        }
+        seen.add(url);
+        const headers = {
+            accept: 'application/json',
+        };
+        // Only attach If-None-Match on the entry URL: a 304 short-circuits the
+        // whole chain, so revalidating a deeper hop with a stale ETag would be
+        // a lie about the redirect target.
+        if (hop === 0 && args.currentEtag)
+            headers['if-none-match'] = args.currentEtag;
+        const res = await (0, net_1.ssrfSafeFetch)(url, {
+            method: 'GET',
+            headers,
+            allowPrivateIp: args.allowPrivateIp,
+        });
+        if (hop === 0 && res.status === 304) {
+            return {
+                status: 'not_modified',
+                finalUrl: url,
+                data: null,
+                ...(res.headers['etag'] && { etag: res.headers['etag'] }),
+                ...(res.headers['cache-control'] && { cacheControl: res.headers['cache-control'] }),
+            };
+        }
+        if (res.status !== 200) {
+            throw new BrandJsonResolverError('fetch_failed', `brand.json fetch returned HTTP ${res.status}`);
+        }
+        const text = Buffer.from(res.body).toString('utf8');
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            throw new BrandJsonResolverError('invalid_body', `brand.json response is not valid JSON`);
+        }
+        if (!parsed || typeof parsed !== 'object') {
+            throw new BrandJsonResolverError('invalid_body', `brand.json response is not an object`);
+        }
+        const obj = parsed;
+        const authoritative = typeof obj.authoritative_location === 'string' ? obj.authoritative_location : undefined;
+        const house = typeof obj.house === 'string' ? obj.house : undefined;
+        if (authoritative !== undefined) {
+            if (hop === args.maxRedirects) {
+                throw new BrandJsonResolverError('redirect_depth_exceeded', `brand.json redirect depth exceeded`);
+            }
+            url = canonicalizeUrl(authoritative, args.allowPrivateIp);
+            continue;
+        }
+        if (house !== undefined) {
+            // The "house string" redirect variant: a bare domain pointing at the
+            // authoritative portfolio. Reject anything that isn't a bare hostname
+            // so an attacker can't inject userinfo, paths, or ports via the
+            // interpolation.
+            if (!BARE_HOSTNAME.test(house)) {
+                throw new BrandJsonResolverError('invalid_house', `brand.json "house" is not a bare hostname`);
+            }
+            if (hop === args.maxRedirects) {
+                throw new BrandJsonResolverError('redirect_depth_exceeded', `brand.json redirect depth exceeded`);
+            }
+            url = canonicalizeUrl(`https://${house}/.well-known/brand.json`, args.allowPrivateIp);
+            continue;
+        }
+        // Narrow shape validation on the terminal document. Full BrandJsonSchema
+        // validation is stricter than we need (it enforces `^https://` on URLs,
+        // which ssrfSafeFetch already polices) and fails too readily on trailing
+        // portfolio fields the resolver doesn't touch. What we MUST reject: a
+        // document whose shape would let an attacker smuggle a non-string url or
+        // jwks_uri past the selector.
+        assertBrandJsonShape(obj);
+        return {
+            status: 'ok',
+            finalUrl: url,
+            data: obj,
+            ...(res.headers['etag'] && { etag: res.headers['etag'] }),
+            ...(res.headers['cache-control'] && { cacheControl: res.headers['cache-control'] }),
+        };
+    }
+    throw new BrandJsonResolverError('redirect_depth_exceeded', `brand.json redirect depth exceeded`);
+}
+/**
+ * Structurally validate a URL and return it in a canonical form for the
+ * loop-detection `Set`. Rejects URLs that `ssrfSafeFetch` would later refuse
+ * anyway — but catching them here gives a clearer error code and prevents
+ * a malformed `authoritative_location` from silently bypassing the hop cap
+ * because its string form differed from a prior seen URL.
+ */
+function canonicalizeUrl(raw, allowPrivateIp) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new BrandJsonResolverError('invalid_url', `brand.json URL is malformed`);
+    }
+    if (parsed.username || parsed.password) {
+        throw new BrandJsonResolverError('invalid_url', `brand.json URL must not include userinfo`);
+    }
+    if (parsed.protocol !== 'https:' && !(allowPrivateIp && parsed.protocol === 'http:')) {
+        throw new BrandJsonResolverError('invalid_url', `brand.json URL must use https://`);
+    }
+    // Fragments are not sent on the wire and must not smuggle loop-detection
+    // aliases — strip them before stashing in `seen`.
+    parsed.hash = '';
+    return parsed.toString();
+}
+function isPortfolioHouse(value) {
+    return typeof value === 'object' && value !== null;
+}
+/**
+ * Walk every `agents[]` array we might consult and reject entries where
+ * `url` or `jwks_uri` are present but non-string. A permissive walk here
+ * catches a malformed document that `pickAgent` would otherwise silently
+ * skip (a non-string url gets filtered out, so an attacker who declares
+ * two agents of a type — one well-formed and one with a poisoned shape —
+ * couldn't change the selector outcome, but schema-invalid payloads are
+ * still a strong signal of compromise).
+ */
+function assertBrandJsonShape(obj) {
+    const queues = [obj.agents];
+    if (isPortfolioHouse(obj.house)) {
+        const house = obj.house;
+        queues.push(house.agents);
+        if (Array.isArray(obj.brands)) {
+            for (const brand of obj.brands) {
+                if (brand)
+                    queues.push(brand.agents);
+            }
+        }
+    }
+    for (const q of queues) {
+        if (q === undefined)
+            continue;
+        if (!Array.isArray(q)) {
+            throw new BrandJsonResolverError('schema_invalid', 'brand.json `agents` must be an array');
+        }
+        for (const entry of q) {
+            if (entry && typeof entry === 'object') {
+                const e = entry;
+                if (e.url !== undefined && typeof e.url !== 'string') {
+                    throw new BrandJsonResolverError('schema_invalid', 'brand.json agent.url must be a string');
+                }
+                if (e.jwks_uri !== undefined && typeof e.jwks_uri !== 'string') {
+                    throw new BrandJsonResolverError('schema_invalid', 'brand.json agent.jwks_uri must be a string');
+                }
+            }
+        }
+    }
+}
+function selectAgent(data, finalBrandUrl, selector) {
+    if (!data || typeof data !== 'object') {
+        throw new BrandJsonResolverError('agent_not_found', `brand.json has no agent matching ${describeSelector(selector)}`);
+    }
+    const obj = data;
+    let picked;
+    if (isPortfolioHouse(obj.house)) {
+        const house = obj.house;
+        if (selector.brandId !== undefined) {
+            const brands = Array.isArray(obj.brands) ? obj.brands : [];
+            const brand = brands.find(b => b && b.id === selector.brandId);
+            if (brand)
+                picked = pickAgent(brand.agents, finalBrandUrl, selector);
+        }
+        picked ??= pickAgent(house.agents, finalBrandUrl, selector);
+    }
+    else {
+        picked = pickAgent(obj.agents, finalBrandUrl, selector);
+    }
+    if (!picked) {
+        throw new BrandJsonResolverError('agent_not_found', `brand.json has no agent matching ${describeSelector(selector)}`);
+    }
+    return picked;
+}
+function pickAgent(agents, finalBrandUrl, selector) {
+    if (!Array.isArray(agents))
+        return undefined;
+    const matches = agents.filter((a) => {
+        if (!a || typeof a !== 'object')
+            return false;
+        const e = a;
+        if (e.type !== selector.agentType)
+            return false;
+        if (selector.agentId !== undefined && e.id !== selector.agentId)
+            return false;
+        return typeof e.url === 'string';
+    });
+    if (matches.length === 0)
+        return undefined;
+    if (matches.length > 1 && selector.agentId === undefined) {
+        throw new BrandJsonResolverError('agent_ambiguous', `brand.json declares ${matches.length} agents of type "${selector.agentType}"; ` +
+            `pass \`agentId\` to disambiguate (choices: ${matches.map(m => m.id ?? '<no-id>').join(', ')})`);
+    }
+    const agent = matches[0];
+    const url = agent.url;
+    const jwksUri = agent.jwks_uri ?? defaultJwksUri(url, finalBrandUrl);
+    return { url, jwksUri };
+}
+/**
+ * Spec fallback: "When absent, verifiers MUST default to /.well-known/jwks.json
+ * on the origin of `url`." We strip any path/query/fragment from the agent
+ * URL and replace it with the well-known path.
+ *
+ * Security: require the agent origin to match the final brand.json origin.
+ * Without this check, an attacker-controlled brand.json could set
+ * `agent.url: "https://victim-internal.example/"` and force the verifier to
+ * treat that origin's JWKS as authoritative — a cross-origin trust pivot.
+ * Publishers that genuinely host their agent on a different origin from
+ * their brand.json MUST declare an explicit `jwks_uri` (and that URI is
+ * validated at fetch time by the inner HttpsJwksResolver, not here).
+ */
+function defaultJwksUri(agentUrl, finalBrandUrl) {
+    let agent;
+    try {
+        agent = new URL(agentUrl);
+    }
+    catch {
+        throw new BrandJsonResolverError('invalid_url', `agent.url is not a valid URL`);
+    }
+    const brand = new URL(finalBrandUrl);
+    if (agent.origin !== brand.origin) {
+        throw new BrandJsonResolverError('jwks_origin_mismatch', `agent.url origin (${agent.origin}) does not match brand.json origin (${brand.origin}); ` +
+            `publisher must declare an explicit jwks_uri for cross-origin agents`);
+    }
+    return `${agent.origin}/.well-known/jwks.json`;
+}
+function describeSelector(selector) {
+    const parts = [`type=${selector.agentType}`];
+    if (selector.agentId !== undefined)
+        parts.push(`id=${selector.agentId}`);
+    if (selector.brandId !== undefined)
+        parts.push(`brand=${selector.brandId}`);
+    return parts.join(' ');
+}
+function computeLifetime(cacheControl, maxAge) {
+    if (!cacheControl)
+        return maxAge;
+    const lower = cacheControl.toLowerCase();
+    if (/\bno-store\b|\bno-cache\b/.test(lower))
+        return 0;
+    const match = /max-age\s*=\s*(\d+)/.exec(lower);
+    if (match) {
+        const serverMax = Number(match[1]);
+        if (Number.isFinite(serverMax))
+            return Math.min(serverMax, maxAge);
+    }
+    return maxAge;
+}
+//# sourceMappingURL=brand-jwks.js.map

package/dist/lib/signing/brand-jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brand-jwks.js","sourceRoot":"","sources":["../../../src/lib/signing/brand-jwks.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,gCAAuC;AAEvC,6CAAgF;AAyBhF;;;;GAIG;AACH,MAAa,sBAAuB,SAAQ,KAAK;IACtC,IAAI,CAA6B;IAC1C,YAAY,IAAgC,EAAE,OAAe;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,wDAOC;AAoED,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,aAAa,GAAG,mEAAmE,CAAC;AAE1F;;;;GAIG;AACH,MAAa,qBAAqB;IACf,GAAG,CAAS;IACZ,QAAQ,CAIvB;IACe,WAAW,CAAS;IACpB,MAAM,CAAS;IACf,YAAY,CAAS;IACrB,cAAc,CAAU;IACxB,WAAW,CAA2D;IACtE,GAAG,CAAe;IAC3B,QAAQ,CAA4B;IACpC,KAAK,CAAgC;IACrC,QAAQ,CAA4B;IAE5C,YAAY,YAAoB,EAAE,OAAqC;QACrE,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG;YACd,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;QAC9E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;QAC/D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;QAClE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;aAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5G,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC9B,qCAAqC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAE7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QAEpB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9E,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC9B,qCAAqC;YACvC,CAAC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACjC,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,QAAQ,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC5C,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC;YACnC,QAAQ,EAAE,IAAI,CAAC,GAAG;YAClB,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI;YAChC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,sEAAsE;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvD,IAAI,CAAC,QAAQ,GAAG;gBACd,GAAG,IAAI,CAAC,QAAQ;gBAChB,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC3C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC;aAC3E,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEzE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,8BAAiB,CAAC,KAAK,CAAC,OAAO,EAAE;gBAChD,GAAG,IAAI,CAAC,WAAW;gBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG;YACd,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC3C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC;SAC3E,CAAC;IACJ,CAAC;CACF;AA5HD,sDA4HC;AAUD;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAAC,IAK7B;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,uEAAuE;QACvE,uEAAuE;QACvE,mCAAmC;QACnC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;QAE/E,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAa,EAAC,GAAG,EAAE;YACnC,MAAM,EAAE,KAAK;YACb,OAAO;YACP,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QAEH,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO;gBACL,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,GAAG;gBACb,IAAI,EAAE,IAAI;gBACV,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,kCAAkC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,uCAAuC,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,aAAa,GAAG,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,GAAG,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;YACpG,CAAC;YACD,GAAG,GAAG,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,qEAAqE;YACrE,sEAAsE;YACtE,gEAAgE;YAChE,iBAAiB;YACjB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;YACjG,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;YACpG,CAAC;YACD,GAAG,GAAG,eAAe,CAAC,WAAW,KAAK,yBAAyB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YACtF,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,8BAA8B;QAC9B,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE1B,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,IAAI,EAAE,GAAG;YACT,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;SACpF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,cAAuB;IAC3D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,0CAA0C,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC;IACtF,CAAC;IACD,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,GAA4B;IACxD,MAAM,MAAM,GAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAgC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAmC,EAAE,CAAC;gBAC5D,IAAI,KAAK;oBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;QAC7F,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,CAAC,GAAG,KAAmB,CAAC;gBAC9B,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACrD,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;gBAC9F,CAAC;gBACD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC/D,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,EAAE,4CAA4C,CAAC,CAAC;gBACnG,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAUD,SAAS,WAAW,CAClB,IAAa,EACb,aAAqB,EACrB,QAA2E;IAE3E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,sBAAsB,CAC9B,iBAAiB,EACjB,oCAAoC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,IAAI,MAAiC,CAAC;IACtC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAgC,CAAC;QACnD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAoC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,KAAK;gBAAE,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,sBAAsB,CAC9B,iBAAiB,EACjB,oCAAoC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAChB,MAAe,EACf,aAAqB,EACrB,QAAyD;IAEzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE;QACnD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAe,CAAC;QAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAChD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC9E,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAC9B,iBAAiB,EACjB,uBAAuB,OAAO,CAAC,MAAM,oBAAoB,QAAQ,CAAC,SAAS,KAAK;YAC9E,8CAA8C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAI,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,IAAI,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,aAAqB;IAC7D,IAAI,KAAU,CAAC;IACf,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,8BAA8B,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAsB,CAC9B,sBAAsB,EACtB,qBAAqB,KAAK,CAAC,MAAM,uCAAuC,KAAK,CAAC,MAAM,KAAK;YACvF,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,MAAM,wBAAwB,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA2E;IACnG,MAAM,KAAK,GAAG,CAAC,QAAQ,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,YAAgC,EAAE,MAAc;IACvE,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/signing/canonicalize.d.ts

@@ -0,0 +1,39 @@
+export interface RequestLike {
+    method: string;
+    url: string;
+    headers: Record<string, string | string[] | undefined>;
+    body?: string;
+}
+export interface SignatureParams {
+    created: number;
+    expires: number;
+    nonce: string;
+    keyid: string;
+    alg: string;
+    tag: string;
+}
+export declare function canonicalTargetUri(rawUrl: string): string;
+export declare function canonicalAuthority(rawUrl: string): string;
+export declare function canonicalMethod(method: string): string;
+export declare function getHeaderValue(headers: Record<string, string | string[] | undefined>, name: string): string | undefined;
+/**
+ * Build the RFC 9421 §2.5 signature base.
+ *
+ * When `signatureParamsValue` is supplied (verifier path), the function emits
+ * it verbatim as the value of the `@signature-params` line — this preserves
+ * byte-identity with the `Signature-Input` header a peer actually sent, even
+ * if their param order differs from ours. When omitted (signer path), the
+ * function formats from `params` using a fixed canonical order.
+ */
+export declare function buildSignatureBase(components: ReadonlyArray<string>, request: RequestLike, params: SignatureParams, signatureParamsValue?: string): string;
+export declare function formatSignatureParams(components: ReadonlyArray<string>, params: SignatureParams): string;
+/**
+ * Raw non-ASCII bytes in the URL authority (IDN U-label) are a parse-time
+ * anomaly — AdCP @target-uri canonicalization expects A-labels (Punycode).
+ * Reject rather than implicitly normalize: UTS-46 transitional vs.
+ * non-transitional produce different A-labels for the same input, which
+ * would open a signer/verifier canonicalization differential. Accepts
+ * both absolute (`scheme://…`) and scheme-relative (`//…`) URL shapes.
+ */
+export declare function rejectNonAsciiHost(rawUrl: string): void;
+//# sourceMappingURL=canonicalize.d.ts.map

package/dist/lib/signing/canonicalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/canonicalize.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAeD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAYzD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAWzD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAYpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,EACjC,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,eAAe,EACvB,oBAAoB,CAAC,EAAE,MAAM,GAC5B,MAAM,CAgBR;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CASxG;AAoDD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAavD"}

package/dist/lib/signing/canonicalize.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalTargetUri = canonicalTargetUri;
+exports.canonicalAuthority = canonicalAuthority;
+exports.canonicalMethod = canonicalMethod;
+exports.getHeaderValue = getHeaderValue;
+exports.buildSignatureBase = buildSignatureBase;
+exports.formatSignatureParams = formatSignatureParams;
+exports.rejectNonAsciiHost = rejectNonAsciiHost;
+const errors_1 = require("./errors");
+const DEFAULT_PARAM_ORDER = [
+    'created',
+    'expires',
+    'nonce',
+    'keyid',
+    'alg',
+    'tag',
+];
+const STRING_PARAMS = new Set(['nonce', 'keyid', 'alg', 'tag']);
+const SUPPORTED_DERIVED = new Set(['@method', '@target-uri', '@authority']);
+function canonicalTargetUri(rawUrl) {
+    rejectNonAsciiHost(rawUrl);
+    const u = new URL(rawUrl);
+    if (u.username || u.password) {
+        throw new errors_1.RequestSignatureError('request_signature_header_malformed', 1, '@target-uri must not include userinfo; strip credentials before signing');
+    }
+    const assembled = `${u.protocol}//${u.host}${u.pathname}${u.search}`;
+    return uppercasePercentEncoding(decodeUnreservedPercentEncoding(assembled));
+}
+function canonicalAuthority(rawUrl) {
+    rejectNonAsciiHost(rawUrl);
+    const u = new URL(rawUrl);
+    if (u.username || u.password) {
+        throw new errors_1.RequestSignatureError('request_signature_header_malformed', 1, '@authority must not include userinfo; strip credentials before signing');
+    }
+    return u.host.toLowerCase();
+}
+function canonicalMethod(method) {
+    return method.toUpperCase();
+}
+function getHeaderValue(headers, name) {
+    const lower = name.toLowerCase();
+    for (const [k, v] of Object.entries(headers)) {
+        if (k.toLowerCase() === lower) {
+            if (v === undefined)
+                return undefined;
+            if (Array.isArray(v)) {
+                return v.map(entry => entry.trim()).join(', ');
+            }
+            return v.trim();
+        }
+    }
+    return undefined;
+}
+/**
+ * Build the RFC 9421 §2.5 signature base.
+ *
+ * When `signatureParamsValue` is supplied (verifier path), the function emits
+ * it verbatim as the value of the `@signature-params` line — this preserves
+ * byte-identity with the `Signature-Input` header a peer actually sent, even
+ * if their param order differs from ours. When omitted (signer path), the
+ * function formats from `params` using a fixed canonical order.
+ */
+function buildSignatureBase(components, request, params, signatureParamsValue) {
+    const lines = [];
+    for (const component of components) {
+        const value = resolveComponentValue(component, request);
+        if (value === undefined) {
+            throw new errors_1.RequestSignatureError('request_signature_components_incomplete', 6, `Covered component "${component}" not present in request`);
+        }
+        lines.push(`"${component}": ${value}`);
+    }
+    const paramsString = signatureParamsValue ?? formatSignatureParams(components, params);
+    lines.push(`"@signature-params": ${paramsString}`);
+    return lines.join('\n');
+}
+function formatSignatureParams(components, params) {
+    const componentList = components.map(c => `"${c}"`).join(' ');
+    const paramPairs = [];
+    for (const key of DEFAULT_PARAM_ORDER) {
+        const raw = params[key];
+        if (raw === undefined)
+            continue;
+        paramPairs.push(STRING_PARAMS.has(key) ? `${key}="${raw}"` : `${key}=${raw}`);
+    }
+    return `(${componentList});${paramPairs.join(';')}`;
+}
+function resolveComponentValue(component, request) {
+    if (component.startsWith('@')) {
+        if (!SUPPORTED_DERIVED.has(component)) {
+            throw new errors_1.RequestSignatureError('request_signature_components_unexpected', 6, `Derived component "${component}" is not supported by the AdCP request-signing profile`);
+        }
+        switch (component) {
+            case '@method':
+                return canonicalMethod(request.method);
+            case '@target-uri':
+                return canonicalTargetUri(request.url);
+            case '@authority':
+                return canonicalAuthority(request.url);
+        }
+    }
+    return getHeaderValue(request.headers, component);
+}
+function uppercasePercentEncoding(input) {
+    return input.replace(/%([0-9a-fA-F]{2})/g, (_m, hex) => `%${hex.toUpperCase()}`);
+}
+/**
+ * RFC 3986 §6.2.2.2: percent-encoded triplets of unreserved characters
+ * (ALPHA / DIGIT / "-" / "." / "_" / "~") MUST be decoded to their literal
+ * form during URI normalization. The spec's RFC 9421 profile step 6
+ * (`@target-uri` canonicalization) requires this decode alongside the
+ * uppercase-hex pass — a verifier that uppercases but does not decode will
+ * produce a `%7E`-vs-`~` mismatch against a signer that decoded correctly.
+ */
+function decodeUnreservedPercentEncoding(input) {
+    return input.replace(/%([0-9a-fA-F]{2})/g, (match, hex) => {
+        const code = parseInt(hex, 16);
+        // Unreserved: A-Z (0x41-0x5A), a-z (0x61-0x7A), 0-9 (0x30-0x39),
+        // "-" (0x2D), "." (0x2E), "_" (0x5F), "~" (0x7E).
+        const isUnreserved = (code >= 0x41 && code <= 0x5a) ||
+            (code >= 0x61 && code <= 0x7a) ||
+            (code >= 0x30 && code <= 0x39) ||
+            code === 0x2d ||
+            code === 0x2e ||
+            code === 0x5f ||
+            code === 0x7e;
+        return isUnreserved ? String.fromCharCode(code) : match;
+    });
+}
+/**
+ * Raw non-ASCII bytes in the URL authority (IDN U-label) are a parse-time
+ * anomaly — AdCP @target-uri canonicalization expects A-labels (Punycode).
+ * Reject rather than implicitly normalize: UTS-46 transitional vs.
+ * non-transitional produce different A-labels for the same input, which
+ * would open a signer/verifier canonicalization differential. Accepts
+ * both absolute (`scheme://…`) and scheme-relative (`//…`) URL shapes.
+ */
+function rejectNonAsciiHost(rawUrl) {
+    const authorityMatch = rawUrl.match(/^(?:[a-z][a-z0-9+.\-]*:)?\/\/([^/?#]*)/i);
+    if (!authorityMatch)
+        return;
+    const authority = authorityMatch[1];
+    for (let i = 0; i < authority.length; i++) {
+        if (authority.charCodeAt(i) > 0x7f) {
+            throw new errors_1.RequestSignatureError('request_signature_header_malformed', 1, 'URL authority contains non-ASCII bytes; use the A-label (Punycode) form');
+        }
+    }
+}
+//# sourceMappingURL=canonicalize.js.map

package/dist/lib/signing/canonicalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.js","sourceRoot":"","sources":["../../../src/lib/signing/canonicalize.ts"],"names":[],"mappings":";;AA+BA,gDAYC;AAED,gDAWC;AAED,0CAEC;AAED,wCAeC;AAWD,gDAqBC;AAED,sDASC;AA4DD,gDAaC;AAjMD,qCAAiD;AAkBjD,MAAM,mBAAmB,GAAyC;IAChE,SAAS;IACT,SAAS;IACT,OAAO;IACP,OAAO;IACP,KAAK;IACL,KAAK;CACN,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAEvF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;AAE5E,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,8BAAqB,CAC7B,oCAAoC,EACpC,CAAC,EACD,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACrE,OAAO,wBAAwB,CAAC,+BAA+B,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,8BAAqB,CAC7B,oCAAoC,EACpC,CAAC,EACD,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AAC9B,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;AAC9B,CAAC;AAED,SAAgB,cAAc,CAC5B,OAAsD,EACtD,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACtC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAChC,UAAiC,EACjC,OAAoB,EACpB,MAAuB,EACvB,oBAA6B;IAE7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,EACzC,CAAC,EACD,sBAAsB,SAAS,0BAA0B,CAC1D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,MAAM,KAAK,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,YAAY,GAAG,oBAAoB,IAAI,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACvF,KAAK,CAAC,IAAI,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,qBAAqB,CAAC,UAAiC,EAAE,MAAuB;IAC9F,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,aAAa,KAAK,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB,EAAE,OAAoB;IACpE,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,EACzC,CAAC,EACD,sBAAsB,SAAS,wDAAwD,CACxF,CAAC;QACJ,CAAC;QACD,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,SAAS;gBACZ,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACzC,KAAK,aAAa;gBAChB,OAAO,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACzC,KAAK,YAAY;gBACf,OAAO,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,+BAA+B,CAAC,KAAa;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/B,iEAAiE;QACjE,kDAAkD;QAClD,MAAM,YAAY,GAChB,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;YAC9B,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;YAC9B,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;YAC9B,IAAI,KAAK,IAAI;YACb,IAAI,KAAK,IAAI;YACb,IAAI,KAAK,IAAI;YACb,IAAI,KAAK,IAAI,CAAC;QAChB,OAAO,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC/E,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,8BAAqB,CAC7B,oCAAoC,EACpC,CAAC,EACD,yEAAyE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}